With the continued emergence of the coronavirus (COVID-19), ISO registered companies are doing their part to prevent the spread of infection by practicing masking, increased sanitation, social distancing and working from home. Some organizations have implemented no-visitor policies, which helps prevent the spread of the disease, but is not so good when it comes to receiving services from their suppliers, which may require onsite interaction.
This was especially true for consulting, internal and external auditing, and training services, which are typically performed by onsite visits. Traditionally, organizations have been reluctant to have these services delivered remotely using web conferencing technology, but COVID-19 has thrust remote service delivery into the forefront. We will explain the benefits and techniques of using technology, such as web conferencing, to have internal audit services delivered remotely within your organization.
Thanks to the advances in information technology, conducting remote or virtual audits is becoming increasingly essential among organizations. ISO 19011:2018, Guidelines for auditing management systems, includes new specifications for conducting remote audits providing guidance to ISO Certification Bodies.
We have in the last two years implemented information technology strategies and systems to allow audit teams to receive and share data, conduct interviews, and make audit observations reducing the need of costly travel to the audit site. ISO Certification bodies in 2020 and 2021 have adapted to this new reality.
A remote audit, also known as a virtual or e-audit, is the same as an onsite audit but uses electronic means to remotely obtain audit evidence and evaluate it objectively in order to determine the extent of compliance to the procedures and ISO audit criteria. It includes document review and interviews with auditees identified as process owners i.e., sales, purchasing, production.
We have successfully used remote audit techniques that allow for file and record sharing through SharePoint, One Drive, Google drive, Dropbox or in a last resort email. This involves identifying the sampling of records i.e., 3-5 samples representative of the last 12 months required which are standard to an internal audit process that typically include but are dependent on the scope of the management system.
- Proposals, quotes, sales orders
- Design and Development projects
- Purchase orders, supplier questionnaires, supplier scorecards, receiving records
- Work and/or service and shipping orders
- Calibration and maintenance records
- Customer surveys
- Nonconformance/corrective action reports
- Training records
We have established a standardized folder structure on the platform of choice to allow for ease of uploading and sorting of records and objective evidence. It is a good idea to review your current internal audit checklist and your external audit records typically reviewed. The uploading of documents occurs a minimum of 2 weeks prior to the scheduling of interviews to allow for review and assessment.
We are often asked how you can conduct a remote audit involve manufacturing processes or product storage. In these cases, we have used live video or prescheduled videos to gather the necessary audit evidence. Manufacturing and service companies have also used this technique with the ISO Registrars to achieve successful certification.
The internal audit plan is prepared identifying the date and time, processes and the auditees selected for the remote audit. We have used Microsoft Teams, Zoom and other web conferencing platforms to conduct the interviews. Invites are distributed and the audit process begins. Based on the evidence previously uploaded we can ask questions about the documentation supplemented by file and screen sharing to validate documentation and compliance. The secret is a well planned internal audit checklist focusing on the 5W’s and H thought provoking questions. It is a good idea because it is an internal audit to advise to the auditee that the audit will be recorded to allow for review after the interview is completed. Auditors will always ask key and relevant questions as determined by the scope of the audit, and, equally important utilize the two key auditing skills that are maximized during a remote audit which is being flexibility and collaboration.
Once the internal audit is complete a remote closing meeting is held to review the results.
There are definite benefits to the remote audit process.
- Reduce social contact, complies with visitor restrictions and government travel restrictions
- Maintains certification even when restrictions and guidelines are in place in your organization.
- Easy to use and proven technologies to facilitate the audit
- Real time by attending the audit from anywhere and in fact is known to reduce audit time due to on site business distraction
- Provides flexibility in planning for your audit team in preparing
You must also have an open mind when introducing the remote audit internally. There may be issues with technology. One of the main challenges you can run into is audit logistics. This can be network connections, accessing the VPN to log into a database during the interview. Interviews and meetings can be interrupted or disconnected. Logging in 15-30 minutes ahead avoids logistical issues. This coupled with sharing of documents minimizes the disruptions.
The other issue often discussed is the lack of involvement from the auditee however a well thought internal audit checklist, thought provoking questions and a friendly demeanor alleviates these problems.
On site audits still hold value and we envision a combination of both techniques allowing for an efficient and cost effective internal audit process.
Fred Andersen, CMC is a management consultant and ISO Lead Auditor who has successfully implemented ISO management systems ensuring first time and ongoing ISO certification.
We hope you enjoyed reading this blog post. Keep up-to-date with the latest ISO standards based news by subscribing to our emails below. Don’t miss out!