Top Tips for Effective Process Auditing: Takeaways

Introduction
ISO management systems standards require process-based auditing as the method of
conducting internal audits. Although process-based auditing is widely recognised as
a best practice methodology, it can be a challenge to implement correctly for
maximum benefit.

Steve Barnes, NQA Aerospace & Automotive Operations Manager, presented a webinar on
effective process auditing on 10 March 2016 – this document summarises the key
takeaways.

WHAT IS PROCESS-BASED AUDITING?

Definition of a Process Approach

 The application of a SYSTEM of processes within an organisation, together with
identification and interactions of these processes and their management, can be
referred to as the ‘process approach’

Benefits of process-based auditing

 Demonstrates that priority is given to questioning the organisation’s identification of
processes, their sequences and interactions, and performance against objectives
and KPIs
 Focus on the processes which directly impact the customer
 Identifies issues / trails around the organisation’s process for setting objectives
 Identifies what plans are in place to ensure objectives are met
 Identifies corrective action plans where objectives are not being met
 Provide on-going control over processes

Process Audit Outcomes

Audits must verify the effectiveness and efficiency of the organisation’s processes, including
evidence of continual improvement, so look for:

 Customer information: scorecards, reports, claims

 KPIs and objectives: relevance, results, trends and continual improvement
 Links with other processes and control of the interfaces (inputs and outputs)
 Risk control

Above all process-based auditing focuses on performance, i.e. improvement.

Process Based Auditing ©NQA 2016 Page 1 of 6

THE PROCESS MODEL APPROACH

The process approach is fundamental to an effective management system –

for example, it is explicitly referenced by ISO 9001 in two forms:

The Process Model

Plan-Do-Check- Act Model

The bracketed numbers in the model refer to the related clauses of ISO 9001:2015.

Process Based Auditing ©NQA 2016 Page 2 of 6

TECHNIQUES FOR BETTER PROCESS BASED AUDITS

#1: PLAN YOUR AUDIT WITH THE V-CYCLE

A useful tool for developing your audit plan is ‘THE V CYCLE’. Designed to start with
management processes, it guides you down through processes that interact with the
customer and then through the support processes that enable product or service
development and delivery.

Top Management Oriented Processes

To apply the above model for a process based auditing approach, you will first need to start
at the top left of the V with the requirement to address top management oriented processes
includes:

 The mission statement

 The organizational business plan
 Strategic objectives
 KPIs
 Management reviews
 Internal and external audit results

An understanding of the context of the organization will need to pervade all of the above
management processes.

Customer Oriented Processes

Working down through the lower-left and central section of the V moves you in to the
assessment of Customer Oriented Processes, including:

 Sales / Contract reviews

 Design
 Purchasing
 Manufacturing
 Release
 Complaints

Process Based Auditing ©NQA 2016 Page 3 of 6

All of the above processes should be influenced by customer specifications and compliance
obligations.

Support Oriented Processes

It is at this point, you should continue from the base of the V to the top right section to
assess Support Oriented Processes. These include:

 Maintenance
 Calibration
 Training
 Problem Management
 Corrective and Preventive Actions
 I.T.

Each of these processes should connect top management plans with product or service
delivery.

Assessment of these processes in the sequence adopted by The V Cycle mirrors the Plan,
Do, Check, Act (PDCA) cycle.

Process Based Auditing ©NQA 2016 Page 4 of 6

#2: QUESTION TOP MANAGEMENT TO LINK STRATEGY TO PROCESS

Following on from the V-Cycle, interviewing top management should be a key element of
your audit. It should focus on establishing a connection between Context, Strategy,
Objectives, Processes, Resources and Outputs.

Top Management should be able to demonstrate:

 Awareness of the macro environment and industry sector factors that determine the
external context
 Evidence that strategic decisions have been established using rational approaches
 The application of ‘Risk Based Thinking’ in the formulation of objectives
 Your position in the market place relative to competitors
 Consideration of the internal context including systems, skills, shared values
(culture), knowledge

Interviewing top management regarding the above should not require deep analysis – you
are looking for indicators that the above considerations have been factored into decision
making.

Evidence of this may be demonstrated in tools like:

 PESTLE – Political, Economic, Social, Technological, Legal, Environmental (i.e.

Context of the organisation, Compliance obligations)

 7S – Strategy, Structure, Systems, Staff, Skills, Style, Shared values (i.e. Interested
parties, Context of the organisation)

 SWOT – Strengths, Weaknesses, Opportunities, Threats (i.e. Risk and Opportunity)

#3: IDENTIFY PROCESS OWNERS

Identifying the most suitable process owner does not always mean going directly to the
manager of a particular process. It could mean approaching an operative who spends the
most time within a process, who may have important tacit knowledge of the process and its
interactions within the management system.

Ensuring that any process critical knowledge that you discover is documented will enhance
the operational integrity of the process.

Process Based Auditing ©NQA 2016 Page 5 of 6

#4: USE THE CAPDO TECHNIQUE

The CAPDo approach complements the PDCA cycle when auditing a process starting half
way through the PDCA cycle.

Identify the ‘process owners’, then apply the following type of questions:

 Who is the customer of the process and what are their expectations?
 What are the KPI’s / objectives / targets?
 Are these appropriate to the risks?
 What risks have been identified?
 How do they know the process is working well or not?
 How are inputs to various process categories recorded?
 Is information correct and up to date?
 Are processes effective and efficient?

#5: USE THE TURTLE-TOOL TO STRUCTURE YOUR AUDIT

The Turtle-tool helps to capture and structure the comprehensive range of information
required ensuring that process risk is identified, assessed and eliminated/mitigated.

Process Based Auditing ©NQA 2016 Page 6 of 6