Planning a quality audit
Key takeaways
- A first-party audit is the organisation auditing itself, a second-party audit is a party with an interest in it, such as a customer, auditing it, and a third-party audit is an independent body auditing it, typically for certification.
- The scope fixes which processes, sites, products or time period the audit covers, matched to the quality management system's own scope statement.
- Audit criteria (the management system standard, the organisation's own policy and procedures, statutory and regulatory requirements, and customer requirements) are agreed before the audit, so a finding is a departure from a named requirement rather than an opinion.
- The audit programme schedules every audit over a period, in rotation; the audit plan sets out the scope, criteria, schedule and team for one audit.
- Resourcing follows from scope and criteria: the team needs collective competence in the standard, the processes and auditing, and time is the resource most often underestimated.
An audit is the formal check that everything covered so far, the quality management system (Quality Management System), risk treatment (Organizational Risks and Opportunities), quality assurance (Quality Assurance), is actually working as intended, not merely documented. It starts, like any structured activity, with a plan.
Types of audit
Audit scope
The scope defines which processes, sites, products or time period the audit will cover, matched to the quality management system's own scope statement (see Quality Management System, on the scope of the system) so the audit's findings can be meaningfully compared against what the system claims to cover.
Audit objectives
- Determine conformity of the quality management system to its own requirements and to the relevant standard
- Evaluate the system's ability to meet legal, regulatory and customer requirements
- Evaluate the effectiveness of the system in achieving its stated objectives
- Identify opportunities for improvement
Audit criteria
Audit criteria are the reference standards findings are compared against, standard operating procedures, internal guidelines, national or international standards, and organisational policies, agreed before the audit begins so findings are objective rather than a matter of the auditor's personal opinion.
Audit resources
Audit plan and program
Audit criteria are the reference against which evidence is compared, and an audit with no stated criteria produces opinions rather than findings. In a quality audit the criteria come from several places at once:
- The management system standard the organisation claims to conform to
- The organisation's own quality policy, manual and documented procedures
- Applicable statutory and regulatory requirements
- Customer or contractual requirements
Stating them in the plan is what allows a finding to be written as a factual departure from a named requirement rather than as a criticism.
Resourcing follows from scope and criteria rather than from habit. The audit team needs collective competence in the standard, in the processes being audited and in auditing itself, and where the process is technical the team may need a technical expert who is not an auditor. Time is the resource most often underestimated: an audit programme that allocates the same duration to every process regardless of its risk or complexity is planning to skim the areas that matter.
Audit team roles
Self-check
(a) Distinguish first-party, second-party and third-party audits, with an example of each. (3 marks)
(b) State four objectives of a quality audit. (4 marks)
(c) Explain what audit criteria are and why they are agreed before the audit begins. (3 marks)
(d) Distinguish an audit programme from an audit plan. (2 marks)
(e) Distinguish a lead auditor, an auditor and an auditee. (3 marks)
(f) A supplier is being checked by one of its major customers to confirm it meets agreed quality standards before a large contract is signed. Which type of audit is this, and why? (2 marks)
Show worked answer
(a) First-party (internal) audit: conducted by, or on behalf of, the organisation itself, such as an internal quality team auditing its own department. Second-party audit: conducted by a party with an interest in the organisation, such as a customer auditing its supplier. Third-party audit: conducted by an independent body, typically for certification against a standard.
(b) Determine conformity of the system to its own requirements and the relevant standard; evaluate the system's ability to meet legal, regulatory and customer requirements; evaluate the system's effectiveness in achieving its objectives; identify opportunities for improvement.
(c) Audit criteria are the reference standards findings are compared against, such as procedures, guidelines and standards. They are agreed before the audit begins so findings are objective and consistent rather than a matter of the auditor's personal opinion.
(d) An audit programme is the organisation's overall schedule of audits over a period, covering every process or area in rotation. An audit plan is the detailed plan for one specific audit, its scope, criteria, schedule and team.
(e) The lead auditor manages the audit team and takes overall responsibility for the audit. An auditor gathers evidence and evaluates it against the audit criteria. The auditee is the organisation, process or person being audited, expected to provide access and evidence.
(f) This is a second-party audit, because it is conducted by a party with a direct interest in the organisation, the customer, rather than the organisation auditing itself or an independent certification body doing so.
Exam tip
The three audit types are commonly tested by asking who is conducting the audit and why, first-party is self-assessment, second-party is a customer checking a supplier, third-party is independent certification, get the relationship right, not just the label.