ISO 9001 Process Approach Auditing

These questions for auditing utilize a process approach. Whether facing a surveillance audit from a certification body or preparing for an internal quality audit – knowing what you face and being prepared puts you a step ahead.  Process-based audits are tools companies can use to evaluate the effectiveness of their processes. Review this checklist which covers the majority of the ISO 9001 QMS requirements. Each question is matched to the clause(s) for reference.

1. Who or what is/are the:
   • Processes? – Clause 4.4.1. These are often defined in a company through the use of a Turtle diagram. There should be a turtle diagram or process description for each of the processes of the company.
   • Process Owner? – Clause 4.4.1. Each of the above-discussed processes needs to have a process owner identified. This is the person who is ultimately responsible for the process and its performance.
   • Personnel Interviewed? – Clause 9.2. As part of the internal audit records, you will need to define the individuals who were interviewed or were involved in the internal audit. This/these person(s) should be in the process of being audited.
   • Documentation Reviewed? – Clauses 4.4.1 and 7.5. The documents needed for the process are often defined in the turtle diagram/process description defining the process. Any documents used to support the process being reviewed need to be controlled as part of the documented information section of the company including forms. Records created as part of the process need to be protected from unauthorized or unintended changes and where electronic records are created, these need to be periodically backed up. Records need to have defined retention times and disposition methods.
   • Records Sighted? – Clause 7.5 and various other clauses of the standard depend on the process reviewed. Records are created when we complete a task requiring documentation of that completion. Examples include but are not limited to: inspection being completed; calibration of inspection equipment performed; identification and documentation of nonconforming material; holding a management review meeting; etc.
2. What are the resources needed for the process? 
   • Clauses 4.4, 5.1, 5.2, 5.3, and 7.1 and specific process documentation as applicable and its associated clause 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7. Where turtle diagrams are used to define a process, resources are frequently identified. However, this is not a requirement of the standard. The necessary resources may be included as part of the process procedure.
3. Are these resources appropriate? 
   • Clauses 6.2 and 9.3. Having adequate resources in a company will be reflected in the measurement of the company and of its processes. These are done through the quality objectives and the process measures, both of which are required for review as part of the management review meeting.
4. Are authorities and responsibilities for required resources defined, documented and known throughout the organization? 
   • Clauses 4.4, 5.1, 5.2, and 7.1. Organizations often define themselves using an organizational chart that is supported by process documentation.
5. Are these persons competent? 
   • Clause 7.2. The company must determine the required competency level of individuals in the company based on the required competency of the job being performed. Where the employee is not competent on a skill, the company needs to determine the appropriate action to meet the competency requirement. Where the action is taken to address the gap incompetency, the company must then determine the effectiveness of these actions.
6. Are competency criteria defined? What are these criteria? How is competency evaluated, approved and monitored, and by which method(s)? 
   • Clauses 7.2 and 7.5. The company must determine the required competency level of individuals in the company based on the required competency of the job being performed. Where the employee is not competent on a skill, the company needs to determine the appropriate action to meet the competency requirement. Where the action is taken to address the gap incompetency, the company must then determine the effectiveness of these actions. All training performed and its effectiveness must be recorded and retained.
7. Are these methods effective? – refer to outputs 
   • Clauses 4.4, 7.2, and 9.2 and depending upon the process being audited, the application of the associated clause 8.1, 8.2, 8.3, 8.4, 8.5. The process owner is most likely reviewing the process performance on a regular basis. Additionally, the output of a process, often defined on the process turtle diagram, is reviewed in the management review meeting and reflects the adequacy of the resources used in the process and the effectiveness of the training performed. Every process will have a different list of outputs and requirements from the standard.
8. Are the resources adequate? Which are they? 
   • Clauses 4.4, 6.2, 7.1, and 9.3. Resources are defined as part of the process description or turtle diagram. Measures that can be used to determine if there are adequate resources include but are not limited to the quality objectives and the process measures.
9. Are records available and appropriately maintained? 
   • Clause 7.5 in addition to the requirements of the process being audited and its associated clause 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7. 9.2, 9.3, 10.2, 10.3, and could also include clauses 6.2, 6.3, 7.1, 7.2. Records are collected to provide objective evidence that a requirement has been met. These need to be retained according to the documented procedure.
10. What are the inputs to this process? 
    • Clause 4.4. Inputs are defined as part of the process descriptions or turtle diagrams.
11. Are these inputs documented and reviewed by competent persons? 
    • Clauses 4.4, 7.2, and the requirements of the process being audited and its associated clause 8.1, 8.2, 8.3, 8.4, 8.5. Inputs are defined as part of the process descriptions or turtle diagrams.
12. Is a description of the processes available and documented?
    • Clauses 4.4, 7.5 and the requirements of the process being audited and its associated clauses 8.1, 8.2, 8.3, 8.4, 8.5. Process descriptions or turtle diagrams are used to define the process and are maintained as controlled documentation.
13. Are these descriptions controlled? – Verify the effectiveness of the organization’s documented information control procedure. 
    • Clause 7.5. Documents used to support a process need to follow the requirements for documented information.
14. Who are the “customers” (internal and external) of the processes? What are the requirements of these customers? 
    • As the intent behind the standard is to focus on customers and their needs, there are several clauses in the standard that can be cited as contributors to this question. 4.1, 4.2, 4.3, 4.4, 6.1, 6.2, 7.1, 7.2, 7.3, 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, and “Customer Specific Requirements” – Organizationally, a company needs to look at how they are structured to meet the needs of the external customer and their specific process or order requirements in addition to the internal customers. 
15. What are the characteristics of the intended results of the process?
    • Clauses 4.4, 7.5, 8.6, 9.1, 9.3. These “outputs” can be defined in many locations: in the process description, or turtle diagrams; in listed process or customer requirements; as product specifications; or process measures.
16. What are the characteristics of the unintended results of the process?
    • Clauses 7.5, 8.6, 8.7, 9.3. These are considered nonconforming outputs. They are documented, addressed, and dispositioned according to a defined procedure and results should be used to improve the company.
17. Are correction and corrective action applied as appropriate? 
    • Clauses 7.5, 9.3, 10.2. Documented records of corrective action, their root cause, and effectiveness are maintained in the company and reviewed.
18. What are the criteria for monitoring, measurement and analysis? 
    • Clauses 9.1 and 9.3. The company needs to define what measurements are necessary to determine the effectiveness of the QMS and its processes.
19. How are these criteria incorporated into the planning of the processes? 
    • Clauses 4.4 and 9.3. Process measures need to be established. Often these are noted in the process descriptions or turtle diagram and reviewed as part of the management review meeting.
20. Are the business performance issues taken into proper account? 
    • Clauses 4.4, 6.2, 9.1, 9.3, and 10.2. Quality objectives and process measures should have established goals and when the goals are not met, corrective action taken. Ensure the goals are realistic.
21. What methods are used for data gathering? 
    • Clauses 6.2 and 9.1. Define who will gather what, how often, and how analyzed.
22. What records are kept and how these are maintained? 
    • Clauses 4.4, 6.2, 7.5 and 9.3. Process measures are defined in the process descriptions or turtle diagrams and are reviewed in the management review meetings along with the defined quality objectives.
23. What are the communication channels?
    • Clause 7.4. How does the company communicate internally and externally?  What information is shared? What is required by the customer or internal processes?
24. How is external and internal information about the process provided? What are the outputs of the process? – Identify outputs. 
    • Clauses 4.4, 6.2, 9.1, and 9.3. Process measures are defined in the process descriptions or turtle diagrams and are reviewed in the management review meetings along with the defined quality objectives.
25. Do these outputs provide evidence of effective implementation of the process? 
    • Clauses 4.4, 9.1, and 9.3. Data collected to support the effectiveness of each process as defined in the process descriptions or turtle diagram in addition to the measured quality objectives assist in determining the effectiveness of the documented quality management system.
26. How is process performance monitored?  
    • Clauses 4.4, 9.1, and 9.3. Process performance requirements are defined in the process description or turtle diagrams. These are monitored and shared in the management review meetings.
27. Are appropriate controls defined?  Clauses 4.4, 6.2, 9.1, and 9.3. Measures are defined, have goals, are monitored against the goals.
28. What measurements are applied? 
    • Clauses 4.4 and 9.1. Process measures are defined in the process descriptions or turtle diagrams.
29. How is the gathered information analyzed? 
    • Clauses 4.4 and 9.1. Process measures are defined in the process descriptions or turtle diagrams. Data collected and analyzed should meet the needs of the company.
30. How are the results of the analysis taken into account?  
    • Clauses 4.4, 9.1, and 9.3. Feedback on collected data is regularly reviewed and action was taken as necessary.
31. How is feedback obtained? 
    • Clauses 9.1 and 9.3. Defined tracking and reporting are regularly reviewed.
32. What data is collected? 
    • Clauses 4.4, 6.2, 9.1, and 9.3. Defined measures are reviewed regularly and changes to processes or measures are made as is necessary to support the company and its goals.
33. Is the issue of improvement of the processes properly addressed? How? What are the results? 
    • Clauses 4.4, 6.2, 9.1, 9.3, 10.1 and 10.3. Using appropriate, defined measures to monitor the success of the company can lead to improvement of the processes. Additionally, the company needs to discuss, plan, and record potential improvements of the company.

Source for questions:  EAGLE Certification Group – 2017 Annual Bootcamp/Conference

Knowledge. Expertise. Experience.

Schedule A Free Consultation

Outsource Your Internal Audits

SimpleQuE offers free sample manufacturing process audit checklists for AS9100, ISO 9001 and IATF 16949® which can be used as an example to examine a company’s key manufacturing process and prepare your company for the highest internal quality auditing possible.

Links to Checklists:

IATF 16949^® Sample Manufacturing Process Audit Checklist – FREE

AS9100 Sample Manufacturing Process Audit Checklist – FREE

ISO 9001 Sample Manufacturing Process Audit Checklist – FREE