Methods and techniques for obtaining audit evidence.
The auditor’s job is not guessing, he must find evidence.
There are basically three methods for finding the evidence.
1- Review the documents and record.
Documentation such as policy, objectives, plans, procedures,
instructions, licenses, permits, specifications, etc.
Records such as inspection records, meeting minutes, reports
on customer complaints, audit reports, etc.
The auditor cannot possibly review every document or record.
Therefore, the auditor must take a sample. The auditor shall select the sample,
not be given a sample prepared in readiness for his arrival by the auditee. The
sample does not need to be a statistically valid sample taken in accordance
with a sampling scheme but should be representative. The bigger the sample
population and greater importance to the quality management system then the
bigger the sample.
Reviewing the documents and records is done by asking for
them from the auditee and reading them thoroughly. This is the best kind of
evidence, so you should always look for it. but in many cases, you will not
find documents because they are not mandatory but very often you will find a
record of some kind.
For example, if you want to find out how the training
process is done in the company then you will ask for their training procedure,
it does not matter if you do not know where those documents and records are,
you should ask the auditee to bring it to you and it is their responsibility to
find them. If the auditor finds the indication of nonconformity in the records,
he or she must verify this nonconformity by checking the processes or
activities that produce this record.
2- Observation of facilities and activities.
You must observantly take time to observe the activities and
recognize the associated aspect. Look over, under, behind, up, into, and
outside. Check what happens to reject and how corrective action is imitated.
For example, if the auditor is suspect the credibility of
the temperature in the warehouse, he must observe the warehousing process and
also temperature monitoring activities to determine whether is conducted as
found.
3- Interviewing the employees.
Interviews are an important means of collecting information
and should be carried out in a manner
adapted to the situation and person interviewed.
However, the auditor should consider the following:
To obtain representative information, persons from different
levels and functions within the auditee’s organization should be interviewed
during the audit, especially those persons performing activities or tasks under
consideration.
The interview should be conducted at the normal workplace of
the interviewed person, whenever possible.
Every attempt should be made to put the interviewed person
at ease prior to the actual interview; it is useful to remind them that they
will benefit from the audit.
The reason for the interview and any note-taking shall be
explained.
Interviews may be initiated by asking the persons to explain
their role and to describe their working practices.
The results from the interview may be summarized and any
conclusions drawn should be verified with the interviewed person where
possible.
Questions should be open. Limited use of closed questions
for confirmation of facts, but leading questions should be avoided.
The interviewed persons should be thanked for their
participation and cooperation.
If there are no records then interviewing the employees is
very often the method to find out whether the process is carried out as required.
Since speaking only to one person is not reliable enough to be solid proof, you
will speak to a couple of employees that are part of the same process to see
their statement match.
For example, if you ask a couple of employees in the sales
department how they monitor and measure customer satisfaction and all of them
give their statement same or very similar answer, this is proof that the
process is done in a defined way. On the other hand, if you received very
different answers, this the proof that the process is not defined, or the
employees are not trained for it.
Keep in mind that the interview should be held with the
person with the correct level and function to perform activities or tasks.
In some cases, you will have to observe the activities and
facilities together with reading the documents, records, and interviewing the
employees.
Observing the processes and activities can sometimes be the
only way to check if the company has really complied with procedures and
standards.
For example, when there are no records for the activity or
any other proof that is carried out as described by the procedure, you will
visit the production facility to check out how this process is carried out. You
will determine whether the process is compliant with the procedure and whether
it fits the statements of the employees.
An important thing to remember here is the auditor team
shouldn’t go beyond the scope of the audit during a site audit. On the other
hand, if the audit team found during the audit evidence that suggests
significant risks exist in the processes or in the quality management system,
they should report it immediately.