Objectivity and Impartiality of the Audit Process
Is your QMS effective at determining whether it's effective, suitable and adequate?
Happy New Year!
Firstly, before I get into things - I should do what everyone on LinkedIn, and any social media is doing and wish you a Happy New Year. That’s not because everyone else is doing it, it’s because I mean it…
I do though, and again, I would like to say thank you so much for your support on this newsletter, it really means a lot to me.
Anyway, enough of that and let’s continue diving into internal auditing as this has been a theme of mine for a wee while.
ISO 13485 clause 8.2.4 specifies the following:
The selection of auditors and conduct of audits shall ensure objectivity and impartiality of the audit process. Auditors shall not audit their own work.
With that being said, I introduce my latest creation…
This is unfortunately the reality for many organisations, particularly SMEs as a result of resource and cultural elements.
The quality department end up conducting the audits.
My disclaimer is that the type of audits we’re talking about typically have audit objectives based upon demonstrating conformity to ISO 13485.
This can create a scenario where audits are not necessarily as effective as they should be, therefore, the organisation is unable to identify areas of nonconformance, or utilise the QMS to manage areas that it knows are nonconforming.
This is the result of a number of things:
Quality team members are individuals, who have professional relationships to maintain with colleagues, and sometimes there is a naturally occurring conflict that comes consequently of having to raise findings on people you know well. It can be departmentally alienating, and personally challenging.
Another element is that Quality often have fairly critical and fundamental roles in key processes that will be audited. Therefore, how can they really be independent and objective when they play a role within that process?
So what’s the answer, Adam, you may be asking?
It becomes difficult when you try and understand what independence is, though…
ISO 19011: 2018 specifies the following auditing principle (e):
Independence: the basis for the impartiality of the audit and objectivity of the audit conclusions
Auditors should be independent of the activity being audited wherever practicable, and should in all cases act in a manner that is free from bias and conflict of interest. For internal audits, auditors should be independent from the function being audited if practicable. Auditors should maintain objectivity throughout the audit process to ensure that the audit findings and conclusions are based only on the audit evidence.
For small organizations, it may not be possible for internal auditors to be fully independent of the activity being audited, but every effort should be made to remove bias and encourage objectivity.
At the end of this paragraph, is the key statement as it shows the standard understands the difficulty that small organisations may experience.
What are the consequences of not using objective and impartial auditors?
The fact that the standard understands and mentions it does not mean the organisation should allow the QM to do all of the audits all the time. If this is the case, and the auditor detects that overall the interal audit sub-system is ineffective, this could lead to bigger issues detected within audits, but also more importantly, it could cause other issues in the QMS such as an ineffective customer complaints handling process, or unaligned vigilance and reporting requirements for example.
Furthermore, it is a waste of the organisations resource. Auditing is a high resource activity. To name some things in the process, we have the auditees involved, the auditor, writing the plan, writing the report, following up and closing actions for example. This isn’t to mention that auditing or being audited (the unfortunate role) is often not someones day job, so the day job they are away from is often then running behind.
Having said that, the best way to answer this question is with another question:
Given that auditing is a mandatory part of the standard, do you really want to do that and still leave nonconformances on the table that may flag during inspections, or not cause you to know the areas of the QMS that could use improving?
How can I try and demonstrate independence?
Responsibility, Accountability, Consulted and Informed (RACI) Matrix is often used, however that can be a very complex thing sometimes.
One of ways I think is good, is to leverage the responsibilities (which should already be defined in the QMS), and link these to your list of internal auditors. So when you are developing your audit schedule, you can select Process / Procedure X with Auditor 1 - and you can justify that the auditor has no direct role in that procedure for example as per the roles and responsibilities.
This is where it comes back to using a planning document to substantiate and defend your audit programme assignment.
Thanks and Bye!
I really do believe that utilising well trained, competent auditors that are truly completely independent of the Quality department is the best and most effective solution. These can be team members that are within separate departments, or they can be external auditors that are conducting internal audits on your behalf.
The benefit of this is that it removes the responsibility of quality to be that voice that is always raising risks. The voice of externals can be a really powerful factor.
I totally relate to what you are saying in your article. Thank you for your succinct clarification. I agree with you as quality is a culture and all staff responsibility not just the quality manager. Everyone should be performing audits and looking for continual improvement. It so happens that audit will identify non confirmities. But better they are identified before an error occurs and there is a major risk to the patient.