787 974 136
Are you looking for a way to improve your business and stand out from similar organisations? Nowadays, when the market is highly competitive and consumer expectations are high, one of the best and most effective ways to build a strong position in the industry is to implement the standards recommended by the International Organisation for Standardisation. These systems, tried and tested in extensive practice and verified by experts, enable you to improve the quality and efficiency of processes that are key to your business. And because ISO standards are recognised worldwide, certification will have an extremely positive impact on your brand’s image and open up a range of new opportunities (e.g. cooperation with foreign companies). If you wish to join the ranks of the best and most trusted players on global markets, you must be prepared not only for continuous improvement, but also for your company’s operations to be subject to supervision. Find out what quality audits are and see for yourself that you can derive many benefits from them!
An audit is a broad term referring to the verification of a particular entity or process to ensure it complies with selected standards. An analysis of specific areas of a company’s operations to assess whether they meet the requirements set out in an ISO standard is classified as a quality audit. Such an audit is, in itself, a structured process which must be conducted in accordance with the guidelines of one of the International Organisation for Standardisation (ISO) standards – ISO 19011, concerning the auditing of management systems.
According to the definition of the Polish Committee for Standardisation, a quality audit is “a systematic and independent examination designed to determine whether quality-related activities and their results comply with planned arrangements, and whether these arrangements are effectively implemented and enable the achievement of objectives”. This process enables the identification of any non-conformities and the planning of corrective actions.
Audits are carried out both during the implementation and certification of a specific standard, and during the subsequent maintenance of the implemented system. This is necessary to maintain compliance with the requirements of the ISO standard, and thus to retain the right to use the certificate obtained. It can be said that audits are an integral part of the management process in accordance with the standards set by the International Organisation for Standardisation.
There has been a linguistic debate for years surrounding the term ‘audit’, as used in relation to quality management systems or the safety of processes within an organisation. This issue is significant in that, both in literature concerning ISO standards and in the documentation you receive, for example, following an internal audit, you may come across the terms “audit” or “auditor”. What does this mean?
The word “audit” appeared in the Polish language in 2009, following the publication of the translation of the new edition of the ISO 9000 series of standards. Previously, only the term “audyt” was used. It is currently difficult to say whether the change from “y” to “i” was the result of a translator’s error or – as the Polish Committee for Standardisation claims – influenced by the linguistic opinion of the University of Warsaw. Supporters of the spelling proposed by the PKN argue that “audyt” implies a strict financial inspection, whereas “audit” is something entirely different and refers exclusively to ISO systems.
As one might expect, linguists disagree with the views of those involved in management issues based on ISO standards. For centuries, the foreign-language prefix ‘di’ has taken the form ‘dy’ in Polish (e.g. in loanwords such as ‘dyrektor’ or ‘kredyt’). The leading authorities among philologists are of the opinion that the use of the word ‘audit’ (and its derivatives) is incorrect and that incorrect terms should not be perpetuated (which is why the institute
The primary purpose of an ISO audit is to verify whether a company’s operating standards comply with the guidelines of a specific International Organization for Standardization (ISO) standard, and thus whether the systems being audited can be used to achieve the established objectives. Depending on the context and who commissioned the audit, its results can serve as a basis for:
Regardless of the immediate objective and outcome of the audit, the company can always derive a number of benefits from it. It gains a detailed picture of its own operations and guidance on which aspects to improve and how to do so to make them more efficient and effective. This can translate into better business performance and, consequently, increase the company’s value in the eyes of stakeholders.
An ISO audit should not be confused with regulatory oversight, which aims, for example, to approve a specific product for sale. Negative audit results do not result in penalties or restrictions. They are purely informational in nature. A company that does not demonstrate a satisfactory level of compliance with the guidelines of a specific ISO standard does not lose the opportunity to be certified for compliance with that standard. It must simply implement corrective actions and then undergo another audit.
Management system audits can be categorized based on the aforementioned direct objectives:
A first-party audit is conducted at the initiative of the organization itself, by an employee designated for this role or by a competent internal auditor. The purpose of the audit may be, for example, to determine the company’s readiness for certification to a specific ISO standard or to improve an existing management system. The audit serves to verify the compliance of individual elements of this system with previously established requirements, which are reflected in a series of procedures and instructions tailored to the company’s specific nature and its individual objectives.
A third-party audit is commissioned by an entity that is interested in utilizing a company’s services or has already become its client but wishes to verify the quality of its supplier’s management systems. In other words, a second-party audit serves to build the company’s credibility in the eyes of its business partners. The audit is typically conducted by a specialized firm acting on behalf of the client. It is most often commissioned during the search for a supplier that meets specific requirements. A third-party audit is a certification audit conducted at the company’s request by an accredited body. It constitutes the final stage of implementing a management system and serves to verify its compliance with a specific ISO standard. If the audit result is successful, the company receives a certificate valid for three years. During this time, the company remains under the supervision of the accredited body. By meeting specific requirements, it may apply for an extension of the certificate’s validity. If non-conformities are identified, the company may lose the right to use the certificate.
For an ISO system audit to fulfill its purpose, it must comply with the criteria set forth in ISO 19011, namely:
The audit takes place on a scheduled date and within a defined scope. Its purpose is to assess the quality of the management system, not to conduct a surprise inspection of company employees for potential negligence. The entire process should not take place under stressful conditions, but rather in a spirit of cooperation—otherwise, it will not yield the desired results. After all, it is difficult to expect reliable, complete information from surprised or even frightened employees. One might even expect that much of it will be untrue, whereas the audit is intended to assess the actual state of the processes taking place within the company.
The frequency of ISO audits depends on the needs of the organization in question, as well as on the reasons for conducting the audit. When referring to systematic activities, ISO 19011 pertains to internal audits, in which a company conducts a self-assessment of its management systems. As a rule, this type of verification is performed at least once a year. However, it is advisable to conduct an internal audit whenever significant elements of the assessed processes are modified (e.g., a change in personnel). Regular audits help maintain the established operational standards.
The independence of an audit depends primarily on the auditor. It is not advisable to entrust this task to someone employed by the company or who works with it on a daily basis, as this could compromise the objectivity of the audit. The auditor should not be guided by emotions, such as personal preferences or biases toward colleagues, or by professional dependence on superiors. Useful audit results can only be obtained based on an impartial, reliable, and comprehensive assessment. Therefore, it is best to commission an independent specialist who has completed the appropriate training for internal auditors to conduct the audit.
Since the purpose of the audit is to eliminate any errors or shortcomings in the management system, the audit should be thoroughly documented. The audit report should include all information regarding the status of the specific management system—both regarding observed non-conformities with the ISO standard and identifying areas where the standard’s guidelines have been properly implemented. Only such a presentation of the audit results allows for a true insight into the processes taking place within the company and the implementation of appropriate corrective actions.
The process of an audit to verify compliance with a specific ISO standard largely depends on which standard the management system under review is based on. The specific nature of the audited organization and its operations also plays a significant role. However, there are standard stages to this procedure. These include:
During the management system audit, both the auditor and the audited entity should bear in mind that the primary purpose of this procedure is to demonstrate compliance with the standard, not to find errors. Finding non-conformities does not indicate poor performance by those responsible for specific processes and does not constitute grounds for penalties or other negative consequences. An audit allows for the detection of problems and serves to implement corrections that will improve the company’s operations.
As you can see, the audits your company will face if you decide to implement and certify ISO standards do not hinder your business. On the contrary—they are a tool you can use to drive its continuous growth.
DJB DORADZTWO
Marcin Chorąży
