Paul Hardiman and Rob Brown SMMT IF

1. Paul Hardiman and Rob BrownSMMT IF Planning and organising an audit

2. Objectives How to: Effectively plan an audit based on organization processes Best utilize the audit time available Process what you see during an audit to make decisions Analyze and synthesize data / metrics Modify priorities based on situational awareness

3. Background ISO/TS16949 auditor qualification and development uses six essential auditing criteria, defined in an �auditor competency criteria booklet:

4. Essential auditing criteria Process Approach Demonstrates priority is given to questioning the organisation�s identification of processes, their sequence and interactions, and performance against the objectives / measures defined, with focus on the processes which directly impact the customer Customer, regulatory, industry requirements Demonstrates that these requirements are integrated into a process based audit. Effectively audit the organisation�s process for gathering, communicating and implementing these requirements. The trainer should explain that the interview is evaluated based upon 6 competency criteria. The trainer should explain the above slide without detailed discussions. Explain that the automotive process approach will be discussed during the course, especially focused on sequence and interactions, and process efficiency and effectiveness. Explain customer specific requirements will be discussed during the training. The trainer should explain that the interview is evaluated based upon 6 competency criteria. The trainer should explain the above slide without detailed discussions. Explain that the automotive process approach will be discussed during the course, especially focused on sequence and interactions, and process efficiency and effectiveness. Explain customer specific requirements will be discussed during the training.

5. Essential auditing criteria Prioritisation Demonstrates priority is given to questioning the process objectives and performance, and focus on issues that have the greatest impact on the customer Focus on performance Identifies issues/trails around the organisation�s process for setting objectives/ targets, what plans are in place to ensure targets are met, and corrective action plans where objectives/targets are not being met Explain prioritisation is essential in any audit, and that an auditor should focus on questions on process objectives, and the actions taken when targets are not met, with particular focus on effectiveness of processes to meet customer requirements. Explain that a process based audit should focus on performance against the customer/organisation targets Explain prioritisation is essential in any audit, and that an auditor should focus on questions on process objectives, and the actions taken when targets are not met, with particular focus on effectiveness of processes to meet customer requirements. Explain that a process based audit should focus on performance against the customer/organisation targets

6. Essential auditing criteria Knowledge/Application of AS9100, AS9110 and AS9120 requirements (and associated checklists) Demonstrates knowledge and application of the requirements within a process based audit Analyse and Synthesize data Demonstrates the ability to collect and analyse data, and draw accurate conclusions based upon the data. Synthesize isolated but connected data in order to draw conclusions. Explain that an auditor should understand the requirements of the documents and then be able to apply the knowledge in an audit situation. Explain that an auditor is faced with reviewing many documents during an audit, but should be able to analyse data, and draw accurate conclusions based upon the review of data. An auditor should be able to link issues identified, and ability to draw conclusions on system issues rather than individual symptoms (ie see the big picture). Explain that an auditor should understand the requirements of the documents and then be able to apply the knowledge in an audit situation. Explain that an auditor is faced with reviewing many documents during an audit, but should be able to analyse data, and draw accurate conclusions based upon the review of data. An auditor should be able to link issues identified, and ability to draw conclusions on system issues rather than individual symptoms (ie see the big picture).

7. Audit plan outputs: ISO17021 the audit objectives; the audit criteria and reference documents; the audit scope, including identification of the organizational and functional units and processes to be audited; the dates and locations where the on-site audit activities are to be conducted including visits of temporary sites as appropriate; the expected time and duration of on-site audit activities, including meetings with the client�s management and audit team meetings; the roles and responsibilities of the audit team members and accompanying persons; and the allocation of appropriate resources.

8. Audit plan: ISO17021 The audit plan information may be contained in a single document or in several documents Any objections to the audit plan by the client should be resolved between the certification body, the audit team leader and the client. Any revised audit plan should be agreed among the parties concerned before continuing the audit. PLANNING APPLIES TO ALL TYPES OF AUDITS (Stage 1, stage 2, surveillance and recertification) Importance of Pre-Audit Phone CallsImportance of Pre-Audit Phone Calls

9. ISO17021 Stage 1 Purpose the client�s preparedness for stage 2 audit; gather information to help plan the stage 2 audit establish the sufficiency of the audit program and resources Also can be used to gather knowledge of types of regulatory requirements that apply

10. ISO17021 Stage 2 Purpose the implementation of the management system; the capability of the management system to be effective in ensuring continual compliance with customer, statutory and regulatory requirements and in meeting its specified objectives; and the extent of conformity of the client�s management system with the requirements of the management system standard within a defined scope.

11. Planning an effective process based audit What information you would need to gather prior to the audit to help you effectively plan an audit Give examples

12. Audit planning The audit programme shall be planned taking into consideration: status and importance of the processes and areas to be audited results of previous audits

13. Process Approach 0.2 Process approach This International Standard promotes the adoption of a process approach when developing, implementing and improving the effectiveness of a quality management system, to enhance customer satisfaction by meeting customer requirements.

14. Stress customer can be external or internal, and that processes will be a sequence of activities or process steps to transform an input to an output to meet a customer requirement. Introduction of the concept of the Car Dealership from the prospective of the customer needs. Stress customer can be external or internal, and that processes will be a sequence of activities or process steps to transform an input to an output to meet a customer requirement. Introduction of the concept of the Car Dealership from the prospective of the customer needs.

15. Plan audit based on processes not departments This is a conceptual model of how processes might interact within organizations. Q: Is it acceptable to have a functional organization chart EXERCISE: 5 minutes within groups: If you were planning to audit this process, what questions might you need to ask. After 5 minutes, the Trainer should highlight the points below as some of the questions that might be asked. -How is the Logistics Process defined by the organization in its process definition? The interactions? Its sequence with other processes? -Note that �supply� is not included. How might that be addressed in the Stage 1 audit? -Be certain that the interactions between the site and the remote, supporting function of Sales are discussed. Also the three departments at the site, Planning, Production, and Shipping. How is the information transmitted? How does the organization ensure that it is understood? -Discuss the concept of �process owner� versus the responsibilities defined in the organization chart. -What would be good measures of effectiveness? Of efficiency? -How does the process owner review the performance of this process? -How does Top Management review this process? Who is responsible for the process. This is a conceptual model of how processes might interact within organizations. Q: Is it acceptable to have a functional organization chart EXERCISE: 5 minutes within groups: If you were planning to audit this process, what questions might you need to ask. After 5 minutes, the Trainer should highlight the points below as some of the questions that might be asked. -How is the Logistics Process defined by the organization in its process definition? The interactions? Its sequence with other processes? -Note that �supply� is not included. How might that be addressed in the Stage 1 audit? -Be certain that the interactions between the site and the remote, supporting function of Sales are discussed. Also the three departments at the site, Planning, Production, and Shipping. How is the information transmitted? How does the organization ensure that it is understood? -Discuss the concept of �process owner� versus the responsibilities defined in the organization chart. -What would be good measures of effectiveness? Of efficiency? -How does the process owner review the performance of this process? -How does Top Management review this process? Who is responsible for the process.

17. Case study�First contact�

18. Best practice in audit planning

19. Note: This slide �builds� as you bring in each part of the animation. The top down approach leads you to start with Management, then come back to Management in the end. Note: This slide �builds� as you bring in each part of the animation. The top down approach leads you to start with Management, then come back to Management in the end.

20. Trainers: Mention interaction between processes as an additional input into planning. The audit plan starts top down and finishes bottom up. After having understood the objectives and policies from the top level, the auditor can check that these are deployed down throughout the organisation. At the same time he will be obtaining information on the PERFORMANCE of all the processes. During the final part of the audit, being again with top management, the auditor can assess the way that policies are modified taking into account actual performance. This should be the A of PDCA but at company level. Top Management as defined from ISO 9000 is �The person or group of people who directs and controls an organization at the highest level.� Trainers: Mention interaction between processes as an additional input into planning. The audit plan starts top down and finishes bottom up. After having understood the objectives and policies from the top level, the auditor can check that these are deployed down throughout the organisation. At the same time he will be obtaining information on the PERFORMANCE of all the processes. During the final part of the audit, being again with top management, the auditor can assess the way that policies are modified taking into account actual performance. This should be the A of PDCA but at company level. Top Management as defined from ISO 9000 is �The person or group of people who directs and controls an organization at the highest level.�

21. Site Audit

22. OBJECTIVES: Be capable of formulating questions to check the performance and robustness of a QMS based on processes, in terms of conformity to ISO/TS requirements. In addition points to audit can be based on an analysis using a turtle diagram. For each element of the turtle for the process concerned, what can go wrong? (risk analysis) For example for a maintenance process what potential problems could occur with the equipment? (With what?) Typical answer: "Special tools not available" This can be noted as a point to be audited in order to test that the process is robust. OBJECTIVES: Be capable of formulating questions to check the performance and robustness of a QMS based on processes, in terms of conformity to ISO/TS requirements. In addition points to audit can be based on an analysis using a turtle diagram. For each element of the turtle for the process concerned, what can go wrong? (risk analysis) For example for a maintenance process what potential problems could occur with the equipment? (With what?) Typical answer: "Special tools not available" This can be noted as a point to be audited in order to test that the process is robust.

23. Confirm delegates are aware of the PDCA cycleConfirm delegates are aware of the PDCA cycle

24. This slide �builds� as you hit a key to add each block,. NOTE: CAPDo� is a registered trademark of Eurosymboise. At train from this slide explain that this is a Eurosymboise concept that they have allowed the IATF to present. It is being presented as an approach that may be taken. It is NOT mandated by the IATF. This is only an example of good practice in determining the order in which to ask the questions relative to the various points identified. Trainer: The very first questions (the C) concern Performance�: measurement, pertinence of the measurable and the objectives.. � The immediate and automatic follow up of the CAPDo auditor is to then examine actions to IMPROVE performance (A), checking that no opportunities have been missed or more importantly identifying potential to change significantly the way the process meets customer and shareholder requirements.� By starting in this way the emphasis, and the time spent, is clearly signalled and the CAPDo auditor will typically spend most of the interview phase on the C & the A before simply checking that the minimum necessary in terms of planning or documentation is available (P) Exactly the opposite of the traditional approach to auditing. For robustness the auditor can base his questions on the Crosby turtle, to check that risks have been identified and addressed. Also has the process been redesigned taking into account improvement opportunities During the last phase (Do), at the work station the CAPDo auditor may well detect further improvement opportunities transforming the audit into a real tool for strategic management.� Of course the CAPDo approach demands a completely different way of preparing the audit, instead of working through a quality standard or adapting a standard questionnaire, the auditor must ensure that he really understands the inputs (requirements) and outputs (deliverables) of the process as well as identifying the process's customer. Only then can he prepare his questions. This slide �builds� as you hit a key to add each block,. NOTE: CAPDo� is a registered trademark of Eurosymboise. At train from this slide explain that this is a Eurosymboise concept that they have allowed the IATF to present. It is being presented as an approach that may be taken. It is NOT mandated by the IATF. This is only an example of good practice in determining the order in which to ask the questions relative to the various points identified. Trainer: The very first questions (the C) concern Performance�: measurement, pertinence of the measurable and the objectives.. � The immediate and automatic follow up of the CAPDo auditor is to then examine actions to IMPROVE performance (A), checking that no opportunities have been missed or more importantly identifying potential to change significantly the way the process meets customer and shareholder requirements.� By starting in this way the emphasis, and the time spent, is clearly signalled and the CAPDo auditor will typically spend most of the interview phase on the C & the A before simply checking that the minimum necessary in terms of planning or documentation is available (P) Exactly the opposite of the traditional approach to auditing. For robustness the auditor can base his questions on the Crosby turtle, to check that risks have been identified and addressed. Also has the process been redesigned taking into account improvement opportunities During the last phase (Do), at the work station the CAPDo auditor may well detect further improvement opportunities transforming the audit into a real tool for strategic management.� Of course the CAPDo approach demands a completely different way of preparing the audit, instead of working through a quality standard or adapting a standard questionnaire, the auditor must ensure that he really understands the inputs (requirements) and outputs (deliverables) of the process as well as identifying the process's customer. Only then can he prepare his questions.

25. OBJECTIVES: Be capable of formulating questions to check the performance and robustness of a QMS based on processes, in terms of conformity to ISO/TS requirements. In addition points to audit can be based on an analysis using a turtle diagram. Refer to the turtle flip chart exercise to highlight sequence and interaction from slide 72. For each element of the turtle for the process concerned, what can go wrong? (risk analysis) For example for a maintenance process what potential problems could occur with the equipment? (With what?) Typical answer: "Special tools not available" This can be noted as a point to be audited in order to test that the process is robust. OBJECTIVES: Be capable of formulating questions to check the performance and robustness of a QMS based on processes, in terms of conformity to ISO/TS requirements. In addition points to audit can be based on an analysis using a turtle diagram. Refer to the turtle flip chart exercise to highlight sequence and interaction from slide 72. For each element of the turtle for the process concerned, what can go wrong? (risk analysis) For example for a maintenance process what potential problems could occur with the equipment? (With what?) Typical answer: "Special tools not available" This can be noted as a point to be audited in order to test that the process is robust.

26. Case study�On-site�

27. Summary Audit plans should be based on the organisation�s processes Audit plans should consider process sequence and interaction Gather essential information prior to audit Audit plans should be reviewed/updated when changes occur/ are identified Modify priorities based on performance data

28. Information for audit planning Scope of activities (product range, design responsibility etc) Site details and any remote support functions Site layout Number of employees (by site and remote location)/ audit days Customers Organization�s identified processes Process owners Objectives (Key performance indicators) Current performance data Last external audit findings (if applicable)

29. Information for audit planning Internal audit findings, and management review results Regulatory/Statutory requirements Significant risks For surveillance and recertification any information on: Organisation changes including organisation structure, new capabilities, staffing levels, customer base changes (aviation, defence, space), and contract volumes Customer Satisfaction/ Perception Status (Returns, Complaints, etc.) New Risks