Types of Audit

An audit means someone coming in to your organisation and looking at how it works, to see whether it meets requirements.

Here, we are concerned mainly with an audit by a certification body. They will audit you if you ask them to certify you to a standard such as ISO 9001/TickIT.

Another kind of audit is that done by a customer. They may want to satisfy themselves that your company is capable of fulfilling a contract. Such an audit is often similar to that described here.

Yet another kind is an internal audit. This is done by your own people, to check the Quality System is working. It differs in detail from what these notes describe, but many of the ideas are the same.

What the Auditors are Looking For

You need to be able to show how your procedures fulfil the requirements. Depending on the type of audit, these may be the requirements of a published standard, of a contract or of your own Quality System. You also need to have records that show compliance in practice.

If you can do these two things, the audit should not cause too much anxiety.

A consultant can advise as to whether you are ready for an audit. He or she can also give detailed advice on the sort of things the auditors are likely to pick up.

Before the Audit

The auditors will want your Quality System to have been in use for some time. Typically, this has to be at least 3 to 6 months. You will need records to show that the system is being used and is effective.

Ideally, they would like to see some projects that have gone through the whole system from start to finish. If you have only been operating it for a few months, this will not be possible - some of the projects now in progress will have started under previous systems. But you may still be able to put up a good enough case to satisfy the auditors.

Documentation Review

The auditors need to be satisfied that your documented procedures comply with the standard, contract etc. They used to do this part of the audit off-site, beforehand, though now it is often rolled in with the audit visit.

Document requirements are less stringent than they used to be. Auditors do not want a lot of written procedures. Especially, they do not want them to exist on paper only, with no relation to reality!

During the Visit

The purpose of the audit visit is to check that you are following the procedures you say you are, in your day-to-day work.

The auditors interview a cross-section of staff. Interviews generally take place where the work is done, so the auditors can see it happening. They will also call for documents and records. Make sure your people know the procedures they are meant to be following and where to find things.

During their work, the auditors will note any discrepancy they find as a non-compliance. If they find a major non-compliance that would result in your failing the audit, they will tell you at once and ask whether you want them to go on with it.

The auditors will be keen to see that you have an effective system of internal audits and that you correct any non-compliances so found. This is important, because the auditors themselves only review a small sample of your work. Be prepared to disclose problems you have found and fixed - these should not count against you.

At the end of the visit, the auditors usually hold a closing meeting. At this, they present a preliminary report of their findings.

After the Audit

After the visit, the auditors write up their report and send it to you. The most important part will be the Audit Findings, a classified list of non-compliances. If an essential part of your quality system is missing or not implemented, this will be a major non-compliance and will result in failure. Other non-compliances will be classed as minor.

To complete the process, you have to correct the minor non-compliances. When you have satisfied the auditors that you have done so, you get your certificate.