It can be said that 2020 has been a year of paradigm shifts in both our personal and professional lives. Friends, families, and co-workers have had to make big changes to stay connected; so too has the world of Quality Management System (QMS) audits. Within a few weeks of the COVID-19 pandemic initial impacts, the international audit community acted to provide a path forward for certification bodies, auditors, and certified companies: the expanded use of remote or virtual auditing. The process of remote auditing has been an option for QMS certification audits within the ISO 19011 standard, Guidelines for Auditing Management Systems. However, prior to 2020, remote auditing was infrequently used as a means of conducting the typical ISO9001 audit (surveillance, certification renewal, etc.).
Audit companies, auditors, and companies being audited had to transition from the traditional on-site audit experience to a remote one. In this transition, audit companies had to review and revise processes and procedures for remote audits to accommodate the wider use. The review and application of a remote audit requires a risk evaluation to ensure the audit objectives can be achieved. Some audit companies start the risk evaluation with the assigned auditor. That is, the auditor reviews the organization and the QMS elements to be audited and provides an initial input to the audit company as to the risk level. Some audit companies perform the initial risk review and then seek the auditor’s inputs to confirm the likelihood of achieving the audit objectives.
This risk level here relates not only to the access of the organization’s documents, databases, and personnel, but also to the technology to be used for the remote audit. Be it WebEx, Zoom, Skype, Teams, or Google Meet, any platform has a risk of not functioning throughout the audit day. In addition, Wi-Fi is another risk to take into consideration; how often has your Wi-Fi stopped working or your router needed to be restarted in a day? The technology risks are just as important as the access to resources. If the technology is intermittent or fails, the audit objectives cannot be achieved. These identified risks are evaluated by the audit company to ensure there are measures in place to mitigate the risks and ensure a successful and compliant audit. Once the risk evaluation is complete and the remote audit is approved, it is now the auditor’s responsibility to plan and conduct the remote audit; after all, this is what an auditor does. Alas, planning and conducting a remote audit is more involved than the on-site audit. While there are no travel arrangements to be made or suitcases to be packed, there is quite a bit of planning for the remote audit.
Planning
Planning for the remote audit is vital, both for the auditor and the organization to be audited. The audit planning for a remote audit is more than assembling an agenda for the topics to be audited. Remote audit planning now involves identifying the video platform to be used and ensuring the log in credentials are received in advance of the audit. With these items in mind, I have incorporated a specific time into my audit plan for auditor and auditee to log on to the video platform and ensure we all have video access, working speakers and microphones. This has essentially replaced the time for auditor arrival and “getting settled” for an on-site audit.
Next, typically, during an on-site audit, an auditor requests to review policies, procedures, process documents, and records during the course of the audit and those documents are provided over the course of the interview. In the remote audit planning process, it is easier to request these documents prior to the audit date to allow the auditor time to review the documents. This also saves on screen time for both the auditor and auditee.
Then there is planning for the opening meeting. In the on-site audit, an opening meeting is typically conversational. Those involved are usually sitting around a conference table and the auditor provides the information on the audit, audit plan, how to handle changes to the audit plan, etc. Not that these items aren’t covered in the remote audit, but it’s different. As more and more people are visual learners and seeing is understanding, I have created a simple PowerPoint presentation for the opening meeting that is reviewed via screen share. It covers all the typical items and adds the items relevant to a remote audit: logistics of screen sharing, taking breaks, viewing production and operation areas, and what may occur that would lead to terminating the remote audit. In the remote audit environment, there needs to be specific backup planning in the event the video platform fails or Wi-Fi goes out; basically, if the objectives of the audit cannot be achieved. It is important for both auditor and auditee to have some type of backup or recovery plan when there are technology issues to reduce the likelihood of terminating the audit.
The Remote Audit
We’ve talked about planning for the remote audit, let’s now turn to the remote audit itself. I realized early on that the remote audit process is very different. Auditors tend to sit a lot even during an on-site audit; add staring at a screen for seven to eight hours and one can get physically exhausted. Thus, ergonomics is now an element of remote audits that many auditors didn’t account for in the process, at least in the beginning. It is important to build in breaks throughout the day for both auditor and auditee. During the opening meeting, I specifically convey that every 60 to 70 minutes we will take a five to ten-minute stretch break so we can all walk away from the screen, get coffee or water, and most importantly get up and out of the chair and get some circulation flowing.
After the opening meeting, it’s time to get auditing. Sounds easy enough. This is where an auditor may become technical support to the auditee with respect to the video conference platform. As an ISO auditor, I’ve had to not only learn and almost master various video conference platforms, I’ve also had to teach some of the organizations I have audited how to use them; muting and unmuting microphones, screen sharing, and switching between a computer to a phone for viewing operations. If I didn’t know the general tools and capabilities of the various video platforms, several audits I have conducted might have been terminated and rescheduled.
Aside from the technology challenges, I’d like to share some of the challenges I’ve encountered in remote audits with respect to document and data availability and retrieval. Many of the organizations I have audited on-site, pre-pandemic, and audited remotely this year are small, less than 100 employees. Most of these organizations maintain a majority of their records in hard copy form. This poses an interesting challenge to the auditor when conducting an audit. During the course of a few audits I have conducted since early April 2020, I have had personnel literally hold a piece of paper up to the video for my review; not ideal, but it worked.
In an effort to learn from the less than desired experience, I worked to engage with organizations to scan documents and either screen share or email them for review. For situations such is this, some audit companies are building in extra time for the audit to account for the added time needed to access and retrieve or email documents or have personnel join the video conference.
From document review to auditing operations, the remote audit of operations is a challenge. The operations areas I have reviewed in remote auditing involved someone walking through the production areas using the camera on their cell phone. In an effort to make this part of the audit as productive as it can be, I have reviewed my objectives with the auditees; what I need to see and in what order to build in a smooth flow for process reviews. This gives the auditee an opportunity to provide feedback as to how their operations are arranged so we both can agree on a productive path forward. A consideration I offer to both auditors and auditees is to be aware of the noise levels in the operations area and build in time where the operations can be viewed via the camera and interviews with personnel can be arranged safely for all involved.
All in all, the remote auditing process can be successful. Planning in this remote audit environment is paramount as it includes more than just the topics to be audited. Take into account that the dynamics and timing are different in a remote audit and most importantly, patience is a virtue, just as it is during an on-site audit for both auditor and auditee. Q
