After a Global Pandemic, Are Fully Remote QMS Audits Truly Effective?

Looking at intent, realities, and possibilities

Although ISO 19011—“Guidelines for auditing management systems” has included language about remote quality management system (QMS) auditing since the 2018 revision, this became a reality for many of us in March 2020 with the onset of Covid-19 and the mass lockdowns that ensued. Many of us have been exclusively auditing quality management systems remotely for a year and a half, and without doubt will continue to do so.

In the beginning of the pandemic, there were articles circulating to point to the language of ISO 19011:2018 or blogs from consultants that claimed they were able to teach effective remote-auditing methods to ensure that the results were just as effective as their onsite counterparts. However, now that we are a year and a half into this, I wanted to get some opinions about the actual effectiveness of remote auditing as it stands today.

…

Want to continue?

By logging in you agree to receive communication from Quality Digest. Privacy Policy.

Create a FREE account

Forgot My Password

Comments

On-site audits suck, too

I think there are a few problems with how the question is being asked. It assumes that on-site audits, as conducted over the past few decades, are some sort of baseline for effectiveness. In reality, as it pertains to ISO certification audits, all evidence shows that on-site audits are largely ineffective, and have been so for many years.

My company (Oxebridge) has amassed a great amount of data showing that between the period of roughly 2000 to present, certification audits have fallen to a pay-to-play scheme, in which now everyone passes every audit, often with "no nonconformities." Under no logical scenario should this be possible. Even worse, when companies are later uncovered to have released defective products, or falsified inspection data, or released counterfeit products .... nothing happens. The companies continue to retain their certifications as auditors simply ignore the evidence around them, as well as the blaring news reports decrying the crimes. Again: you pay, you get the certificate.

As I write this, the new head of the IAF just wrote to me with an opinion that would allow companies found guilty of fraud to maintain their ISO certifications. And this comes from the organization with is supposed to uphold the integrity of certifications.

So the pearl-clutching over remote audits is worth a number of eye-rolls. If bodies like IAF and the attendant accreditation bodies have been unwilling to make on-site audits more than just performance art, why is anyone raising a fuss now about remote audits?

The entire assessment model needs to be fixed, starting with a return to requiring evidence by way of documents and records. This reduces auditor interpretation, and the need for elderly grunts to rummage around the shop's garbage bins in between trips to the coffee machine.

You are assuming this refers only to External audits!

While you can argue that external audits 'on-site' may not be effective; Internal Audits 'on-site' are effective.

So in one case the data is valid and in the other case, probably not so much!

Remote internal audits by

Remote internal audits by auditors who are already on site? Mmkay.

I Was Primarily Talking About Imternal Audits

Hi, Chris. I am the author and was primarily talking about internal audits. I'm now doing a lot of remote audits for clients that I used to audit for onsite, or reviewing their previous internal audit reports that were conducted onsite prior to conducting my own remotely. I definitely see your point and agree with you, but I'm really not taking about CB corruption and the IAF, just talking about challenges that regular internal auditors need to learn to overcome both by improving their skills and the tools used.

Same argument applies

It's irrelevant. The standard only demands that companies "identify" or "determine" or "plan" a thing, and then never require a record for any of those. For any auditor, whether internal or external, they would have to use super-psychic mindreading powers to obtain objective evidence of an undocumented mental exercise like "determining" something. Until the standards are updated, remote auditing can't work well for anyone. The IAF just leans into this by making audits lackadaisical drive-by events. But a lot of internal auditors do that, too. The standards don't really require anything more from them.

Article

Nice article. Good insights. Thank you. Mukund