| by
Chad Kymal
When conducting a system audit for ISO/TS 16949:2002, it’s important to study how processes are linked together in the normal organizational sense. Following an audit trail allows an auditor to verify most of the processes defined in a typical ISO/TS 16949 process map. It also allows for a detailed study of links between processes and departments. While on the audit trail, the auditor will audit not only for conformity, but also for performance as judged by the customer.
Audit trails are techniques that minimize the number of times an auditor examines one area. They also allow for a detailed study of links because the processes connected by samples taken in one area lead to a second or third area of investigation. For example, during business planning and management review, an auditor would find customer needs and expectations in the process that gauges customer focus. The auditor would subsequently move on to the quality policy in relation to that customer focus. This could then lead the auditor to study the business objectives as they relate to needs, expectations and quality policy. Finally, the management review would be studied to ensure that the company is fulfilling the objectives of the business, and that it’s ultimately satisfying the needs and expectations expressed by its customers.
The three basic audit trails that follow the key links for the major processes found in most automotive organizations are:
• Business planning and management (BPM) review : Followed when auditing strategic planning, business planning, policy deployment, objective setting, customer expectations, management review or operations review
• New product development (NPD): Followed when auditing processes related to new product development, which begins with the bid or quote and ends with product approval
• Production and service provision: Followed when verifying that an organization has effective control over its production and service operations
What’s the best way to use these audit trails? The auditor should start by taking the organization’s process map and trying to understand the processes in the organization that correspond to the audit trails provided. He or she should then insert the processes in their respective audit trails. In other words, the auditor should use the company’s business processes and procedures during the audit for guidance. Doing this will help uncover weaknesses in the process map. The processes corresponding to the audit trails—not the clauses found in ISO/TS 16949—are used to create the audit plan. Because the actual audit trails will vary from one organization to another, using tools such as audit-trail flowcharts will aid auditors in confirming the processes and links to be audited.
Of the four audit trails given here, the BPM review trail, new product development trail and the provision audit trail are the most important.
Management commitment, along with the business planning process, often guarantees an organization’s success or failure. If the BPM review audit trail is effective, there’s a good chance that the other clauses of ISO/TS 16949 will also be properly implemented in the organization.
In the flowchart in figure 1, “Customer focus” (subclause 5.2) is the starting point.
The phases of the BPM review audit trail, along with relevant clauses from ISO/TS 16949, can be broken down as follows:
• The auditor starts the audit with top management, learning its strategic planning process. The auditor samples customer expectations and requirements to evaluate the audit trail.
• The auditor uses expectations and requirements to check their alignment with the quality policy (subclause 5.3), and then examines how they relate to the quality objectives chosen (subclause 5.4.1) and the business plan (subclause 5.4.1.1).
• The quality objectives drive the quality management system (QMS) planning (subclause 5.4.2), which results in a continual improvement plan and QMS changes.
• The plan (subclause 5.4.2) also needs to include new or changed processes under general requirements (subclause 4.1).
• The auditor then examines the internal audit process (subclause 8.2.2), the customer satisfaction process (subclause 8.2.1), continual improvement (subclause 8.5.1), and corrective and preventive action processes (subclauses 8.5.2 and 8.5.3).
• The results of these processes are examined during management review. If the process-monitoring audit trail and/or operations audit trail are assigned to the auditor, then they should be completed before the management review is audited.
• Finally, the management review process is audited to ensure that the QMS is being managed effectively and that performance improvements are taking place. The auditor can compare the organization’s set objectives against its actual performance. The auditor can also gauge if the organization is truly satisfying customer needs and expectations.
For an organization to be considered customer-focused, ISO/TS 16949 requires key customer requirements to have objectives. These must be included in the organization’s business plan and used for policy deployment, and they must have continual improvement goals and appropriate resources. The objectives should also be linked to customer expectations and be achievable in a defined time period.
Therefore, it isn’t enough to sample random customer requirements and objectives. The auditor must start with key customer requirements, follow the trail and then sample related documents. It’s essential that the audit trail is followed thoroughly and completely. The business plan objectives are key pieces of evidence for this audit trail.
The auditor should be able to study a process and ask if the organization measured the right criteria in the process. For manufacturing processes, the auditor must sample specific process information (i.e., process studies and capability).
Samples of five to 10 key customer requirements should be selected to audit this trail appropriately. The auditor should start with customers and end with improvements made to meet the customers’ needs.
Examples of processes include:
• Gathering customer expectations
• Market research
• Business and/or strategic planning
• Management review
• Operations review
The clauses for BPM audit trails are those associated with top management. Top management’s responsibilities are defined in subclauses 5.1 and 5.1.1. There are only two responsibilities that top management can delegate, according to subclause 5.1: ensuring that quality objectives are established, and that resources are made available. All other tasks listed in subclauses 5.1 and 5.1.1 must have top management’s direct involvement.
The success of the new product development process is vital to the future of the organization being audited. This process is ineffective in many organizations and often leads to problems with timing, product quality at launch and designs that don’t meet customer expectations.
As seen in the flowchart in figure 2, the audit trail starts by identifying
customer-related processes or sales processes (subclause 7.2), then proceeds to program planning, design and development of the product (subclause 7.3), process or technology development and, finally, to the production part approval process (PPAP). In some industries, such as semiconductor design, technology development occurs first. The entire set of advanced product quality planning (APQP) requirements can be audited only when technology and product are being developed initially.
After the PPAP, the audit moves to the operations, process monitoring and improvement audit trails.
The links in this audit trail are those from contract review (subclause 7.2) to the product approval process. To audit this trail, the auditor first selects product samples and tests customer-related processes or sales processes (subclause 7.2) for the contract review. This will verify that the organization has properly identified and reviewed the product requirements prior to agreeing to supply the product. Contract review is a sales and marketing function. To ensure that there’s a trail to product planning and then to the plant, the auditor identifies the products that have recently been through the PPAP or are being produced in the plant.
Next, the auditor examines how the organization has planned the processes required to produce the product identified in product-realization planning (subclause 7.1). This audit of process planning takes place where the organization conducts its project or program management. During this phase, or early in the audit trail, the auditor should document the goals and objectives of the product launch. What were the timing, quality goals and budget at the start of the program? Those in the organization who were involved with program or project management should be able to identify where they started and what the results were. If they can’t, that’s a finding in the audit.
For a product launched a few months to a year before, the organization should provide the auditor with the quality history or scrap, rework and customer rejects data. It’s important that the auditor conducts this performance evaluation and subsequently prioritizes the audit areas. He or she then tracks a sample product through design and development (subclause 7.3) to test that each step of the new product and process development procedure has been followed. Finally, the product approval process is reviewed for content and effectiveness.
It’s always good to sample a variety of products, including those that have been running for one year, those that were recently introduced and those still in the pipeline. The auditor should try to audit each of these and many others chosen randomly when auditing customer-related processes (subclause 7.2). In this way, contracts that were won and lost will be audited. The auditor can study how customer requirements for a particular product were gathered by the organization, as required in subclause 7.2.
The audit scope and product definition are important on this audit trail because a product could include hardware, software, service and processed material. The auditor should carefully define the scope ahead of time.
Examples of processes include:
• New product development
• Bid or quote
• Order entry
• Product design and development
• PPAP
As seen in the flowchart in figure 3, the provision audit trail covers all the activities necessary to produce and deliver products and services to the customer. It includes activities for operating the realization processes, identifying and tracing products and services, handling customer property, preserving product, measuring product and service output, and handling nonconforming product.
The auditor must carefully study the different processes in the organization for production and service provision (subclause 7.5) and sample them appropriately. For example, in a manufacturing plant that has heat-treating, machining, paint and assembly, each of these processes should be sampled.
This audit trail starts with production and service provision (subclause 7.5), then tracks through all the other processes in operations. The auditor studies how processes that produce and deliver the product are controlled, identified, measured and monitored. Customer requirements and characteristics are important during this step of the audit trail. Nonconforming products are segregated and evaluated for disposition. Finally, the performance of the process is analyzed, and projects are chosen for improvement.
Examples of typical processes are:
• Assembly
• Fabrication
• Scheduling
• Shipping
• Packaging
• Stamping
• Blending
The common elements are the products being sampled. The products could be the same ones that were sampled for new product development. The sampling should be conducted with the following considerations:
• Do the sampled products involve all the processes?
• Do the sampled products represent the major product families?
Select some products that represent a small percentage of sales revenue and some that represent major product lines. This will also determine whether the organization has applied its operational controls across the board. If the organization is required to provide any post-delivery services, that process will need to be sampled as well.
The measurement and monitoring devices specified in the control plan must be controlled according to subclause 7.5.1.1. These devices measure the characteristics in the monitoring and measuring of product (subclause 8.2.4). The auditor should document several monitoring and measuring devices when auditing the production and service provision (subclause 7.5), and then follow-up in control of monitoring and measuring devices (subclause 7.6).
Subclauses 7.5.1.1 and 8.2.4 are linked because the former describes the characteristics and the latter measures them. Also, the control plan describes the process for control, and subclause 8.2.4 is the mechanism of that control. Another link is between subclause 8.2.4, which could measure received products, and subclause 7.4, regarding purchasing, which controls supplier processes.
Finally, after product characteristics are measured in subclause 8.2.4, flawless products go to the next stage, and flawed ones are segregated as nonconforming products. These must follow a process described in subclause 8.3, which is concerned with the control of nonconforming product.
The same product sampled in monitoring and measurement of product (subclause 8.2.4) and control of nonconforming product (subclause 8.3) is analyzed with other organizational data in the analysis of data (subclause 8.4), and further developed in the improvement (subclause 8.5) phases.
The intent of this audit trail is to verify that an organization has effective control over its production and service operations. To do so, the organization has to set up a number of activities and mechanisms on the production floor. To audit these items, the auditor should proceed as follows:
• Ask for a plant layout and a process map of product flow around the plant. Evaluate these for layout efficiency.
• Ask about appropriate facility metrics that are monitored (e.g., throughput or overall equipment effectiveness).
• Check overall efficiency during a plant walk-through.
• Ask for a production schedule.
• Sample departments (i.e., part numbers) to audit. In a representative sample, include final inspection and packaging.
• Ask for a process flow and control plan.
• Sample processes to audit.
The following assessments should be made for each process sampled in the process flow:
• Study the operator work instructions against the requirements outlined in the control or quality plan.
• Ask the operator how he or she operates and sets up the machine. Study responses against work instructions.
• Ask how the organization inspects its product.
• Check the inspection checklist against the control plan.
• Ask how both special and regular characteristics are inspected and controlled.
• Ask if the frequency and method in the control plan is followed (e.g., with a check sheet).
• Ask about gauges mastered and write down gauge numbers.
• Check the gauge-calibration sticker or its equivalent for calibration expiration.
• Check statistical process control charts.
• Assess stability and capability.
• Ask questions about out-of-control conditions.
• Check the tagging procedure and/or work instructions. Check visually throughout the department.
• Ask the operator what he or she does about nonconforming parts. Check this response against a nonconforming product procedure.
• Check inspection status as appropriate.
• Ask about preventive maintenance as it relates to the operator.
• Write down operator names, operation numbers, gauge numbers and document numbers for the audit trail.
• At the end of the interview, ask to see the records. Sample weeks of data for each operation for conformity. (Note: This is key to the provision audit trail. Performance to the control plan can only be gauged by evaluating manufacturing records.)
• Ask about the quality policy.
• Ask about process changes.
• Look at the overall cleanliness of the plant and the maintenance process. (Note: Packaging and shipping areas should be examined as well.)
After these audit trails have been completed, the auditor should be able to determine if a process is sufficiently defined, if it’s working satisfactorily, if its performance relates to overall performance and if the links are well established. This will ensure that the company has established a true process-driven system.
Note: This article is taken from the author’s upcoming book, The ISO/TS 16949:2002 Audit Handbook: Conducting Effective Process-Based Auditing for the Automotive Industry, which will published later this year by Paton Professional.
Chad Kymal is an international trainer, consultant and founder of Omnex. His broad experience includes total quality management (TQM), setup reduction, technology assessment and inventory analysis, statistical process control, and quality function deployment. He received the Quality Professional of the Year award by the American Society for Quality’s Automotive Division in 2005.
|
