No matter what activity your organisation is undertaking in regards to quality standards – whether it be internal audit, self-assessment, reviews – at some point someone is going to have to make a call as to whether a finding is a non-conformance to a standard / indicator / expected outcome. When you’re
starting out in internal audit, this can be a difficult point – if you make a conformity call and then an external auditor says it’s a non-conformity, it can have a big impact on your credibility. Same for vice-versa.
If you’ve had auditor training you will know that part of the audit process is that we look at information objectively, so if another auditor came in and looked at the same information, they would come to the same conclusion. That is a good theory, but in my experience it doesn’t always mean that you and another auditor
are going to agree – we are human, and standards are not always written in black and white. You just have to look at the large amount of evidence guides out there attached to standards – they’re in place to try and reduce the degree of interpretation, but sometimes they can complicate things further.
As an internal auditor, your job is to assess your organisation’s information against quality standards to a highly critical degree – you are there to lower risk. But if you’re not sure when an issue is a non-conformity, you’ve come to the right place! Let’s take an example and walk through it.
Human Services Quality Framework – Standard 3, Indicator 3 – The organisation has processes to ensure that services delivered to the individual/s are monitored, reviewed and reassessed in a timely manner.
In every indicator there are key words that will help you determine what conformity is really based on, and what evidence has to be measured against. The key words in this indicator are ‘monitored, reviewed
and reassessed’. Notice that it doesn’t say ‘or’—what this indicator is telling you is that the organisation needs to have processes in place for all three of those things before you can be considered to achieve conformity.
Having processes in place doesn’t necessarily mean that you have a documented procedure—what it does mean is that the organisation must have determined what its requirements are, that all staff involved know
these requirements, and that it’s actually being done. So, a documented process does help, but it’s not an indicator of conformity in this case—that the process actually happens is the indicator.
So, in this case, I would consider a non-conformity to be:
1. Not having defined a process to monitor, review and reassess services within a reasonable timeframe—it might be occurring, but it’s at the discretion of staff.
2. Staff not being aware of what the defined process is, and/or developing their own processes.
3. There is no process in place for either monitoring, review or reassessment, it is not occurring, and this is evidenced by reviewing client records and/or through client interviews.
4. There is a process in place for monitoring, review or reassessment, however it is not occurring as defined, for example, the process is for reassessment to occur every six months, but systemically this is not happening until 12-18 months.
Breaking down indicators in this way helps in two major ways. Firstly, it gives you a framework by which to audit—you’ll be looking at the right things and asking the right questions. Secondly, you will have a logical and understandable way to explain why you have made a non-conformity call.
Thanks for reading,
The Quality Nerd loves all things Quality Management and Internal Audit...too much is never enough!