an open letter to all ISO 9000 auditors

dear Mr Auditor

1. Please stick to your job
you are an auditor not a consultant
dont advise the client

2. Please be clear about the audit criteria
IS: 15000 (Codex Guideleine) cannot be audit criterion
It is only a guideline

3. Respect the client (MD)
He/ she is your customer
You and the certification body is a Service Provider only

The MD may not be familiar with the ISO 9000 jargon
But he/ she is a successful business person
Give him/ her credit

(Read the Dhirubhai story)

and if one day u get sacked from your auditors job
do not aspire to be a Consultant

Knowledge about ISO 9000 is not sufficient to be a successful Management Consultant
You need to have domain knowledge of the industry you are consulting to

and Preferably with Management qualifications
and hands on business experience in India

Auditors are those people who get to the battlefield after it is over

and then stab the wounded

Does that describe your auditors (internal of external) that you are employing? We have such a problem with auditors in industry currently in South Africa.

Common problems experienced by organizations include:
Auditors not registered with SAATCA or IRCA (International Registrar for Certified Auditors)
Auditors not following the ISO19011 auditing guidelines
Auditors not competent in terms of qualifications and experience
Auditors auditing in a field which they are not competent in (eg. health & safety auditors auditing environment because it looks similar and easy)
Auditors being unprofessional (arriving late, handing in 4-page audit reports or the client having to beg three months later to get hold of the audit report)
Auditors not knowing how to compile an audit report according to international audit report writing principles
The list is endless.

Let us have a look at the ISO19011: 2002 guidelines for auditors. This document gives the foundation of who, what and how an auditor should be, do and act as well as the framework for doing a systematic audit from A to Z.
The principles of auditing are:
• Ethical Conduct: The foundation of professionalism – Trust, integrity, confidentiality & discretion
• Fair Presentation: The obligation to report truthfully & accurately – Audit findings, conclusions & reports are reflected truthfully & obstacles & unresolved opinions are reported
• Due Professional Care: The application of diligence & judgement in auditing – Care with their task & confidentiality
• Independence: The basis for the impartiality of the audit & objectivity of the audit conclusions – Independence & free from bias & conflict of interest
• Evidence-based Approach: The rational method for reaching reliable & reproducible audit conclusions in a systematic audit process – Verifiable & based on samples

The ISO19011 guideline then gives further information regarding the competency of an auditor and lead auditor (Adapted from Table 1, Page 27 of ISO19011).

A further checking tool is to look at the registered auditors on the SAATCA (South African Auditing and Training Certification Body) website http://www.saatca.co.za/To be registered as such an auditor a strict protocol is maintained which include the above ISO19011 criteria as well as the handing in of a comprehensive CV of the prospective auditors, the continual professional development you have done over the past year, sponsor reports and a report on your professional abilities. Then the SAATCA board sits and decides if they would allow you to be registered under their name. It is quite a process but well worth it. Remember: the easier it is to be accepted as an auditor at other institutions the more you need to ask yourself if this “status” will benefit you as an individual and what credibility this qualification will have in the market place?

Before you have an audit done on your site, verify the auditor status, competency and registrations against the SAATCA database to ensure you are getting a competent individual to audit your organization.

ISO19011 also identifies the systematic approach to be followed in the auditing process (Adapted from ISO19011, Page 10):
1. Initiating the audit
- appointing the audit team leader- defining audit objectives, scope and criteria- determining the feasibility of the audit- selecting the audit team- establishing initial contact with auditee
2. Conducting document review
- reviewing relevant management system documents, including records, and determining their adequacy with respect to audit criteria
3. Preparing for the on-site audit activities
- preparing the audit plan- Assigning work to the audit team- Preparing work documents
4. Conducting on-site audit activities
- conducting opening meeting- communication during the audit- roles and responsibilities of guides and observers- collecting and verifying information- generating audit findings- preparing audit conclusions- conducting closing meetings
5. Preparing, approving and distributing the audit report
- preparing the audit report- approving and distributing the audit report
6. Completing the audit
7. Conducting audit follow-up

Is this process followed by your auditors? If not you need to investigate why the audit is not done according to international guidelines.
Contact Christel Fouche
Management Systems