Findings relating to the CBs perception, interpretation and application of the ISO 19011 standard
| Themes | Factors | Findings from the CBs interviews |
|---|---|---|
| Principles of auditing | Integrity | Some CBs are becoming inconsistent in terms of moral character, honesty and truthfulness. They succumb to the influences of the auditees to issue certification in exchange for business opportunities. Inducements are offered to the CBs and the auditors in exchange for certification |
| Having a relationship with the auditee exonerates unethical practices, making it acceptable to issue certification even if the management system does not conform to the requirements | ||
| Unaccredited, incompetent CBs prey on gullible organisations, offering certification at low cost, thereby luring organisations to contract them | ||
| A focus on profit margins causes the CBs to accept more work with inadequate capacity at the expense of quality | ||
| Fair presentation | The auditors have two different personalities: the one for which they are ordinarily known, and the other for auditing | |
| The auditors cannot handle what the ISO 19011 standard requires, so they assume a hostile auditing personality | ||
| The audit tools are used to hide and overcome the lack of interpersonal skills | ||
| The auditors’ different interpretations of the standards cause unresolved diverging opinions between them and the CBs | ||
| Due professional care | Personality and interpersonal skills are not as comprehensively addressed in the ISO 19011 standard compared to the technical requirements | |
| The lack of interpersonal skills prevents the auditors from engaging the auditees and interrogating the management system in fear of being challenged by the auditees. They intimidate the auditees, and do not afford them opportunities for interaction or debate | ||
| Confidentiality | Even though the CBs commit to non-disclosure, the auditees remain reluctant to submit their organisational documentation to them | |
| Independence | Despite commitment to impartiality, not all the CBs and auditors are independent of the management system they audit. Close relationships with the auditees are in some cases not perceived as a threat to the audit independence. Moreover, helping the auditees with both implementing and auditing the system is not always perceived as a conflict of interest | |
| Evidence-based approach | Observations and works, rather than training certificates, are regarded as evidence demonstrating competence | |
| Risk-based approach | The CBs are prepared for responding to potential audit programme risks | |
| Managing an audit programme | Managing an audit programme | The audit programmes are managed according to the ISO 19011 standard and the requirements of the International Accreditation Forum |
| Roles and responsibilities of the person managing the programme | The CBs are the owners of the certification bodies, programme managers and lead auditors | |
| Competence of the person managing the programme | The CBs have extensive experience to conduct third-party quality audits and to manage the audit programme | |
| Technical knowledge is not necessarily relevant when auditing ISO 9001 management systems as the focus should be on the management of a quality system, the mechanisms used and the processes; not on what the business is about | ||
| Establishing the extent of the audit programme | While onsite reviews are performed to physically verify the accuracy of the information initially supplied by the auditees, familiarity with the various organisations sometimes is used to exempt the CBs from performing onsite reviews of those auditees’ processes; furthermore, only the implementation of the ISO 9001 framework is verified | |
| The extent of the audit programme is sometimes established before the stage one audit | ||
| Identifying and evaluating audit programme risks | The CBs are prepared for responding to potential audit programme risks | |
| Establishing procedures for the audit programme | Procedures for the audit programme are established based on the ISO 19011 and ISO 17021 standards | |
| Identifying audit programme resources | Many auditors have no management experience, knowledge or skills | |
| There is a shortage of auditors in senior professional positions because they are not paid well | ||
| South Africa seems not to have auditors of the same high-quality standard as certain countries overseas, which have doctoral engineers and scientists working for the CBs on a full-time basis | ||
| Competence criteria do not include personality, interpersonal skills or self-confidence | ||
| Defining the objectives for an individual audit | The audit objectives are defined and achieved irrespective of how activities are planned | |
| Defining the scope for an individual audit | The auditees often disagree with the predefined plans on the day of the audit despite prior acceptance, thus affecting the audit scope | |
| The stage one audit is usually used to collect information to define the audit scope | ||
| Defining the criteria for an individual audit | The audit criteria are defined using information obtained from the auditees and are sometimes limited to tools such as checklists containing only the ISO 9001 system requirements and no technical questions | |
| The auditors seem to be prescriptive and do not audit according to the set criteria, but have their own requirements, not based on the standard | ||
| Technical/process-related questions are often avoided and not considered to form an essential part of the audit criteria | ||
| Selecting the audit methods | The remote auditing method is not popular and seldom used | |
| Some auditors might use checklists to hide their incompetence | ||
| While implementation of procedures is reviewed, outcome verification and correctness checks are not always performed | ||
| Selecting the audit team members | Problems with the audit teams are often due to a lack of competence and not necessarily due to the selection process | |
| The CBs subcontract auditors to supplement inadequacies in the competence requirements | ||
| Many auditors are not of age, not registered professionals, do not have management skills, or experience, and hold no senior positions at their full-time employment | ||
| The CBs are under pressure to fulfil the needs of the customers which leads to signing auditors off and engaging them to audit without their having the necessary competence | ||
| Unlike the technical skills, people’s personalities and interpersonal skills are not given enough attention when selecting auditors | ||
| Assigning responsibility for an individual audit to the audit team leader | The CBs are also lead auditors and share certain audit responsibilities with the other lead auditors | |
| Managing the audit programme outcome | The CBs are responsible for both the audit results and approval of the audit reports | |
| Managing and maintaining the audit programme records | The audit records and documents exchanged with the auditees are managed as contractual documents | |
| Monitoring the audit programme | The ISO 19011 standard is generic and gives no guidance on how to monitor implementation and evaluation of conformity; hence the CBs compile their own procedures aligned with ISO 17021 standard | |
| The interpersonal skills are difficult to measure formally as the evaluations are not defined; but only proof of competence from a qualification and work-related experience | ||
| Reviewing and improving the audit programme | The review and achievement of objectives is demonstrated by different measures which include customer satisfaction, yearly evaluations, witnessing of audits and issuing of certification to the auditees |
| Themes | Factors | Findings from the CBs interviews |
|---|---|---|
| Principles of auditing | Integrity | Some CBs are becoming inconsistent in terms of moral character, honesty and truthfulness. They succumb to the influences of the auditees to issue certification in exchange for business opportunities. Inducements are offered to the CBs and the auditors in exchange for certification |
| Having a relationship with the auditee exonerates unethical practices, making it acceptable to issue certification even if the management system does not conform to the requirements | ||
| Unaccredited, incompetent CBs prey on gullible organisations, offering certification at low cost, thereby luring organisations to contract them | ||
| A focus on profit margins causes the CBs to accept more work with inadequate capacity at the expense of quality | ||
| Fair presentation | The auditors have two different personalities: the one for which they are ordinarily known, and the other for auditing | |
| The auditors cannot handle what the ISO 19011 standard requires, so they assume a hostile auditing personality | ||
| The audit tools are used to hide and overcome the lack of interpersonal skills | ||
| The auditors’ different interpretations of the standards cause unresolved diverging opinions between them and the CBs | ||
| Due professional care | Personality and interpersonal skills are not as comprehensively addressed in the ISO 19011 standard compared to the technical requirements | |
| The lack of interpersonal skills prevents the auditors from engaging the auditees and interrogating the management system in fear of being challenged by the auditees. They intimidate the auditees, and do not afford them opportunities for interaction or debate | ||
| Confidentiality | Even though the CBs commit to non-disclosure, the auditees remain reluctant to submit their organisational documentation to them | |
| Independence | Despite commitment to impartiality, not all the CBs and auditors are independent of the management system they audit. Close relationships with the auditees are in some cases not perceived as a threat to the audit independence. Moreover, helping the auditees with both implementing and auditing the system is not always perceived as a conflict of interest | |
| Evidence-based approach | Observations and works, rather than training certificates, are regarded as evidence demonstrating competence | |
| Risk-based approach | The CBs are prepared for responding to potential audit programme risks | |
| Managing an audit programme | Managing an audit programme | The audit programmes are managed according to the ISO 19011 standard and the requirements of the International Accreditation Forum |
| Roles and responsibilities of the person managing the programme | The CBs are the owners of the certification bodies, programme managers and lead auditors | |
| Competence of the person managing the programme | The CBs have extensive experience to conduct third-party quality audits and to manage the audit programme | |
| Technical knowledge is not necessarily relevant when auditing ISO 9001 management systems as the focus should be on the management of a quality system, the mechanisms used and the processes; not on what the business is about | ||
| Establishing the extent of the audit programme | While onsite reviews are performed to physically verify the accuracy of the information initially supplied by the auditees, familiarity with the various organisations sometimes is used to exempt the CBs from performing onsite reviews of those auditees’ processes; furthermore, only the implementation of the ISO 9001 framework is verified | |
| The extent of the audit programme is sometimes established before the stage one audit | ||
| Identifying and evaluating audit programme risks | The CBs are prepared for responding to potential audit programme risks | |
| Establishing procedures for the audit programme | Procedures for the audit programme are established based on the ISO 19011 and ISO 17021 standards | |
| Identifying audit programme resources | Many auditors have no management experience, knowledge or skills | |
| There is a shortage of auditors in senior professional positions because they are not paid well | ||
| South Africa seems not to have auditors of the same high-quality standard as certain countries overseas, which have doctoral engineers and scientists working for the CBs on a full-time basis | ||
| Competence criteria do not include personality, interpersonal skills or self-confidence | ||
| Defining the objectives for an individual audit | The audit objectives are defined and achieved irrespective of how activities are planned | |
| Defining the scope for an individual audit | The auditees often disagree with the predefined plans on the day of the audit despite prior acceptance, thus affecting the audit scope | |
| The stage one audit is usually used to collect information to define the audit scope | ||
| Defining the criteria for an individual audit | The audit criteria are defined using information obtained from the auditees and are sometimes limited to tools such as checklists containing only the ISO 9001 system requirements and no technical questions | |
| The auditors seem to be prescriptive and do not audit according to the set criteria, but have their own requirements, not based on the standard | ||
| Technical/process-related questions are often avoided and not considered to form an essential part of the audit criteria | ||
| Selecting the audit methods | The remote auditing method is not popular and seldom used | |
| Some auditors might use checklists to hide their incompetence | ||
| While implementation of procedures is reviewed, outcome verification and correctness checks are not always performed | ||
| Selecting the audit team members | Problems with the audit teams are often due to a lack of competence and not necessarily due to the selection process | |
| The CBs subcontract auditors to supplement inadequacies in the competence requirements | ||
| Many auditors are not of age, not registered professionals, do not have management skills, or experience, and hold no senior positions at their full-time employment | ||
| The CBs are under pressure to fulfil the needs of the customers which leads to signing auditors off and engaging them to audit without their having the necessary competence | ||
| Unlike the technical skills, people’s personalities and interpersonal skills are not given enough attention when selecting auditors | ||
| Assigning responsibility for an individual audit to the audit team leader | The CBs are also lead auditors and share certain audit responsibilities with the other lead auditors | |
| Managing the audit programme outcome | The CBs are responsible for both the audit results and approval of the audit reports | |
| Managing and maintaining the audit programme records | The audit records and documents exchanged with the auditees are managed as contractual documents | |
| Monitoring the audit programme | The ISO 19011 standard is generic and gives no guidance on how to monitor implementation and evaluation of conformity; hence the CBs compile their own procedures aligned with ISO 17021 standard | |
| The interpersonal skills are difficult to measure formally as the evaluations are not defined; but only proof of competence from a qualification and work-related experience | ||
| Reviewing and improving the audit programme | The review and achievement of objectives is demonstrated by different measures which include customer satisfaction, yearly evaluations, witnessing of audits and issuing of certification to the auditees |
Source(s): Author’s own creation
Sharing content requires targeting cookies to be enabled. Please update your cookie preferences to use this feature.