You could summarise the term audit trails by simply saying ‘areas of investigation’ but there is a little more to it than that. An actual definition can be difficult to find in ISO management system supporting documentation such as ISO 9000 Terms and Vocabulary and yet audit trails are essential in management system process audits.
We could look further at the individual definitions of audit and trail and arrive at something like
‘A systematic approach to collecting evidence based on specific samples, that the output of a series of inter-related processes meets expected outcomes.’
But what does this mean in practice? Although applied by some auditors, the use of an audit trail is by no means universally accepted. It is the failure to ensure all audits employ process audits following an audit trail that undermines their credibility. Auditors should understand the path of the process that they are auditing and perform the audit, accordingly, ensuring that the requirements of the process are being met. For example, as a matter of course auditors will visit the shop floor. This enables the auditor to see what is taking place and to identify the specific order numbers of jobs that are going through at that time. From this information it is easy to identify in the sales department the agreed specification for that product or service and select relevant samples to be chosen. This means the process can be checked to ensure that what takes place is controlled and will meet the required specification. From here, the audit trail is picked up and followed through. Using the audit of a purchasing activity as an example, you need to identify what material or equipment has been purchased for your sample order. It is always important to understand what drives the process. In this case, it is normally the requisition, which defines what is wanted. If the auditor does not understand the specification, then he or she cannot check if the process being followed meets the requirements of the requisition. Some checklist questions might include:
- What does the requisition require – does this comply with the agreed specification?
- How is the decision to purchase made?
- How is the specification decided?
- Is it adequate?
- Who decides what is required and do they have the authority?
- Who chooses the supplier and by what criteria?
- What is the process for bid evaluation?
- How is the specification advised to the supplier?
- Are national or international standards used?
- What controls the process?
- Are there any special packing delivery requirements?
Sampling
The starting point for the audit is to use the chosen samples and identify the process path and the controls that were applied. It is vital that the samples are linked and come from the same trail. Too frequently, audit samples are taken at different stages of the process and are not related or linked to the initial sample chosen, which means that an auditor is unable to verify that the process is working. He will only be able to check if that a document is filled in correctly. Procedures and forms, other documents or data, all ensure that a process is managed and controlled effectively. It is essential that auditors take the time to understand what is required from the process they are auditing. It is impossible for a second- or third-party auditor to carry out an audit of an organisation if the auditor does not take the time to understand the specification of its product or service, including statutory and regulatory requirements. It is this professional approach to auditing that allows the auditor to identify any weaknesses in the process and decide if an organization is capable of meeting the specified requirements. The audit trail approach applies to any audit be it an internal, second- or third-party audit.
To discuss audit trails or discover other elements of auditing management systems there are a number of routes available. It may be that you’re a certified organisation looking to refresh your audit practices or perhaps you’re an aspiring auditor looking to join one of our CQI IRCA approved training courses. Whatever the reason the best place to start is simply checking out our website or making contact with our team to find out which route is right for you.