Internal Audits - Part 1 of 2

Introduction

I have been blogging about SPC (statistical Process Control), which is a great way to accumulate data on your process.  Another method of data collection is auditing.  Auditing will tell you much more than just numerical information and will bring a more visible presence of the programs to the employees.  As part of a GFSI (Global Food Safety Initiative) program - you will find the relevant sections under 2.5.7 in SQF edition 7 and section 3.4 in BRC edition 6.

What needs to be audited

In short - all activities that are being done on the production floor need to be audited.  Specifically mentioned in the BRC and SQF codes are all prerequisite programs, HAACP program, programs in place to maintain/achieve standards (example - maintenance program and warehousing program), food quality program (SQF level 3), and all government regulatory requirements.  In the two codes, only BRC states that hygiene, equipment, and building audits must be at least once per month.  All other audits are at least annually or based on risk analysis.  Please note, the higher the risk to product safety, the higher the frequency of audits. Personally, I typically see hygiene audits once per shift.  Of course the frequency of audits will be higher when a new or improved program is begun and the frequency should decrease as people understand what is required from the program (less non-conformances).

Non-Conformances

An interesting notion on non-conformances is, if the auditor can correct the non-conformance during the audit, then it is a responsibility of the auditor to make the correction.  All corrections and non-conformances need to be written and actioned.  Actioning a non-conformance means that a corrective action is created with a timeline for completion.  Without the completion timeline, I find the correction gets placed in the "I will do this tomorrow" box and tomorrow is always tomorrow never today.  If the non-conformance has a potential risk to food safety it may need to be communicated to upper management.  This communication is to ensure that other company managers know that the non-conformance needs to be corrected and if funds or external help is required - then the appropriate help and funds are made available.

Summary

All audits will need to be placed on an audit schedule with the who, what, where, and when items defined.  Who, keeps this schedule?  The lead auditor keeps the schedule - usually the QA Manager.  This lead auditor will also need to keep upper management informed about non-conformances and corrective actions.  A great way to summarize the information is by construction of a Pareto diagram (see statistics blog part 2).  Also to chart the information as a KPI (Key Process Indicator) where the number of non-conformances or overall audit scores are mapped monthly.  An overall score would need the development of a numerical system on each audit form to make it possible to create a KPI around the audit.

Part 2 will look at what elements are being looked at and what makes a good auditor.  I will also look at the various audit areas and what should be "in" the audit.