Global Community

Auditor using risk-based approach focuses on “the processes which have the greatest impact on enhancing customer satisfaction and producing expected results, while considering past problems and trends.”
The reason why Auditor should use the risk approach stated that “it is not feasible to audit every single document, record, and activity”

Considering that :
I may not be able to depend on management’s statement or provided data,
Organization rapid changes, management’s dishonesty, or well-concealed fraud, can escape risk-based focus if not considered.

Inadequate risk based audit procedure or documentation, undoubtedly makes risk -based audit ineffective.

Experienced auditors or master auditors, please talk to me! I am a new auditor but I have some crazy thoughts stirring up.

I am also fairly new to the auditing situation also but some practice in it. You need to remember that you are looking at a sample in a sea of information. Using risk correctly can help in looking where you need to look. If KPIs are down in one area spend more time digging in for examples. If on time delivery is off review shipping and production. 

You can only review the information as presented. If they purposely try to show you certain items only, that is a red flag for reviewing system and ask for more examples. Typically, found they only prepare 2-3 but during our last audit he jumped up to 5-10 samples which opens up more to review.

Also, as you gain experience or work with a company, you start to see things that are a risk to you. Auditor eye is what I call it. Items show before even asking a question.

------------------------------
Jason Clauser
------------------------------

Godly, your instinct is sound, and the honest answer is that risk based auditing was never built to give total assurance. An audit is a sample and a snapshot in time, so no method, however good, will reliably catch deliberate and well concealed fraud. What the risk approach really buys you is direction, sending your limited hours to where a failure would hurt the outcome most rather than spreading them thin across everything.

The guard against the dishonesty you are worried about is not the procedure, it is professional skepticism. Do not take a statement or a dataset at face value, corroborate it against something independent, and follow the inconsistencies rather than the tidy story. And when a system genuinely cannot give you confidence, that itself is a finding worth raising. You are asking the right questions this early, so keep that discomfort, it is what makes a real auditor.

------------------------------
Dilawar Laghari
------------------------------

Godly,

The two previous responses are spot on!  

I worked as a Quality Engineer for years.  Once I was introduced to the 6-Sigma philosophy of "Splitting the Dictionary", root causing on the fly took less time.  I use this as an analogy for auditing to answer your question.

The information you have is what you have.  Do not spend time auditing the "GOOD".  Audit the questionable.  Oftentimes, auditing the questionable areas lead you to audit trail(s) that may very well spill over into the supposed "GOOD" areas, as reported by the body being audited.  Jason used the example of KPI's in his response.  He is exactly correct, and oftentimes you unearth even more.

I approach auditing as team member tasked with adding value to the organisation I am auditing.  This value comes in the form of verification, identification, OFI's, Non-Conformances and Communication of your findings back to the team,  Your reporting should potentially make the organization better, if findings are acted upon.

This is our job as professional ISO Auditors, in my humble opinion.  BK

------------------------------
Billie King
Supplier Quality Engineer
Hussmann Corp.
------------------------------

Three deep, accurate insights into audit. I just learned a lot from you guys and this is what this community is all about!

My point is at the core of an audit, both the auditors and the auditee are expected to be truthful and provide accurate information (auditors should report findings fairly and with evidence; auditees should provide relevant information honestly).

Good audit requires honesty.

Thank you for sharing.

---------------------------------
Godly Yao
---------------------------------