[Section Coordination] Working Together to Improve the Effectiveness of Remote Audits

 

Good evening everyone. During the pandemic, everyone worked from home, conducted remote audits, and operated independently. Originally, we could meet every few days, audit together during work, sometimes watch movies together after audits, sometimes discuss certification topics, sometimes talk about major family matters, and sometimes share the joys and sorrows of raising children. Back then, we often complained about frequent business trips and long working hours.

 

Sometimes different teams could meet at the train station. Once, when going to Pingyin, several teams unexpectedly ran into each other at the same time, a lively group of more than ten people.

 

However, the pandemic arrived. After the outbreak at the end of 2019, IAF and the national certification bodies quickly responded to the national call to resume work and production as soon as possible after the pandemic, issuing a series of certification policies including remote audits to ensure the valid use of enterprise certificates. Unexpectedly, the pandemic dragged on endlessly, with Alpha and then Omicron variants emerging, becoming increasingly contagious. From initial localized prevention, it gradually spread, leading to a society-wide lockdown. Working from home became the norm, remote audits became the norm, and mutual longing became the norm.

 

Remote audits are hard to conduct! I really miss those days of on-site audits.

 

Next, I will discuss some characteristics and precautions of remote audits from several aspects:

 

1. Disadvantages of remote audits:

 

ISO, IAF, and their national certification bodies encourage remote audits as a method to reduce travel costs, decrease travel expenses, lessen the impact of harsh audit environments, reduce adverse weather effects, and make full use of network equipment. However, remote audits are not encouraged to be implemented as an independent audit method. In many certification standards, remote audits are considered a supplementary form of on-site audits, especially defining audit activities during the pandemic as "emergency events." For audits during the pandemic, certification bodies adopted remote audits and stipulated remedial measures after remote audits, including supplementary on-site audits.

 

Therefore, remote audits have their limitations, mainly reflected in the following points:

 

First, poor interaction effect. Remote audits increase the distance between people, making interpersonal communication dull. Thus, it is difficult to build trust. During on-site audits, eye contact, gestures, tone, and smiles sometimes convey more than words and text, sometimes achieving a silent understanding. But in remote audits, personal charisma cannot be fully displayed. Facing the video, smiles are ambiguous, expressions mechanical and stiff, tone harsh, making interaction difficult, seriously affecting communication effectiveness.

 

Second, poor network performance. Everyone working from home relies heavily on the network, causing congestion. During video sessions, situations like stunned faces, exaggerated gestures without sound, or sound without image occur frequently, greatly affecting people's mood and resulting in poor audit effectiveness.

 

Third, poor evidence collection. Sometimes the requested items are not understood by the other party. After requesting twenty records of implementation processes and auditing for two days, sometimes the first record is not clear to the other party. Sometimes, for a period after the audit, evidence is requested intermittently every day via WeChat, causing mutual impatience.

 

Fourth, unfair evidence collection. Evidence provided via WeChat or video cannot prove that the documents are from the audit day, nor can it prove that the activities took place at the enterprise's site, nor that the records are currently being implemented by the enterprise. Due to on-site evidence being obscured by the camera, it may cause evidence to be unreliable. If further investigated, it may lead to false certification.

 

Fifth, the audit process is severely shortened, missing certification procedures. The audit team holds a start and end meeting, takes screenshots, then takes screenshots with the parties involved, and asks the auditee or consultant to package and send them over. An audit that should take several days ends in just a few minutes. This kind of audit seriously omits audit procedures.

 

In summary, remote audits carry risks. If these risks are not addressed, accidents are likely to occur. Therefore, remote audits must be taken seriously.

 

2. Guiding documents for implementing remote audits. After careful collection, the current guiding certification documents include the following, which we will study together here:

 

(1) ISO19011:2018 Guidelines for auditing management systems

(2) IAF ID12 Principles of remote assessment

(3) CNAS Explanation on remote audit activities, No.: CNAS-EC-063:2021

(4) IAF: ISO 9001 Auditing Practices Group Guidance on: REMOTE AUDITS (2020-04-16, Edition 1)

ISO 9001 Auditing Practices Group Guidance: Remote Audits (April 16, 2020, Edition 1)

(5) IAF ID3:2011 Management of emergencies or situations affecting accreditation bodies, conformity assessment bodies, and certified organizations

(6) IAF MD5:2015 Mandatory document determining audit time for QMS and EMS

(7) IAF MD22:2018 Application of ISO/IEC17021-1 in occupational health and safety management system certification

(8) CNAS-CC105 Determining management system audit time (QMS, EMS, OHSMS)

(9) IAF MD4:2018 Mandatory document on information and communication technology (ICT); CNAS-CC14 2019 Application of ICT in audits, implemented 20190704

(10) T/CCAA 36—2020 Certification body remote audit guidelines

 

3. Remote audits cannot replace on-site audits, but given the current situation, they must be used as much as possible despite this limitation.

 

On May 5, the Standing Committee of the Political Bureau of the CPC Central Committee held a meeting emphasizing: always maintain a clear mind and unswervingly adhere to the general policy of "dynamic zero-COVID."

 

"Dynamic zero-COVID" has become the basic national policy of China. Currently, the pressure of dynamic zero-COVID is very high, which will inevitably lead to working from home becoming the norm for an uncertain and not short period in the future. Correspondingly, remote audits will also become the norm. Remote certification audits will no longer be emergency events, abnormal states, or unexpected situations, nor will they be a supplementary form of on-site certification audits, but rather the normal state of certification audits.

 

At this point, how to identify, judge, and evaluate the status, role, and both positive and negative impacts of remote audits under normal conditions, and how to identify the key factors of remote audits in the mission process of certification trust transfer under normal conditions, are the basic issues that must be considered first when conducting remote audits. Once recognized and unified in awareness, the subsequent implementation process can be smoothly and effectively carried out, aligning with the original intent of relevant laws, regulations, and industry standards. As the saying goes: "If one intends to do good, even if the good is not rewarded; if one unintentionally does evil, even if the evil is not punished."

 

Otherwise, if one standard is used here and another basis there, if you have one statement and I have another viewpoint, always treating remote audits as an emergency event, always treating remote audits as a supplementary method to on-site audits, temporarily handling it casually and perfunctorily, the consequences will seriously deviate from national policy, deviate from the mission of "certification trust transfer," and will inevitably ruin the future of certification.

 

4. How to improve the effectiveness of remote audits:

 

1. The biggest difference between remote audits and on-site audits is the effectiveness of audit evidence. To obtain good audit evidence, the audit evidence must be clarified. What is audit evidence? At the very least, it is legally recognized evidence. Searching relevant laws and regulations, the evidence stipulated by various laws and regulations is as follows:

 

Classification of evidence includes: original evidence and transmitted evidence, direct evidence and indirect evidence, verbal evidence and physical evidence, affirmative evidence and rebuttal evidence, etc. The following are the types of evidence related to China's three major procedural laws:

 

Civil Procedure Law:

Article 63 Evidence includes:

(1) Statements of the parties;

(2) Documentary evidence;

(3) Physical evidence;

(4) Audiovisual materials;

(5) Electronic data;

(6) Witness testimony;

(7) Appraisal opinions;

(8) Inspection records.

Criminal Procedure Law:

 

Article 48 Materials that can be used to prove the facts of a case are all evidence.

Evidence includes:

(1) Physical evidence;

(2) Documentary evidence;

(3) Witness testimony;

(4) Victim statements;

(5) Confessions and defenses of criminal suspects and defendants; (6) Appraisal opinions;

(6) Records of inspections, examinations, identifications, and investigative experiments;

(8) Audiovisual materials and electronic data.

Administrative Procedure Law:

 

Article 31

Evidence includes the following types:

(1) Documentary evidence;

(2) Physical evidence;

(3) Audiovisual materials;

(4) Witness testimony;

(5) Statements of the parties;

(6) Appraisal conclusions;

(7) Inspection records and on-site records.

 

The evidence sought during the audit process must be based on the above evidence to be most accurate. If remote audits cannot solve the above evidence collection issues, there is a problem with the remote audit. Different responsibilities lie with the certification body, audit scheme planners, audit team leaders, certification decision makers, and others.

 

2. Remote audits should pay attention to the following issues:

 

(1) Planning of the audit scheme:

When implementing CNAS-CC105 "Determining Management System Audit Time (QMS, EMS, OHSMS)," in addition to considering the given high, medium, and low risks, organizational scale, complexity, and other requirements, it is also necessary to consider that the conditions required for remote audits are broader and more complex, especially under limited non-verbal environments on-site. How to find more objective evidence? The author believes at least the following should be considered:

Region

Local epidemic situation

Impact of the epidemic on production and services

Local epidemic prevention policies

Local auditors' situation

Feasibility of semi-remote audits

Reasons for fully remote audits

Information and Communication Technology (ICT) (see CNAS-CC14 for details)

Composition of the auditee population for remote audits

Language

Customs and habits

Climate

Industry background

Composition and cooperation level of the population accepting remote audits

Logistics

Political background

Religious situation

Possibility of on-site audits for surveillance and recertification

。。。

Each client should have their own remote audit scheme, which should consider the entire certification cycle and grasp all risk points of remote audits from various perspectives.

 

(2) Appointment of the audit team:

The composition of the audit team should consider the remote capabilities of auditors, especially the remote audit capability of the audit team leader.

 

(3) Preparation of the audit plan:

The plan should be prepared based on a risk approach and consider:

The ICT methods used;

Remote and on-site auditor days;

Remote sampling and stratification techniques;

Risks to achieving audit objectives caused by the ineffectiveness of the audit plan in remote audits;

Risks to the auditee caused by remote audits;

Matters related to confidentiality and information security, etc.

 

(4) Implementation of the audit

The initial meeting should preferably be conducted via video conference;

During the audit, the audit team should establish timely and smooth internal communication channels;

Communication with the auditee should be strengthened;

Make full use of the advantages of ICT to obtain as much evidence and verify information from the system as possible;

The closing meeting should preferably be conducted via video conference, and audit conclusions and nonconformities should be saved in electronic document form;

The audit report is sent to the auditee via the company email;

Rectification of nonconformities is communicated and confirmed through electronic documents;

The entire process retains necessary remote audit evidence, including but not limited to audio, video, voice calls, photos, screenshots, interview and communication evidence, etc.

 

(5) Audit personnel should focus on the following during remote audits:

Videos or images must fully record evidence of communication with personnel, through which it must be confirmed whether the interviewees have the corresponding competence and awareness;

Videos or images must fully record evidence that all activities and monitoring results of the production/manufacturing process comply with specified requirements;

Videos or images must fully record evidence that product processes, especially key and special process controls, are effectively controlled;

Videos or images must fully record evidence that nonconforming products are effectively controlled and the effectiveness of corrective actions;

Videos or images must fully record equipment management and maintenance, especially the on-site operation of special equipment, monitoring, and measuring devices;

Videos or images must fully record emergency preparedness and response related emergency equipment, emergency exits, emergency signs, emergency medical supplies, etc.;

Remote audits bring many risks that require rules to avoid together. Raising awareness is more important than anything else. It is hoped that the effectiveness, completeness, and credibility of remote audits will be fully guaranteed through everyone's active efforts.

Auditor: Guo Miao