Recommended Reading | Establishment and Application of Audit Data Packages for Quality Management Systems Based on Information Technology

　　With the continuous development and maturity of information and communication technology, remote auditing under informatization conditions has become the development direction for various certification bodies to conduct audit evaluations. While remote auditing brings convenience and efficiency to the audit process, it also raises higher requirements for the enterprise system's operational capabilities. The standardization, normalization, accuracy, and matching of audit data have increasingly become core issues in implementing remote audits. This article analyzes the changes in audit models and comprehensively applies information technology, network service technology, and audio (video) communication technology to propose the establishment method of quality management system audit data packages for achieving cross-regional and cross-industry audits or internal supervision via the Internet, ensuring the effective operation and continuous improvement of the quality management system.

　　To carry out remote audits, the first requirement is to obtain audit data, mainly relying on remote audit platforms built with modern information technology, network technology, and communication technology for real-time data transmission or sharing. Therefore, establishing a unified standard set of indicators related to data package transmission reliability, stability, data types, and data formats to meet the data requirements generated by different enterprises and products is a fundamental condition. The core of audit evidence is the data content. Enterprises generate a large amount of data records during product realization. There must be clear requirements on which records form the quality management system audit data package to ensure that the data packages collected, organized, and formed during product realization are associated with audit requirements and that the data content matches the audit process.

　　1. The Relationship Between Quality Management System Audits and Data Packages

　　(1) The Connotation of Data Packages

　　Quality management system audit data packages (hereinafter referred to as "data packages") refer to a series of work requirements related to the quality management system formed during product operation, and a collection of objective records of related operational information. They provide objective evidence for evaluating the enterprise's quality management system and are used for quality management system audits (internal and external audits) and corresponding quality certification work. This standardizes and strengthens the management of information related to quality management system audits, ensures the integrity and traceability of audit information, and promotes the overall quality level improvement during enterprise operation.

　　(2) Main Content of Quality Management System Audits

　　The main content of quality management system audits includes two parts: the enterprise's common clause processes and the product realization operation clause processes. The main department—the common clause processes—includes: organizational environment confirmation process, leadership role confirmation process, organizational quality management system planning process, organizational support confirmation process, organizational performance evaluation process, and improvement process; the product realization operation clause processes include: design and development process, testing process, technical status management process, procurement process, outsourcing process, production process, inspection process, and quality issue handling process.

　　(3) Audit Requirements for Product Realization Operation Processes

　　This article uses the product realization operation process as an example to explain the related audit requirements:

　　The design and development process audit content mainly includes inspection requirements and methods for design and development planning, inputs, outputs, control, changes, and new product trials;

　　The testing process audit content mainly targets large-scale tests, including inspection requirements and methods for quality planning, preparation, implementation, summary, and improvement of the testing process;

　　The technical status management process audit content mainly includes technical status management plans, identification, control documentation audits, and inspection requirements and methods for process technical status management;

　　The procurement process audit content mainly includes the selection of new suppliers, supplier evaluation, qualified supplier lists, supplier management inspection requirements and methods, as well as inspection requirements and methods for procurement information, acceptance of procured products, screening and re-inspection of newly designed and developed procured products, storage control of procured products, management of nonconforming procured products, and quality issue handling;

　　The outsourcing process audit content mainly includes the selection of new outsourcing suppliers, supplier evaluation, qualified outsourcing supplier lists, outsourcing information, outsourcing process management, acceptance of outsourced products, storage of outsourced products, management of nonconforming outsourced products, and quality issue handling inspection and testing;

　　The production process audit content mainly includes process planning, feasibility demonstration, overall process scheme, process breakthroughs/inspection methods, process optimization, design document process review, process document preparation, process review, process changes, process document deviations, temporary process documents inspection requirements and methods, as well as confirmation of process-led production and service provision processes, key process technical work, computer software control used in production and service, first article inspection, process finalization and production finalization, process equipment design verification and calibration, process discipline inspection requirements and methods. Inspection content also includes production planning, pre-production preparation status checks, human-machine-material-method-environment measurement control, prevention of human errors, process inspection identification and traceability, product protection, control of nonconforming products during production, customer or external supplier property control, and commissioning delivery inspection requirements and methods;

　　The inspection process audit content mainly includes inspection responsibility authorization, inspection resource allocation, inspection documents, inspection technology and measuring devices, inspection of procured products, inspection of outsourced products, inspection of customer-provided products, production process inspection, final product inspection, submission for acceptance representative inspection, product packaging inspection, inspection of surplus materials and supervision of non-destructive testing, re-inspection, inspection record control, inspection seal management, and nonconforming product control inspection requirements and methods;

　　The quality issue handling process audit content mainly includes the formulation of quality issue handling regulations, general quality issue handling, technical reset, management reset, FRACAS system, handling of quality issues involving products, and quality information handling inspection requirements and methods.

　　2. Data Scope of Quality Management System Audit Product Data Packages

　　(1) Product Data Package Content

　　The product data package content mainly includes: product design documents, process documents, debugging test and inspection documents, test verification documents; product assurance documents, quality improvement and comprehensive management documents; product design, production, and test process quality control records, especially records of key control points and inspection points; product test outlines and reports (including key technical breakthroughs, environmental tests, reliability tests, etc.); occurrences of quality issues and quality improvement situations; records related to product technical status deviations and changes; documents and materials related to product use and maintenance, etc., see Table 1 (partial examples).

　　(2) Requirements for Product Data Package Content

　　The document categories involved in product data packages mainly include three types of data package documents: records, files, and lists.

　　1. Record-type Data Packages

　　For key (important) processes, new processes, new materials, new equipment, new environments, etc., quality records should be formed, especially for those with quantitative requirements where actual measured data must be filled in; for key (mandatory) inspection points, key (important) processes, and products that cannot be inspected, cannot be confirmed by re-inspection, or have surplus material control requirements, multimedia records must be retained. These records should truthfully, completely, and clearly reflect the actual product status. Specific requirements for shooting timing, location, resolution, etc., should be clearly defined in design, process, and inspection documents; multimedia records should include the overall product and each assembly (component) and mode. Multimedia records should clearly identify product name, code, number, shooting date, part, and other information; multimedia data files should be archived promptly according to regulations after generation; multimedia information should be archived centrally by the same product and batch.

　　2. File-type Data Packages

　　Written completely according to the prescribed document template, with clear and accurate information; the content of the product data package in document format should comply with relevant regulations, norms, and standards, and the description should be detailed and clear.

　　3. List-type data package

　　Each item in the product data package document list should be filled out completely and accurately, with traceability. Items that are not involved or not included should be marked with "/".

　　(3) Product Data Package Delivery and Receipt Requirements

　　The product data package is based on the model product hierarchy and composition, using combined products with product codes as the basic unit. Each set of physical products corresponds to the delivery of one set of product data packages, including product overview, data package document list, delivery checklist/record type statistical table, delivery document type statistical table, delivery checklist/record, and delivery documents. Before product delivery, each unit should inspect and confirm the data package, and complete rectification for any non-compliance. Submit the data package for acceptance as required; after acceptance, the data package is delivered with the product. Quality and reliability information generated during product zeroing and repair after delivery should be supplemented into the product data package. The receiving unit should archive the received data package according to the archiving management requirements of the model product documents for future reference.

　　3. Application of Audit Data Packages

　　(1) Application of Data Packages in Remote Audits

　　The application of audit data packages can serve not only as an effective means for organizations to conduct internal audits themselves but also as a tool for certification bodies to review and access the organization's quality management system audit data packages using information technology, network services, and audio (video) communication technology when on-site audits cannot be conducted, thereby achieving audit objectives.

　　Of course, different organizations with different structures and product/service scopes require different data packages to be completed. Auditors should not require different organizations to provide audit data packages in the same format but should plan different data package collection modes based on organizational characteristics.

　　(2) Example of Application of Supervision Audit Data Packages

　　The following uses the annual supervision audit organized by the certification center as an example to illustrate the application scenarios of quality audit data packages.

　　The purpose of quality supervision audits is to identify key focus processes based on major risks, prominent issues, common problems, or significant quality issues during the operation of research, batch production, subcontracting, and purchased model products. Inspections are conducted according to the corresponding process supervision audit implementation requirements, with targeted analysis of weak points exposed in the operation of the quality management system. This approach uses specific points to influence the overall system, improving the effectiveness of the quality management system and providing better assurance for product quality. Taking the main product design and development control of R&D enterprises (GJB 9001C standard clause 8.3.4) as an example, the audit content requirements and corresponding data packages in the enterprise quality management system audit process are clarified, as shown in Table 2.

　　In the "Design and Development Control" process, the data package includes a list of planning output documents, review plans, review team member sign-in sheets, issue summary lists, issue handling records, review conclusions and tracking management of review issues, test verification planning documents, general quality characteristic verification reports, evidence of implementation of measures for identified issues, full sets of documentation for finalization (identification) planning, implementation, and completion, records of implementation of measures for identified issues, etc. Inspection content and related evidence can be found by reviewing documents. Similarly, the audit team can find all compliant content in different data packages of a product and also judge the coordination among various documents. Providing files (electronic versions) according to the data package directory can reduce interaction time and save online resources.

　　Of course, in such remote audit planning, the plan preparation should not only clarify the departments, processes, requirements, and remote methods (video, recording, meetings) as in traditional ways but also specify the communication targets for the process. For example, in the product design and development process, communication should include direct designers, not just department heads.

　　Conclusion

　　Quality management system audit data packages can provide convenience and efficiency not only in remote audits but also in on-site audits. They facilitate the audit team's review of documents and records. Moreover, once data package files are stored, any modifications or changes will leave traces, which can further enhance the authenticity of audit evidence and provide strong support for making effective evaluation conclusions of the quality management system.