An audit program is a key component for monitoring the external supply chain, the management of which is an enterprise within an enterprise. Many of the program requirements for internal and external audits are the same. But external audits are different due to the customer-supplier relationship.
Audit program managers must interface with procurement departments to ensure contracts contain access clauses and to schedule audits or other oversight services of the global supply chain. Oversight may be needed for first, second and perhaps third-tier suppliers depending on organization objectives, customer requirements and risk.
The external audit program most likely will be involved with the procurement, performance management and risk management aspects of the supply chain.
In many cases, the procurement department is the client that needs the services of an audit program. Procurement personnel are sometimes called procurement specialists, buyers, purchasing agents, purchasing managers and purchasing supervisors. Depending on its needs, the auditing organization may employ procurement and auditing personnel with international experience.
Creating and implementing performance metrics, such as key performance indicators.
Monitoring and reporting trends in the supplier and contract base that could affect supply.
Verifying special programs as needed, such as vendor projects, changes, buy-resale and private label.
Usually, audit program managers and auditors are not involved in establishing supplier requirements but are likely to be involved in their oversight.
Requirements may be technical, logistical, administrative, legal or related to supplier processes. Technical requirements typically come from the process designer or owner; quality department; or technical, procurement or legal department.
Examples of technical requirements include physical characteristics, such as weight or dimensions; chemical composition; physical properties, such as hardness, smoothness and finish; and performance results.
Examples of logistical requirements include identification, such as barcode, name, serial number and color code; packaging, such as padding, box, pallet and spacing; instructions; packing lists; special storage conditions listed on packages; and storage service requirements.
Examples of administrative and legal requirements include hazardous response instructions and markings, first-aid instructions, purchase order or contract number, and disaster recovery plans, such as those for natural disasters, cyber attacks and material outages.
Examples of supplier process requirements include process variation monitoring, certificates of compliance, first-article inspection or other test requirements, and ISO 9001 plus or minus requirements.
Movement of goods and services includes modes of travel, such as train, air, roadway and sea; distribution and storage services; storage conditions; technical services; expedited services; and controlling storage costs and expenses, such as detention and demurrage fines.
Supply chains can stretch across the globe and thus can vary widely. In all cases, however, deadlines must be met and customers satisfied. Language and cultural barriers must be overcome because effective communication is an important factor for success. E-audits are an increasingly viable option and becoming an important audit program strategy to ensure proper oversight and control of risks.
The purpose of the program should be to ensure customer requirements are being met, and to prevent external product failures and nonconformities. An effective risk management program will reduce the chances of undesirable and harmful consequences to the organization.
Reduced probability of delivering nonconforming products and services.
Increased probability of achieving organizational objectives.
Reduced probability of delivering product or services behind schedule.
Increased probability of compliance to quality, environmental and safety regulations, plus the avoidance of undesirable consequences.
During any visit or interface with a supplier, an auditor has a duty to report any potentially significant risks to the audit program manager and the client. Depending on the risk and criticality of the product or service, supplier monitoring may include many activities. Monitoring and reporting needs will continue to change due to organizational needs, changes and relationships with suppliers.
Ongoing inspection (100% inspection, acceptance and skip lot inspection).
In many cases, suppliers are asked to conform to a management system standard, such as ISO 9001. If a supplier is asked to comply with that, plus specific additional requirements found in another standard—such as ISO 13485 (medical devices) or ISO/TS 16949 (automotive)—it may be called an ISO 9001-plus audit. Audits of small supplier organizations that are asked to implement only certain parts of a management standard such as ISO 9001 might be called ISO 9001-minus audits.
Audit results are one input to maintaining an effective supplier relationship. The results may be the basis for increasing or decreasing oversight of the supplier organization. Some organizations have supplier levels that affect not only oversight, but also the share of the business, and have monetary consequences. The higher the supplier level, the less oversight needed.
This article was excerpted from chapter 16 of The ASQ Auditing Handbook, fourth edition, edited by J.P. Russell. It’s available in the Quality Press Bookstore at http://asq.org/quality-press/display-item/index.html?item=H1435 (case sensitive).
J.P. Russell is the founder and managing director of QualityWBT Center for Education. He also is an ASQ fellow, ASQ-certified quality auditor, voting member of the American National Standards Institute/ASQ Z1 committee and member of the U.S. technical advisory group for International Organization for Standardization technical committee 176. Russell is a recipient of the Paul Gauthier Award from the ASQ Audit Division.