Auditing a Process that is Undocumented

Some quality auditors struggle when auditing processes that are not documented. Unfortunately for them, ISO 9001:2000 only requires a few documents:

  • Quality Policy, Quality Objectives, and Quality ManualDocument Control and Record Control ProceduresInternal Audit and Nonconformity Control Procedures
  • Corrective Action and Preventive Action Procedures

ISO 9001:2000 also states that organizations should include any other documents they need for the effective planning, operation, and control of their processes. However, if an organization thinks their employees can perform a process well based on their training, skills, and experience, they can choose to go without a procedure or instruction.

So, how do you audit processes if their requirements aren’t documented? Begin by talking to the process owners and ask them to describe their processes. In lieu of a procedure, you are basically documenting the process in your notes.

You can use a manager’s statement about the process as the audit criteria for evaluating evidence for conformity. Watch carefully the process being performed, and examine its records, to see if the process operation matches the stated requirements.

If there is a discrepancy, then the nonconformity can be written as shown below:

Requirement: The design manager stated drawings are appproved by the engineer.

Evidence: Drawing EG101 was approved by a draftsman instead of the engineer.

As auditors, our job is to assess conformity, evaluate effectiveness, and identify opportunities for improvement … not to establish the root cause and suggest corrective actions. Therefore, if an undocumented process is found to be nonconforming, we can’t recommend it be documented as the solution.

Also, be careful during interviews not to tell someone a documented process isn’t clear to you, and that it should be further documented. They would be within their rights to tell you it is perfectly clear to the employees trained on the job, and if they expand the document for you, it would just clutter it up for their employees.