So what’s the difference between a system and process audit?

A system audit is conducted to ensure the management system meets the requirements of the relevant ISO standard.  It is usually completed using a checklist that list the standard requirements and identifies the elements of the business’ management system that meets the ISO Standard.  Considering that the standards or business’ management system framework probably doesn’t change often, the business should consider how often they need to conduct such an audit – maybe a triennial audit, in preparation for your recertification audit or with a change in the standard.

A process audit is about checking the “processes” that the business has determine to be necessary to implement the management system and ensure they are performing and producing in accordance with desired outcomes.  These audits allow the business to also challenge “what is done” in the name of the management system and determine relevance and accuracy against what is “being done” in operations.  These audits should take the auditor to the pointy end of the business to ensure the management system supports the business outcomes.  The audits may analyse the linkages between processes to ensure cohesion of the management system and may consider

Audit Programme

The business needs to establish an audit programme (schedule) that details

+ Methods – how the audit will be conducted – desktop, during work hours

+ Resources – Audit tools

+ Frequency – how often the specific audit will be conducted – monthly, quarterly etc – risk based – which processes are more critical?

Conducting the audit

An auditor should be selected who has

+ The required skills and knowledge to conduct the audit

+ Independence from the process being audited to ensure objectivity and impartiality (you shouldn’t be auditing your own work)

+ Responsibility – who will conduct and partake in the audit

Audit close out

Following the completion of ISO internal audits, the final 2 steps need to be completed

+ Ensure that the results of the audit are reported to relevant management

+ Take appropriate corrective actions as required

For any questions about ISO internal audits get in touch with the Astute Business Certification team here.

The post Internal Auditing appeared first on Astute Business Certification.

So where do you start?  The objectives need to “add value” to the business providing strategic activities and good data and not become a task requirement of the system.  So, to start, the objectives need to be consistent with your policy such as

• Quality – supporting the business’ strategic direction and continuous improvement
• Health and Safety – prevention of work-related injury and ill health, fulfilling legal requirements, risk mitigation, continual improvement and
• Environmental – protection or the environment and prevention of pollution.

Example could include

• Quality – increase in customers, increase spend by customers, decrease in defects
• Health and Safety – focus on high-risk activities, consultative activities, critical analysis of incidents
• Environmental – focus on significant impacts, waste management, energy consumption

Once we have a direction, we can start applying structure around the objective, let’s look at quality and increase spend by customers

• Is the objective measurable – lets aim for and increased spend of 20%
• What the business will do – marketing campaign, direct customer contact, promotion of other services
• How the business will monitor the progress – monthly financials, campaign reviews
• How the objective will be communicated to key personnel – Kick-off and progress meeting, dashboards

Now we have the structure, lets allocate

• Specifics of the objectives
• Resources required
• Personnel
• Time frames
• Evaluation processes including data indicators

Remember the business will also need a process to review the objectives and, if necessary, reviewed with information on how the business is achieving their system objectives an input to the management review process.

For any questions about ISO Management System Objectives please get in touch with the Astute Business Certification team here.

The post ISO Management System Objectives appeared first on Astute Business Certification.

If you have any questions please feel free to get in touch with the Astute Business Certification team here.

The post Management Review appeared first on Astute Business Certification.

As the new ISO standards emerged since 2015, Context of the organisation is a new requirement that the business needs to consider in establishing the direction of the management system. The standard leads to 2 aspects that need to be considered and these aspects are mapped throughout the other clauses

• – Understanding the organisation and its context

• – Understanding the needs and expectations of interested parties

Understanding the organisation and its context

This requires the company to determine external and internal issues that are relevant to its purpose and its strategic direction and that affect its ability to achieve the intended results of the management system.

To determine external context, you should consider issues arising from its social, technological, environmental, ethical, political, legal, and economic environment. Examples of external context may include

• – Change in legislation
• – Economic shifts in the market
• – Competition
• – Corporate image
• – Technology

Internal context is the environment in which the company aims to achieve its objectives and may include

• – Governance
• – Organisational structures, roles and responsibilities
• – Contractual relationships with customers and external parties.
• – Objectives, policies and strategies
• – Resource capabilities and knowledge

The context can include positive and negative factors or conditions to consider and may be detailed through varied methods such as SWOT (strengths, weaknesses, opportunities and threats) and PEST (political, economic, social and technological) analysis tools. This process needs to be completed with management and may form part of a business / strategic plan.

Understanding the needs and expectations of interested parties

Next the company needs to identify relevant interested parties, internal and external stakeholders who impact or could potentially impact the company. Ask the question, “if it goes wrong, who will be asking questions?” Once interested parties are identified, the company needs to determine each stakeholders needs and expectations – what do they want? Examples could include

• – Customers looking for quality, value or on time
• – Shareholders looking for financial performance
• – Government agencies require legislative compliance
• – Employees looking for stability and value

Once the above are determined . the information identified helps with

• – Determining the scope of the management system
• – Determining the management system and its processes
• – Links to Risk and Opportunity

The post Context of the Organisation appeared first on Astute Business Certification.

– Life cycle perspective

– Aspects and impacts

– Significant environmental aspects

Life cycle perspective

“Life cycle” is the consideration of a product or service from concept to disposal – cradle to grave – and includes acquisition of raw materials, design, production, transportation/delivery, use, end-of-life treatment and final disposal.

The business needs to consider the life cycle in the context of what can be controlled or influenced such assessment energy efficiency when purchasing equipment, raw materials sources in products (such as recycled paper), sharing of information (electronic over paper), choice of products (such as biodegradable oils) and recycling capabilities after use (such as printer cartridges).

https://www.epa.vic.gov.au/-/media/epa/files/publications/1110.pdf

Aspects and Impacts

A business’ activities, products and services that interact with the environment are referred to as “aspects”, which may have a negative or positive impact on the environment. 

An environmental impact is defined as any change to the environment, whether adverse or beneficial, resulting from the business’ activities, products, or services.Use of chemicals – contamination or waterways

– Consumption of water – wastage

– Consumption and emissions from fuels – energy efficiency and air contamination

– Disturbance of vegetation – affects on fauna

– Production of dusts – air quality

– Production of waste – landfill

– Use of paper and other consumables – waste and consumption

– Noise – affects to the public

Significant Environmental Impacts

The standard discusses that the Environmental Management System must manage all aspects which are found to be significant.  There is no single accepted method for evaluating significance.  What is significant for one business will not necessarily be significant to another. 

When determining which aspects are significant, the business needs to adopt an approach that works for its specific circumstances considering its size, the site, and the natural of the works conducted.  The approach taken should consider the significance of each aspect under the following circumstances:

– Normal operating conditions

– Abnormal operating conditions (e.g. start-up, shutdown, maintenance)

– Incidents

– Past activities

– Planned activities

A register of significant environmental aspects is usually produced to meet the requirement to maintain documented information of environmental aspects and associated impacts and of significant environmental aspects.  The register must be kept up to date, and will need to be reviewed periodically (e.g. at management review) or when new aspects are identified; when processes are changed or in the event of an environmental incident, accident or emergency.

Assistance to Business

CCIQ ecoBiz is a free program, funded by the Queensland Government, that helps businesses save money across their energy, water and waste bills.

https://ecobiz.cciq.com.au/

For any questions about ISO 14001 get in touch with the Astute Business Certification team here.

The post Key aspects of ISO 14001 appeared first on Astute Business Certification.

ISO 14001 Environmental Management provides the structure for business to manage their environmental requirements and meet client and regulator expectation as their conduction their business including planning, operation and continuous improvement.

ISO 45001 Health and Safety Management provides the structure for business to manage their health and safety requirements, fosters workplace consultation and participation and provides assurance to clients that regulatory requirements are been addressed.

For any questions please get in touch with the Astute Business Certification team here.

The post ISO 9001, ISO 14001 & ISO 45001 appeared first on Astute Business Certification.

One way to assist in managing contractors is to take a 3-step approach

1. Contractor review – what do we know about the contractor, can we see previous work or obtain references from other clients? Do they have systems of work for their personnel? Do they have adequate insurance incl workers compensation? Will they be outsourcing the work?
2. Initial consultation – establish your workplace requirements and communicate with the contractor – this may include specific personal protective requirements, work permits or site meetings. If you have a site management plan it would be worth sharing the relevant parts with the contractor. Also discuss the scope of works and proposed mitigation of risk.
3. Onboarding – conduct general workplace familiarisation / inductions. Ensure relevant documentation is available.
4. Onsite audit – audit the contractor against the agreed process that is to be implemented. This is where the initial consultation brings benefit; use the contractor’s systems of works in conjunction with the workplace requirements.

We can conduct 2^nd party audits on contractors and suppliers who are working at your workplace and see how Astute Business Certification can compliment you contractor management process.

The post Do you engage contractors? appeared first on Astute Business Certification.

Next you will need to determine which certification company to engage. It is worth doing your homework – how many audit days will be required, how often is surveillance audits and are addition / annual fees on top of audit fees.

The certification process comprises of 2 stages. The stage 1 audit is an initial assessment of your management system against the specified standard and will including review of policies, processes and procedures, measurement and monitoring, management review and continuous improvement.

The stage 2 audit is the final assessment of your management system where the implemented systems are validated against your management systems and will involve workplace visits and engage in discussions with workers and key personnel. On successful completion of the stage 2 assessment your business will be issued with a certification confirming compliance with the relevant statement. The certification is valid for 3 years from the date of issue.

To maintain certification, surveillance assessments will be conducted regularly (at least annually). The surveillance assessments assist the business and benchmark the implementation of the management system.

Astute Business Certification is a Queensland-based member practice of Equal Assurance Pty Ltd (a JAS-ANZ certification body) providing ISO Management System certification. Astute Business Certification can provide a free Gap Analysis Checklist to assist with this process. To obtain the Gap Analysis Checklist, contact our office today.

The post So you have decided to obtain ISO certification…..what next appeared first on Astute Business Certification.

For any questions about ISO 45001 Health and Safety Management please get in touch with the Astute Business Certification team here.

The post What is ISO 45001 Health and Safety Management? appeared first on Astute Business Certification.

For any questions about ISO 9001 – Quality Management please get in touch with the Astute Business Certification team here.

The post What is ISO 9001 – Quality Management appeared first on Astute Business Certification.