Recently, there has been an increased interest in conducting “Systems Audits” especially within businesses or agencies already familiar with “Compliance Audits”. In this article, we compare Systems Auditing to traditional Compliance Auditing.
Compliance auditing tends to be a straight-forward process. Objective evidence is collected to determine the status of compliance relative to specific requirements. Often these will be regulatory requirements, but compliance audits can be conducted relative to company or agency policies or procedures. To conduct a compliance audit, the auditor needs to know what the specific requirements are. Based on documentation review and observations made by the auditor, compliance with these requirements is evaluated.
Compliance auditing tends to develop a “snap-shot” of compliance on the day the audit was conducted. The important point is whether or not the auditee is in compliance, and not how compliance is attained.
Systems audits extend beyond strict compliance on the day of the audit. Although compliance with requirements is an important factor in a systems audit, providing an indication of system effectiveness, auditing the process leading to compliance is just as important.
For systems audits, the auditor needs to not only understand the specific compliance requirements, but also needs to understand the system the auditee uses to attain compliance. To pass a systems audit, the auditee must be in compliance with requirements and must demonstrate that an effective system is in place and being implemented to continuously be in compliance.
Systems audits will assess the compliance assurance system, and not simply assess the status of compliance on the day of the audit. Because a systems audit requires more intimate knowledge of the systems being used by the auditee, typically a systems auditor will request more information prior to the audit, including documents such as written plans and procedures, training requirements, etc. Often, systems audits will focus on specific areas, rather than being a site-wide assessment.
As an example, we will consider how a systems audit would address a specific compliance issue –proper labeling of drums in a hazardous waste storage area. In this case, drums of hazardous waste must be properly labeled; this is very straight forward for a compliance auditing process. The specific requirements for labeling are well documented and apply to all facilities that store hazardous waste. The auditor simply reviews the labeling documentation and determines if it meets these requirements.
Auditing the proper labeling of the hazardous waste drums with a systems auditing approach will require that the auditor understand the process the facility uses to assure that drums are properly labeled. While the requirements for labeling are generic and apply to all facilities that store hazardous waste, the system to assure proper labeling will be unique to each facility.
The compliance audit reviewed one type of document –the drum label –to determine compliance. The systems audit may review a broad range of documents related to the facility’s compliance system; for example,
- Internal checklists/blank label forms
- Written procedures
- Training requirements and training records
A systems auditor may also conduct interviews with key staff to assure they have been trained and understand the procedures they need to follow.
Systems audits offer a clear advantage beyond compliance audits – they address the underlying processes in place to assure on-going compliance. Systems audits also require a higher level of effort by the auditor and involve a broader range of personnel at a facility.
For further information contact Caltha LLP at
info@calthacompany.com
or
Caltha LLP Website
No comments:
Post a Comment