When you plan out your internal audit program for the year, is the Human Resources department in-scope?
It sounds like a simple question, but it's not. Or at any rate I've found that auditors I respect approach the question very differently from the way I do.
When I first started planning audits, it seemed easy: we were going to audit every department in the company, HR was one of those departments, ergo we audited HR. Simple enough.
Then one day I was working with a colleague from another division – a fine auditor with decades of experience in the Quality business – who asked me Why? in genuine bafflement.
His argument was that ISO 9001 is all about customer satisfaction. The whole point of a Quality Management System in the first place is so that you consistently deliver the goods and services that your customers require. So who cares what your hiring process is, or how you do annual reviews? None of those things affect the customer, so they should be out of scope for the audit program.
He did make an exception in case HR was in charge of the company training program. Training shows up under clause 7.2 ("Competence"); so if HR is in charge of training records (and sometimes they are) he was prepared to visit them so he could audit training records and ask about the process for ensuring that all training is up to date.
But even when you look at the other clauses that discuss how the organization hires or treats its people – see, for example, 7.1.2 ("People") or the Note under 7.1.4 ("Environment for the operation of processes") where there is discussion of social and psychological factors in the work environment – HR's role is usually to do what they are told. The HR Manager isn't going to tell the Operations Manager that he needs another inspector on Line 3. Rather, it's the Operations Manager who determines that an extra inspector is "necessary for the … control of … [the] processes" on Line 3 and who then asks HR to go hire one. So if you want to check how that determination was made (because you are auditing 7.1.2), go ask the Operations Manager and not HR. As for social and psychological factors in the work environment, … when was the last time you saw HR tell Engineering that the product development deadlines have to be more generous in order to avoid burnout in the design team? Well, then.
It's a good argument, and I had to think about it for a while. In the end I think I still disagree, but I've had to build an argument of my own. Here is how I see it now: let me know in the Comments which of us you find more persuasive.
My first point is that ISO 9001 is no longer just about customer satisfaction. It's now about the entire functioning of the organization. When ISO 9000:2015 defines quality* as the "degree to which a set of inherent characteristics of an object fulfils requirements," those requirements can come from any interested party.** Interested parties and their needs are determined way back in clause 4.2, and the list of interested parties should certainly include the employees themselves (among others).
Now, consider an absurd example. Suppose the organization offers its employees health insurance, and there are three plans to choose from: call them Gold, Silver, and Bronze. And suppose further that, no matter how the employees fill out their paperwork, the organization's HR department always signs them up for Bronze!
Clearly in a case like that something has gone wrong in the HR process. It doesn't affect the quality of the goods and services that are delivered to the customer, but it seriously affects the quality of the services provided to the employees. So if I were the auditor I'd want to write a nonconformity against some clause – probably 8.5.1 ("Control of production and service provision"), because I would argue that something was badly wrong with the controls on (internal) service provision.
Naturally a breakdown like this is unlikely. But the point is that it is possible, and that the organization's employees are legitimate interested parties who deserve to have their needs and expectations considered as the organization defines its business processes. Or alternatively, if the organization has deliberately chosen not to treat the employees as interested parties, there should be some documented discussion of that decision in the overall planning for the QMS. And that documented decision itself should then be available to the auditor.
So I have persuaded myself that it is still fair and reasonable to rule HR in-scope for the internal audit program. But have I persuaded you? Leave me some remarks in the Comments to let me know.
__________
* in entry 3.6.2
** see entry 3.6.4, Note 4
The quality of the product is highly dependent on the quality of the people designing and manufacturing the product.This goes back to hiring practices.
ReplyDeleteAs an example - if the HR department uses inappropriate screening practices for applicants, a highly qualified applicant may be overlooked and the hiring manager may never know they applied.
Another example would be if during the interview process other team members were not allowed to meet a prospective team member, a hire could take place where a disruptive team is created, thereby affecting quality.
Absolutely true. Thank you for those examples -- I didn't think of them when I wrote this, but they are clear and to the point.
Delete