A word about remote audits

Last week I talked about some of the changes I've heard proposed for ISO 19011, and one was that it be expanded to include guidance on remote audits. Suddenly I realized that up till now I've never described my own experience with remote audits. So let me repair that omission.

Remote internal audits

Of course the topic came up in 2020, as offices were shutting down because of COVID-19 and people were starting to work from home. I had created an internal audit plan for our organization, to be carried out in the spring of that year. The plan covered several locations across the United States, and my boss told me clearly, "Do them remotely, to reduce the risk of contagion. I will not authorize you to travel."

"How do you want me to audit our factory, if I can't travel there?"

"There are other qualified auditors in the organization who live within driving distance of the factory, and won't have to take commercial transportation. Let them do it."

So I did; and for auditing office functions (i.e., everything except factory production) it went well enough. The one big difference between remote audits and in-person ones, I soon learned, was that remote audits take longer. Or (to turn it around) if you have only a fixed amount of time for each interview, you can't ask nearly as much, so you have to be far more selective and strategic about your questions. The reason is that time is invariably lost in setting up the connection at a technical level, and then in the auditee sharing documents so you can read them on your screen. In a few cases the auditee had only hard copies of some artifacts, and we had to find a workaround. And invariably you miss a layer of communication when you are not there in person. Still, within those constraints, we were able to make the internal audits work adequately.

Remote external audits

The exercise got more interesting when it came to our external surveillance audits. These had all been scheduled in the fall. Because all our sites used the same management system, our registrar had elected to audit only three of them, and the three audits were on consecutive weeks. I asked the registrar's scheduling office whether we should expect the audits to be in-person or remote, and their answer was, "That's up to each auditor to decide for himself individually, but none of them have told us that they plan to audit remotely. So I guess you should plan for in-person." I explained that in some cases the entire office had shut down: if the auditor arrived in person, he and I would be the only two people in the building. The scheduling office promised to make a note of that in our file.

Since we couldn't be sure what our external auditors would do, my boss reluctantly authorized me to travel to all three locations so that I could be there "just in case." And of course we assumed that the audit of our factory would have to be in person, so the auditor could walk around the production floor. In the end, I heard from each auditor mere days before his respective audit was scheduled, and all of them chose to audit remotely. So for the two pure office audits, I logged in from my hotel room and talked the auditor through our artifacts. Other auditees were scheduled to enter the conversation at specific times, and they did.

But what about our factory? That building was open, after all, and people were working there. (We were fortunate that our line of work was classified as "essential," so we were never shut down.) In that case, at least the auditor had a good reason for failing to show up: he was traveling from Canada, and the border had been closed. But how was this supposed to work?

Naturally some of the functions at the factory were office functions; and for those, our auditor conducted a remote audit in the normal way. Then he told me, "I want to talk to someone working on such-and-such a machine. Please carry your laptop onto the floor and find such an auditee." So I carried my open laptop out onto the floor, found the right machine, and asked the operator if I could have a few minutes. Then the auditor questioned the operator through the laptop screen, and I had to hold the laptop in a variety of positions so the auditor could see the specific things he wanted to see. (This particular auditor also had a very soft voice, so I regularly had to repeat his questions so that the operator could hear them over the general background din.) We spent ten or fifteen minutes like this, and then our auditor asked to look at a different machine. I set off across the floor to find the next machine, and we went through the cycle again. In all, I think we looked at three different workstations on the production floor that way—or maybe four, I no longer remember exactly.

At the time, it felt a little comical for me to be walking around with my open laptop like that. But I couldn't think of a better way to do it, and honestly I'm not sure I can even today. Perhaps a willingness to tolerate a certain level of absurdity is actually a job requirement for auditors.

As always, please let me know about your experience in the comments.