Constrains of Third Party Auditing - IV

Evolution of Third Party Auditing

The high visibility of quality audits to standards such as ISO9000 may lead to a perception that quality audits are very much a 1990s phenomena (Russell and Regel, 1996). However, quality audits have been popular tools to improve quality, productivity and profit for several decades (Thresh, 1982; Mills, 1976; Palmer, 1977; Van Dine, 1978).  In fact, quality auditing and ‘approved supplier status’ (certification or registration) as we know it today can be traced back as far as the1920s in the UK to the Aeronautical Inspection Directorate (Drew, 1969; Souch, 1976).  Later, during the 1950s the North Atlantic Treaty Organization (NATO) standardized an agreement (STANAG 4107) whereby a National Quality Assurance Authority in a manufacturing country could undertake evaluations of the competence of the supplier organization on behalf of the purchasing country. The experience of the defense industries with quality audits to ensure assurance and quality control subsequently provided a model for the wider business community.  This was due in part to the work of the Raby Committee in 1968 and to the Industry Consultative Body set up in 1971 to ensure that the Raby recommendations for pre-contract evaluations of supplier systems and rationalization of defense quality assurance standards were ‘equitable, practical, economic and acceptable to both parties’ (Souch, 1976; Allaway, 1977).  Private sector companies initially implemented quality control systems based on standards to gain or maintain contracts with government agencies (Ho, 1995; Johnson, 1970; Mills, 1989). 

During the late 1960s and throughout the 1970s, auditing of supplier capability to standards specified by the customer became accepted practice outside the defense industry.  Company-wide quality assurance schemes thus became firmly ensconced in the corporate landscape (Thresh, 1982).  In the absence of domestic standards, private sector organizations used the available military standards to establish the status of supplier quality systems (e.g. MIL-Q-9858AQuality Program Requirements for Industry in USA; 05-21 MOD series in the UK; and also NATO documents such as AQAP-1 NATO Quality Control System Requirements for Industry).  Each of these bodies also provided other standards and documents to guide the evaluator or auditor as to the process of quality systems auditing, including typical questions to address.  The military standards had a far-reaching impact on the subsequent national domestic standards for quality system requirements and auditor guidance standards (such as British Standards BS4891 (1972 Guide to Quality Assurance); BS5719 (1974 Guide to the Evaluation of Quality Assurance Systems); BS5750 (1979); Australian Standard AS1821-1823 (1978); Australian Standards Series AS3900 (1987); Canadian Standards, CAN-CSA-Z299.1 through CAN-CSA- Z299.4, 1981; India too, had quality systems standards by the mid-1970s).  This brief review of standardization demonstrates that quality auditing has a longer and more coherent history than most texts on quality assurance would lead one to believe (for a comprehensive comparison of the elements of early British quality system standards, see MacDonald, 1977 and Periera, 1987). Arrangements to undertake a quality audit were generally agreed between the two parties to the contract, customer and supplier. 

Impact of ISO 9001 in Third Party Auditing

Quality auditors from purchasing (customer) organizations would audit their supplier organizations, first to establish capability in respect of a contract, and then to conduct surveillance audits as the term of the contract progressed.  There was always scope for third-party assessment (i.e. external verification, or audit, of the supplier’s stated quality specifications by a party not subject to the contract – in effect a second party proxy), although this did not become a common practice in industry until the mid-1980s.  With many customers and suppliers interacting, the resource implications of multiple audits or assessments and the compatibility or suitability of national quality standards was a challenge for quality assurance (audit) departments.  There was a veritable audit explosion in the late 1970s (Sayle, 1981) and calls were made for more uniform/standardized measurement of supplier capability and a reduction of multiple customer audits of a single supplier (Hearn, 1987).  To encourage cross national trade and improve standardization for the supplier assessment/quality audit process, the International Organization for Standardization (ISO) commissioned a Technical Committee (TC176) to develop and agree a common set of criteria.  This resulted in the ISO 9000 series of standards being issued in1987, which subsumed most of the requirements of previously independent national standards such as BS5750.3. Although the intent of the ISO 9000 series was the same as its predecessors (to enable verification of the applicability of the implemented quality program and its ongoing effectiveness), the ISO 9000 series claimed to be a generic “model for quality assurance.”

The international standardization of quality system standards (ISO 9000) resulted in a dramatic rise in the scale of external, third-party assessment and certification. External certification bodies (such as SGS Yarsley ICS, Lloyds Register Quality Assurance, Bureau Veritas Quality Assurance, Det Norske Veritas, British Standards Institution) are increasingly used by organizations seeking ISO 9000 audit and certification.  These bodies are themselves accredited by regulatory agencies (such as the UK Accreditation Service (UKAS) and the Joint Accreditation Scheme of Australia and New Zealand, JASANZ) to conduct external quality audits. They audit organizations’ management systems to assess whether they satisfy the requirements of a particular standard.

In the UK the move to formal external audit and certification of quality systems was instituted by the Government’s 1982 White Paper on ‘Standards, Quality and International Competitiveness.’ This explicitly promoted independent audit and certification schemes and sought to develop the necessary supporting infrastructure (including the creation of a national accreditation body and the specification of rules/criteria to be satisfied by ‘certification’ bodies and individual quality assessors). The first certification bodies were accredited by NACCB (the National Accreditation Council for Certification Bodies now the United Kingdom Accreditation Service, UKAS) in March 1986  in the UK and there are now well in excess of 70 such bodies in existence.  The individual auditors and assessors working for the certification bodies must be both professionally qualified, operate within nominated industries, and undertake a specified number of audit activities within a prescribed period (Hutchins, 1997).

ISO 9000 standards quickly gained popularity, and registration bodies surfaced throughout the globe. Organizations believed that ISO certification offered a competitive advantage over non-certified suppliers while concurrently; customers began mandating ISO 9000 registration as a requirement for sourcing business. As a result, the late 80s and early 90s realized a tremendous increase in third-party audits due to the need for certification. The third-party audit increase influenced the growth of the consulting industry, which in turn helped increase the urgency for organizations to obtain ISO 9000 registration.  Oversight boards were implemented to oversee the registration bodies, administer and set guidelines for third-party audits, and develop standards for auditor competency and qualification.  However, after nearly a decade of this self-sustaining, expanding cycle, organizations and individuals began to question the value of the process.

Constrains Identified in Third Party Auditing

Thus third-party quality audits have been an accepted practice within the manufacturing industry for several decades.  In the late 1980s and early 1990s, the audit process gained enormous momentum via the introduction of international standards such as ISO 9001, ISO 14000, and industry-specific standards such as QS 9000 (subsequently replaced by TS 16949).  Each of these compliance standards requires a third-party audit to evaluate the organization’s management system against the requirements outlined in the standard.  In most situations, compliance to these management standards is required by customers; therefore, the third-party audit is paid by the auditee (i.e., organization subject to the audit).  The intent of these standards and audit practices was to reduce the number of audits bestowed upon an organization; however, it simply has not achieved its goal.

Each individual industry sector such as automotives, foods, electronics as well as software developed process-specific assessments (sometimes executed as second-party audits) as a method to audit a process against known best practices and not against a set of generic requirements which are basically related to private label standards. Customers are using such assessments to conduct audits of their supplier’s vital processes, thus reducing the value of the third-party certificate which, in principle, evaluates the effectiveness of all process at a registered facility.  An organization with 400 employees will pay approximately $15,000 for a complete audit cycle that typically consists of an initial registration audit (full systems audit) followed by five surveillance audits for bi annual audits or 2 surveillance audits for annual audits.  An audit cycle begins with an extensive, full-system registration audit followed by five or two subsequent surveillance audits, based on the audit interval agreed.  In addition to hard dollars spent for maintaining certification, vast resources are consumed to prepare and participate in the audit. According to the International Organization for Standardization (ISO) (2015), approximately 1138155 organizations are ISO 9001 registered. On the other hand, 40,655 organizations are registered within North America and Europe 530,722 by 2010. Based on this estimate, and using an employee count of 400, approximately $7,713,589,500 is potentially spent every 3 years simply on audit fees and administrative costs imposed by the register.

Additionally, this approximation estimates the cost of organizations certified to ISO 9001; but if other standards such as TS 16949–Quality Management System Guidelines for the Automotive Industry, ISO 14001–Environmental Management System Guidelines, and ISO 13485 Quality Management System Guidelines for the Medical Device Industry, ISO 22000 for Food and Feed Manufacturers in supply chain are considered, the total cost spent for a 3-year audit cycle would be exorbitant. Placing a value on the use of company resources is somewhat difficult. Nevertheless, it is hard to dispute those managers, engineers, clericals, and team members participating in the audit process devote significant time to it. For example, recent audit results shared by a major automobile supplier (a facility approximately 400 employees) indicate the total cost of resources for a successful registration audit is conservatively estimated at $16,000. This estimate is based upon (a) audit administration costs; (b) man-hours consumed preparing for the audit; (c) time spent by management as guides for the auditors; (d) disruption of production activities; and (e) resources dedicated to addressing and responding to the audit findings. These costs are estimates for a facility with approximately 400 employees.

Regardless of organizational magnitude, all companies subject to the third-party audit and registration process are subject to the same cost and use of resources. Based on these costs, and the magnitude of the potential organizational burden resulting from third-party audits, one may contemplate how such a costly process became necessary and mandatory. The answer to this question lies within the history of third-party audits. By examining the evolution of third-party audits, it becomes evident that these audits developed to fulfill an industry need. However, due to various circumstances and events, such audits have become antiquated and non-effective.

As to the current research findings; 

(a) the third-party audit process is adequate to assess an organization’s quality management system against the ISO standard, 

(b) the third-party audit process fails to add tangible value for the organization, 

(c) the relationship between the auditor (registrar) and auditee (organization) represents a significant conflict of interest, 

(d) the continued audit cycle is redundant and offers diminishing value, and 

(e) mature organizations fail to benefit from the third-party audit process.

Reference:

Kluse, Christopher, "Third-party Quality Management Audits for Automotive Component Manufacturing: Perceptions and Insights into a Necessary Yet Debatable Practice" (2012).