Conformity Assessment and Change

One of the members of a Linked-In group on quality auditing asked why he was not getting agreement from the auditee. As an auditor, he had pointed out several nonconformities and cited the appropriate ISO 9001:2008 clauses. Yet the auditee was reluctant to change anything. Here is my response:

To properly understand, we must look at the bigger picture. You are asking for change in response to a system that is not designed for change.

Audits done by the registration agencies (called third-party audits) are done for the purpose of conformity assessment. They are similar to field visits from the government regulators. Is the auditee conforming to a certain underlying standard or regulation? It does not matter how good or poorly they conform; rather, "did they meet the requirements?" That's why the registrars use the term nonconformity, which was invented for the Conformity Assessment system. Granted, some of the accredited registration agencies classify nonconformities as major (you did not pass and will not receive a certificate) or minor (you passed, but barely). But fundamentally, third-party audits (actually conformity assessments) were never designed for improvement. Go or no-go.

Now, this conformity assessment model has many benefits to society. It helps in supplier selection. It raises an entire industry (pharma for example) to a higher standard of performance. It acts as a catalyst (threat?) for an enterprise wishing to reach a higher level of performance. It is public acknowledgement of a job well done. Since the implementation of conformity assessment for quality management systems in 1987, the quality of goods and services has increased worldwide.

But the conformity assessment model - even with major and minor nonconformities - does little for internal growth and development. Or supply-chain partnerships. This is where internal and supplier audits really shine. An internal or supplier audit is focused on the future, not the past. These audits address four basic things:

• Are controls defined? (Policies, manuals, procedures, specs)
• Are defined controls implemented? (Do what you say)
• Do the implemented controls really work? (Reduce errors)
• Will these controls continue to work? (For the next 9-12 months, at least)

But wait, there's more!

For the internal or supplier auditor to affect change, she must remember that only two things motivate humans: pain and pleasure. Show a person that his actions result in pleasure and he will continue or increase those actions. Show a person that her actions result in pain, and she will change to take away the pain.

Our challenge as auditors is to show pain. By this I mean business pain of cost, production, and risk. CPR. Through analysis of data from the fieldwork, the auditor must show where the pain is. In medical terms, this is called the disease. Then the auditor selects a number of symptoms uncovered during the audit. By showing this cause and effect relationship in our report, the auditees are obligated to change. Not because we tell them to do something differently, but because they want to do it differently. They do not want pain to remain. And they have the power to do something about it.