The old saying goes, the only constant in life is change.  And of course, this is what everyone tries to fight all of the time.  Any implementation of a management system includes change, even a little.  But it has to happen and many organizations do not know how to manage it well.

As auditors, we have to look at change and how it is managed.  There is always change because the essence of all management systems that follow the Plan-Do-Check-Act cycle are driven by continual improvement and therefore, change.

So how do we go about auditing change?

First, we need to understand how change affects the management systems that we are auditing.  (see my recent blogs on change in the new ISO 9001 and ISO 14001 standards)  Because we need to be able to understand how any evidence related to any deficiencies in the management of change are applicable to our audit criteria.  We can’t raise findings simply because a change is poorly implemented, it has to be related back to the criteria of our audits.

Second, we need to determine if and what changes have occurred.  There will be different sources of information for that: observations, interviews and records.  All the standard stuff.  It will be easier if you have been there before or are an internal auditor.

Look for clues:  capital budgets, shiny new equipment, over or under crowding since the last audit, ask during all interviews, management review meeting minutes, objectives, new or revised procedures.

What kind of changes should you be interested in?  All changes:  new equipment, removed equipment, new and expanded spaces, significant changes to staffing (i.e. an entirely new shift or department), new chemicals, new processes, new products.

Third, follow the change through the management system.  All management systems must be maintained.  Maintenance of a management system means that it is updated as a result of change.  You must go through all of the elements of the Plan-Do-Check-Act.

The first trigger for change is a review of the risks and issues and how they affect the context of the organization and scope of the management system.  In a QMS, how is production planning affected?  In an EMS, are there new or changes aspects?  For an OHSMS, new or changed hazards?

Once changes to the planning stages are identified, there should be a cascade in the control of the operations.  New or changed:

• Procedures and policies
• Training requirements
• For equipment, maintenance tasks
• Different roles and responsibilities

Finally, the management review should acknowledge the changes and review the effectiveness of the management system with adapting to the changes.  Often, the management review meeting is the catalyst for changing the management system, rather than the intent, which is to verify that the management system was maintained as a result of the change.

Once all the above has bene done, review the timeliness of the changes.  Are changes to the management system completed as soon as possible after the change is identified or even before it is implemented?  Or is the change an afterthought a couple of months later?

There will always be changes going on in a company, just many of them are not going to trigger changes within the management system.  Keep digging and you will find them.