Implementing Audits using Oracle Quality

An Oracle White Paper June 2004

This page is intentionally left blank

Implementing Audits using Oracle Quality

EXECUTIVE OVERVIEW

The effectiveness of an enterprises Quality Management Systems (QMS) is dependent on meeting the quality and business objectives so that the ISO 9001:2000 certification can be maintained. Auditing is one of the processes to evaluate the effectiveness of a QMS in any enterprise by evaluating, confirming and verifying the activities associated with continuous improvement. This paper illustrates how the features of Oracle Quality can be used to implement Audits in an enterprise to measure the effectiveness of any Quality systems. The quality system may be that of a potential supplier, an active supplier or users enterprise itself. Oracle Quality is a very flexible and powerful application, and can be used to implement a system to plan, track and conduct quality audits.
INTRODUCTION

The International Standards Organization defines the Quality Audit as follows: A systematic, independent and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled.1 An audit typically commences with a preliminary stage that enables the auditor to gain a good understanding of an auditees nature of business and existing quality system. During this initial stage, the scope and plan of the audit is determined. The audited organization is also provided with an opportunity to rectify any deficiencies before the execution of certification stage audit. An audit team is put together to conduct the audit based on the focus areas to be audited. Audit execution consists of collecting responses to the audit questions, recording observations and objective evidence, and identifying opportunities for improvement. The audit may reveal a need for corrective actions to be requested and implemented. Reports are generated at the close of the audit, which would be useful for management to review the results.

ISO 9000:2000 Section 3.9.1

REQUIREMENTS OF AN AUDIT SYSTEM

A software system for performing an audit should be capable of supporting the following requirements: Ability to support audit focus areas and assign appropriate auditors Ability to have a two-stage approach to auditing; scoping, planning and scheduling as the preliminary stage and the audit execution as the certification stage. Ability to provide documents to the auditors such as audit policies, standards, documentation etc. Ability to tailor characteristics recorded based on varying business needs Ability to have a centralized data repository Global visibility for multiple lines of business User Administration and Security Automated Notifications Ability to have an audit trail of the data entered

KEY CAPABILITIES OF ORACLE QUALITY

Oracle Quality is a flexible application, and since the features available can be leveraged to build an audit solution, it is worth briefly highlighting a few important ones as below. Define Collection Elements and Collection Plans You can create collection elements, which define the characteristic of the product or process that you want to monitor, record and analyze. Collection plans are composed of collection elements, their values and specifications, and any actions to be initiated in response to quality results. This approach provides flexibility to tailor the system to varying business processes. A collection element can be of type Sequence when defined as sequence, it functions as a sequential counter for record identification and other purposes (e.g. Audit ID). A collection element can be of type Comments when defined as such, it can store up to 2000 characters of text (e.g. Audit Objectives). Actions: Collection plan/element actions You can specify that Oracle Quality initiate an action based on the quality data that you collect. You can have Quality issue alerts and electronic notifications, launch workflows created using Oracle Workflow, assign values to other collection elements automatically, executing a SQL and operating system scripts. This provides the ability to setup proactive and reactive responses to quality concerns.

Implementing Audits using Oracle Quality

Page

Automated Notifications Communication to the necessary personnel on the progress and updates to an audit can be done through the use of electronic mail notifications or workflow notifications. The workflow notifications can be further extended to set reminders on due dates and follow-up dates. These notifications can be built and/or tailored by the implementers using Oracle Workflow. Parent Child Collection Plan structure Oracle Quality supports parent-child collection plans, which allows for establishing relationships between collection plans. This feature provides support for easy Extensibility and ad-hoc data collection. A specific type of parent-child relationship (History) supports the ability to automatically collect historical data on a plan. This provides the audit with capabilities to track changes made to audit data. Integrated with Corrective Action and Preventive Action (CAPA) Solution Oracle Quality has a Corrective Action and Preventive Action (CAPA) Solution. The Audit system can be integrated to CAPA using the parent-child relationship definition feature, which is available out-of-the box in Oracle Quality. The integrated systems facilitate a seamless data transfer from the audit system to CAPA, which provides for loosely coupled and yet tight integration capabilities. Attachments Support in Oracle Quality Additional reference to a document and evidence such as image can be associated during audit execution through the Attachment feature in Oracle Quality. This is a very powerful feature with myriad applications and its usage include attachment of Audit Policies, objective evidence gathered etc. Report Writer All required audit reports could be built using the different reporting tools available in Oracle Quality Report Writer and Oracle Discoverer and published in the companys Intranet for management review. Security User access to the system can be restricted by use of user groups and privileges allowing for selective access and operations that can be performed on the audit data. Supplier Management Portal Oracle iSupplier Portal provides secure online collaboration capabilities that make it easy for suppliers to perform common business functions, including reviewing purchase agreements, tracking inventory balances and verifying receipts. Oracle Quality has integration with the iSupplier Portal, allowing the suppliers to enter and view quality data. Key benefits of the iSupplier Portal are to strengthen supplier relationships, increase quality, lower costs and collaborate via the web for enhanced efficiency and better service. For non-physical audits, audit questions may be

Implementing Audits using Oracle Quality

Page

published through iSupplier Portal and responses may be obtained in to the audit system. Ease of setting up the system copy complex structures In 11i.9, Oracle Quality provides a user interface to copy the complete parent child hierarchy and the actions/relationships in to a new structure. Thus, once a required template is setup, it becomes extremely easy to copy such previously defined audittemplates, and fine-tune it as necessary to fit relevant business processes. This offers significant convenience for deploying audits similar to the one in the past in one line of business to a different line of business with minimal modifications relevant to only that line of business.

Implementing Audits using Oracle Quality

Page

BUILDING AN AUDIT SYSTEM WITH ORACLE QUALITY

The example below shows how an audit system can be constructed using the features available in Oracle Quality. This is only an illustration of the concept, and can be adopted by the organizations as per their specific requirements. As always, the main building blocks to be used are the collection plans, and parent child relationships. History plans can be used for tracking changes to any of the data associated with these plans as necessary.

A proposal for the collection plan structure:

Integration with other e-Biz suite modules

Audit Master
(Main plan for initiating an audit)

Audit Focus Areas

SECURITY & AUDIT-TRAIL

(An audit may have more than one focus area with auditors assigned)

Audit Questions
(standard questions to be answered during an audit execution)

Audit Findings
(ad-hoc observations, evidences gathered, suggestions for improvement)

CAR Solution
(corrective action requests logged as a result of audit)

Response to Qns.
(record responses provided as answers to the above questions)

REPORTING TOOLS (Example: Oracle Discoverer)

Implementing Audits using Oracle Quality

Page

AUDIT PROCESS FLOW (AN EXAMPLE)

The Audit Master is the main plan for initiating an audit. The significant collection elements in this plan are Audit ID (generated by a sequence), Audit Name (to identify the audit), Audit Type (such as Internal, Supplier etc), Audit Classification (Process Control, Design Control etc), Chief Auditor, Audit Standard (ex. ISO9000), Supplier and Site, audit status (such as in-process, approved, closed etc.), audit objectives (long comments to store more information). In addition, for a supplier audit, any prior supplier certification can also be noted, if desired. An audit can have more than a single focus area, such as Material Control, Packaging and Shipping. By defining these in the Audit Focus Areas plan, different auditors can be assigned to work on the focus areas. The significant collection elements in this plan are Audited Area, Primary auditor, Section Audited (ex. 4.9Process Control). During the audit, it needs to be noted whether there is a procedure that exists, and if it is adequate and compliant. Collection elements to capture these are also an important part of the Focus Areas plan. If it is determined that corrective actions are necessary, then CAR Required flag is set to Yes in the Focus Areas plan, and a corrective action request is entered through the Corrective Actions plan. Certain elements such as Reference Request Number, Standard Violated and Section Violated can be seamlessly transferred to the CAR plan from the Focus Areas using the parent child relationship definition. Apart from the standard set of questions, there may be a need to capture information on ad-hoc findings and observations. These observations can be a valuable input for improvements in the organization or process. These can be recorded in the Audit Findings plan. A Finding ID can be generated as a sequence, which serves as a unique identifier for reference and tracking the observation and objective evidence in the future. Any pictorial or documentation evidence can also be attached at the time of recording the observation in the Findings plan. The audit questions plan contains the standard questions to be answered during an audit execution, for which responses are collected in the Responses plan.

Implementing Audits using Oracle Quality

Page

Figure 1 : Audit Master

This is an illustration of how an Audit Master collection plan with certain collection elements defined for conducting an audit. Additional elements and actions can be added to the various audit
collection plans in the parent-child structure. Information can then be recorded in the Audit Focus areas as shown below:

Figure 2 : Audit Focus Areas

Implementing Audits using Oracle Quality

Page

Figure 3: Request corrective action

This is an illustration of the integration between Audit Focus Areas collection plan CAR Solutions Master Plan. Note
certain elements such as Reference Request Number, Standard Violated and Section Violated are seamlessly transferred.

Figure 4: Data copied over to CAR

Implementing Audits using Oracle Quality

Page

10

BUSINESS BENEFITS OF USING ORACLE QUALITY FOR AUDITS

The audit system solution using Oracle Qualitys infrastructure provides multiple business benefits, some of which are highlighted below: Single repository of Audit data A single plan or multiple plans can be used to enter audits nevertheless, the audit data resides in a single repository in the Oracle Applications model. This is a very powerful feature to later retrieve and analyze/archive data that is required. This provides a global visibility across different lines of business. Integration with CAPA Solution An integrated CAPA and Audit system helps to reduce IT implementation costs and helps ensure compliance. It also provides executives with the powerful benefits of centralized data. It facilitates rapid identification of issues as they occur, thus preventing large problems with widespread business impact. Oracle Quality can support this integration through the parent-child relationship feature, which provides an easy and simple way of integrating and creating Corrective actions from audit findings. Configurable and tailorable solution Since the entire audit system is being built using the flexible infrastructure of the Oracle Quality application, it lends itself to be configurable and tailorable to the individual business needs. This eventually eases the process of implementation. Consolidation of disparate systems Companies may be using paper systems or homegrown systems as well as different Audit systems within the same enterprise. This solution provides the ability to consolidate all these disparate systems into a single audit tracking system for the enterprise. This enables corporations to run enterprise wide effective quality management systems. Streamlining and Process Standardization One of the key benefits as a result of the use of a single system across the enterprise is the ability to standardize the audit process across the different units or divisions within the enterprise. A common system and standardized operating procedures enables sharing best practices. Reduction in cycle time In comparison to a paper system or disconnected systems within an enterprise, it is expected that this solution will reduce the cycle time to plan, schedule, execute and review an audit in the enterprise.

Implementing Audits using Oracle Quality

Page

11

Better communication tool The user can build tailored email and/or workflow notifications, and can fire this at the appropriate time by setting actions in Oracle Quality. By using such automated notifications, the required and responsible personnel can be informed and requested to act as and when necessary which leads to better communication within the different functions of the enterprise. Effective Enterprise-wide reporting With the reporting tools that can be used with this solution, it is possible to provide reports with varying degree of details. Reports can be generated that are targeted for review by upper management in an organization to study performance. Also, operational reports can be generated that are required by the Quality personnel to perform the day-to-day tasks in implementing the corrective actions created based on the audit findings.
SOLUTION AVAILABILITY

The parent-child definition feature that is instrumental in implementing an audit solution using Oracle Quality has been available since release 11.5.8. The CAR Solution templates are available in 11.5.9 as an out-of-the box feature. Using these features in Oracle Quality, an effective audit solution can be built with no programming requirement.
CONCLUSION

The audit system based on the key infrastructural capabilities of Oracle Quality would enable a corporation, in a short time, with a simple, yet effective audit system that would help compliance to standards and identifying potential process improvement opportunities within an enterprise to meet or exceed the quality and business objectives.

Implementing Audits using Oracle Quality

Page

12

Implementing Audits using Oracle Quality (pre-11i.10) Version A Last Update Date: July 2004 Author: Ilam Sivakumaran Reviewers: Bala Balakumar, Aravindan Sankaramurthy and Rajesh Devakumar Oracle Corporation World Headquarters 500 Oracle Parkway Redwood Shores, CA 94065 U.S.A. Worldwide Inquiries: Phone: +1.650.506.7000 Fax: +1.650.506.7200 www.oracle.com Oracle Corporation provides the software that powers the internet. Oracle is a registered trademark of Oracle Corporation. Various product and service names referenced herein may be trademarks of Oracle Corporation. All other product and service names mentioned may be trademarks of their respective owners. Copyright 2002 Oracle Corporation All rights reserved.