#201 It Shouldn't Happen To An Auditor

The end of another year has rolled around in the blink of an eye! We've managed to publish a whopping 42 episodes this year, pushing us over the 200 episode mark.

We want to thank all our listeners, both old and new, for allowing us to continue to share both ISO tips and success stories from our wonderful clients. We hope you'll follow along as we continue our podcasting journey in 2025.

To close out the year, Ian Battersby and Steve Mason share some of their stories of misadventures during audits, from common mistakes, to broom battles and forklift mishaps, they really have seen it all! Listen, laugh and learn what not to do during an audit.

You'll learn

· What not to do in an audit

Resources

· Isologyhub

In this episode, we talk about:

[02:05] Episode Summary – Ian and Steve share some of their experiences from their time as auditors. From common mistakes to outlandish situations that you'd have to see to believe, listen and learn what shouldn't happen during an audit.

[03:40] Lazy Copycats: Steve recounts a time where a company had copy and pasted their Management Review for years, which rightfully earned them a non-conformity.

Ian shares a similar story where a construction company submitting a tender had copy pasted the content and included the wrong company name!

The copying doesn't stop there, as Steve remembers a company Quality Manual that managed to include multiple company names. It was found that they'd simply copy and pasted example pages they'd found online that looked good, but didn't bother to update any of the content to be relevant to them.

[06:30] Training Troubles – Ian recounts a time where he was auditing a subcontractor for a construction company that required a record of training. The induction was very important and obviously needed to be documented.

When he checked the documents, though all the forms had different names, all the signatures suspiciously had the exact same handwriting! Turns out the Director was signing them all off, which is obviously in breach of a number of health and safety related regulations.

[08:00] IT Security slip-ups – Steve recounts a time where a Finance Director had good intentions, but poorly implemented his idea. The Finance Director didn't trust their IT system back-up and instead backed-up all his information on a memory stick.

Steve had pointed out the flaws with this, such as losing the memory stick, data getting corrupted ect. It just simply isn't a safe or reliable way to store such important information.

[09:05] Disconnected Leadership – Ian shares a time where an auditor caught the lack of leadership commitment to their management system. Despite it being a very nice looking management system by all accounts, the cracks showed enough for an outsider to spot the flaws.

Steve adds that sometimes, you can over engineer a management system to a point past useful. It needs to work for your business, otherwise people will work around it to get what they need done.

Steve had a rather obvious example if this when he required a chat with a member of leadership, who refused on the day initially, despite it being scheduled for 6 months. The person relented a few minutes over lunch where he posed his complete commitment to BS 5750 – A standard that existed 20 years ago and had since been replaced by ISO 9001. Very telling for his level of 'commitment'.

As we have covered in a previous episode – Leadership commitment is imperative to a successful management system.

[11:40] Skip Diving for Secrets – Steve shares his experience of conducting a skip diving exercise, which is following a document waste trail. At a certain company, they ended up looking in an actual skip only to find what looked like a lot of confidential documents, when questioned someone had said that they looked like they belonged in the CEO's filing cabinet.

When questioned, the CEO remarked 'I didn't want you to catch me with anything that I shouldn't have, so I threw it all out last night'.

This warranted a non-conformity as anyone could have gone past and fished out that confidential information just as Steve had.

Ian also adds a time where he worked in the NHS and a local hospital had an accident where a lot of confidential medical files ended up scattered across the floor. These were documents that should have been disposed of securely.

[14:05] PPE? You've got to be kidding me! – Ian recounts a time working for a manufacturing company that was part of a large international firm. Their UK operation had to abide by strict PPE requirements, proper shoes, eye protection ect. It was something that everyone on the premises had to adhere to.

One day, a Director walked in with none of the PPE which was clearly labelled on many of the signs decorating the shop floor. He had incorrectly assumed that because of his position, he could walk around with no PPE whatsoever. Fortunately the shop floor supervisor set him right and sent him to get properly suited up.

[15:35] Data Centre security says no – Steve recalls a time when a member of top management went to visit one of their own data centre's, on getting to the gate the security had told him 'I don't care who you are, your name isn't on the list so you're not getting in.'

That person hadn't gone through the process of being approved for entry. Yet, predictably, they sent complaints everywhere, but the head of the UK branch had quite rightly praised the security personnel for simply following protocol.

[16:55] Private bank details? Don't mind if I do! – While Steve was auditing physcial security for an office, a printer ended up printing the payroll of every employee at the business. This wasn't in a private room, this was in the middle of the office, so anybody could walk up and see bank account details and salaries!

When questioned, it turned out their Finance Director was working from home, and hadn't bothered to contacts anyone to retrieve the documents. So unsurprisingly, they received a non-conformity.

[19:55] Do not goad the auditor - A bit of advice from Steve "Never say 'this is our most secure room' to an auditor" – that is essentially a challenge, and one that you'll likely lose if you don't follow your own processes.

Steve put this to the test when someone had claimed only 3 people had access to a certain room. Out of curiosity, Steve used his visitor badge to gain entry, and asked if he was included in that 3. Obviously he wasn't, and this was simply down to access control being a bit muddled at that particular company.

[21:25] Mistaken Identity: Steve recalls a time when he was given a visitors badge with a completely different person as the photograph. It had no effect on the correct access rights, but amusing all the same.

He shares another story where he shared a waiting room with another Steve. When they called only the first name, the other Steve was taken into that business and questioned on ISO, to which the poor man had to inform them that he had no idea what they were talking about! Shortly after, the correct Steve was collected. But it goes to show how important it is to ensure you're giving access to the right people.

[24:20] Battle of the Broomsticks: Ian recalls another time when working in construction, when he had the opportunity to work at a horse racecourse. They were looking to achieve what was OHSAS 18001 at the time (now known as ISO 45001), and it was going so well until a few new hires came running across the stable yard wielding 2 brooms, battling like gladiators in view of their auditor.

Thankfully they weren't really harming each other, but it was enough for the auditor to raise a few questions about subcontractor controls. You really couldn't write the timing any better (or worse, I suppose!).

[26:15] Clearly a certified forklift driver: While Steve was working at a warehouse, the manager there stressed how well trained all of their forklift drivers were, how sensible they all were.

Though, Steve could see a person dancing, speeding and popping wheelies with his forklift over the managers shoulder. After he'd been alerted to the wannbe stunt driver, the manager went to have a word with them.

[27:30] Accidents don't happen after 5pm: Ian was working at a company that highly valued the use of PPE on-site, everyone did a good job of abiding by that, until it came to the end of the day. One person leaves across the shop floor in just a normal t-shirt and jeans, waving them all off happily as he leaves for the day.

He still had to cross the shop floor, and being off the clock doesn't make you invincible.

[29:10] Fire Door Dramas: Steve recalls a time during an ISO 9001 audit where he spotted a fire door had been blocked by pallets in a warehouse.

Another time he saw a fire door that was actually chained and padlocked!

On another occasion, a local council had put their rubbish bins outside the fire door for the building, and during a fire drill, they couldn't get out.

Ian states how many times he's seen signs ignored by drivers who park in front of fire exits. All this to say that a little awareness goes a long way.

[31:10] Emergency Plans for the avid reader: During an incident at an NHS hospital where they'd suffered a long term major power outage, Ian and the staff had found that the emergency plans were 144 pages long! With Senior responsibilities hidden away in an Appendix on the last few pages.

Well thought out plans are necessary, but the actual procedure needs to be something that can be followed in the event of an emergency. A little common sense should be applied when deciding what needs to be communicated.

[34:00] Risk Assessment disaster: While working with a team in a manufacturing plant, Ian helped them to streamline their risk assessment process as their previous one needed too many signatures to actually go anywhere. This bottleneck was resolved with months of hard work, or so they thought…

When it came to being audited, the auditor asked the team manager what happened to all of the risk assessments, he'd then pointed towards the Health & Safety Management and claimed they had them all, who had to admit that he didn't.

Later that evening a director called the administration and asked to hide all of the documentation, to which she rightly refused to do. This also linked back to when the auditor had asked about how the apprentices were trained, and it happened that the apprentice supervisor was on holiday and so they were just let onto the shop floor. Suffice to say, this didn't reflect well on the resulting audit results.

[36:30] Against the wire: Ian states that manufacturing companies are not famous for admin. He had one experience while trying to get a recertification booked in, which went up against the wire for their current certification running out.

The CB obliged and sent a very qualified Health & Safety assessor there, who took them to pieces. It didn't take long for him to point out that they had a really nice management system with no commitment from managers to use it.

A word to the wise – don't leave your recertification up until the last minute! If a CB tried to move your recertification past that expiry date, you can and should push back.

[39:00] Password palavers: Steve shares an experience when he interviewed a very organised PA who managed 7 Directors. At the end of the audit he pointed out a folder on her computer called 'passwords', to which she obliged to show him the contents. Predictably it contained all the usernames and passwords for various accounts the Directors owned.

She knew about the secure passwords policy, but no one could realistically remember that many! When Steve questioned the technical team, they states only selected people needed one, and she wasn't one of them. Steve pointed out that she did, and had done the best she could with the tools available, and gifted them a non-conformity as a result as they hadn't done a good job of ascertaining who should get additional security tools.

By the end of that day, the PA had their own password vault.

[41:30] A fire extinguisher as useless as a chocolate teapot: In another company Steve had noted that they still had a black fire extinguisher. When asked, the staff replied that they were all up-to-date as of 2007. On checking, it was revealed that it had last been serviced in August 1997 – so no, it was not in fact 'up-to-date'.

It may be innocuous to some, but when it comes to safety equipment, that could be the difference between life and death in an emergency.

[42:40] Technophobes in a modern age: Ian recounts a past quality audit he did for an engineering company. They require a lot of specific ISO Standards for that industry, and so the company paid a subscription service to ensure they had digital copies of all these Standards to refer back to.

One such standard was on verification, and on asking a particular quality engineer about how he verifies a specific product, he pulls out a printed hard copy of a standard from 1993. Ian was interviewing him in 2017, there had been at least 2 updated versions of the Standard out by that point. When probed about why he wasn't using the online standards library paid for by the company, he simply stated 'I don't like computers'.

[45:00] The case of the mysterious ghost file: Steve once had an audit with a relatively nervous member of staff, after explaining that all he has to do is explin how he works, the interview went rather smoothly.

At one point he photocopied a bit of paper, hole punched it and filed it away on a shelf in the corner. Steve initially thought 'good admin, he's clearly following a process', so when he returned Steve asked why he filed that particular bit of information away, to which the staff member said 'I don't know, I've just been told to do it'.

Steve then questioned the Quality Manager there about that document and they replied with the same. He then questioned the warehouse personnel to get the same answer.

So, you have this document being photocopied over and over, filed away each time and no one knows why! Steve politely pointed out that it might be a good idea to rethink that pointless process.

[47:50] Useless numbering systems: Ian had a similar experience with a numbering system that nobody knew the origins of. The staff involved simply shrugged it off and stated it was simply just what they used.

Ian decided to put something to the test, by getting rid of it. He removed an entire archive system from a company's network folder, as back then file space was a big cost and concern. He kept the files and waited to see if anyone actually needed them. After months, he only had 2 requests for documents.

It's important to ask both what is and isn't working well. Getting input from all levels of staff can be eye opening, and empower those employees who can help shape up company processes to work more efficiently.

[49:50] Allergic to Audits: Ian shares a secondhand story where a trainer for the HSE was conducting a site visit, where he needed to question the shop supervisor on a few things. He asked him for something he couldn't see, and the guy agreed to go get it, and just never came back. Apparently he was so scared of the auditing process that he just went home!

[54:00] Shady police and stolen cars: One of Steve's previous clients had an experience where what they thought was a policeman asked about a hire car the company owned, stating it had been involved in a crime. They didn't think much of letting him take it for his 'investigation'.

Later when the hire company asked about getting their car back, the staff let them know what happened, rightly confused this led to a lot of discussion. As you can probably tell, the man was not a policeman and had made off with a nice shiny BMW simply by asking for it.

If something like this happens to you, always ask for documentation from the police.

[55:00] The Great Computer Caper: Ian recalls a training centre incident where a lot of computer equipment is stored in one suite. One day a few guys came in and started lifting stuff out, people were holding doors open for them, not at all thinking them to be thieves. Low and behold, they were and took everything.

Steve recounts a very similar experience where the thieves posed as a computer service company, stripping the entire office on a Friday afternoon. It wasn't until Monday when everything was still gone that people thought to question who those people really were.

Thank you all for a great 2024, we look forward to bringing you more ISO tips and success stories in 2025.

We'd love to hear your views and comments about the ISO Show, here's how:

● Share the ISO Show on Twitter or Linkedin

● Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List