An audit is a systematic and documented investigation to determine if prescribed processes are functioning as intended. We audit to find out whether processes are working properly, where they are not working properly, and how to address identified gaps. No matter how diligent the staff is in following procedures, there are nearly always revelations indicating needed corrections and opportunities for improvement. Whether an audit is conducted as part of a due diligence process, to evaluate management system effectiveness, or to assess routine EH&S compliance, the audit process allows us to reset the system back to where it should be.
Types of Audit Surprises
Since there is a high likelihood that audits will reveal unexpected problems, it is important to understand how to handle those surprises. Every situation is different in the specifics, however, negative findings generally occur in a few primary categories: legal violations, procedural discrepancies or corporate system violations. Legal violations will, of course, require immediate attention. In the case of a safety issue, it may be critical to isolate the problem immediately to reduce the possibility of injury. If there is an environmental compliance issue, it may be necessary to mitigate the situation. In situations of lesser urgency, it may be sufficient to simply stop the situation from continuing while an investigation is conducted to identify the root cause of the problem.
When investigating a potential legal issue, it is important to refrain from jumping to conclusions. A careful analysis is needed to determine if an actual violation exists. If the problem is a system or procedural violation, rather than a legal one, it still may be important to act quickly to prevent a financial loss. No matter which type of issue exists, it is critical that the situation be investigated thoroughly, the root causes discovered, and appropriate corrective actions taken. Below are a few real-world situations for illustration.
- During a regulatory compliance audit at a chemical and components parts manufacturer, the auditor discovered that the company's wastewater discharge from a large parts washer associated with their painting operation was being sent to a municipal water treatment system. The company believed they were obeying the law because they were operating within the limits of their state- issued NPDES permit. They had made an earlier decision to stop discharging to the local creek and route their discharge directly to the city system instead. In making this change they failed to consider city sewer ordinances which had tighter limits than their permit. When the audit revealed the problem, the initial concern was that a violation of the city ordinance existed. A careful investigation revealed that although their system would have allowed for a legal violation, their records revealed that no actual violation had occurred. The audit found the problem before any violation had occurred and gave them the opportunity to take appropriate corrective action without any legal difficulties.
- In a similar audit, a different company, that has an excellent reputation for safety, redesigned a room to include explosion proof electrical fixtures for the storage of highly flammable solvents. The audit revealed an improper repair of one electrical fixture in the room. The repair compromised the explosion proof design and created a major fire risk. Immediate action was needed to assure the safety of all involved. The audit made it possible to eliminate a serious fire hazard.
- At a telecommunications company that designed its products and new facility without asbestos, an auditor was assured that there was no asbestos onsite. Never-theless, the auditor discovered asbestos in the hazardous waste shed. The subsequent investigation revealed that the company's installers were cleaning up the waste they created at their clients' sites and were returning it to the company shed. This included the dust created from drilling through floor tile that contained asbestos. The environmental manager was previously unaware of the practice. The audit revealed a situation that required correction due to both safety and environmental concerns.
Identifying the Root Cause
All three of these situations required some form of corrective action but the causes varied considerably. A root cause analysis is an effective way to determine the true reasons for the problem, leading to corrective actions that are permanent rather than quick fixes. A simple technique for performing a root cause analysis is known as the 'Five Why' approach. Don't just ask why a problem occurred but rather ask 'Why?' five times consecutively. For example, consider the scenario above at the chemical company where the city sewer ordinance was not considered. The 'Five Why' approach might look like the following:
Problem Statement- The wastewater was being sent to the POTW without considering the limits of the city sewer ordinance.
WHY #1 - We thought the State NPDES Permit covered the waste water discharges.
WHY #2 - We were unaware of the City Sewer Ordinance.
WHY #3 - We failed to research the legal implications when we made a change to the plant's handling of wastewater.
WHY #4 - We did not inform the plant environmental manager of the plant change.
WHY #5 - The plant environmental manager is not routinely copied on plant infrastructure changes.
If the staff stopped at WHY #1, they would have corrected the potential problem of a violation of the city ordinance but not addressed the root cause. As a result, there could have been a reoccurrence of the issue when a different plant infrastructure change occurred. The root problem was not the legal one but rather that the environmental manager was not being informed of changes that could affect plant compliance. The 'Five Why' process revealed the root cause that will allow them to address the immediate problem and prevent the problem from reoccurring in the future. Of course, simple problems may not always need to have five levels of asking 'Why?' and complex issues may require deeper investigation. The concept, however, is to repetitively ask 'Why?' until the root cause is identified.
The strength of the 'Five Why' approach is its simplicity. This encourages its use in a wide variety of situations. On the other hand, more complicated situations may require a more in-depth evaluation. A modified version of the 'Five Why' approach is usually needed when multiple root causes are found. In these cases it is usually best to break down each root cause separately by dividing them into categories such as:
- People - training, human behavior, ergonomics, communications
- Equipment - infrastructure, maintenance, capital expenditures
- Environment - physical conditions, culture, weather
- Materials - industrial hygiene, consistency, handling, transportation
- Methods - policies, procedures, systems
Each category may contain a separate root cause to a problem. A Cause and Effect Diagram (Fishbone diagram) is often an excellent tool for analyzing the various root causes. In the simple example above there are indications of root causes in the training, communications, infrastructure and systems categories. The company had failed to train the Facility Engineer about the compliance consequences of rerouting wastewater discharges. There were communications issues among the Operations Management, Facilities department and the EH&S department. The infrastructure may have been in question due to improper labeling of the facility piping or out-of-date facility drawings. Finally the system of making facility changes without considering the EH&S implications indicates a weakness in the maintenance & capital improvements procedures. Each category's root cause could involve a different aspect of the problem's resolution.
It may be of value to next consider doing an FMEA (Failure Mode Effects Analysis) to explore all the possible means of the process failing and the methods of prevention. In complex cases, it may be desirable to use Scatter Diagrams and Correlation Analysis to determine trends and to find the central reality in the mass of seemingly inconsistent data. Statistical Process Control techniques may also be used to analyze and monitor processes when multiple root causes are having a variable effect on the outcome. In evaluating all of this, it is important to remember 'Occam's Razor' which states that when multiple competing theories exist it is usually the simplest one that is correct. In other words, we should start with the simple and work toward the complex to ensure the potential benefit is greater than the risk.
Although surprises are common during audits, handling them with a thorough examination of the facts, a careful analysis of the requirements, and a diligent focus on root causes can lead to appropriate corrective actions. Of course, there was also an audit of a plastics manufacturer that 'unearthed' a four foot snake living in a storage area. Now that was a surprise of a different nature!