Second SQF Audit coming in 6 weeks, Advice?
We will be having our second SQF Audit coming up in the beginning of October, looking for any and all advice on what you would have done differently, what I should expect, what I should do to prepare.
Obviously, we have fixed all the NCs from the first audit, we had a few minor issues that were easy corrections either day of, or week after. All our corrective actions were corrected and approved, just wondering if the auditor will change things up on the second go round.
We already know we will have the same auditor. He was a very nice, informative auditor, and helped me figure out easier ways of doing things, making things less complicated. So, I would assume the same will be of him this go round.
Just looking to see if audits change from year to year, less lenient, more by the book, or should I expect the same frame of mind he gave us last time?
Thanks, it's getting easier every day, don't feel like I'm losing hair this time around.
Expect a similar experience if it is the same auditor. In your shoes I'd verify myself that all the NC corrections from last year are still working as intended and correctly implemented. You can bank on the auditor finding more things (NC's), try to treat it as an opportunity to improve. I always find it helpful to do a more in-depth pre-audit walkthrough (or several) of the facility. Usually 6 months, 3 months, and then the month prior to audit is how I do it. I'm looking for things that might be getting missed on my monthly GMP audits. Also, it gives me insight into how I can expect the audit to go.
Half the battle of an audit lately is getting a decent auditor (knowledgeable, not a jerk, etc.). Sounds like you got a good one!
Good practice for any non con, review the issues from your previous audit and look at the root cause analysis. Has it genuinely identified the root cause? If so, have the preventive actions been done, not just the correction? The reason I'm raising this is firstly, it's common to miss it but secondly when someone says "we corrected it on the day..." it sets my spidey senses tingling that the fix to the problem has been applied but not what caused the problem.
It is also really worth getting your senior leadership and leaders reports in a room and reminding them, this is not an audit of technical / quality but an audit of the site and they are as much part of it if not most of what is being audited. So this is their chance to:
1. take ownership.
2. flag anything they're concerned about so you can fix it before the auditor arrives!
It also doesn't hurt to plan out the day a bit, e.g. who will support with the factory walk round etc.
Our audits the last two years were really close together as well. Odd. It went just as they always do for me, they're always gonna find something to write up. I just tell the auditor every year that we're trying our absolute best to live the plan every day, and I welcome them looking at us, because if we ain't doing it right, we wanna be....which is true. So imho anyone who walks the line every day as best they can has no reason to fear an audit.
I'd run a GAP analysis now and fill in any gaps that may have cropped up - then you'll be good sailing and it sounds like you have a good auditor too.
If last year was an initial audit for your company, you may find the auditor a bit more stringent this year especially on the topic of record keeping. If last year you had any moments of "aw shucks, we just started this new program, so we only have a couple months of records," that was fine back then but now he'll ask to see the years' worth of records to pick through and review. But generally speaking if you had a good experience with the auditor last year, you're likely to have it again. Obviously they won't let things slide, but they're also not likely to come in loaded for bear.
I echo the above about the GAP analysis. Make sure you've reviewed your FSQMS to the SQF standard, they love it when you use the downloadable template from SQFI's website. Keep in mind the code requires you provide objective evidence for each line of the code as to how you're either compliant or non-compliant. Yes, they basically want to you audit yourself and have the cheat sheet available to the auditor. Yes, it's annoying lol.