I have always valued the process-based management system (PBMS) approach based on the ISO standards as the best start to designing and implementing a management system that produces confirming products and services. Over time with continual improvement the system should give the ROI (return on investment). The management system is not a magic trick, agreed, it all depends on the implementation. The system starts in a responsive manner where NCs (non-conformities) drive correction and CA (corrective action). The system then matures and becomes proactive when data drives risk and trends. The internal audits should give the leadership the inputs to better resource and continually improve the system. Yet I see organizations end up with a “checklist-style” audit where these frustrating audits do not provide the inputs to improve the system. It is often because audits treat a living system like a static inventory. Most audits miss signals because they focus on conformity (did you do what you said?) rather than capability (does the process achieve the intended result?). The intend should be to bridge the gap between “compliance” and “performance.”
The illusion of compliance pays the price. Most ISO audits fail to detect systemic rot because they are designed to find missing records, not broken logic. That is because auditors fall into the checklist trap. Standard auditors often follow a linear path. If the “management review” happened and the minutes exist, they check the box. Then there is the “paper thin” system where organizations have become experts at “audit-ready” documentation that masks operational chaos. Finally, the auditors focus on output and not on outcome during the audits, they often verify that a process ran but fail to ask if the process is healthy.
The question then is why the “signals” are missed? System failures rarely happen overnight; they emit “smoke” long before the fire. Standard audits miss these because:
- Siloed Auditing: Auditors look at Department A and Department B separately, missing the friction and “white space” between them where most failures occur.
- Sampling Bias: Auditors often let the guide choose the records. Experienced auditors know that the most telling data is usually in the “messy” folders the guide is trying to steer them away from.
- Metric Manipulation: If a KPI is 99% green but the customer is complaining, the system is failing. A standard audit sees the 99% and moves on.
Therefore, the need is to see how experienced auditors “hear” the system. Veteran auditors move beyond the “what” and the “where” to the “how” and the “why.” They use a PBMS lens to detect:
- The “work-around” signal, when employees have a “shadow” spreadsheet or a personal notebook to get the job done, the formal system has already failed.
- The “quality debt” signal where recurring “minor” non-conformities are often symptoms of a single “major” systemic bypass.
- Language patterns when experienced auditors listen for phrases like “we usually do it this way, but for the audit…” or “that person is the only one who knows how that works.”
The need is for auditors to transition from “auditing for points” to “auditing for risk”. To truly add value, the audit must evolve into a diagnostic tool.
- Vertical vs. horizontal auditing where instead of checking a department, follow a single order from “quote to cash” to see where the process bleeds.
- The “stress test” approach where auditors ask, “what happens if this person is out?” or “what happens if this supplier fails?” to test system resilience.
The key takeaways so far could be summarized as:
- The process is the patient. Treat the audit like a medical check-up. Don’t just check the pulse; look at the lifestyle and the underlying vitals.
- Stop re-inventing, start refining. Since you believe in standards, emphasize as an auditor, that the ISO standards already require a process approach. Most people just ignore it in favor of the easier “clause-by-clause” approach.
As an example, we can consider a perfect paper audit that is followed by a major product recall, as indicative of illustrating the compliance-performance gap. The occurrence of a mishap, or a rejected product soon after a perfect audit should make an organization investigate its auditing effectiveness. It is necessary to take the great deep-dive and shift the focus from “did they follow the process?” to “is the process actually functioning?” is what separates a tick-box auditor from a system specialist.
In a standard audit, if the records are signed and the dates match, the process is marked “effective.” But experienced auditors know that a perfectly documented process can still be a failing one. To detect the signals most miss, you must look at the friction points the places where the “official” system meets human reality. Avoid the Illusion of compliance. In the world of ISO standards, there is a dangerous comfort in a “clean” audit report. As a specialist in process-based management systems (PBMS), I have always believed in the power of standards. Why re-invent the wheel when a global framework for excellence already exists? Yet we see it constantly: organizations pass their surveillance audits with flying colors, only to suffer a catastrophic service failure, a massive product recall, or a sudden dip in profitability weeks later.
In conclusion I would caution organizations, audit clients and auditors to stop auditing the paper, and to start auditing the pulse. If we continue to treat ISO audits as a “pass/fail” hurdle for a certificate, we do a disservice to the discipline of management. A standard is not a ceiling; it is a floor. It is the “wheel” that shouldn’t be re-invented, but it must be maintained, balanced, and aligned.
Any organization’s call to action may be called the “value-add” challenge where the organization changes the lens for the next audit cycle to:
- Ditch the clause-by-clause audit to follow a single order from “quote to cash” rather than checking department folders.
- Search for the “shadows” and look for the post it notes and cheat sheets. They show you where the formal system is failing to support the staff.
- Ask “why” Five times to root cause the system. Refuse to accept “human error” as a root cause. Dig until you find the process flaw. Blaming is easy but not the answer.
The goal of a Process-Based Management System is to create a resilient, predictable, and scalable organization. Let’s stop auditing for compliance and start auditing for capability. At QMII we train our auditors for this.
—
This article was written by IJ, Principal Consultant at QMII. With extensive experience in ISO standards, auditing, and organizational transformation, IJ has guided global organizations in strengthening their management systems. His approach focuses on aligning ISO implementation with strategic business objectives to drive long-term performance improvement.
