13.2 Audit Tools, Tracing Techniques & Audit Communication

Why an Inspector Studies Audit Tools

Section 12.3 covered what audits are and how the audit lifecycle runs. This section covers the tools that do the work, because a quality inspector meets them from both sides: as the person being audited, whose records must survive a trace, and increasingly as an internal auditor or a member of a supplier audit team.

---

Audit Tools

Checklists

An audit checklist converts requirements into a sequence of things to look for. It is built from the audit criteria — the standard clauses, the customer requirements, the organization's own procedures, and the risks identified in planning — and it exists to guarantee coverage, provide a consistent basis across auditors and audits, and give the auditor a structure for note-taking.

Two rules define its proper use:

1. The checklist is a coverage aid, not a script. Reading questions verbatim from a page produces yes-and-no answers and no evidence.
2. The checklist is not the scope boundary. When an auditor encounters something concerning that the checklist did not anticipate, the auditor follows it. An audit that stops at the end of the checklist while a visible problem sits unexamined has failed at its purpose.

A well-built checklist line records the requirement, the evidence to be examined (which record, which sample, which observation), space for what was actually seen including document numbers and dates, and the conclusion.

Log Sheets and Observation Records

Log sheets capture raw observations as they happen: sample identifiers, document and record numbers, revision levels, dates, names and roles of people interviewed, equipment serial numbers, and what was seen. Their value is specificity. A note reading "calibration records reviewed, all good" supports nothing later; a note reading "reviewed calibration records for gages 4471, 4512, 4588, and 4610 on 2026-08-14; 4588 shows a due date of 2026-06-30 and remained in service until 2026-08-02" is a finding with evidence attached.

Contemporaneous recording matters. Notes reconstructed after the closing meeting are weaker evidence and are easier for an auditee to dispute.

Sampling Plans in Auditing

Audits sample; they never examine everything. Audit sampling comes in two forms:

• Judgment (non-statistical) sampling deliberately targets areas of higher risk, new processes, recent changes, prior findings, and characteristics with severe consequences. This is the dominant form in management-system auditing.
• Statistical sampling applies a defined plan so the result supports a quantitative inference about the population. It is used where an audit needs a defensible conclusion about a rate — for example, verifying the effectiveness of a corrective action across a large record population.

The essential honesty rule is that a sample supports a conclusion only about what it represents. Examining four calibration records and finding all four compliant does not establish that the calibration system is compliant; it establishes that those four were.

Document Review Versus Record Review

This distinction is tested directly.

An audit needs both, and the pairing is where findings come from. A procedure requiring a first-piece inspection on every setup is a document. The travelers showing that first-piece inspections were actually performed and recorded are the records. Auditing only the documents finds a well-written system that nobody follows; auditing only the records finds activity with no way to judge whether it was the right activity.

---

Forward and Backward Tracing

Tracing follows a thread through the system to test whether the linkages actually hold. It is the most powerful single audit technique because it crosses departmental boundaries and exposes gaps that a clause-by-clause review never reaches. Section 9.5 covers tracing as a product traceability discipline; here it is an audit method.

Forward Tracing

Start at an input — a purchase order, a receiving record, a raw material lot, a customer order, a design input — and follow it forward through every step to the finished, shipped product.

Forward tracing tests completeness: did every required step actually happen, in order, with the required evidence?

Worked thread: purchase order for bar stock, to the receiving inspection record, to the mill test report and its lot number, to the material tag, to the work order that consumed it, to the setup and first-piece approval, to the in-process inspection records, to the final inspection report, to the certificate of conformance, to the packing list and shipper. A gap anywhere in that chain is a finding.

Backward Tracing

Start at an output — a shipped unit, a finished-goods item, a customer complaint, a final inspection record — and work backward to its origins.

Backward tracing tests support: is every claim in the final record backed by evidence?

Worked thread: the certificate of conformance states conformance to a drawing revision, so which drawing revision was on the floor? The final report shows a diameter measured with gage 4588, so was 4588 in calibration on that date? The traveler shows an operator stamp, so was that operator trained and was the stamp assigned to them? The record shows a heat treat certification, so does the furnace chart cover that load?

Why Auditors Use Both

Forward tracing finds missing steps. Backward tracing finds unsupported claims. They fail differently, so a thorough audit runs one of each. Backward tracing is also the natural technique when investigating a specific complaint, and forward tracing is the natural technique when verifying that a newly implemented process is being followed end to end.

---

Communication Tools and Techniques

Interviewing

Most audit evidence begins with a conversation, and the technique determines whether that conversation produces information.

Question types:

The funnel technique moves through those types in order within each topic: open the topic broadly, probe what emerges, then close to confirm.

Practices that produce good evidence:

• Interview the person who does the work, not their supervisor describing it.
• Ask them to show you, then observe. Demonstration beats description; observation is the strongest form of objective evidence.
• One topic at a time. Compound questions produce partial answers.
• Avoid blame-framed questions. "Why didn't you follow the procedure?" produces defensiveness; "Can you show me how this step is normally done?" produces the process.
• Use silence. A pause after an answer frequently produces the most useful additional sentence.
• Read back what you heard to confirm accuracy before writing it as evidence.
• Never interview to trap. An audit establishes conformity, not guilt, and an adversarial interview shuts down the information supply for every future audit.

Active Listening

Active listening is a skill the BoK names explicitly. It comprises attending (eye contact, open posture, no interruption), paraphrasing ("so the gage goes back to the crib at the end of every shift"), summarizing at the end of a topic, and noticing what is not said — hesitation, a changed subject, or an answer that describes the ideal rather than the actual. Language and cultural differences require extra confirmation; so does technical jargon that means different things in different departments.

Graphs, Charts, and Reporting Aids

Audit results have to persuade people who were not there. Visual aids do the work:

• A Pareto chart of findings by clause or by process identifies where the system is weakest.
• A trend chart of findings over successive audits shows whether corrective actions are holding.
• A repeat-finding chart is the single most persuasive exhibit in a management review, because a repeated finding demonstrates that a previous corrective action failed.
• Tables of finding, requirement, and evidence make each item auditable in its own right.
• Photographs of an observed condition, where permitted, remove argument about what was seen.

The finding statement itself has a standard three-part structure that makes it defensible:

1. The requirement — clause, procedure, or specification, cited exactly.
2. The objective evidence — what was seen, with identifiers and dates.
3. The nonconformity — the specific way the evidence departs from the requirement.

Example: "Procedure QP-7.1.5 section 4.2 requires that gages be removed from service on their calibration due date. Gage 4588, with a due date of 2026-06-30, was observed in use at station 12 on 2026-08-14 and appears on inspection reports dated 2026-07-08 through 2026-08-02. The gage remained in service 45 days past its due date."

Note what the statement does not contain: a cause, a blamed individual, or a proposed fix.

Meeting Communication

The opening meeting confirms scope, criteria, schedule, and logistics, and sets a cooperative tone. The closing meeting presents findings with no surprises — anything presented at closing should have already been raised with the process owner when it was observed. Findings are stated factually and the auditee is given the opportunity to respond, correct a factual error, or produce evidence not available during the audit.

---

Corrective Action Requests

A corrective action request (CAR) is the formal instrument that converts a finding into improvement.

What a Good CAR Contains

• The requirement that was not met.
• The objective evidence, with identifiers and dates.
• The nonconformity statement.
• The classification (major, minor, or observation).
• A response due date and a corrective action due date.
• Space for the auditee's containment, root cause, corrective action, and effectiveness verification.

What a Good CAR Does Not Contain

• A proposed solution. The auditor identifies the nonconformity; the auditee owns the root cause analysis and the corrective action. An auditor who prescribes the fix takes ownership of the outcome and forfeits independence in verifying it.
• A named individual as the cause.
• An opinion unsupported by evidence.

Correction, Containment, and Corrective Action

These three are distinct and are heavily tested.

A CAR response containing only correction — "the gage was calibrated" — is incomplete and should be rejected. Section 12.3 covers the CAPA workflow and verification of effectiveness in detail.

How CARs Drive Improvement

CARs are only worth their administrative cost if the organization uses them as data. Aggregate CAR analysis answers questions no single CAR can: which processes generate the most findings, which corrective actions failed and produced repeat findings, how long CARs take to close (CAR aging), and whether verification of effectiveness is actually being performed. Those aggregates go into management review and drive systemic improvement, and a rising repeat-finding rate is a direct signal that root cause analysis in the organization is superficial.

Supplier corrective action requests (SCARs) are the same instrument directed outward, and the response is evaluated by the same standard: containment, root cause, corrective action, and evidence of effectiveness.

---

Common Exam Traps

• Documents versus records. Documents say what is intended and are revised; records prove what happened and are never revised, only corrected.
• Forward versus backward tracing. Forward starts at the input and finds missing steps; backward starts at the output and finds unsupported claims.
• The checklist does not bound the audit. Follow evidence wherever it leads.
• The auditor does not determine root cause or prescribe the fix. The auditee owns both.
• Correction is not corrective action. Fixing the instance is not fixing the cause.
• An observation or opportunity for improvement is not a nonconformity and does not by itself require a CAR.
• Objective evidence has a hierarchy. Observation and records outrank an interview statement, which is why auditors ask to be shown rather than told.