Garry Cornell outlines an approach to auditing that focuses on the outcome
The case against the environmental industry is that it has spent the past 30 years failing to arrest global climate change, tackle resource depletion and prevent ecosystem destruction. Moreover, ISO 14001 certification has squandered billions of pounds’ worth of investment and resources on a global scale, resulting in nothing but a mass of documents.
The case against 14001 auditors, both internal and external, is that by relying on documented procedures, registers and records to provide evidence, they have failed to harness the critical purpose of the international standard for environmental management systems. A UKAS auditor once said: ‘The purpose of audits is to check documentation and that procedures are being followed.’ No, they are about far more.
Now the profession has a new standard, 14001: 2015. You can almost feel the frustration with the previous version in the demands set out in the update: leadership and commitment; no more asking for documented procedures; understand externalities to the business. It could not be any clearer if the standard was renamed: ‘For God’s sake, do something for the environment.’
However, if we continue to audit the revised standard in the same way as in the past, we will continue to fail to deliver change.
Outcome-based auditing
Outcome-based auditing is simple and has big advantages over traditional auditing processes. My proposal is that using this method for 14001 audits could help auditors and auditees to deliver far better results from the outcome. There are four stages to outcome-based auditing (see below).
1. Define expected outcomes
The auditor and auditee define and agree expected outcomes. In 14001, these are:
- protect the environment;
- meet compliance obligations; and
- continuous improvement.
All the remaining requirements of the standard are the mechanisms by which these outcomes are achieved. Practitioners will recognise them as the commitments made in an organisation’s environmental policy. This is why they are in the policy, which is signed off by senior management and made publicly available. They represent a pledge by the organisation to achieve environmental goals and that stakeholders – including shareholders, neighbours, customers, suppliers and employees – can expect results. The role of the auditor is not to assess whether mechanisms are in place to realise these objectives, but to provide assurance that the outcomes are being achieved.
2. Suboptimal outcomes
Next is to test whether the expected outcomes are being achieved. There are many ways to do this:
- Start by looking at reality before you dig into paperwork. This makes the audit more time-efficient and prevents the auditor being ‘brainwashed’ by the auditee into believing everything is working like the paperwork says it should. It is a matter of applying some basic psychology to the process. Find out what happens in practice and look at the documents later if it helps you to understand what you are seeing.
- Start on the outside and work your way in. In most cases, better results occur when management is focused on environmental issues. Management attention tends to be drawn to the core business. By implication, less attention falls further away from the core and to the area where more environmental issues will be found (see panel, below).
- When looking for suboptimal outcomes, remember the expected ones. Look for examples of poor environmental controls, unnecessary or badly managed impacts and standards of compliance.
- Always try to understand what is happening and why. Use each suboptimal outcome as a discussion point. Who, why, when, where?
- Do not accept the challenge that the situation you are seeing is acceptable, if you believe it isn’t.
- The audit needs your professional judgment. You must apply your knowledge and experience. This is why you are conducting the audit. If you do not feel comfortable in that position, you ought to think about developing your technical understanding first.
- Do not rush. Remember that the devil is in the detail. Go too fast and you will miss that detail; what is happening in reality. I would advise that this should take up at least 50% of the auditing time, if not 75%, if it is done properly.
- Share everything. Aim to ensure the auditee is fully aware of any of the issues you have identified. There should be no surprises.
- Take photographs. They make outcomes more interesting, and it is easier to share and discuss what you have found.
- Do not accept a quick fix. Even if problems are fixed quickly, they remain valid because they were present before the audit started. Remember that suboptimal outcomes are evidence that leads to a conclusion, not the end itself.
3. Causal analysis
This stage focuses on gathering and analysing the root causes for the issues you have found. Techniques such as ‘5 Why’, ‘Fault Tree Analysis’ and ‘Fishbone’, which are ways to explore the cause-and-effect relationships underlying a particular problem, could be used for this, but there are other approaches:
- Capture each suboptimal outcome on a Post-it note or a Powerpoint slide. Group them together with similar causes or similar locations, situations or behaviours for further assessment.
- Another approach is to use 14001, allocating each suboptimal outcome to a clause, so you can evaluate the elements that did not work well.
- Develop a process flow of how the standard should have been implemented. For example: commitment; communications; capability; competency; checking; and corrective action. Where in the process was there failure?
My tips for this stage would be:
- Include in the process the management team, or at least the auditee, to share what you have found and why it is an issue. It allows discussion about where issues lie and, in some cases, what needs to change.
- Remember that you are trying to discover why something has happened; not just within the requirements of 14001 but in the wider management approach.
- Look for inconsistencies between different management disciplines, especially between environmental management and the way other issues are managed. Why the difference? Is management using other techniques that are working better?
- All managers and organisations prioritise. Sometimes it is not always clear how decisions are made or what the priorities are.
- It is hard for most management teams to acknowledge lack of commitment or attention to a subject as a reason for problems. However, if this is sitting behind the issues and causing the problem, it is the responsibility of the auditor to bring it into the open.
- It is often easy to focus on behaviour or culture as an answer to systemic issues. However, these are both the result of active decisions and actions. Ideally, the audit needs to identify what these are.
4. Non-conformance and improvements
Once you understand why the expected environmental outcomes are not being achieved, it is a simple matter to link the causes to the clauses in 14001. This is the stage when the advantages of outcome-based auditing become easier to see, particularly when assessing compliance with clauses of the standard that do not require documented procedures. Leadership and commitment, for example, is not a clause that is assessed on the available evidence, rather it is based on the evidence that it is the root cause why environmental outcomes are not being achieved.
Many different questions
Outcome-based auditing is a simple approach but asks many questions of the organisation being assessed. It tests principally whether environmental outcomes are being delivered and where there are gaps. It then asks what caused them and why? With this evidence, it assesses the conformance against the requirements of 14001.
Ask yourself: How much more valuable would an audit be if it provided a test of environmental performance in practice and then gave an indication of where there were weaknesses in management systems? Would we not then start to make a significant impact on organisations’ environmental performance? Would we then not see the revised 14001 standard make a palpable difference in our world?