Note: this article is the transcript of an interview conducted on March 1, 2021.
World of Auditing
Hi Agnieszka! Many thanks for having accepted this interview and share a little bit on your experience in auditing. Could you please present yourself and explain where you are coming from and what company you are working with?
A. Sobolewska
My name is Agnieszka Sobolewska. I’m coming from Poland, but I live in Antwerp in Belgium right now. I work as a QA compliance specialist for a leader in the medical healthcare industry. My background is related to microbiology and quality management and, I have worked between medical devices and the pharmaceutical industry for over 11 years. It was changing throughout my career. I also worked for the food industry for a short period and have been a freelancer for quite a while, so working now as a permanent QA compliance specialist for a global company has been a change. Still, I took this role because many new regulations were coming up (i.e., EU MDR) and I was seeking a development, including in the auditing area.
For example, I am going to lead five audits in my company this year. They will be related to different departments, but as a member of QA team I cannot audit the quality department so, it will be out of scope. My company is a good place to develop for me right now, so that’s the benefit.
World of Auditing
I’m discovering this business. What kind of products is your company placing on the market?
A. Sobolewska
I’m a part of the image-guided therapy devices. We place systems in hospitals that, with the help of wires or catheters, navigate through the veins. That’s just the very simple explanation of the part of the business that I’m working for, but we also have different branches of IGT systems where you would see bigger devices like PET scans, Roentgen or MRI… We also actually have different divisions like toothbrushes, microwaves, and coffee machines. However, I do not have much contact with these divisions.
World of Auditing
So how did you discover the audit function?
A. Sobolewska
It has always been a part of my job one way or the other. I started my career in a medical device company. There, I was a QA associate and was participating in preparing the site for the audits. Then, throughout my career, when I switched to the pharma industry, I was responsible for managing the QA audit system and compliance on that site, so I worked in the backroom, supporting and delivering the data to the auditors. Then, I worked in the food industry as an internal lead auditor, auditing the production lines in ongoing process, checking if they are complying with the HACCP requirements and all the cleanness and GMP standards. After that, I moved to work as a lead investigator. I was dealing a lot with the auditors because, as a consultant, I was a part of the FDA remediation project related. Hence, we encountered them twice in the same year, and we were trying to bring the site up to speed.
When I joined my actual company, it was part of my job since the very beginning because I was looking after the external audits. Now I’m a qualified lead auditor, so I have scheduled and written the risk assessment for the audits that will happen this year.
World of Auditing
It was always part of your job in one way or the other. What did you find exciting about auditing?
A. Sobolewska
It’s a lot of things because you’re finding a way of learning different things, of improving things. So each time when you are a part of the audit, you’re listening to the point of view of someone else (i.e., external auditor) and you realize that you could not notice this previously because when you are already with a company for a while, you might stop seeing things because you are an integral part of it. It’s not always easy to improve things, but when the auditors are coming on-site, they have a fresh pair of eyes. They look at things in a little bit different way because they don’t know your processes. They don’t follow it daily. I think that’s what made me think about auditing more seriously and led to obtaining the lead auditor certification.
In the future, I want to have an opportunity to see different companies and different processes and maybe improve them from my experience and perspective.
World of Auditing
Excellent! Variety and improvement. Would you recommend this function to anyone, and if so, why? And I guess a lot of the “why” comes back to what you just said.
A. Sobolewska
It’s an excellent opportunity to develop your knowledge in different areas. When you already know some regulations related to one industry, you can still gain knowledge in a different industry. And you know, every industry has to be audited against various standards, so you are constantly developing, which keeps your work interesting. You are also meeting a lot of people from who you can obtain knowledge, see their perspective and learn a lot from them. That’s why I would recommend it.
World of Auditing
Excellent. Is it hard to audit?
A. Sobolewska
It depends on who you are auditing and how comfortable the auditees are with you. Sometimes there is a situation when the auditor is coming, and auditees have this fear that you are just trying to damage their reputation. They don’t always see that as a positive thing, so sometimes it can be challenging.
But I do have good experiences with audits (external/internal). I’ve always worked with very experienced people, very knowledgeable, and it wasn’t difficult. There was never a problem.
World of Auditing
You started as a young auditor. Did you face some specific issues linked to the fact that you were not as experienced as you are today?
A. Sobolewska
I think the main thing is that you need to keep yourself updated. When you are auditing, and the regulations are changing, you have always to be on track. That is a challenge because when you are working as a QA compliance specialist, an audit is not the only thing that you’re looking after, then you need to make sure that you’re going to find the time to read if there is a new ISO requirement or if there is an update, what has changed. For example, there were some regulation changes in a South American country, and I had to attend this country’s seminar. Even though the time zone difference, I needed to accommodate that because it was my only chance, and I was required to know the regulations because my company sells products in that country. So, I think that “to be always updated” is the most challenging part.
Also, you need to make sure that you have a strong personality because you never know who you are going to deal with. You need to be straightforward and confident about what you’re asking for, you need to have the background knowledge. So, in the beginning, when I started and because this knowledge was still building, I think that was the biggest challenge.
World of Auditing
And knowledge brings credibility. I don’t think that what you are explaining is different from one sector to the other? You would have faced the same kind of issues in other types of business.
A. Sobolewska
I’m pretty sure that is in any business.
World of Auditing
Agnieszka, what are for you the main technical skills for auditors?
A. Sobolewska
I think that statistical sampling, data analysis, and risk management are crucial in building an auditor role. The certifications related to specific regulations are very important as well. I think they are the most important ones. Also, technical writing is important because when you’re writing the report, you want to make sure that you are explaining yourself well, being understandable to the auditee, what your observations are, and generally the results of your audit.
World of Auditing
You mentioned statistics, risk management, and sampling. Are these becoming more and more important?
A. Sobolewska
They have always been important, but right now, I think since we are a little bit limited because of the COVID-19, most of the audits are happening in a remote environment. In this type of auditing, you need to focus on the approach, so statistical sampling is crucial because you need to make sure that you will choose a good representative sample for what you are auditing. I would say that probably the importance of it is now reinforced.
World of Auditing
You mentioned COVID, but something else I have seen in my career is that resources are getting scarce. Companies tend to reduce the number of resources. That also means that this limited number of people need to focus on where the riskier areas are.
A. Sobolewska
Exactly, and that’s why the combination of the risk assessment, statistical sampling, and overall data analyses cannot exist separately. They need to be appropriately merged. You need to think about how you want to approach it. For me, this statistical sampling and risk management are crucial for the auditor’s technical skills.
World of Auditing
What about soft skills?
A. Sobolewska
The very important thing is to be disciplined. You need to be detail-oriented because, as I said, when the regulation changes, it might be one sentence that is changing, but it has a crucial impact on the whole regulation. When you are doing a statistical sampling and choosing the area you want to focus on, and you are following a risk approach audit, attention to detail is crucial. So, I would say that the top two for me are discipline and attention to detail.
World of Auditing
In terms of reaction from auditees, what is your experience? How did you see auditees approaching audits, and perhaps also did you see any differences between sectors?
A. Sobolewska
I think it depends on where the audits are coming from. Some auditing bodies inspire a kind of fear. I have seen this scary reaction and I have also seen some positive reactions. When the authorities are coming, they are generally giving you a new perspective, something that you might not be able to see because you are already part of this company for so long.
On the other side, the fear can be created because someone said that such an auditor was hard because he/she required so many details or dug very deep into the pro. But it depends. I dealt with the really tough auditors that were amazing people on the private level, but that could have a scary reputation because they required many details.
World of Auditing
Could also the fear be linked to the impact the audit outcome might have on business continuation?
A. Sobolewska
Yes, but auditors, such a representative of regulatory bodies, nearly always give you time to prepare for the audit. It’s usually not from day to day that they are coming. So, if you’re running a successful business with some small issues, you still have time to fix them before the audit is coming. Suppose you are aware of your issues, which is a good thing. In that case, you might open some corrective actions already, so it’s easier to explain and discuss with the auditor on this specific point. Auditors usually never come unexpectedly unless there is a critical situation resulted from a recall or risk of death of patients.
World of Auditing
In the medical sectors, don’t you have unannounced audits like where the food industry moved to?
A. Sobolewska
Not really. It can happen but in a very rare situation. I have been working in the industry for over 11 years, and I never had unannounced audits, but I believe it could happen when you are probably releasing a new product that needs FDA approval. If they notice something wrong at the first audit, they could come back and not announce when they are coming back. But it is a rare situation.
World of Auditing
In the food industry, through the GFSI, this became a mandatory requirement. Certification bodies have to perform unannounced audits during the certification process, and I know that many global organizations also went for their internal audit through this process.
A. Sobolewska
I think that this can happen with internal auditors much more often than with external auditors. So internal audits are part of your company, so they could come and do the unannounced audit. However, as I said, I have not been a part of an unannounced audit in these years of my career.
World of Auditing
Regarding the added value provided to an organization, can you take us through maybe some thoughts or examples? Also, how is the auditor playing a role in this?
A. Sobolewska
Most of the audit results come with some type of observations (minor, major, critical). These are always leading to the continuous improvement to get the level of the company which is representing their best. External auditors, for example, have no background on the processes of the company and could see things differently and that can bring more benefits to the company. It does not necessarily have to be an observation, but it can be a recommendation of how the process can be improved. I think that the biggest value that the audits are adding to the company is the improvement.
World of Auditing
Interesting to hear this. If I’m correct, the fact that auditors have an external pair of eyes brings another lens and uncovers things that are even not seen anymore by the people who are working daily with the organization?
A. Sobolewska
Yes, because they know the general regulations, they know how the system is supposed to function. Still, each company has its own approach to this process defined in its quality policy. It is covering the requirements; however, you can cover these requirements in a million different ways.
For example, if you will look at the CFR regulations from FDA, they are pretty generic. You could find a sentence like “The documents have to be stored in archives” and you can have a million ways to do that. They can document everything paper-wise, which is right now the most obsolete version because when you’re filling the documents manually, there is more chance to make a mistake. Otherwise, they can get a system that can record this data, your process, where you can sign everything electronically, have verification in the background with an “alarm” if something doesn’t fit or doesn’t meet the requirements. And, this is something that the auditor can see because these kinds of systems are common.
Now, if you have a small family-based company that got used to working in their way for years, it could still be fine for them and don’t see the need to change that. However, the auditor could recommend some other methods or tools based on what he has seen in other companies he audited. That might improve, for example, the company time management because you are not spending so much time on unnecessary things, it might make your company more human error-proof because even though you are still confirming the data, it’s not necessarily something that you manually enter. And for example, when you are tired, instead of eight, you might put a zero, and that is a huge difference.
World of Auditing
That is very interesting. So, it’s even like being compliant, but more effectively. How did you and how do you see the evolution of the audit function over the years?
A. Sobolewska
Right now, I do think that there will be a lot of audits that will be limited or will happen virtually depending on the risk assessed. In the past, you would never think about a remote audit. When I started to work in the medical industry, it was always an in-person audit. Now, we have more options. You can still go in person depending on what you want to see or based on the risk you identified during your initial assessment. It also depends on what the company is asking you for because if you are an external auditor, you might sometimes be hired to see certain things, and they want you on-site to see the process step by step. But, if the risk is assessed as long as the company is performing well, and it’s just a review checking if they are doing good, that can be assessed remotely, I think. It’s giving you more opportunities.
Also, from what I remember, it was always like two or three auditors: one was reviewing the documentation, the other was doing something else around in the company and looking at the processes.
I think that one auditor will be enough as well. It depends on how you’re going to approach the audit in general. The regulations are becoming tighter and tighter, so we update the standard operating procedures in whatever industry we are dealing with. So, when the laws are tighter, the companies are more prepared because they need to comply. If they are more detailed, then it’s easier for the auditor as well. So, I think that the auditor function is going to be broader and will have more possibilities.
World of Auditing
If you project yourself after the COVID, would you see auditing continue to look like it is, or would it be a blended solution with remote audits and people on-site? How do you see that?
A. Sobolewska
I think that they will be blended because, as I mentioned and depending on the risk assessment you are performing around the site and how the site is performing, you sometimes need to see the operations. Another time, you don’t need to observe everything because you can see the process through the flow charts or standard operating procedures as they are pretty easy, and then you are interviewing people and reviewing related documentation.
There will be more remote audits but there will also be on-site audits, depending on the company’s size and the risk.
World of Auditing
That’s what we hear from different big players. That’s how they envision the future. It will be a blended approach. We also see that the top management is interested in the remote auditing because it brought savings.
A. Sobolewska
True, but if you will look, for example, when the company is going through some kind of transition because they are changing, like when they bought a new company. There is a merge for whatever reasons. Then, you would like to be on-site to see how this is going because there is a new process introduction. So, in some cases, it’s impossible to lead only remote audit because it’s not going to give you the full answers for what you’re looking for until you will see the processes. I think that we cannot fully get rid of on-site audits, that’s for sure, but I think that there will be a lot of remote audits.
World of Auditing
It is interesting what you said about the before COVID-19. From our experience, many companies were not prepared and were not even trying to understand the possibility of a remote audit. COVID-19 forced them to go there. We also see that when we talk about the digital transformation of big organizations, many companies connect the word “digital transformation” to remote, but there is much more than that, as the use of big data. What is your view on that, and how, maybe, is your company evolving on its digital transformation?
A. Sobolewska
My company is in the stage where a lot of mergers are taking place, and new companies are introduced to our current system. Talking about digital transformation would be very difficult at this stage because we cannot go this route only yet. The digital transformation wouldn’t fully work at this stage.
World of Auditing
Is it because the systems are different?
A. Sobolewska
Yes, that’s one of the reasons why. When you deal with so many different systems, it becomes more difficult to manage that digitally only.
World of Auditing
So this is something that will or might come in a longer-term, right?
A. Sobolewska
I believe that we need to be prepared for everything at some point. I think before COVID-19 happened, there was a lack of trust that a company could function well in a remote environment. There was a lack of trust that people would get this discipline to work. In the past, people always had to be on-site, and everything had to be on-site because there was a need to see if people are working. But now, as COVID-19 forced us to work from home, we could prove this theory is wrong as it is visible by company performance that people want to work and want to perform well even in the remote environment. They want their companies to perform well because, at the end of the day, when the company is performing well, the employees get benefit out of it too. So, before, there was this lack of trust in human behavior and because we were forced by nature, we had to put this trust in on a much higher level and, to be honest, we can expect anything in the future.
World of Auditing
I hear that the food business struggles to recruit auditors, and the lack of auditors is a concern for companies and certification bodies. Is it something you see also in your business?
A. Sobolewska
No, I think people working in my business are getting exposed to audit so often that, at some point, they are choosing to extend their qualifications to auditor levels as a part of the career enhancement and opportunities.
So I wouldn’t say that there is a lack of auditors in the pharmaceutics or medical device industry sectors.
World of Auditing
So, the audit is so much part of your business that people are used to it and it is almost a normal career path…
A. Sobolewska
When I think about it, when you mention the word “Audit” in the place where I work, people always will say that they have a quality mindset. When people are working in a highly regulated environment, they have to adopt a quality mindset, and if they won’t that might lead to problems. So, when they are there with the company for quite a long, they want to learn, they are seeking this information and see that as a future opportunity.
So I think that if you’re working for any company right now and you want to develop, you will put that somewhere in your career development plan. You can always become an auditor. It just depends on you. In the area where I am working, many departments must know the regulations by heart because it’s so important. Like if you’re looking at the sales manager, sometimes they need to provide specific data to customers to sell the equipment. For example, if you’re selling candies or pens, you wouldn’t have to get this kind of data, so they need to learn. And when they are learning, they are getting interested.
World of Auditing
And this is very specific to your business. I think it makes a difference with all the type of business. Agnieszka, as a student, did you hear about the auditor’s profession?
A. Sobolewska
No. As I studied microbiology, I was focused more on being a microbiologist, and I was not really looking for anything else at that time. I do believe that the audit profession existed already, but I was not aware of it and I think it was not developed that much. I know that there were possibilities. For example, suppose you had five years of experience working in some kind of environment. In that case, you could then apply for an internal audit position as you already knew how the processes are running. And so, you could get some training, and become a certified one. I believe that there were some private schools where the auditing profession already existed, but I was not aware because that was not what I would like to do at that time.
World of Auditing
I was not aware either, but this is like 30 years ago, but my collaborator, a young graduate, was also never been exposed to the audit function. If you look at the finance, you know who the Big 4’s are in this world. They go to Universities and talk about their business because they need these people, which is not happening in the industry, and perhaps that’s something we should do more.
Agnieszka, thank you a lot for sharing with us some of your stories and your views on the audit function. It’s been a real pleasure to have you with us. Also, people who are interested in furthering this discussion should know that they can contact you on LinkedIn at Agnieszka Sobolewska.
