Internal Auditor training

Internal Auditor training
Guillaume Carle October 2016

Training objectives Understanding how to prepare, organize and conduct internal audits, including: Raising awareness on the Responsible Mining Management System (RMMS) Identifying key audit elements Organizing an audit team Communicating during an audit Identifying findings and conclusions Reporting This training is based on the general principles set out in the ISO 14001:2004, OHSAS :2007 and ISO 19011:2012 standards adapted to Agnico Eagle’s RMMS. This training fulfill the requirements set out in clause 7 of the RMMS Standard.

Organizing and conducting an audit Establishing facts
Training outline Day Day 2 Introduction Organizing and conducting an audit Establishing facts Reporting and follow-up Introduction to Intelex Management Review

Section 1 Introduction

OUR MANAGEMENT PRINCIPLES
The ABC of Agnico Eagle management style: Anchored in our values Based on teamwork Clear and simple

8 mines, 3 development projects
OUR BUSINESS STRATEGY Agnico is 59 years old Nunavut Meadowbank Meliadine - Amaruq Finland Kittila Mexico Pinos Altos Creston Mascota La India El Barqueno Quebec LaRonde Lapa Goldex Canadian Malartic (50%) Northern Business Southern Business 8 mines, 3 development projects

rmms – responsible mining management system

This is the RMMS Logo. Plan-Do-Check-Act (called Deming wheel) is a four-step management method used in business for the control and the continuous improvement of Health & Safety, Environment and community relations. This concept is used in the main internationally recognized management system : ISO (Environment), OHSAS (Health & Safety) and ISO 9000 (Quality)

Plan Act Check Do RMMS Elements Policy Legal and other requirements
Risk management Management review Modification Management Objectives and targets Roles and responsibilities Performance reporting Competence, training and awareness Evaluation of compliance and internal audit You can see the name of the RMMS elements Document control Records management Communication and stakeholder engagement Nonconformity management Operational control Monitoring and measurement Emergency and crisis management

Very logical approach: Plan, Do, Check and Act
Very similar to the Supervision Formula

What is rmms It is a complete organizational system for managing and decreasing the level of operational risks related to: • Health and safety • Environment and • Community relations This system allows to document evidence of our actions and our best practices. Why do we need it ? To decrease the Health&Safety, Environmental and Community risk level

Proposed AEM’s Approach:
We want to ensure due diligence by implementing an “Integrated Health, Safety, Environment and Social Responsibility” Management System: AEM – Responsible Mining Management System– RMMS Characteristics Uniform but adapted management of HSE and Social Responsibility Developed in-house close to the operations Integrated: All our obligations and expectations in one system (health, safety, environment and social responsibility), including: Mining Association of Canada – Toward Sustainable Mining (TSM) International Cyanide Management Code (ICMC) Global Reporting Initiative (GRI) Modelled on recognised standards: ISO for the environment, OHSAS for safety, and as much as possible following the ISO guidelines for social responsibility We don’t want certification

Operational Procedures, guides,
Document Hierarchy The 5 core values of AEM: Trust Respect Equality Family Responsibility Values SD Policy The Standard System Procedures Critical Procedures Operational Procedures, guides, Work Instructions Commitments made by senior management It explains how to meet the requirements of the RMMS standard HSEC requirements of the RMMS 17 elements Minimum requirements for our main HSEC risks Detailed instructions that allow us to reduce our risks in our operations This pyramid represents the document hierarchy. The most fundamental elements are in the top of the pyramid and the most detailed at the base. Next pages will explain all the levels

Aem Document Hierarchy - Critical Procedures
Health & Safety Critical Procedures Working at height Lockout Hot work Mobile equipment Etc. Environment Critical Procedures Dike/tailing pond management Cyanide management Closure plan preparation Etc. Community Critical Procedures Stakeholders mapping Community liaison committee procedures Community response mechanism Etc. Critical procedures will decrease the level of our main Health & Safety, Environment and Community risks. Each site should develop and implement critical procedures and comply with the minimum requirements included in the AEM critical procedures. …these fall under management system Element 10: Operational Control

Key message of the quarter
How will the RMMS help me ? The RMMS will help us better manage HSEC risks Example : Mobil equipment collision is a Very High Risk Better reporting Improved correctives actions after incidents Procedures updated Training done and documented

RMMS Workflow RMMS Elements Examples Example :
Document & Records Management Check list before using equipment Operational Control Procedure to drive mobile equipment Objectives & Targets ↓ 5% HS statistic Monitoring & Measurement Speed measurement Emergency & Crisis Management ERP, mine rescue team Example : Mobil Equipment Collision Policy Legal & other Requirements Modification Management Risk Management Inform Develop Evaluate Evaluation of Compliance & Internal Audit For example, mobil equipment collision could create injuries and environmental spills. How do we do to decrease the level of this risk ? 1 – First of all, a risk identification and assessment with multidisciplinary team (drivers, mechanics, supervisors, ingeneers, etc., and a facilitator. 2 – During the risk assessment, - we identify the actual control measures (training, speed limits, etc.) (Operational control) (Monitoring and measurement) - If after the assessment, the level of the risk is still too high, we need to develop mitigation plans to reduce this level. (Objectives and targets) 3 - Even if we put everything in place to avoid an accident, we must be prepared to respond effectively in case of accident (Emergency and crisis management) 4 – The continual training is very important (Competence, training and awareness) 5 – All these elements should be well documented (Document & records management) 6 – At the end of the year, we should evaluate if the system that we had implemented is efficient (Managent review) 7 – If not completely, we will begin again this wheel to improve continually our system and performance. Roles & responsabilities Job descriptions, Procedures Competence, Training & Awareness Training for mobil equipment users Communication & Stakeholder Engagement OUF shared with all sites Nonconformity Management Inform Management Review

agnicoeagle.com

RMMS Organization – Check and Act
Plan Do Check

RMMS - Element 2: Legal and other requirements
Objective: Comply with legal and other requirements including internal AEM standards, policies and obligations relevant to Health, Safety, Environment and Community (HSEC) performance. Clause 2.1: Identification of relevant requirements Relevant requirements must include: Relevant legislative and permitting obligations (International, federal, state/provincial, regional or local). Any other obligations, such as those of licenses, codes of practice, Toward Sustainable Mining (TSM) protocols, Impact Benefit Agreement (IBA) and Conflict Free Gold. Clause 2.2: Compliance evaluation and compliance register Compliance must be evaluated for permitting requirements. Compliance must also be evaluated for any parameter that will be subjected to an external audit (ex: requirements of TSM, Cyanide Management Code, Conflict Free Gold, Industria Limpia, Empresa Socialmente Responsable). All other relevant requirements must be classified in order of importance using the provided matrix, and only the requirements with high and very high importance must be evaluated for compliance.

RMMS - Element 7 : Competence, training and awareness
Clause 7.5 Minimum competence training As a minimum, the following competence-based training must be provided (as appropriate to the role): AEM HSEC critical procedures (including Formula of Supervision); management of modifications; emergency and crisis management; incident management; and inspection and audit (for selected personnel).

RMMS Element 15 : Evaluation of compliance and internal audit
Clause 15.4 Audits There must be a business or site-level procedure for conducting performance and conformance audits (related to the RMMS requirements). Clause 15.5 Audit Scheduling The site must define an annual schedule of planned audits. The schedule must be developed based on an evaluation of the importance of specific RMMS processes, the results of previous audits, and significant HSEC risks associated with the site. It must include: internal audits conducted every 2 years against the RMMS and AEM Critical Procedures. external audits as required for Toward Sustainable Mining, International Cyanide Management Code, and any other site certification, and legal compliance. Clause 15.6 Management of audit results and improvement opportunities Non conformance identified by audits conducted against the RMMS and AEM Critical Procedures must be recorded and reported through Intelex. Corrective actions to address non conformance instances must be assigned and tracked until completion. Opportunities for Improvement from audits must be recorded and reported. They can also be assigned an action plan but with less priority than for non conformances.

RMMS Element 13 : Non conformance Management
Ensure all incidents and other health, safety, environmental and social acceptability non conformances are recorded, and corrective actions identified, implemented and communicated as appropriate. Clause 13.3 Other Non conformance management There must be a procedure for the management of other non conformances (e.g. from permits, legal inspections, routine inspections, observations, compliance register, audits, work cards, etc.). Instances of non conformance must be recorded when appropriate. Instances of non conformance, with High or Very high outcomes or potential outcomes, must be: Investigated; communicated to relevant people; managed with corrective actions to prevent reoccurrence.

RMMS Continuous improvement cycle
1 - Policy 17 – Management review 2 to 5 - Planning 12 to 16 - Checking 6 to 11 – Implementation and operation

Internal audits The RMMS is not an ISO System, however the system was developed in accordance with ISO principles. As per ISO, the internal audit is a process aiming at : Evaluating whether the RMMS conforms to planned arrangements including its requirements, and Evaluating whether the RMMS has been properly implemented and maintained, while apprehending its usefulness. This is to check the actual implementation of the measures and arrangements put in place and the capacity of the system to achieve the objectives. provide information on the results of audits to management. Au audit is a systematic, independent and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled. An audit is a key component towards continuous improvement: Measuring to improving.

Audit Characteristic within the RMMS Context
The audit is a key component to evaluate HSEC performance. It… …allows the monitoring and surveillance of the management system and the achievements of the RMMS objectives (15) …identifies the conformance or non conformance compare with the RMMS elements and other requirements (15) …must be must be implemented at business-level or site-level (15.4) …must be scheduled within an annual schedule of planned audits for every sites (15.5)

Why conduct an audit? RMMS Element 15: to regularly evaluate HSEC performance. It supports in… Promoting regulatory compliance Consistent with its commitment to compliance, the organization shall establish, implement and maintain a procedure(s) for periodically evaluating compliance with applicable legal requirements and shall keep records of the results of the periodic evaluations. Promoting compliance to compliance with other requirements to which it subscribes The organization shall evaluate compliance with other requirements to which it subscribes and shall keep records of the results of the periodic evaluations. Auditing contributes to demonstrate due diligence and to ensure AE walks the talk.

Good auditing practices ingredients
ISO 14001:2004 and OHSAS 18001:2007 standards, pillars of the RMMS, specify in clause – Internal Audit, that… An audit programme shall be planned, established, implemented and maintained by the organization, taking into consideration the importance of the operation(s) concerned and the results of previous audits. An audit procedure shall be established, implemented and maintained that address the responsibilities and requirements for planning and conducting audits, reporting results and retaining associated records, the determination of audit criteria, scope, frequency and methods. Selection of auditors and conduct of audits shall ensure objectivity and the impartiality of the audit process.

RMMS Audit Program 15.4 Audits
There must be a business or site-level procedure for conducting performance and conformance audits (related to the RMMS requirements). The procedure defines: Roles, responsibilities and requirements regarding: Planning and conducting Audits Reporting Audit Criteria Audit Scope Audit Frequency Audit Methodology Clause15.5 Audit scheduling The site must define an annual schedule of planned audits. The schedule must be developed based on an evaluation of the importance of specific RMMS processes, the results of previous audits, and significant HSEC risks associated with the site. It must include: internal audits conducted every 2 years against the RMMS and AEM Critical Procedures external audits as required for Toward Sustainable Mining, International Cyanide Management Code, and any other site certification, and legal compliance.

Audit calendar Audits Location Dates Auditor role Auditors
Audit LaRonde Week Nov 7 RMMS Corp. Coord. Denis Therrien Community Corp. Or Div. Josée Brazeau Env Specialist Jaimie Quesnel/Hanna Lampinen HS Specialist Jean Ladouceur Audit Kittila Week Nov 28 Nov and Dec 1st Janice Turgeon-Gervais Gregory Marakovic Norm Ladouceur Louise Grondin Audit Meadowbank Week Jan 9 Denis Therrien (5) JF Doyon Martin Archambeault Joel Provencher/Teemu Audit Pinos Altos Week Jan 30 Mélanie Roy Marie-Élise / Yanick Patrice Gilbert (2) Benoit Massicotte Audit Goldex Week Feb 20 Patrice Gilbert Josée Noël/ Paola Casarez Gérald MacDonald

Key audit elements definition
Audit: systematic, independent and documented process for: obtaining audit evidence evaluating it objectively; and determine the extent to which the audit criteria are fulfilled Auditee: Division being audited. Client : organization or person requesting an audit (Agnico Eagle). Auditor: person with competence that conducts an audit Audit team: one or more auditors conducting an audit, supported if needed by technical experts. Audit scope: extent and boundaries of an audit

Key audit elements definition (continued)
Audit program: arrangements for a set of one or more audits planned for a specific time frame and directed towards a specific purpose. Audit plan: description of the activities and arrangements for an audit. Audit evidence: records, statements of fact or other information which are relevant to the audit criteria and verifiable Audit criteria: set of policies, procedures or requirements used as a reference against which audit evidence is compared Audit findings: results of the evaluation of the collected audit evidence against audit criteria. Audit conclusion: outcome of an audit, after consideration of the audit objectives and all audit findings.

Key audit elements definition (continued)
Conformity/conformance: fulfilment of a requirement Nonconformity/Non conformance: non-fulfilment/non-execution of a requirement Guide: person appointed by the auditee to assist the audit team Observer: person who accompanies the audit team but does not audit (An observer is not a part of the audit team and does not influence or interfere with the conduct of the audit) Technical expert: person who provides specific knowledge or expertise to the audit team.

Audit types (most common)
Gap analysis Readiness audit Internal audit External audit Third party audit Monitoring/surveillance audit Follow-up audit Process or product audit Contractual audit (Confilct Free Gold) Combined or integrated audit Audit objectives, scope and criteria must be relevant. First party audit (Internal audit) Organization that audit its own management system. Second party audit (Supplier auditing) Organization that audit its supplier or subcontractors. Third party auditing (External audit) Organization audited by a third party generally for legal, regulatory or for certification purposes.

4.5.5 Audit principles Integrity: the foundation of professionalism Fair presentation: the obligation to report truthfully and accurately Due professional care: the application of diligence and judgement in auditing Confidentiality: security of information Independence: impartiality of the audit and objectivity of the audit conclusions Evidence-based approach: the rational method for reaching reliable and reproducible audit conclusions

Integrity As defined in AE’s code of conduct or your professional order Auditors and the person managing an audit programme should: perform their work with honesty, diligence, and responsibility; observe and comply with any applicable legal requirements; demonstrate their competence while performing their work; perform their work in an impartial manner, i.e. remain fair and unbiased in all their dealings; and, be sensitive to any influences that may be exerted on their judgement while carrying out an audit.

Fair presentation the obligation to report truthfully and accurately
Auditors and the person managing an audit programme should: Ensure that the findings, conclusions and audit reports reflect truthfully and accurately the activities of the audit; Report significant obstacles encountered during the audit (limitations); Record the unresolved issues and diverging opinions between the audit team and the auditee; and, Ensure that the communication of the audit is fair, accurate, objective, timely, clear and complete.

Due professional care the application of diligence and judgement in auditing Auditors and the person managing an audit programme should: Auditors should exercise due care in accordance with the importance of the task they perform and the confidence placed in them by the audit client; and, Make reasoned judgements in all audit situations. Due professional care implies reasonable care and competence, not infallibility or extraordinary performance.

Confidentiality Ensuring that information remains accessible only to those whose access is allowed. Auditors and the person managing an audit programme should: Use caution and protect information gained during the audit; Never use the information gathered during an audit for their personal gain or to harm the legitimate interests of the auditee; and, Treat diligently sensitive and confidential information.

Independence The basis for the impartiality of the audit and objectivity of the audit conclusions Auditors and the person managing an audit programme should: Be independent of the activity being audited wherever practicable It may be impossible for internal auditors to be totally independent, but must strive to eliminate bias and promote objectivity. Be free from bias and conflict of interest Internal auditors should be independent of the operational managers of the audited function. Should maintain objectivity throughout the audit process

Evidence-based approach
The rational method for reaching reliable and reproducible audit conclusions in a systematic audit process Auditors should: Collects evidence verifiable; Evidence based on samples of the information available; Sample the information available, since an audit is conducted during a finite period of time and with finite resources; and, Use appropriate sampling, since this is closely related to the confidence that can be placed in the audit conclusions.

Auditor’s role Third party auditor
Respect the code of conduct and its professional order code Can’t make recommendations or provide guidance Internal auditor: Facilitate and moderate the audit Interacts with the client and/or auditee and the external auditors and acts as a guide Can advise (act as a consultant)

Auditor’s responsibilities
The auditor should, at all times: Support the team leader; Be prepared (having read the procedures, audit calendar, provided information, if applicable); Participate in the opening and closing meetings; Perform the allocated tasks*; Respect the audit scope; Document and maintain findings; Keep informed the auditee; Protect and safeguard all documents; Respect confidentiality; Be objective and moral; and, Assess corrective actions, if any. *Assigned by the lead auditor and subject to changes as the audit progress.

Exercise – Definition (15 minutes)

Section 2 Organizing and conducting and audit

RMMS Audit process (ISO 19011 based)
6.2 Initiating the audit 6.3 Preparing audit activities 6.4 Conducting the audit activities 6.5 Preparing and distributing the audit report 6.6 Completing the audit 6.7 Conducting audit follow-up

6.2 - Initiating the audit Defining the audit objectives and what is expected in the audit: Evaluating the level of compliance of: The RMMS, or part, compared with the audit criteria Activities, processes and products with the RMMS’ requirements and procedures Evaluated the ability of the RMMS to ensure compliance with legal and other requirements Evaluate the effectiveness of RMMS to meet its objectives Evaluate the ability of RMMS to improve HSEC performance Identify RMMS’ opportunities for improvement

6.2 – Defining the audit scope
Describe the extent and limits of the audit scope: Geographic; Organizational units; Activities and processes; Duration; Outsourced products and services; and, RMMS clauses. Stay consistent with the audit program and audit objectives.

6.2 – defining audit criteria
Use the audit criteria as reference (policy, procedures or requirements) vis-à-vis which compliance is determined. The audit criteria can include: The commitments within the Sustainability Policy; Standards (ISO, CSA, etc.); Applicable legal requirements; RMMS requirements; Contractual requirements (ie IIBA); Industry codes of ethics; and, other provisions.

6.2 – feasibility Assessment
Evaluate the feasibility of the audit vis-a-vis the objectives Take into account factors such as the existence of: Sufficient and relevant information for the planning and conduct of the audit; Appropriate cooperation from the auditee; and, The resources and time required to perform the audit. If the audit is not deemed feasible, changes should be proposed to the audit client, in agreement with the auditee.

6.3 Preparing audit activities
Review the documentation to: Collect information for the activities of the audit and audit protocols; Identify potential gaps; Include previous documents, records and audit reports. Take into account: The size, nature and complexity of the organization and RMMS; The objectives and scope of the audit; and, Schedules of operations and logistics.

6.3 – Organizing the audit team
Identification of the lead auditor (responsible for the audit team). The lead auditor will: Identify/select the members of the audit team; Transmit relevant information to team members; Coordinate logistics with the auditee; and, Ensure the proper conduct of the audit.

The audit plan The audit plan must include:: Audit objectives
The extent and scope of the audit (ie: the identification of the division, departments and processes, RMMS elements and risks to audit) The working language during the audit Places and dates, and the schedule and duration scheduled for the audit work to be undertaken, including meetings with management of the audited (audit itinerary) The methods used to audit and audit criteria The roles and responsibilities of the members of the audit team The provision of necessary resources conduct the audit Writing a report, including the methodology, findings and conclusions of the audit Follow-up actions for the audit findings Must be sent in preliminary version to the champion and submitted to the site at least a month in advance. Example: AEM-RMMS-FRM1-Internal Audit Plan V1-EN

6.4 – Preparing an audit – Process-based approach
References Requirements Evidence Notes References: -standards -Procedures -Instructions -Plans -Documentation Process’ requirements, applicable to: -Input -Output -Performance -Resources -Methods Evidence anticipated, such as: -Documents -Observations -Records -Certificates -Results Audit notes including: -Findings -Comments -Opportunities -Concerns

Audit Plan – Audit itinerary

6.3 Preparing audit tools Prepare audit tools for reference and record evidence during the audit. The tools may include: Checklists, protocols, list of requirements; and, Forms to record information, evidence, audit findings and meetings’ summary. It is necessary that the use of audit tools does not limit the audit activities (ie: too long, irrelevant, etc.). Throughout the audit, it is important to maintain flexibility to allow changes based on information gathered. It is very important to keep all audit tools and records at least until the end of the audit.

Example of a list of requirements
INSPECTION, MAINTENANCE, TESTING, AND RECHARGING PERIODS FOR PORTABLE FIRE EXTINGISHERS

Example of an audit protocol
RMMS requirements Clause Summary Questions Evidence/Records associated Observation Ranking 1 - Policy 1.1 All AEM divisions must develop, implement and maintain an integrated approach to responsible mining How does the division ensure the implementation of the sustainable development policy? How does the division ensure the commitment from all to the SD policy? How does the division promote the RMMS culture and principles on a day-to-day basis? Targets, initiatives, programs, communications, etc. 10 – Operational controls 10.3 Critical equipment Procedures and/or work instructions must be developed, documented, communicated and followed for the operation and maintenance of critical equipment (e.g. scrubbers, ventilation system, water treatment plant, cyanide destruction, etc.) that has the potential to impact HSEC performance. Did you inventory all critical equipment that has a potential to impact HSEC performance? Do you have maintenance and operation procedures, logs register or inspection records regarding critical equipment. How are critical equipment inspected, tested and calibrated? Inventory of critical equipment Procedures/work instruction Maintenance/inspection records

6.3 – Creating auditing tools
To create useful auditing tools, the auditor needs to: Identify the scope of the audit and the process in this field; and Identify factors that apply (references, requirements, registrations, etc.). Use these factors to: Plan what to watch for Plan what to look for And prepare a checklist accordingly. Note that checklists tend to lose their value if they consist in: Checklists Questionnaires without requirements listed Lists and other tools (protocols, etc.) can cause rigid adherence to pre-programmed questions/sequence. It is should therefore be considered as a reference.

Section 3 Conducting an audit

RMMS Audit process (ISO 19011 based)
6.2 Initiating the audit 6.3 Preparing audit activities 6.4 Conducting the audit activities 6.5 Preparing and distributing the audit report 6.6 Completing the audit 6.7 Conducting audit follow-up

6.4 – Opening Meeting Opening meeting
The objective of an opening meeting is to: Introduce the audit team; Confirm the agreement of the auditee and the audit team with the audit plan; and, Ensure that all planned activities can be carried out as planned. The meeting should be held with the management of the auditee and, if necessary, with those responsible for the functions or processes to be audited. The level of details should be in line with the degree of knowledge of the auditee with the audits. The audit team must give the opportunity to ask questions during the meeting.

6.4 –opening meeting as per ISO 19011 – For reference
A formal opening meeting hosted by the lead auditor should cover these elements: Presentation and roles of the auditors Objectives, scope and audit criteria The state of the available documentation Audit plan, itinerary and upcoming meetings Methods to perform the audit Sampling (prioritization) information Communication circuit Language during the audit How and who to Keep informed of the progress of the audit Resources and Facilities Confidentiality and information security Health and safety considerations Method for identifying findings and classification Information on the closing meeting Availability of guides Restrictions or questions? Review of logistics Attendance record In case of an emergency

6.4 - Conducting the audiT Source of information:
Interviews and observations on-site; Information about the programs in place, controls and monitoring; Reports from other sources (ie: customer opinions, studies and external measures, other relevant information from external parties and supplier evaluations; Data, records, analysis (trends) and performance indicators databases and websites simulation and modeling INTELEX

6.4 - Conducting the audiT Document review
Review the documentation of the auditee to: Determine compliance with documented system audit criteria; Gather the necessary information to support audit activities. The magazine can be combined with other audit activities and may continue throughout the audit, if it does not harm the effectiveness of the audit. Should relevant documentation not be provided during the audit, inform the audit program supervisor and the auditee, and produce, if necessary, an interim findings.

6.4 - Conducting the audiT General rules during an audit:
Avoid unnecessary disruption of operations/process. Ensure that the audit team uses appropriate PPE. Ensure communication of emergency procedures (eg fire exits, muster point). Programming the communication to minimize disruption (who, when). Adjust the number of listeners, guides and observers according to the audit area to avoid interfering with operations/processes. Do not touch or handle any equipment unless otherwise authorized, even for skilled auditors professionals that hold a certificate of proficiency. It is highly recommended to take photographs to support audit findings.

6.4 - Conducting the audiT Auditor proper interaction with auditee:
Ask questions to the right person; Put the auditee at ease; Smile and maintain eye contact; Ask short questions and listen to answers; Follow audit trails; Show interest; Act with tact, be open minded and polite; and, Be patient and understanding.

6.4 - Conducting the audiT Auditor proper interaction with auditee:
Ignore your own problems; Show positive attitude, tone of voice, body language and facial expressions; Be aware of cultural, social or religious habits; Avoid false and condescending remarks; Compliment, if any; and, Do fake you understand if you don’t. * The audit team and / or the auditee may meet from time to time to exchange information, update on the progress of the audit or share concerns

6.4 - Conducting the audiT Conducting an interview The auditor should:
Talk to the people responsible for appropriate levels or performing activities. Speak appropriately to people of different hierarchical levels. Put the person at ease. Ask people to describe their work. Conduct interviews during regular working hours. Explain the reasons for the interview and state that you will take notes/photographs. Avoid leading questions. Summarize the results of the interview with the person. Thank the people for their cooperation.

6.4 - Conducting the audiT Conducting an interview Open question
Use why, who, what, where, when or how much / how many to get more than a yes or no (usually to explore, learn) Open-ended question Clarifies a specific point (to verify previously collected information) Opinion question Get advice on a specific point (to verify an assumption) Non-verbal communication Use of gestures (ie: frown) for more information.

6.4 - Conducting the audiT Conducting an interview Repetitive question
Repeating the answer in the form of a question (to verify your understanding or to validate contradictory information). Hypothetical question Uses imagine…, and so…, etc. (to verify consequence or opportunities for improvement) Close-ended question Is answered with yes or no Used to confirm (Avoid using it too often) Silence May help to collect more information (use sparingly)

Exercise – Definitions (30 minutes)

Section 4 Establishing facts

3-Audit logical scheme Source of information
Sampling (prioritization) and review Evidence Comparison with audit criteria Audit findings Review Audit conclusions

6.4 - Conducting the audiT Collecting and reviewing information
Collect verifiable information connected to the audit objectives, criteria and audit scope using appropriate sampling. Collect information about the interaction between functions, activities and processes. Record audit evidence leading to audit findings. Take into account any new or changed situation or any new or changed risk which was brought to the audit team attention during the collection of evidence. The information collection methods include: Interviews Observations Document review, including records

6.4 - Conducting the audiT Interviews:
Of people who are in charge, perform and monitor activities Make sure they are responsible for the activity being audited Observations: Identity, status, condition, processes, activities Equipment, working environment, personnel at work Documents review: Policies, programs, procedures, work instruction and standards Specifications, drawings and manufacturer’s instructions Records review: Records of inspections, meeting minutes and reports (including previous audits) Records of monitoring and measuring results

6.4 - Conducting the audiT Document review
Information contained in document reviewed must be: complete (expected content is present in the document) Correct (consistent with reliable sources such as standards) consistent (the document is consistent in itself and report to the associated documents)date (the content is updated) Ensure the reviewed documents cover the audit scope and provide enough information to meet the audit objectives and support findings.

6.4 - Conducting the audiT – Establishing the facts
Work closely with the auditee and: Discuss issues and concerns Verify findings with the auditee Save all evidence: precise observations; Where, when, what, etc. Use the auditee’s terminology Define why non conformance exists State who (when possible) - by position and not by a person name Obtain agreement with the facts The audit should focus on compliance and effectiveness, NOT on the discovery of non conformances. The benefit of the doubt must be given to the audit when audit evidence is insufficient (eg. Procedure not found). In a continuous improvement objective, lack of evidence may be reported as opportunities for improvement.

Establish the facts – Keep the auditee informed For constructive, helpful and professional audits: Communicate regularly the progress of the audit and identified findings Do not rely on rumors Define why a non conformance exists Obtain agreement with the facts

Prioritization (Sampling) During an audit, it is impossible to read everything, see everything and meet with all employees. We must therefore determine the effort required to assess compliance with requirements. Generally, we must put more effort on the processes that are: Risky New Complex Generating a large amount of data and records The auditor needs to review a number of records consistent with the size of the organization, the scope of the audit, the results of previous audits, and the nature and complexity of the process. The auditor must collect enough evidence to be confident in being able to represent fairly and accurately the audited process. At all time, the auditor must keep in mind that no non conformance in the revised documentation does not mean that there is no non conformance.

It is important to keep in mind that there is a risk that… The evidence may not be representative of the audited element. The conclusion is different from the result that would be obtained if all the information was reviewed There is always a degree of uncertainty linked to audit findings and conclusions. It is the auditor's responsibility to determine the number and type of document to review. It is always necessary to: To match the effort with the relevancy of the element Move on when the review does not reveal non conformance Make sure this is understood by the auditor and auditee

Taking useful notes Record audit evidence: acceptable statements Include information such as: The titles and document numbers Revision number Publication dates Identification numbers of equipment Lot numbers Departments Names and titles of the audited person

Taking useful notes Notes can be used as a reference for: An immediate review A forthcoming review The use by a colleague Subsequent audits The notes shall be: Readable recoverable

Audit control Audit tools must remain a tools and not become an obligation. If potential audit trails appear, you can choose to: Not to take them into account Note for later follow immediately Follow an audit trail can affect: The prioritization/sampling size The audit plan

RMMS Requirements Legal compliance
Non conformance types Conformity with a standard against legal compliance RMMS Requirements Legal compliance Conformance with the RMMS requirements Non conformance may lead to a certification loss (ex: Cyanide Code) Voluntary basis Meeting the legal requirements Non conformance is subject to administrative penalties ($) or criminal penalty (jail) Obligations

Exercise – Conformance Evaluation (45 minutes)

6.4 – Audit closure - Findings
Findings’ identification Assess the evidence against the criteria to develop findings Note the findings as conformance or non conformance. When specified by the audit plan, include in the audit findings: Conformances and good practices, with the associated evidence. Opportunities for improvement Any recommendations to the auditee (for internal audits only) Non conformances, with the associated evidence.

6.4 – Audit closure - Findings
The identification of the audit findings must take into account: Tracking records of previous audits and findings; The findings beyond the requirements (opportunities for improvement); and, The uncertainty. A finding must include the: Description or the reference to the audit criteria; Audit evidence to support the finding; and, Statement of conformance or non conformance.

6.4 – How to write a “good” audit finding
A finding should always be composed of three elements: an observation/evidence (located in time, in space and its source) A requirement (reference) the clear indication of the unmet element Therefore, a finding should look like: Observation Requirement Finding At the time of the audit, it was reported that the truck safety inspection checklist was not taking into account winter conditions. Proc. S.2 – Mobile Equipment c Any vehicle used for professional activities is subject to appropriate pre-operational safety verification, conducted according to the risk assessment. At the time of the audit, it was reported that the truck safety checklist was not taking into account winter conditions. In accordance with section 2.2 of the S.2 – Mobile Equipment procedure, any vehicle used for professional activities must be subject to appropriate pre-operational safety verification, conducted according to the risk assessment.

ExAmple of « good » findings
Requirements Findings Proc. S.3 – Working at Height s.4.5 At the time of the audit, it was reported that no system was established to develop and test emergency rescue procedures for falling victims. In accordance with section 4.5 of the S.3 procedure on working at height, a system must be established to develop and test the emergency rescue procedures for falling victims. SGMR Clause 7.5 – Minimum competence training At the time of the audit, it was noted that internal auditors were not trained before conducting audits. In accordance with the RMMS Clause 7.5, auditors should be provided with a competence-based training before conducting an audit. Clause Contractor competence management At the time of the audit, the superintendent for Lignec, a contractor performing work on the main electric substation, reported not meeting the competence requirements related to the HSEC risks. In accordance with RMMS Clause 7.8, Prior to hiring or allowing a contractor on-site, the contractor’s competence requirements, related to the HSEC risks associated with the awarded contract, must be identified and verified.

Example of « weak » findings
Requirements Findings Working at Height No system was established to develop and test emergency rescue procedures for falling victims. RMMS Clause 7.5 At the time of the audit, it was noted that internal auditors were incompetent to conduct audits. In accordance with RMMS clause 7.5, auditors should receive a basic skill training for the acquisition of basic skills in relation to inspections and audits. Contractor competence management At the time of the audit, the superintendent for Lignec was not aware of the proficiency requirements in connection with HSEC risks. In accordance with RMMS Clause 7.8, prior to hiring or allowing a contractor on site, the contractor’s competence requirements, related to the HSEC risks associated with the awarded contract, must be identified and verified.

6.4 – Audit closure Non conformance ranking
Must take into account the perceived risk level: What could go wrong if the non conformance is not corrected. The probability that it goes wrong. Is the system likely to detect it before it happens? If you are unsure whether it consists in a non conformance, then it is not. Remember, a non conformance is made of: An unsatisfied requirement Evidence that it was not satisfied

6.4 – Audit Closure Non conformance ranking Finding types Definition
Major Non Conformance1 - Repeated failure in the RMMS application Failure to meet one or more elements2 of the standard which prevents the proper functioning of RMMS  Failure that could result in a high or very high HSEC risk (refer to risk matrix)3 Minor Non Conformance Non-fulfillment of a requirement Single failure of RMMS application  Possibility of an isolated incident  Procedure not followed occasionally or completely Low probability that the Non-Conformance reoccurs because of a system failure Opportunity for improvement Proposed action responding to a noted failure which is not a Non-Conformance  Consideration to be taken into account to improve the audited system  Can lead to a possible Non Conformity if not treated Good Practices Beyond the requirements Innovation New process or equipment which increases the performance in environment, health and safety or the community relations 1 The non-compliances to legal requirements will have to be reported to site personnel , but will not be included in the audit report because it is a system audit. 2 For this audit, the following elements are evaluated (1,2,3,4,5,7,10,13 and 17) 3 The classification selected by the auditor will be validated by the person assigned to correct the nonconformity using the matrix 5 X 5.

6.4 – Audit Closure Findings review
Get auditee’s approval on evidence and findings Attempt to resolve any disagreements about the evidence or findings and record any unresolved issues Meet the audit team to review the audit findings at appropriate stages of the audit Preserve the confidentiality of information gathered during the audit

6.4 – Audit Closure Preparing the closure meeting The audit team should reconvene prior to the closing meeting and: Review audit findings and evidence collected during the audit in comparison to the audit objectives. Agree on the audit conclusions, taking into account the uncertainty inherent in the audit process. Prepare recommendations, if specified by the audit procedure. Discuss audit follow-up actions, if any.

6.4 – Audit Closure Prepare audit conclusions
Audit conclusions should inform on: The overall compliance level noted during the audit The RMMS level of implementation and continuous improvement The system's ability to achieve its objectives The achievement of audit objectives and coverage of the audit scope Similar findings on the site Internal audits are useful if they can quickly detect major problems and resolve them effectively. An audit performed poorly focuses on procedural gaps and misses major malfunctions.

6.4 – Audit Closure Closure meeting
Hold the closure meeting with the auditee (and if possible with the client and other parties interested) to present the findings and conclusions. Present opportunities for improvement Inform of the situations encountered during the audit that may increase the uncertainty related to audit findings. Note minutes and record attendance Discuss any disagreement related to findings or conclusions and record any outstanding issues

6.5 – Audit Closure as per ISO 19011 – for your reference
Closure meeting A formal closing meeting held by the lead auditor may cover: Participants and Acknowledgments The objectives and scope of the audit The evidence based on samples The method for recording evidence Confidentiality statement The audit summary Non conformances and ranking Approval (signed) Audit findings Opportunities for improvement Recommendations, if any Method to establish findings The possible consequences Clarifications, when required Post-audit activities Monitoring, if required Attendance records *

Section 5 Reporting and follow-up actions

6.5 - Reporting Audit report Is an official record of the audit
Contains methodology, findings and conclusions Must be communicated in accordance with the internal audit procedure The audit report must : Be clear, precise and concise Be based on facts, not opinions Presents non conformances and ranking Document opportunities for improvement Be presented positively to the auditee Be Informative and helpful to the improvement of the management system. Remember, this is a part of continuous improvement!

Audit scope (organization, function, processes);
6.5 - Reporting Audit report content as per ISO 19011 Audit objectives, Audit scope (organization, function, processes); identification of the audit client, auditee Audit team Audit participants Audit plan and itinerary Audit summary Audit criteria Audit findings and related evidence Findings ranking Audit conclusions Statement on the degree to which the audit criteria have been fulfilled. All obstacles encountered Any element within the scope that was not covered (limitations) confirmation that the audit objectives have been achieved Opportunities for improvement Good practices Agreed follow-up action plans, if any Statement of the confidential nature of the contents; Any implications for the audit programme or subsequent audits; The distribution list for the audit report. The audit report can be developed before the closing meeting.

RMMS Non conformances management
AS PER AEM-RMMS-SP-Non Conformance Management Immediacy principle When an instance of non conformance is observed that can be corrected immediately, immediate action must be taken. Non conformances management Non-conformances (including incidents) must be recorded, communicated and managed with corrective actions and/or preventive actions to prevent reoccurrence. Non-conformances with High or Very high outcomes or potential outcomes, must be investigated to find the root cause and apply corrective or preventive measures more effectively. Non conformance identified during an audit must be recorded and reported through the following Intelex modules: Process non-conformance, Environmental Incident and Health and Safety incident, Work Card. Non conformances must be ranked Corrective actions to address non conformance instances must be assigned and tracked until completion.

Corrective and preventive actions
Corrective action : Action to eliminate the cause of a detected non-conformance (ex.: hazardous waste removed from the recycling bin and placed into the hazardous waste bin) Preventive action : Action to eliminate or reduce the potential of a nonconformity occurring (ex.: provide training on waste segregation) Non conformances can have several causes, it is sometimes necessary to combine several actions to resolve the issue. Actions should be coherent with the problem and correspond to the actual or potential impacts. Any necessary modifications to RMMS documentation following corrective or preventive actions to be implemented and recorded.

RMMS Non conformances management - Investigation
The following personnel should be involved in the investigation: the person most directly involved in the non-conformance (ex: worker); the manager responsible for the work area (ex: superintendent or representative); the manager of the person(s) (ex: supervisor) involved in the incident; he/she must take charge of the investigation with the appropriate technical personnel; the manager responsible for ensuring conformance (ex: health safety superintendent or representative); he/she will be responsible for guiding the investigation and communicating the results of the investigation as required ; any other relevant personnel as required by the investigation. Incident investigations must be completed by personnel who have been trained in the appropriate methodology and must include a root-cause analysis. Methodology fishbone the Five Whys fault-tree analysis Etc.

Communications The relevant internal and external parties must be notified of non-conformances in accordance with established timeframes and/or legislative requirements (ex:. ERP, CMP, permit conditions). All health and safety incidents that have been investigated will be communicated to the employees and discussed at the joint health and safety meetings. All incidents and non-conformances with high and very high potential risks will be presented and discussed at the local management team meetings and will be communicated to the appropriate corporate director (Environment, health and Safety, communication) as soon as possible or at least within 24 hours. Reporting All incidents with an impact causing personal injury or occupational illness must be reported to Agnico Eagle in the monthly health and safety performance statistics. All environmental incidents must be reported to the regulatory authorities according to the prescribed rules. All environmental incidents that have been reported to the authorities must be reported in the monthly report. All non-conformances to legal requirements must be reported to the regulatory authorities according to the prescribed rules. All non-conformances to legal requirements that have been reported to the authorities must be reported in the monthly report.

Action Plan and Monitoring Management of the incident or non-conformance requires: development of an action plan to correct the non-conformance and prevent reoccurrence; monitoring of the effectiveness of this action plan. Such an action plan can include: changes in equipment repairs to equipment additional training new procedure implementation or procedure change clean-up of contamination ban or change of product Monitoring of the effectiveness of the corrective or preventive measures included in the action plan could be done by adding this verification to the routine inspections, audits and tasks observations.

Intelex Presentation

Exercise – Findings (30 minutes)

Section 6 Management review

RMMS Element 17: Management review
The audits allow to identify findings (positive and negative) and to inform on: The overall compliance level The RMMS level of implementation and maintenance Opportunities for improvement A good audit program will also inform on: System malfunctions The system's ability to achieve its objectives This information will be brought to the management in order to take actions and get budget/resources approval to support the RMMS continuous improvement.

Objective: Ensure the RMMS is effective in managing HSEC performance and meeting AEM and other requirements. Management shall review the organization's management system, at planned intervals, to ensure its continuing suitability, adequacy and effectiveness. Reviews shall include assessing opportunities for improvement and the need for changes to the management system, including the policy and objectives and targets. Records of the management reviews shall be retained.

The review must be led by the site senior management and consider, amongst other elements: the suitability of the policy; the impact of changing legislation; the management of risk registers; HSEC objectives, targets and performance indicators. changing expectations and requirements of relevant stakeholders/communities (including complaints); changes in the products or activities of the site; the effectiveness of the management of modification process; the status of corrective and preventive actions; performance statistics, including an annual summary of relevant safety statistics, occupational hygiene, medical, environmental and social monitoring results; findings of completed audits; follow up on actions from previous management reviews; recommendations and opportunities for improving the effectiveness of the management system. The management review output shall include any decisions and actions related to possible changes to the policy, objectives, targets and other elements of the RMMS consistent with the commitment to continual improvement.

Management review is primarily dedicated to business strategy and offers a moment of reflection on the RMMS: To benchmark the RMMS Check compliance of the results with the objectives / targets. Update RMMS and HSEC programs. Evaluate the necessary resources and make them available. The review demonstrates that the management respect its due diligence obligation ensuring to maintain an RMMS: -Efficient: supports the achievement of expected results determined through objectives and targets. -Pertinent: Coherent, appropriate to the Agnico Eagle and its context. -Sufficient: Means and resources are made available to support the RMMS. -Efficient: Adequacy of resources to the results obtained.

RMMS Organization

To become an effective internal auditor
It is important to understand the role of audit within the RMMS. It is essential to learn how to use positive social skills. It is important to always be prepared, having well planned audit activities and consider the audit as an important process for continuous improvement and not a coercive activity.

Exercise – Clauses (30 minutes)

Internal Auditor training

Similar presentations

Presentation on theme: "Internal Auditor training"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Internal Auditor training

Similar presentations

Presentation on theme: "Internal Auditor training"— Presentation transcript:

Similar presentations

About project

Feedback