Are you a Compliance Manager, Compliance Advisor, Water and Sewer Manager, Internal Auditor or Water Quality Compliance Officer? Are you responsible for preparing for and managing your external operating licence and drinking water management system audits? Are you responsible for handling the audit outcomes? Are you confused over why you are not getting full compliance when you think you have fulfilled all the requirements?
Here are my ten top tips to help you breeze through your next water quality audit.
Understand your context
I can’t emphasise this enough. You need to have a good grasp of what your business is (your products, services and corporate objectives) coupled with, what your operating licence and statutory obligations require of you. You have to demonstrate to the auditor that you have thought about your context and more importantly, that you have the evidence to show why you have reached a particular position. A good example could be how you understand your area of operations (a legal opinion on your area of operations would be good evidence), understanding your stakeholders in relation to your products and services (evidence to support stakeholder identification and consultation) and a compliance register with clear articulation of roles and responsibilities (including legal opinion where relevant, to clarify any potential areas of grey).
My ten top tips to breezing through your audit:
- Understand your context
- Understand the requirement
- Keep it short and sweet
- Optimise your evidence
- Be open and transparent
- Business objectives vs compliance objectives – integrate, don’t separate
- Think carefully about your Drinking Water Quality Management Plan structure
- Understand the compliance grade
- It’s all about relationships!
- Use the audit outcomes to your advantage
Understand the requirement
The next area of angst is the licence clause or criterion – the ‘thing’ you are being audited against, your operating licence requirement. I’ve come across examples where there has been dispute or uncertainty over what the audit criterion is actually asking for – what does it mean in practice. It’s always useful to go back to not only the criterion, but any guidance that supports it, in helping to better understand what is required. A great example is Element 2 of the Framework:
- Element 2: Assessment of the drinking water supply system
- Component 2.1: Water supply system analysis
- Action 2.1.2: Construct a flow diagram of the water supply system from catchment to consumer.
The criterion is the action in this case. But the criterion actually doesn’t tell you that much. What sort of water supply system flow diagram? What should it look like? What features make it a good water supply system flow diagram that is compliant for this part of the Framework?
I always therefore, go back to the text around this part of Component 2.1 which, for the water supply system flow diagram, sets out the following:
“A generalised flow diagram should be constructed describing the water supply system from catchment to consumer. The diagram should:
- outline all steps and processes, whether or not they are under control of the drinking water supplier;
- summarise the basic characteristics of each component;
- make explicit any characteristics that are unique to the system;
- be verified by field audits and checked by those with specific knowledge of the system.
The water supply system analysis should be reviewed periodically to incorporate any changes that occur, for example in land use, treatment processes or consumer distribution.”
Therefore, you also need to ensure that your water supply system flow diagram not only exists, but that it details ‘catchment to customer’, outlines all steps and processes (even if they are not under your control), that the diagram summarises the key characteristics of each process component, describes any unique characteristics and that it has been verified by someone with the authority to do so. Lastly, you’ll need to have version control so the auditor can see the review cycle, whether the diagram has been updated within the water supply system flow diagram’s review cycle and whether it has been reviewed ‘out of cycle’, in response to system change.
You need to show all of these things to have a compliant water supply system flow diagram for the purposes of Action 2.1.2. You can find more detail in our blog article on what makes a good water supply system flow diagram.
Key features of a compliant flow diagram:
- Shows catchment to customer
- Outlines all steps and processes (even if not under your control)
- Shows the key characteristics
- Describes any unique characteristics
- Has been verified by an appropriate person
- Is current
- Show evidence of regular review
Keep it short and sweet
Some jurisdictions require the auditor to develop a questionnaire of questions against each criterion they are auditing, with an example of the type of information that they might expect to see, to fulfil that criterion. Then, prior to the site visit, the auditor is supplied with the information, that the auditee thinks will fulfil the requirement.
In my experience, we are usually provided with reams and reams of information, which doesn’t always meet the requirement. My advice is to keep your eye on what is being asked for, and what the criterion actually requires. Then, constrain your information and keep it short and sweet – make sure you are actually addressing the requirement, not going off on a tangent. Keep your responses punchy – there’s no need to write a ‘war and peace’ effort. Tell the auditor where in the evidence the criterion is being met e.g. Document name, section, page number. All you are doing in the first part of the information delivery is providing an example of how you are meeting the criterion. The auditor may be satisfied with the information you have already provided but will ask for more information at the audit interviews, to verify what they have been told, actually occurs in practice, or follow up on gaps they think might exist based on their first review of the provided information.
Optimise your evidence
In your provision of evidence to the auditor, it might be possible for there to be one piece of information that you can use, to satisfy a number of criteria.
If it’s designed properly, a stakeholder register is a great example of providing evidence across all of Component 1.3: Engaging Stakeholders:
- Action 1.3.1: Identify all stakeholders who could affect, or be affected by, decisions or activities of the drinking water supplier.
- Action 1.3.2: Develop appropriate mechanisms and documentation for stakeholder commitment and involvement.
- Action 1.3.3: Regularly update the list of relevant agencies.
So, as long as your register has all of your stakeholders, shows how they are communicated with, who is responsible for the communication, and that there is version control to confirm currency, that one register can be cited in the questionnaire, for the three criteria – one piece of evidence to knock of three criteria, how good is that?! You might also state that the auditor can review ‘TRIM Container XYZ’ at the audit interviews to verify implementation. For the auditor to sight use of TRIM, it also provides us with evidence that document control and records’ management is being implemented in practice and that people have been trained in its use – yet another way of optimising your audit preparation and response.
Be open and transparent
Don’t give the auditor any reason to think you are hiding information. I’ve been at audits where auditees have been at pains to only show the bare minimum and yet at others, where the auditee is falling over themselves to show you information and seek your input on its suitability. In the end, hiding information only falls back on you as the auditee both in terms of audit outcomes, and not being able to build a better business.
Business objectives vs compliance objectives – integrate, don’t separate
Many utilities now have integrated systems in place, it’s therefore possible to optimize requirements across systems and minimize the number of documents/registers/databases etc that you need to deal with – an example is document control and records’ management, a requirement common to all management systems. It’s often challenging when preparing for an audit, to pick your way through what has actually been provided by the auditee, as evidence of meeting the requirement. As an auditor, this observation only serves to place uncertainty on how well the system actually works in practice and whether everyone understands what is required of them. While you shouldn’t let your compliance requirements dictate how you structure your business, it’s not bad practice to design your systems to optimize both your business objectives and compliance requirements – rather than thinking of them as separate requirements or objectives.
Think carefully about your Drinking Water Quality Management Plan structure
I’ve seen voluminous documents that are hundreds of pages long. I’ve also seen examples of succinct, yet practical documents. Some great examples have been where Drinking Water Quality Management Plans have been tabulated according to the elements, components and actions of the Framework for Management of Drinking Water Quality. While this forms only one approach, it has several business and compliance benefits:
- It’s easy for someone to pick up the document and understand the system without having to wade through a heap of waffle.
- It’s easy for you to minimize the number of pages in the document.
- It’s easy to operationalize the information.
- It’s easy to update and keep current.
- It’s easy for you to prepare for an audit.
A well-designed system means that you shouldn’t have to spend weeks and weeks preparing for an audit, it should just be ‘what you do’.
Understand the compliance grade
It’s important to understand the compliance grade, on which the auditor has landed. ‘Compliant’ is easy – there’s no need to comment further. But what about other grades that are not that full ‘shade of green’ that you were after? Any grade that is not ‘green’ should have the auditor’s reasoning to support it. Areas which the auditor may consider in reaching their decision include lack of or insufficient evidence, shortcomings in approaches and the materiality of the shortcomings, based on the auditor’s professional judgement. Further, if the licence clause states that you ‘must’ have something in place, and you haven’t, then the finding is automatically ‘non-compliant’. The ‘shade’ of the non-compliance will depend on the thing that is missing, however, it’s more usual than not that if something is required and it is not there, the grade is ‘non-compliant material’ as the auditee has failed to meet their licence obligation.
It’s all about relationships!
I’ve seen many examples where all business units in a utility are not aligned with each other – to the point where a non-consulted change is made in one business unit, that adversely affects water quality management and compliance, and impacts on the water quality business unit. An example might be where a change is made in a risk policy or the media and communications section put out a marketing directive on water quality, or a decision is made to open up a drinking water reservoir for recreation, without first consulting with the water quality business unit. This sort of approach can jeopardise operating licence compliance outcomes, as well as business outcomes, for the whole of the enterprise. So, make sure that as a business, you all talk to each other and understand each other as important stakeholders in protecting public health and water quality. It’s all about relationships!
Use the audit outcomes to your advantage
As the auditee, it’s important to keep an open mind, put your ego to one side, understand that the auditor is impartial and that their findings are helping you to improve your performance, and hopefully, pick up risks before they occur, protecting you and your business. I’ve had examples where an auditee has had a less than favourable outcome one year then picked themselves up and had a stunning result the following year, with sustained success for their business. Using the audit and its outcomes as an opportunity for improvement will help you breeze through your future audits and show that you are committed to protecting public health.
Need help? D2K Information and Risk Edge profoundly know water.
BIO:
Dr Annette Davison