Question
I am a Quality Assurance GxP Auditor and I am being told that I cannot perform employee qualification audit. I am being told that CV/resumes, job descriptions, and training records are confidential and my viewing them would violate an employee’s privacy. If this is true, how to I prove to my client that the company has qualified personnel?
On the same note, is this also true of an internal or 1st party employee qualification audit where my own company would want me to verify the qualifications of our employees to ensure they meet international FDA/ICH guidelines?
Response
Thanks for contacting ASQ’s Ask the Experts program.
With regard to your question, maintaining confidentiality can be a major concern for the employee, organization and the Auditor. For this reason, the review of employee files containing private data such as social security numbers, banking, personal contact or other sensitive information should be avoided if possible.
This not only maintains employee privacy, but also reduces the Auditor’s level of exposure to potential liabilities.
So now the question is; how can the Auditor verify employee qualifications and experience? Remember that there is no requirement for an Auditor to review job applications, CV/resumes, or other confidential information.
It’s the organization’s responsibility provide the Auditor with objective evidence that they have established job descriptions for employees performing work activities that affect the quality of the product or services to be provided to the customer (ISO 9001:2008, clause 6.2.1). This includes providing evidence that the employee’s qualifications, skills, education and any applicable certifications have been verified to meet job description requirements or the need for training has been established to ensure job description requirements are met (ISO 9001:2008, clause 6.2.2, sub., a. b and c).
As you are aware, a job description may be considered as proprietary, but they are seldom considered as private since they don’t contain any personal information. Some organization’s may require that a nondisclosure agreement (NDA) be signed to protect propriety information such as engineering data, drawings or other methods related to product realization processes.
A record of an organization’s review and verification of employee qualifications should be readily available. Likewise, training and applicable certification records should be available to provide objective evidence that qualification and/or competency requirements have been met (ISO 9001:2008, clause 6.2.2, sub., e).
Bill Aston
ASQ Senior Member
Managing Director of Aston Technical Consulting Services
Kingwood, TX
http://www.astontechconsult.com