Happy 2009!

I just want to wish everyone who follows "Show Me the Shall" faithfully a Happy New Year!

I sincerely thank you for your readership and would like to let the both of you know that my New Year's resolution is to audit less and blog more!

Please forgive my unforgivable absence, I was on the road auditing non-stop starting in July through December. Not that I could have competed with all the attention given to the election (that's my excuse and I'm stickin' to it) Of course I always have my trusty laptop with me (although, my Sony puts the "rust" in trusty - but, I digress), so it seems like a pretty lame excuse... Of course, I won't let that stop me from whining...

Besides, as any auditor knows, one's creative juices are not exactly flowing after a grueling day of torturing auditees - although the gin and juice is. OK, so it may have inspired Hemigway, but he was in the Florida Keys, which is infinitely more relaxing than some of the places I have been this year. This brings me to my top 12 auditing FUBARs of 2008 - why not 10? 'Cause I can't afford rehab, so this blog is my 12-step program!

12. Auditing on my birthday in northern Minnesota on a record cold day - You betcha!

11. Visiting the Mexican desert in August and getting Montezuma's revenge - Aye papi!

10. Auditing in Phoenix in July - WTF???

9. Traveling to 9 cities in 4 days and crossing every time zone in this beautiful country - Jet lag-schmet lag!

8. Spending all but 17 of the last 100 days of '08 on the road - even my dog doesn't know me anymore...

Yada, yada, yada, wah, wah, wah, so let's skip to number one:

I get a flat tire in the middle of the night on the way home from an audit. I call the emergency roadside assistance service folks who say they'll call back when they find a tow service. An hour passes and absolutely no one has stopped to help. I decide to change it myself (because I am impatient). To my dismay, I discover that the hand-crank jack (sounds naughty, doesn't it?) needs about a foot of clearance, which my sporty little coupe did not have.

At this point, a state trooper pulls up. I immediately drop the lug wrench, put my hands up, and pray he doesn't shoot me, or worse, write me a ticket for speeding (this actually happened to me the last time I broke down in Indiana). To my utter amazement, he helps me. He grabs a good old American car jack from his trunk, gets the tire off and we grab the spare. Sadly, this is where the fairy tale ends: The spare has to be inflated by a cute little compressor that plugs into the cigarette lighter. The compressor works great - if you are a balloon animal artist and not in a big hurry.

Any-who, we call the emergency roadside assistance folks to see if they have any advice on how we can inflate the tire before we grow old and die. I hand the phone to the officer so he can get the skinny. They have no answers, they also tell him that no wreckers are available and end by recommending he call the police for help.

PRICELESS!

My hubby had to drive down and rescue me.

All in all it wasn't a bad year, but I wish everyone a better 2009!

Document Dilemmas Part 1: To Control or Not to Control...

...Ahh, but this is really the question: "Do I have to control all my EMS documents?"

If I had a dime for every time I heard it, I might be able to buy a gallon of gas!

This question reminds me of a nonsense riddle my grandfather, Scoop, used to tell: "What's the difference between an orange?"

And, no, I didn't forget the "and what" part...

Done scratching your head?

The correct answer, according to Scoop, is: "It must be a bicycle because a vest doesn't have any arms." Yeah, grandpa was funny like that, and, come to think of it, this traumatic childhood memory probably goes a long way toward explaining why I drink so much now...

Nah... I drink because I audit!

Anyway, this riddle is obviously absurd, and can only result in an absurd answer. Not surprisingly, it has a lot in common with that first question about document control. (Yes, there was a point to this blog besides a stroll down memory lane.)

The standard is actually very clear about document control (I know, I was shocked too). It's right there in the first sentence of element 4.4.5: "Documents required by the EMS and by this International Standard SHALL be controlled."

Not much wiggle room there... But just in case there is still confusion, let's break this high-falutin' language down into what I like to call "Okie-speak" (in other words, the no-BS version):

If you create, have or use a document, ANY document, you gotta control it.

------ COMMENTS FROM THE PEANUT GALLERY ------

GASP!!!***SPLUTTER*** ##CHOKE## ----WHEEZE--- &^%$%#@*!?

Surely she doesn't mean EVERY document! Why, that would be impossible! She's describing a nightmare world!!! What a crackpot!!

She is obviously clueless about the extreme difficulty we have in controlling the few, elite documents that we have chosen for such a high honor! This is outrageous!

I knew it: bloggers can't be trusted, there is no accountability. She can just say anything she wants!!!! This is utter horsesh--

...

Sorry, I stepped away for a second - had to freshen my drink. Hopefully you did too - after all those peanuts, I bet you're thirsty!. OK, let's continue down this path of "utter madness."

Maybe you have nowhere else to go and nothing else to do, or maybe you are tipsy enough not to be offended by my extraordinary philosophy on document control. Whatever the reasons you have stuck with me, you may nonetheless still be skeptical. Good for you, you're still reasoning - that means you can't possibly have alcohol poisoning! But wipe the drool off your chin and rest (hopefully in an upright position) assured that I am not alone in this interpretation. See TC 207 COI 99-03.A7.

Had too many Harvey Wallbangers or Moscow Mules to remember what the #$%& TC 207 is? read Dr. Strangeaudit... to find out more.

Believe me, when I was an ISO newbie back in the day (well after Scoop and well before auditing), I felt that document control did nothing but create a red tape nightmare. This philosophy was based in my gripe that I had enough worries what with the EPA breathing down my neck, and all the laws I had to follow, etc., etc, wah, wah, wah.

No amount of whining can change the fact that document control is an essential key in effective business management, regardless of the type of system. But no matter whom I talk to, it seems that the number one reason people don't want to control a document is because...

\/\/\/\/\/\/ DRUM ROLL PLEASE \/\/\/\/\/\/

IT'S A ROYAL PAIN IN THE BUTT!!!!

But after hundreds of audits, and more than a few attempts to revamp inherited systems, I can clearly see the root cause of the problem, and it ain't the standard folks. Just like Charlton Heston said in Soylent Green: "It's people!"

The standard requires very simple controls. WE create these document control nightmares ourselves - Freud would have a field day with us on this one!

Most document control methods are overly complex and, in reality, more an attempt to create a loophole for document control rather than to actually control a document. To read more on this fascinating (and probably highly inflammatory) subject, check out the next installment in the Document Dilemmas series - Ultimate Document Smack Down!!!

But this post still needs some perspective, some seasoning, or as Emeril might say, some BAM! So here comes the heat - you may want to get out of the proverbial kitchen here, unless, like Hillary Clinton, you are very comfortable there.

For the quality gurus out there who stumbled across this blog while surfing for S&M sites, think of it this way: You wouldn't use an uncalibrated piece of equipment to collect data about the management system - you're certainly not allowed to by the standard - it might help you to imagine the standard wearing a lot of shiny, black leather and carrying a whip. So, think of document control as a form of calibration. You can't use an uncontrolled (uncalibrated) document. And if you did, you would get a spanking for being naughty (and not just because you like it).

Since environmental folks surf for bestiality sites (it's more "natural"), they wouldn't see this blog unless I renamed it "Show Me the Sheep" or something. But even if they did, the above example wouldn't register with most of them who usually aren't as well-trained (I'm not even sure most of them are potty trained) in the finer points of calibration. I am speaking from experience (ESPECIALLY the potty trained part).

But that's OK. I just pull on my Depends and remember that the primary purpose of document control is to ensure everyone has access to current, consistent and accurate information. So here's an example the "bunny huggers" can understand: If you control the procedure for hazardous waste management so that it gets revised when the accumulation time limit changes from 180 days to 90 days, you won't have to trade cigarettes with your cell mate to get your diapers.

OK, perhaps the spiciness has left a bad taste in your mouth. Let's switch gears. It's late as I finish this up, last call has come and gone, the kitchen's closed, and I'm in the mood for some warm milk, cookies and a nice bedtime story. So here goes...

Yes, Virginia, there is a Santa, and yes, you must control all your documents - even your Christmas wish list. Otherwise, Santa might leave you a door mouse instead of a doll house because he didn't know which revision was correct.

Let's stop here and continue the story another night...

Till then, sleep tight and don't let the auditors bite....

Bizzare Audit Experiences

I have been asked many times what is my strangest auditing experience. I have really had too many to pick one that stands above all others, but here a some of the weirdest by category:

Animal Encounters:

"Nice doggy!": I was bitten by a junkyard dog while trying to take samples based on a complaint that the owner was dumping oil (at a junkyard - imagine that!). Once the incident was reported, the owner reported the dog missing for almost all of the 2-week rabies observation period. It looked like I was going to have to get the dreaded series of shots in the stomach, until the dog miraculously "reappeared" on the last day. Whew! But they don't call me "Mad Dog Molly" for nothing!

"The Stress Musta Got to 'Em":

There is nothing quite like the special ambiance of an emergency room for a closing meeting. My client was having dizzy spells and was uncontrollably nauseous, which is not necessarily abnormal at a closing meeting, but we did think this case was serious enough to go to the hospital. Fortunately he got better, and to this day claims it was NOT the audit, but a temporary loss of equilibrium in his ear after a cross-country flight.

"War" stories are sometimes an excellent way to encourage a client to open up and relax, but ghost stories? One client explained to me that he talks to ghosts that live on the other side of his backyard fence, and they tell him what to do. What can you do but nod your head, smile and try not to make any sudden movements?

Lovely Weather We're Having:

Having 3 tornado warnings in one afternoon was an excellent chance to test the effectiveness of emergency preparedness and response procedures at one organization. Plus, I had a ready-made pool of interviewees trapped there with me. Bonus! Hey, just like showbiz: the audit must go on!

Unfriendly Fire:

As a rookie park ranger (19 years old), I was on patrol, when my veteran partner spotted someone with beer on the beach (which wasn't allowed), so he let me out to write my first ticket. While I was busily trying to figure out how to fill out the form, I was oblivious to everything else, including my perp, who was standing between his car door and the interior of the vehicle. My partner came up behind him, and grabbed the billy club he had been reaching for, brought it up and said" What's this?" I sure learned some important observation skills that day...

...and the "most evil" award goes to this one:

When I was a hazardous waste inspector for the Indiana Department of Environmental Management, I was involved in a case where the owner of a plating company was trying to sell off and/or dispose of all his chemicals so he could skip town. I got involved after the city shut off the company's sewer access and called IDEM in to investigate. The case ultimately wound up with the federal EPA. If it were a Master Card ad, it would go like this:

Fines for illegally discharging your untreated plating solution to the sewer: $5000.
Fines for illegally burning your hazardous waste in the parking lot: $25,000.
Getting ten years in the federal pen for trying to sell your polluted property to the city for use as a youth center: Priceless!

Time After Time - Audit Planning Follies Part 2

When it comes to figuring out how often and how many (audits, not adult beverages), it is helpful to remember that this not a ritual you do to fend off evil spirits, like vampires (and/or auditors).

Unlike rituals - stabbing voodoo dolls, sacrificing virgins (auditors) or bouts of heavy drinking - internal audits give you measurable data about environmental performance.

Ok, ok, I had you until that last part where I started to sound like a textbook. To clear up any confusion, here’s how Huggy Bear would say it: “Word on the street is, audits tell you what’s goin’ down!”

That’s right, internal audits enable the lonely, red-headed step-child environmental manager (no, a longer title does NOT equal more pay) to get in the loop and find out what’s really going on outside their dark little corner of the office, otherwise known as the broom closet.

What may be the most upsetting to some is that without a required number of audits, it is nearly impossible to plan an avoidance strategy, not that folks won’t still try. Here’s a good example: “If there is no requirement about how often you must audit, is auditing the entire system once every three years often enough?”

Geez! Don’t strain yourself! No, this would not be acceptable. You would fail to meet the requirement to base planning on previous results and environmental importance, not to mention it’s just silly! Audits are your window on the world; do you really want to fly blind for 3 years?

Avoidance strategies like this reflect a failure to see value in auditing. If auditing is something that is done only under extreme duress, you are missing the point of having an EMS. These attempts to side-step "extra work" may also reveal a fear of finding out that things really aren’t working and then having to pass that information along to managers. Ignorance is bliss, right?

I know it’s scary to show your soft underbelly to managers, but if environmental performance equals your personal performance as EMR, you have MUCH bigger problems (See “Taming Your Inner Scapegoat - An Owner’s Manual for Environmental Professionals” – coming soon!)

Remember, EMS is top-down: the buck stops with top management and they drive the system (not the EMR), so if something is not working because of inadequate resources, they are required to provide them. Audit data helps to create an accurate picture of performance; one that you show to your managers so you can get the resources you need: i.e., money, people, cash, equipment, $$$$, time, bucks, training, money, money, money). In other words, audit data is a lot like the PIN to your ATM card: you gotta have it before you can get the dough (or d‘oh!)

You know the old phrase "Money talks..."? Well, you want to make sure your audit data isn't the equivalent of the second half of that famous saying.

So hopefully now you understand that audit data are your "friends." But you may still be asking how audit frequency comes into play.

MULTIPLE-CHOICE QUIZ

Do you want your audit data to show managers:

a) A one-time snapshot?

or

b) Trends that have developed over time?

If your answer was “b,” you get 1000 points on the EMS-O-Meter toward expert-EMR status. Congratulations! You know that the messenger relaying tomorrow’s potential problems is better off than the bearer of yesterday’s bad news.

As I have said before, the standard intends for you to do internal audits whenever you need the feedback they provide. So now that you know how to schedule audits, the trick is getting them done… AND getting them done right!! (See “Bad Audits and the Auditors Who Love Them” – coming soon!)

To Everything, There is a Season... Audit Planning Follies Part 1

Do I have to audit all elements of the standard within a year?

What the $^&@*! is a "full cycle" of audits? (See “EMS Registration: The Road to Becoming ‘Certifiable’” – coming soon!)

Will an audit a day keep the registrar away?

These are the questions that keep environmental managers up at night… or at least the night before their registration audit.

Well, let’s see: Element 4.5.5 requires audits to be conducted at “planned intervals,” whatever that means... So a simple schedule showing I audited all the elements in a year should work…

But… wait a minute... What’s this gobble-de-gook in paragraph 2: “Audit programme(s) shall be planned, established, implemented and maintained by the organization, taking into consideration the environmental importance of the operation(s) concerned and the results of previous audits.”??? Huh??? Why can’t they just say what they mean??!!!!!!

What, you want more clarification? Well, alrighty then. How about our good friend (and would-be rapper) TC 207? This roundabout requirement is mirrored - in two-part harmony no less - by COIs 02-03.A1 and 02-03.A2. After reading them, I promise, everything will be clear… as mud.

Don't know what a TC 207 COI is? See "Dr Strangeaudit or: How I Learned to Stop Worrying and Read the COIs."

Still itching for a numbers fix? I’ll try to explain in plain English: You audit when you need to.

It all boils down to that pesky 25-cent phrase: “planned intervals,” which miserably failed to clarify equally vague “periodically” used in the 1996 standard.

So is an interval the same as a “period”? If yes, then what’s a "period"? Is there a standard accepted timeframe that any auditor (no matter how dense) can recognize as a "period"? Whoah there! All this talk about periods is enough to give anyone PMS! To quote Foghorn Leghorn:: “I gotta straighten this lad out; thing like this could warp his mind for life.”

Look, take some ibuprofen, dry your eyes and cheer up. The "party animals" who went to the TC 207 site and read the COIs already know that there is no bare minimum number of audits you can “get away with.” Yep, that’s right. Playing dodge ball around an arbitrary number is not an option here. But there is still a silver lining: in a freak accident of common sense, the standard writers decided to require you to base your audit needs on:

1. What is important to your organization (NOT your registrar auditor), and

2. What has been a problem in the past

This means you focus on your problem areas, both actual and potential. Let’s face it: in the world of environmental management, things are constantly changing, and usually not for the better. Controls seem to fail when it’s most inconvenient, and even relatively good days still have nagging glitches. Then, there are always nasty surprises like mystery drums left by naughty “elves” in the middle of the night. Wouldn’t it be great to catch the problems before they blew up in your face, instead of being constantly blind-sided?

Internal audits help you do this because (if you do them right, and look beyond the "safe zones" of what's already working) they give you consistent, accurate and regular data about how your attempts at environmental control are performing, so you can quickly respond to small problems before they get out of hand. If you do enough good audits of the right things, they might even help you see a problem before it happens and prevent it!! You move from REactive to PROactive.

But I still hear whining: “That doesn’t answer the question how often and how many! Give us a number, we just want a number, surely there must be a number?!!!! WAAAAHHHH!!!!”

Well, just like other addicts, the whiners can’t help it. They have been brainwashed and need their number fix. There are lots of meaningless and arbitrary numbers out there - in permits, in regulations, or (if you really screw up) on your prison-issued clothing. And really, we are all in the same boat with the whiners because, even though enforcement of these numbers is capricious and inconsistent, we all want to believe that, if we meet the numbers, or get under or around them, everything is ok, even when it really isn’t. The reality is more like Lucy swiping the football out from under Charlie Brown – as soon as you are convinced it’s OK, the game changes.

Without our numbers, we often feel like a blind person trying to climb Mount Everest. But you still have “Sherpas” to guide you through this audit scheduling wilderness. You want numbers? Here are 5 things to consider when planning your audits:

1. Applicable legal requirements

2. Significant aspects

3. Corrective and preventative actions

4. Objectives and targets and

5. COMMON SENSE!

Numbers 1-4 are indicators of environmental performance, so they should be audited regularly; how regularly depends on number 5. The EMS does not exist in a vacuum, and you should always listen to your inner reason!

Objectives, Targets and Bullseyes

...And the comments just keep rolling in - I feel so loved!

Someone has asked what the difference between an objective and target is. A lot of people think there isn't any difference, but there is, and it is important to understand it because objectives and targets are a powerful tool for demonstrating continual improvement.

Both of these terms are specifically defined in the standard in Section 3 (Terms and Definitions) 3.9 and 3.11, which means they don't want you to use the dictionary version. Although the standard writers probably thought they made it crystal clear, you are not alone in asking: "What the #$!@" do they mean?"

A common explanation is that an objective is an overall goal or "umbrella" description of a goal whereas the target is more specific and must be met as part of the larger goal.

...zzzhnh Wha...?? Whoa - I just fell asleep typing that!!!

This reminds me of something mildly hilarious: When asked why the ISO 14001 standard wasn't written more clearly, my instructor answered that it was difficult even for college undergraduates to understand because it was written very elegantly to the "17th-grade level." Folks, I can't make up stuff this ridiculous.

Although mere baccalaureates (I mean, 16th graders) cannot reasonably be expected to attain this lofty reading comprehension level, the concept of objectives and targets could easily be explained to a tipsy barfly with a beer in one hand and a crooked plastic dart in the other.

Think of the type of dart game (301, cricket) as the "objective," and the various numbers on the dartboard, including the bullseye, as the "targets." In the game, hitting individual targets measures progress toward reaching the overall goal: winning. Without both the objective and the targets defined, you might as well throw darts at anything or anyone, which I think we can all agree would not clearly demonstrate continual improvement, even if they were thrown by someone with a PhD.

The standard requires programs be defined to achieve objectives and targets. So I'll take this example one step further (too far?) and define a "program": the barfly (responsibility) must use the darts (means) to finish the game before he passes out (timeframe).

And just because I can, I'm going to go over the proverbial cliff with this example: In 4.5.1, the standard requires calibrated/verified equipment to monitor objectives and targets. This is because the data must be not only accurate, but consistent, reliable and repeatable. So, to return to the example: if the "equipment" is a drunk person using worn out bar darts, I wouldn't bet on a winning streak. In other words, "GIGO" applies.

There are lots of myths about how objectives must be set and what they must include. For more information on objectives and targets, see the following COIs: (click on the link under "Faves," or if you don't know what COIs are, click here)

99-03.A4

97-05.A1.R99-06

07-08.A1

07-08.A2

Maaaa! Do I Have To?

Some bold soul has asked one of the most common questions out there: "Is it mandatory to have one or more significant aspects to be registered?" Huzzah!!! My first comment. I'm so excited...

The essential answer is: YES!

Now, you may feel a little sheepish telling someone, "Well, this blogger said to do it..." Baaah humbug! Fortunately, you don't have to depend on an opinion-based blog to get the answer because the standard writers (TC 207) and the registrar oversight body (ANAB) have kindly provided the "official" answer to this question. To quote Mr. Burns: "Eh-eh-xcellent!"

There are actually 2 different places to find the answer, although only one really applies if you are seeking registration.

1. Our TC 207 friends answered almost the exact same question in COI 04-03.A1. Unfortunately, their publishing skills do not appear to extend much beyond stone carving because you cannot directly link to this question online, but you can access the COI document that contains it here, or by clicking on the link provided under "Faves." Hint: it's in the 2004 version.

For more information on TC 207 COIs see the following blogs: "How I learned to Stop Worrying..." and "The ABCs of COIs"

2. TC 207 gets you most of the way there, but those competing for "registration gold" must play by the rules - in this case, ANAB's Accreditation Rules. This group of sages has at least a minimal grasp of "that new-fangled internet thingy," and you can directly access Accreditation Rule #13 online.

For that ANAB history buff out there (you know who you are), AR 13 supersedes Advisory 20. More importantly, it incorporates the TC 207 COI mentioned above and adds some extra ANAB icing, which spectacularly fails to make this topic any less dry. So, grab something to wash this down (it should be at least 80 proof), and I'll give you the "CliffsNotes" version - there is no movie version (thank God!!)

AR 13 essentially says: If you don't have any significant aspects, you won't have a system that can be registered because you WON'T have to do..., well, pretty much anything and everything that would show an auditor you have a system in place. That's because key elements all tie back to SIGNIFICANT aspects; heavy-hitters like: objectives and targets, training, communication, operational control and monitoring and measurement. You don't need to do this stuff for INsignificant aspects, so without any significant aspects, you basically don't have a reason for a system.

You just snorted your drink through your nose, didn't you? I can hear the choking and spluttering from here. In the immortal words of George Carlin: "Calm down, have some dip." OK, so you've changed your shirt, refreshed your drink, and taken several deep breaths. You are dry, relaxed, and best of all, armed with new (albeit painful) knowledge: You must have at least one (1) significant aspect to get registered. Whew!

But this begs a second question (so take a big steadying gulp and swallow it before reading on):

Why put a whole EMS program in place around 1 or 2 aspects? And even if you still see value in a severely limited scope, why register such a system? It's like throwing a big party and not inviting anyone. OK, registration is nothing at all like a party, except for possibly the excessive drinking, hangovers, and morning-after regrets.

For more information about this endlessly fascinating topic, see "Covering Your Aspects" - coming soon.