Hi

One of our sister companys recently failed their external ISO 9001 audit. They did not even get past the review of their quality manual, policy, objectives and documentation.

I have rectified these non-conformances but have now been tasked with auditing the whole of the QMS before the external auditors come back. I have never carried out an audit to this level before as I have only done internal audits to procedures.

I have searched the forum and found loads of check lists and information to help me - you guys really are great!

The thing I am slightly unsure on is I know how to audit a procedure but how do I know their procedures and supporting documents meet all the requirements of the ISO 9001 standard?

I also know I need audit training and it will happen but not before I have to carryout this internal audit.

Any advice would be much appreciated.

Nette

Hello Nette, and welcome to The Cove.

Performing a bench audit (which is what your sister company failed) is the first step.

Using a checklist, audit the documentation for compliance with ISO 9001:2000. At each specific clause and "shall", obtain objective evidence that the system's documentation covers adequately the requirement.

This is why documents that are closely patterned after the standard are easier to audit, because they'll repeat the requirement. "The organization ensures purchasing information does such and such by" and then reference to documents that will provide the objective evidence during an on-site audit.

Thank you Atetsade.

I know I am being very blonde but just to double check. Basically I need to go through the standard and find all the shalls and make sure that they have something in place to cover them.

Example

7.4.1 Purchasing Process

The organisation shall ensure that purchased product conforms to specified purchase requirements.
I need to make sure they have a process in place to ensure that suppliers are told what our requirements are and that also shows how we ensure that they have met these requirements. Evidence of this would be things like drawings and supplier PPAP (we are a manufacturing company for the automotive industry).

The organisation shall evaluate and select suppliers based on their ability to supply product in accordance with the organisation's requirements.
This would be evidence of supplier questionnaires that grade suppliers, supplier delivery and quality performance and approved supplier list.

Sorry I know its probably a really obvious thing but I'm having a bad week.

Thank you.

Nette

I think I will leave the response to someone with more audit experience, there are many certified quality auditors and even registrar auditors who participate in the forum.

It sounds like you are spot on. I like to remind people of the effectiveness requirements of ISO 9001:2000. For example:

The organization shall conduct internal audits at planned intervals to determine whether the quality management system

a) conforms to the planned arrangements ...
b) is effectively implemented and maintained

Therefore, at each step, I would consider it imperative to question whether the planned arrangements are effective at satisfying the requirement.

Basically I need to go through the standard and find all the shalls and make sure that they have something in place to cover them.

Example

7.4.1 Purchasing Process

The organisation shall ensure that purchased product conforms to specified purchase requirements.
I need to make sure they have a process in place to ensure that suppliers are told what our requirements are and that also shows how we ensure that they have met these requirements. Evidence of this would be things like drawings and supplier PPAP (we are a manufacturing company for the automotive industry).
Right on - just turn each shall statement into a question.

Question: "How does the organization ensure that purchased product conforms to specified purchase requirements?" Answer: "The organization performs receiving inspection per their procedure TCF.10.01" Then you ask for some objective evidence and they should show you receiving inspection records.

Sorry I know its probably a really obvious thing but I'm having a bad week.
Don't apologize - we've all been there and we're here to help.:agree: I was torn from my CMM kicking and screaming and thrown into this stuff. Luckily I ended up liking it - but I didn't know anything about ISO or QS at the time. I wish I'd known of the Cove back then!

Right on - just turn each shall statement into a question.

Question: "How does the organization ensure that purchased product conforms to specified purchase requirements?" Answer: "The organization performs receiving inspection per their procedure TCF.10.01" Then you ask for some objective evidence and they should show you receiving inspection records.

Right on...or, even better (in my opinion), phrase the question in plain english.

Question : How do you know that you're getting/receiving what you ordered?

This is a very open ended question and phrased simply. It then leads to possible answers like...what if there are no specified purchase requirements? What if they don't know? What if there is no inspection?

I''ll attach an Internal Audit check list for ISO 9001 and TS16949 (in Red)
that I found here on the Cove. This basically covers all the "shalls" by each section and provides some guidence. Hope this helps you.

Right on...or, even better (in my opinion), phrase the question in plain english.

Question : How do you know that you're getting/receiving what you ordered?
Even better!:agree1:

Hi Nette,

Here are a few thoughts that I hope might help:

First, just hazarding a guess, but maybe there's some resistance to documenting processes at your sister company? If so, do remember there are only formal requirements for six documented procedures. All the other 'shalls' have to be satisfied, and there have to be records as you imply, but not necessarily a documented process (although that will often be the case in practise). So, for example, if the mangagement team are inclined to be rude about documenting a process for management review, that's ok: as long as there are records that show (a) it happens and (b) it's planned (e.g. minutes include 'date of next meeting') that should work just fine.

Once you've gotten all the "shalls" squared away, go back and check the system is consistent with itself. Especially, check that the quality policy has been translated into measurable quality goals, that they are measured and trended, and that there's corrective action when trends go the wrong way. For example, if the policy is to deliver defect-free product to customers, check that there are targets for defect rates (5.4.1), a plan for achieving targets (5.4.2) and that they're measured, trended and improved (8.2, 8.4, 8.5). The processes for all these items don't necessarily have to be documented (although they probably will be), but there do need to be records.

Finally, in the process descriptions, check that each role is defined, the training or experience requirements for it are determined (probably documented) and that there are records for all this. (6.2)

Hope this helps,
Patrick

ps It's ok to be blonde!

How do you know what their procedures say? Ask for a copy of them ahead of time, make sure they cover the requirements, then when you go to their facility check to make sure they are doing what they say they will do.

How do you know what their procedures say? Ask for a copy of them ahead of time, make sure they cover the requirements, then when you go to their facility check to make sure they are doing what they say they will do.

And carry the ISO standard, checking the ISO requirements as you audit their processes. You'll need to bounce back and forth between what they say and what is absolutely required. Take lots of notes!! When in doubt, Come back to the Cove:) and ask more questions!

A big thank you to all of you. All your advice and the check list have been a huge help. :thanx:

Nette

How do you know what their procedures say? Ask for a copy of them ahead of time, make sure they cover the requirements, then when you go to their facility check to make sure they are doing what they say they will do.There we go. Yes, you must be provided access to all the procedures you will need to do this--could be a tall stack--starting with the QMS manual and working through the critical systems as the previous posters have said. Be prepared to spend some time doing this, and carefully read the registrar's remarks for insight and guidance. If you need more clarity, by all means contact the registrar, explain your project and ask your specific questions.