I was recently called in by a company to train up a couple of internal auditors to audit their ISO 9001 certificated system, so we decided to to a bit of theory and then conduct some audits on their own system - also helped because they were well behind on their audit schedule.

When I got to the company I looked at the system and it was of the 'bare bones' variety - i.e. a brief quality manual and the 6 mandatory procedures. Now, I don't have a problem with the system being nice and brief but trying to train new auditors, who know nothing at all about ISO 9001, to prepare for and audit the system was a real challenge.

We identified the key processes in the organisation easily enough but what do they audit against? The QM, ISO 9001, current practice all come to mind but when they don't know the standard and the manual is very brief, it was really tough for them.

Just wondered how other people have handled a similar situation.

They may not have "documented" procedures, but they still have procedures (those things or actions they perform to achieve customer expectation) and the requirements they must meet. Audit that stuff.

Ask about what they are supposed to be doing, the inputs, out puts and measuring and then verifiy what is actually happening.

Look at their "requirements" (contracts, orders and that stuff) and see if they are being fulfilled as required.

You can also check if employees are doing the job in a consistent manner.
If there is no consistency, there may be a need to have a procedure.


Danny

Don't forget to ask for things like controls for the process, maybe an external requirement, maybe an internal one, as well as how they know when to put a control into place.

This is a tough situation for persons new to auditing. I approach these situation by getting the auditees to walk me through there process starting at the begining and I look for evidence of things happening, be it forms, database records, meeting notes, emails etc, as we go through the process.

A general rule I hold is when someone tells me they do something I ask them if they have evidence of this.

Just wondered how other people have handled a similar situation.Try the ISO APG advice on Auditing a QMS which has minimum documentation (http://isotc.iso.org/livelink/livelink/3556498/APG-MinDocumentation.doc?func=doc.Fetch&nodeid=3556498)

In this situation,you may just conduct audit against ISO9001:2000.

Thanks for the replies so far.

Randy, you are quite right of course, everyone has procedures but not all are documented. I am quite happy auditing against 'what they do' but it is difficult for a new auditor to do as they have nothing concrete to refer back to.

Fireonce, I do indeed do that myself as I am familiar with the standard and what it requires. However, new auditors rarely know the standard and given that they only perform a few audits per year, will probably never get to the point where they know it well enough to use.

On a similar vein, I have recently been involved in the re-design of an IRCA registered 2 day QMS IA course and they do not include familiarisation with ISO 9001 in the course criteria, just the structure. I find it crazy that we should present this course without going through the standard.

Dear Sir
I have read all the suggestions you have received so far. I am an IRCA LA for ISO 9001 & 14001 on panel of many certification bodies far last ten years.
As regards auditing without any documented procedures, that is the challange the third party auditors face all the time. Precisely for this reasons the CBs look for auditors who have work experience in the related industry, which enables them to know what the organization must do meet the customer requirements consistently.
Firstly, if the QM is too sketchy that in it self is bad QMS documentation. Most importantly know organization can work successfully with only six manatory procedures.
Secondly, during the interviews you will able to find lack consistency among the procedures/methods employed various workers. This will mean the organization must establish those procedures/work instructions as part of the QMS documentation.
Finally. based on the industry/work experience you should audit the organization. This should ce coupled with the statutory & regulatory requirements the organization must comply with.
Thanks for raising such an interesting issue.
Major B V Naik