Hello everyone,
I need to perform the anual internal audit as usual; however, the company has changed ownership and the new management is giving new directions and policies, which is expected and normal; still, how can i conduct the audit during this period?. There will be lots of findings and what made sense for the previous management, is not under the new one.
We need to have a Management review meeting, so we can set the objectives for this year and so fort, but we also need to present all the findings from the audit with their corresponding action plan.. how do u think the external auditor will find the amount of findings raised during the internal audit?.
And my other concern is: are the external auditors auditing according to the new version of ISO 9001? whar if i have some work in progress by the time of the external audit?

I hope you guys can give some guidance.
Regards,

Fernando

Can you change the audit schedule to give management more time to make their objectives?

If not, if your management had objectives before, but the objectives will now substantially change and are under review for that, I would just ask about the process, either underway or expected, for identifying objectives; and then how they will want to learn about the progress, and what the expectation is once they receive the data. After all, without a process for all this, objectives have no meaning at all.
:2cents:

I agree with Jennifer. Also, you have some time before you have to adopt the new standard, so I would move that to the back burner for now. (That said, if you were complying to the 2000 version there will not be much to change for the new version). If your external audit schedule is set, and will come up soon, it is better to have many nonconformances documented in your C/A system, and be working on them, than to have the auditor come in and have a field day, IMHO.

I have moved this post to this forum, since it is focusing on Internal Audits

Hello everyone,
I need to perform the anual internal audit as usual; however, the company has changed ownership and the new management is giving new directions and policies, which is expected and normal; still, how can i conduct the audit during this period?. There will be lots of findings and what made sense for the previous management, is not under the new one.
I hope you guys can give some guidance.
Regards,

Fernando

Fernando:

Do you only do one (1) internal audit, covering the whole system? If so, you are non-compliant to ISO 9001, which requires audit programs (a number of audits) to be scheduled based on status and importance. By doing smaller (scope), more frequent audits, you won't run into this problem again.....you won't generate so many audit findings at one time and it won't seem so overwhelming.

And my other concern is: are the external auditors auditing according to the new version of ISO 9001? whar if i have some work in progress by the time of the external audit?

Don't worry too much (if at all) about having 'work in progress' at any external audit. You run the system for your company (not for your external auditors), and any good auditor will take the time to ask questions about what's been happening since their last visit, before they start to audit so they get the context. This normally happens at the opening meeting, but if by any chance it doesn't, just explain what's been happening and how big the changes have been.

They will understand you can't do everything all at once/very quickly after such a major change. Provided they can see good evidence of things happening (eg, a plan, objectives and progress) they'll be fine with that.

I need to perform the anual internal audit as usual; however, the company has changed ownership and the new management is giving new directions and policies, which is expected and normal; still, how can i conduct the audit during this period?. There will be lots of findings and what made sense for the previous management, is not under the new one.

There is one key distinction that makes a solid and mature Management Shine shine above one that exists "for the certificate" only...the ability to survive and adapt through major changes. A robust Management System should not stop because of a change...it may slow down, some priorities may be re-prioritized...but at the end, the Management System has the tools, techniques and methodologie to get things back up to optimum speed.

Things to look for during the audit may include...

Does your Management System have controls in place that will effectively implement and communicate new directions and policies?

Is there a training plan for the new management to help them become more familiar with the existing processes?

Are Customer and Regulatory requirements still being met or has all control of processes being lost?

We need to have a Management review meeting, so we can set the objectives for this year and so fort, but we also need to present all the findings from the audit with their corresponding action plan.. how do u think the external auditor will find the amount of findings raised during the internal audit?.

You can also use the Mangement Review meeting as a kind of training session...an introduction of the Management System to the new people. They may have questions. They may want to understand what you measure and why. They may want to dig deeper into your improvement areas to fully understand the justification. This is a perfect opportunity.

I don't believe a good external auditor will look at the number of findings, per se, but more at the caliber/nature of the findings. As well, as a result of the significant change that has happened, if there are some heavy findings, you may wish to reschedule another audit towards the end of the year - this will enable the team to see if the findings have been resolved or if more indepth action plans are required.

And my other concern is: are the external auditors auditing according to the new version of ISO 9001? whar if i have some work in progress by the time of the external audit?

You should contact your registrar for an answer to this one. At the same time, you may with to outline your concerns with the registrar to see if they are able to provide you an alternate date for an external audit. This will give your organization more time to adjust to the change and perhaps implement some of the easier-to-do actions from any internal audit findings (i.e., demonstrate to the external auditor that the new management is commited to the Management System).

There is one key distinction that makes a solid and mature Management Shine shine above one that exists "for the certificate" only...the ability to survive and adapt through major changes. A robust Management System should not stop because of a change...it may slow down, some priorities may be re-prioritized...but at the end, the Management System has the tools, techniques and methodologie to get things back up to optimum speed.
Very, very true.

Excellent post, Roxanne, with excellent advice.

I agree that it's an excellent opportunity to use the Management Review meeting as a kind of introd to the system (for top management), and a real opportunity for them to ask questions and have a (I hope) fruitful discussion. Now that's a real review.

Thanks very much guys for all your comments. In fact my plan was to have this audit at the end of 2008; however, because of these changes I decided to re-schedule it.
As Roxanne said, it is a great opportunity to show the system to the new management but I am afraid it could be kind of overwelming, specially for the one that have to do most of the work, meaning, ME...lol.
I will contact the registrar for sure and let them know about this transition period and how we can handle the next audit.
I have another question. Is it possible to raise a major finding for a non-conformance to a general clause instead of going into the detail of every single item of the clause?... I am asking this with the intention of avoid paperwork. The root-cause is pretty much the same and the solution could be to review the whole aspect and reflect current policies.
Thanks again,
Fernando

I have another question. Is it possible to raise a major finding for a non-conformance to a general clause instead of going into the detail of every single item of the clause?... I am asking this with the intention of avoid paperwork. The root-cause is pretty much the same and the solution could be to review the whole aspect and reflect current policies.
Thanks again,
Fernando
The short answer is yes. But first, are you sure that there are as many problems as you think there are? I'd recommend that you don't go into the audit with the assumption that because the new management team has been making changes, that the things they are doing now don't meet requirements. Keep an open mind and see if what they are doing, even if it's different from what's been done in the past, will meet requirements and be effective for the organization. If there are problems, you should be able to provide them with objective evidence...

Thanks very much guys for all your comments. In fact my plan was to have this audit at the end of 2008; however, because of these changes I decided to re-schedule it.
As Roxanne said, it is a great opportunity to show the system to the new management but I am afraid it could be kind of overwelming, specially for the one that have to do most of the work, meaning, ME...lol.
I will contact the registrar for sure and let them know about this transition period and how we can handle the next audit.
I have another question. Is it possible to raise a major finding for a non-conformance to a general clause instead of going into the detail of every single item of the clause?... I am asking this with the intention of avoid paperwork. The root-cause is pretty much the same and the solution could be to review the whole aspect and reflect current policies.
Thanks again,
Fernando

If you are talking about an internal audit, NO! You shouldn't be writing 'major's and 'minor's! That's a CB auditors reporting technique. As an internal auditor, you have to report the system as you find it. Lumping many issues together won't be helpful to management, and certainly not if you put a ribbon around it with an 'ISO Clause' on it. Once again, this is a consequence of doing one (very) large audit instead of smaller, more focused ones.

Going forward, I feel you must rethink your whole internal audit strategy.........

Hello,
something from my current experience: the company is in the process of major re-organisation and we are having an external audit this very day. Our records showing that we work on processes and we have appropriate action plans, were sufficient for the auditor.
As for internal audit, I would carry it out on planned date for process as it is documented now and show NCs found; then the process owner can close some by changing relevant process description (keeping standard requirements in mind). Normally, I would schedule next internal audit for the same process within, say, 6 months, to evaluate whether the process runs smoothly after implementation of changes.