Time to stop lurking and start posting !

Hello, I'm a QM for a small software company in the UK, we've had our ISO9001 and TickIT certification since 1998 and were certified against ISO9001:2000 last June.

My certification body is one of the larger ones, and at our last audit they raised a non compliance on my internal audit schedule. The text of the non compliance is as follows: "The internal audit schedule was reviewed and was judged appropriate to the requirements of ISO 9001:2000. However there was no independent audit of the quality function identified to show that 8.2.2 paras 3 and 4 are being complied with".

My initial response - senior management provide the appropriate level of checking and authorisation by reviewing and/or setting the companies "policies" on quality, and then hold me accountable for the delivery of them by formally measuring me against my objectives - wasn't well received. Neither was the second response - that as the certification body audit me on a six monthly basis an internal audit was unnecessary.

Being a small company we don't have anybody with the appropriate skill set that could audit the quality function and we don't really want to hire (either temporarily or permanently) or train another QM/auditor. Any comments ?

Thanks in advance
Ad

In a similar situation in the past, we had certain customers who audited us on a regular basis; this was judged acceptable by our certification agency.

Otherwise, we always considered the formal audit to be the check on the Quality Manager.

Admittedly, though, I'm not in the UK.

Sounds to me like they're trying to force you into additional audits which might not be necessary.

Based on how I read your post, I think that this finding is a bit nit-picky.

Bruce pretty well covered it, but hear is a couple more ideas.
Take a look at your management review system and see if there is a way to beef up the records etc. from this. I feel this is the area where you really get the most formal audit. Otherwise just bring in one of your internal auditors to check over your records, processes etc to provide the warm fuzzy for the auditor.

Another option would be to bring in a consultant once a year to look over your processes. This may not be too expensive.

Good to see another lurker come out of the shadows.

Welcome to the mad mad mad mad mad mad mad:frust: :frust: world of the cove.

James

Just tell the auditor that your schedule is based on status and importance................and the quality function has neither :vfunny:

Sorry

Yes,

For $50-$100/hour/quarter you can hire someone to come in and give an opposing view. Even if it costs a few bucks more, say up to $1,000.00 / year it is well worth the expense.

There are qualified people out there that can cover your situation!!!

I'd love to but I am too far away!!!!

This topic was discussed, at length, and with some great ideas, just a few short months ago.
Please check out the search engine - it will be worth it.

Without knowing how your audits are conducted, the problem may be that there was no audit of the Quality Department. Since the quality department is a key process it should be audited. Any trained auditor (internal) should be able to audit it. The 00 standard slacks up and just says you can not audit your own work. We do process audits, so just add the Quality Department to your list of departments to audit. MO

Originally posted by David Mullins

This topic was discussed, at length, and with some great ideas, just a few short months ago.

Please check out the search engine - it will be worth it.I couldn't find it. If anyone knows which thread, please do post a link. Thanks!

In a prior life I ran into this situation and addressed it by having the QM of one of my customers audit me, and returning the favor when she needed it.

Perhaps not in Software Badger's case, since he notes that it is a small company, but in many systems would it not be acceptable for an internal quality auditor outside of the QM's area to audit relative to par 3 & 4 of 8.2.2? The specific statement of independence has not been carried forth into 9k2k and it now says in par 2, 8.2.2 "Selection of auditors and condcut of audits shall ensure objectivity and impartiallity of the audit process. Auditors shall not audit their own work." Thus, an internal quality auditor from a department or area other than the QM's department should be capable of satisfying this requirement for auditing the QM relative to the two paragraphs in question.

As an auditor I would less likely question the use of an in-house internal auditor for this purpose than a Customer's QM for whom you cannot certify capability unless the the person is a certified auditor. ;)

Who's minding the store?

I my view, the systems of checks and balances includes the third party opinion.

As for my company, we have a Government entity/customer perform surviellance audits and of course the third-party registrar assessment as well.

Quality Manager/Lead Internal Auditor simply comprise the local authority.:eek:

I have worked in several situations where the practice Russ mentions was implemented. We had a volunteer internal auditor from another department, or another quality engineer with responsibilities that did not include the audit program, perform an audit of the internal audit program.

But, I agee that it is kinda nit-picky. I guess I'd have to question: Where does the madness end? If I have someone audit my auditors, then who audits the auditor of the auditors, and who audits that person, etc. etc.?:bonk:

I believe one can audit their own dept so long as the audit is audited??!!!

It's a food chain thing.

Ultimately, the International Organization for Standardization dictates the hows and whys.
So, who checks them?

I my view, the systems of checks and balances includes the third party opinion.

Good point Radar! I'v talked with several auditors over the past years, and this topic comes up regularly. The consenses seems to be that the third-party audit is a confirmation of the audit process.

Al, James! Great to see you both posting again! :bigwave:

Look at 8.2.2 states: "Selection of auditors and conduct of audits shall ensure objectivity and impartiality of the audit process.
Auditors shall not audit their own work."

The focus is on impartiality and objectivity, not independence.

The next sentence is the hard one "Auditors shall not audit their own work" We enter into the letter of the law and the spirit of the law here, so to speak.

Smaller organizations, "Mom & Pops" and single person company's cannot easily get around auditing there own stuff. If the M&P or other small org can show impartiality and objectiveness (narking themself off so to speak) during the audit process, is not the spirit of the law fulfilled?

We need to ask ourselves "What is the real purpose of the audit?" 1st and foremost I think it is to identify potential areas for improvement and 2ndly to identify areas of deviation in order to put them right and to do so in such a manner that the deviation doesn't occur again.

Kinda simplistic piont of view.

We took a simple solution to the question of who created the craetor.

Our Puchasing Team have been trained (and qualified) as QS auditors, they audit the quality function.:bonk:

We took a simple solution to the question of who created the creator.

(ps. Engineers ca't spill (craetor :biglaugh: :biglaugh: ))

I work in a small company and the first internal audit was done by a external consultant, but it was so expensive for us.
And now we have a qualified audit team: quality responsible, general manager and a person of purchase department.
General manager and quality resposible audit "as a team" all the system, except 2 procedures: management review and quality comitee that are audited by the person of purchase.
For us is cheaper and we know better our company.

I feel processes are to be audited and not the persons or departments. I was told during my training (LA for TS 2) that if you are doing auditing department wise and person wise you are not doing justise with auditing based on Process Model.
Infact, the whole manufacturing process is to be auditing without much interaction of persons. It is called audit by SEEING or By Observation.

Manoj

I don't usually like to say this but I would challenge the auditor and the certification body to justify the non conformity. The spirit of the requirement is that the organisation's processes are all audited. The quality function is important but is not a key process within the business (controversial?). As such the quality function can audit all the core processes.

Any support processes that the quality function contributes to can similarly be audited. I have yet to see a certification body stick to its guns on this one as it goes beyond the spirit of the element to say you should have completely independent auditors throughout the system. We are all involved when it comes down to it!

If all else fails get someone off the "shop floor", give them half an hour on filling in the audit paperwork and present a piece of paper to the external auditor the next time that isn't worth a light, explaining "well I told you so!"

Controversial, Paul? Which part?

You say The quality function is important
Now that's controversial Some quality functions seem to be designed to work against the business and for the registrar. Hopefully management wakes up and such 'professionals' are removed from the Job Continuation Plan before they can do too much damage.

You say The quality function is not a key process within the business
That's much less controversial, depending on exactly what you mean. I suggest that the quality function operates several processes, most of which are not key (i.e. not what ISO 9000 calls product realization processes). Some QC-like work may constitute a procedure as part of the control of a key process. But much of the work of the quality function - where it's not simply a waste of space and money - comprises what ISO 9004 identifies as 'support' processes.

You say it goes beyond the spirit of the element to say you should have completely independent auditors throughout the system. We are all involved when it comes down to it!

True - and there is no requirement for an auditor to be independent anyway - simply the "you shall not audit your own work" requirement.

Item: we no longer audit 'work' - that is old-think.

Item: since we audit processes, we presumably involve suppliers and customers [internal or external] so we always have someone else involved in the audit anyway.

Obviously not as controversial as I thought!

Thanks for the reply, Tom. I agree that there are some quality people who aren't focused on the business first but I maintain the importance of the quality function (widest sense) is there. The product and process design activity should be supported by the quality function using quality tools and techniques. So rt process - Yes. Important process - also Yes.

Back to the independence bit. I appreciate the wording. I just feel that there is no way a certification body should insist on more than one auditor in a small firm.

Hello,
I am the Quality Manager, the Audit Coordinator and the Internal Auditor :) :bonk:
We only have 6 employees.