Setting up ISO9001 system - when to start internal auditing?

Hello All,
As this is my first posting here let me introduce myself. I am an electronic engineer working for a small company (4 employees) in the UK. I have been given the task of setting up an ISO9001 quality system, the boss would like us to have gained certification by the end of the year.

I am not a Quality professional, but have worked to ISO9001 in other companies.

My question is this, for the certification audit will we be expected to have already carried out a programme of internal audits, or will it be acceptable, since we are just starting out, merely to have an audit programme scheduled for the future?

Thanks, John.

The IAF (International accreditation forum) guide states the following on that matter:
" quote :
IAF Guidance to clause 2.1.5. (G.2.1.42. – G.2.1.45.)

G.2.1.42. Clause 2.1.5 of ISO/IEC Guide 62 does not mention a specific period in which at least one complete internal audit and one management review of the organization’s quality management system shall take place.
The certification/registration body may specify a period.

Irrespective of whether the certification/registration body has chosen to specify a minimum frequency, measures shall be established by the certification/registration body to ensure the effectiveness of the organization’s management review and internal audit processes.

G.2.1.43. Certification/registration shall not be granted until there is sufficient evidence to demonstrate that the arrangements for management review and internal audit have been implemented, are effective and will be maintained." unquote.

It looks like their is no requirement for a complete internal audit at the time of the registration audit. The organisation has to provide evidence that the system is established, implemented and maintained at a sufficient frequency to garantee effectiveness of the QMS. ( unlike ISO TS where a full round of internal audits and completed management review is mandatory at the certification audit )

Best regards,

Antoine

Welcome to the Cove, John

How about keeping us updated about your progress as you go along? That way you can benefit from the collective knowledge of the Cove, while we benefit from your experience.


/Claes

John Mann said:

Hello All,
As this is my first posting here let me introduce myself. I am an electronic engineer working for a small company (4 employees) in the UK. I have been given the task of setting up an ISO9001 quality system, the boss would like us to have gained certification by the end of the year.

I am not a Quality professional, but have worked to ISO9001 in other companies.

My question is this, for the certification audit will we be expected to have already carried out a programme of internal audits, or will it be acceptable, since we are just starting out, merely to have an audit programme scheduled for the future?

Thanks, John.

Click to expand...

In my opinion, to begin this process now, and expect to be certified by end of year, is not appropriate. There is much benefit to be gained in an ISO 9001 system, but in this short time, there is not enough time to learn how to do it well. You might get the certificate, but unlikely to get much of the benefit. The other distinct possibility, if the system is not well implemented because of the short time frame, there could be many nonconformities, then you spend the next 90 days fixing thos. IMO, better to take the time to learn and implement properly, then get audited. The smal size of your organization can work to your favor since there will be less people to train.

While I agree with hjilling in theory, I feel the statement regarding certification by the end of year depends on the complexity of you company's operations and current level of documentation. It is possible for a company to gain registration in 5 months, just not for most companies.

As to your original question regarding auditing, you should begin auditing as soon as you: a) have a documented procedure in place to control the process; and b) have suffecient objective evidence to prove either conformity of nonconformity.

While I have read Antoine's quotes from the IAF, I doubt you'll find a registrar willing to reccomend your system for registration if you havent performed internal audits, management reviews and taken action on the outputs of both. It would be a huge stretch for an auditor to say you have functioning system if not every part f the system is functioning. I've worked with 4 auditors from 3 unique companies and all required every procedure be audited atleast once prior to registration.

If you chose your registration company, I would ask them (your auditor to be) this question. That is the only opinion you really need. If you havent chosen a registration company yet, you need to. If your target is the end of the year and you havent selected the registrar yet you are already behind schedule.

Welcome to the board.

As an auditor, we require that all new certifications have an internal audit completed before the certification date.

The reason is that it demostrates that you know how to implement the internal audit process that is documented in your system. Don't forget to have an audit schedule prepared for the next year as well.

More importantly, I would strongly suggest that you do an internal audit before the certification audit, just to be sure that everything has been completed as required. I also like to conduct a little QMS refresher training a week or two before an external audit.

In this case, an internal audit is preventive action against the chance of having an error identified during the certification audit.

In reality... the best way to spread the quality awareness within the company is to have your internal audits planned and completed midway between external audits. If the external certification audit is every December, for example, then plan the internal audits between June and August.

Just a suggestion.

Good luck.

Many thanks for all the very helpful replies so far. I will certainly keep you updated on our progress (I'm sure many more questions will arise!) I should explain that I have been putting the documentation together for some time and this is now nearly complete.

The two main problems we face are
1. Of the 4 employees in the company, I am the only one who has any experience of working under ISO9001. It will be quite a culture shock to the others, for example the idea of controlling Engineering Changes is quite new to them.

2. The usual small company problem of lack of resources

John.

John Mann said:

It will be quite a culture shock to the others, for example the idea of controlling Engineering Changes is quite new to them.

Click to expand...

Try not to shock them by making the means for that control as user friendly as possible. Btw: Is it really completely uncontrolled today? No notes? Nothing?

John Mann said:

The usual small company problem of lack of resources

Click to expand...

Yes, there is that of course, but being small has its advantages too. Take a close look at my favourite note in ISO 9001:2000:

ISO9001:2000 said:

The extent of the quality management system documentation can differ from one organization to another due to
a) the size of organization and type of activities,
b) the complexity of processes and their interactions, and
c) the competence of personnel.

Click to expand...

Now, the system should be tailored to your needs, and chances are that a very lean system will serve you well.

/Claes

John Mann said:

The two main problems we face are
1. Of the 4 employees in the company, I am the only one who has any experience of working under ISO9001. It will be quite a culture shock to the others, for example the idea of controlling Engineering Changes is quite new to them.

2. The usual small company problem of lack of resources

John.

Click to expand...

I can empathize with you regarding #1 and #2! When I started with this now 11-employee company (9 at the time of hire), Engineering just did what they wanted, and hoped they remembered where the files were saved! Thank goodness they at least had a disaster recovery process!

We have not achieved ISO 9001 registration yet, because the owner thinks the registration is overrated. However, he expects us to be compliant. That would be fine with me. All other areas comply with ISO 9001. Just the owner is a hold-out with the marketing process. He is too busy. This is where I empathize with your situation for #2!

Best of luck.

--QG

Claes Gefvenberg said:

Btw: Is it really completely uncontrolled today? No notes? Nothing?

/Claes

Click to expand...

No it's not like that now as change control was the first system I set up and everyone here understands the reasons for having it. However, previously it was much as described in Quality Goddess's post.

A further question on auditing - with only 4 employees, most get involved in most areas of the company's work. Even if everyone acts as an auditor it will be hard to meet the requirement that auditors only audit areas in which they are not involved. How would you cope with this?

Thanks,
John.