Do all findings (nonconformities) in an internal audit require a corrective action?

M

MrOctober

My company is AS9100 certified,

In our quality manual it states that a corrective action is required for all findings in an internal audit and a Corrective Action Report must be issued.

Our manual used to have the words, "as necessary" but past AS9100 audits had that as a finding. So it was removed.

My issue here is that with something extremely minor and can be fixed in the matter of five minutes, still requires a corrective action and report to be filled out. Is there a way I can reword the sentence and make it depend on the severity of the finding? Say if it doesn't effect the end product?
 

John Broomfield

Leader
Super Moderator
Re: Do all findings in and internal audit require a corrective action?

My company is AS9100 certified,

In our quality manual it states that a corrective action is required for all findings in an internal audit and a Corrective Action Report must be issued.

Our manual used to have the words, "as necessary" but past AS9100 audits had that as a finding. So it was removed.

My issue here is that with something extremely minor and can be fixed in the matter of five minutes, still requires a corrective action and report to be filled out. Is there a way I can reword the sentence and make it depend on the severity of the finding? Say if it doesn't effect the end product?

MrOctober,

Correction only of nonconformity is permissible before your organization evaluates the need for removing the root causes from its system.

As a result of this evaluation (opportunity/risk assessment) your organization may decide not to invest in corrective action to stop recurrence.

The nonconformities and the results of the evaluation (and corrections) should be recorded so you can see how effective they are.

Simply saying "as necessary" or "only if affects product quality" may be seen as a cop out.

For example, an ineffective recruiting process may result in employees who never will become competent.

John
 

Sidney Vianna

Post Responsibly
Leader
Admin
Re: Do all findings in and internal audit require a corrective action?

My issue here is that with something extremely minor and can be fixed in the matter of five minutes, still requires a corrective action and report to be filled out. Is there a way I can reword the sentence and make it depend on the severity of the finding? Say if it doesn't effect the end product?
One of the problems is the fact that the AS9100C Standard itself seems to be rigid, as it reads:
The management responsible for the area being audited shall ensure that any necessary corrections and corrective actions are taken without undue delay to eliminate detected nonconformities and their causes
I taught many auditing courses and I always tried to educate the auditors-in-training that they have to have common sense, when evaluating the findings from the audit and, before documenting something as a nonconformity, they should make a mental evaluation if the issue at hand could really be prevented from happening again and, thus, a corrective action is possible. There are some isolated instances of failure to comply with a requirement which can NEVER be totally resolved. For example, an obsolete document being used. If someone really thinks that organizations of a certain size can achieve perfection in terms of applicable revision of documents being used, I will call them naive.

Still, most auditors like to pretend that organizations can implement true corrective actions when a couple of isolated instances (definition of minor nonconformity) of obsolete documents were observed during an audit.

Typical example of archaic quality thinking clashing with real-world business.

So, instead of wording your procedure differently, I would try to educate your internal auditors in the proper categorization of findings and not report something as a nonconformity when all evidence points to a really unique occurrence when no systemic fix is possible.

I suspect some purists will disagree with my proposal, but I can handle it.
 
Last edited:

dsanabria

Quite Involved in Discussions
Re: Do all findings in an internal audit require a corrective action?

My company is AS9100 certified,

In our quality manual it states that a corrective action is required for all findings in an internal audit and a Corrective Action Report must be issued.

Our manual used to have the words, "as necessary" but past AS9100 audits had that as a finding. So it was removed.

My issue here is that with something extremely minor and can be fixed in the matter of five minutes, still requires a corrective action and report to be filled out. Is there a way I can reword the sentence and make it depend on the severity of the finding? Say if it doesn't effect the end product?

While I do understand your dilemma in your wording, you need to use common sense and think outside the box. For the next 3 month develop a Box Matrix:

First Column - Issues
Second Column - product related
Third Column - process related
Fourth column - one time occurrence
Fith column - training / document related

after 3 month of this exercise (or more) you will start a process develop and you see trends. This will lead you to re-write your procedures into different category (i.e. 8.3) and you could guide internal and external auditors when a non conformance is written

Hope this helps!

Try developing a
 

AndyN

Moved On
Re: Do all findings in an internal audit require a corrective action?

IMHO - this is an area where internal audits and external audits differ considerably. For a start, internal audits should simply present the findings (ncs if you like) to management for action. No "CARs" should be issued, just simple reports - which contain sufficient information that management understand that action needs to be taken.

External audits (particularly SQA audits) often require a supplier to take corrective action - not just correction - because the issue is often seen as the "tip of the iceberg".

Take out of your manual the need for any "CA" from the internal audit process and make it part of the CA procedure, that management can decide on what level - Correction or corrective/root cause etc - needs to be taken.

Of course, it helps to be far more collaborative in their planning of audits to engage with management, so they WILL take action, because they understand it needs taking!
 

Jen Kirley

Quality and Auditing Expert
Leader
Admin
Re: Do all findings in an internal audit require a corrective action?

If we are to be purists, there are different kinds of findings: positives, observations (OBS), opportunities for improvement (OFIs) and nonconformances (NC) major and minor.

When internal auditing I used all of these, and as a CB auditor now I still do. Only nonconformities require corrective action. It was important to raise a legitimate NC. It needs to be accurate, actionable, and hopefully value-added. It is not value added to send auditees spinning like weather vanes to obey auditors' wishes. I see it more than I want to.

If the NC is not actionable, I wonder if the nonconformity you are referring to is citing the standard or your requirements, or maybe customer requirements? We need to conform to the standard and customer requirements; where the standard is not prescriptive, the auditor is tasked to apply some reason and maybe some imagination to see that is happening. If it is not actionable but the requirement is in procedure, is the procedure correct and realistic?

The auditee can "push back" and try to explain it a different way, show some more documentation, send another auditee etc. Even CB nonconformances can be disputed. Can you try?
 

LUV-d-4UM

Quite Involved in Discussions
Re: Do all findings in an internal audit require a corrective action?

During one of the surveillance audits, the auditor was concerned that we are not writing nonconformances only opportunities for improvement. So we reaudited one of our processes and found 6 ncs against the ISO standards. NC's against 4.2.3, 7.6, 7.5.3, etc... were documented and corrected after doing the RCA.
 

AndyN

Moved On
Re: Do all findings in an internal audit require a corrective action?

During one of the surveillance audits, the auditor was concerned that we are not writing nonconformances only opportunities for improvement. So we reaudited one of our processes and found 6 ncs against the ISO standards. NC's against 4.2.3, 7.6, 7.5.3, etc... were documented and corrected after doing the RCA.

This is purely because CBs have been told to "tighten up" on the grading of findings. It's silly. Firstly, what has it got to do with what you "grade" them as? Did the auditor spend any time to look at the content? No, it's a silly, picky nonsense comment.
 

LUV-d-4UM

Quite Involved in Discussions
Re: Do all findings in an internal audit require a corrective action?

As a result of that comment in the CB surveillance audit report, the Top Management was at its full throttle to fix the finding and as internal auditors we earned a bad reputation within our peers. However, when we did the audit, we wrote down justifications for the nonconformance and the consequence of not taking action. Thank you.
 
Top Bottom