Internal Audit and Management Review before Certification: Is it a required?

[romelnar]

i am in a consulting business and been around for quite some time now (after disconnecting myself from the chain of everyday, neverending audits ). i have some concerns about regulations of certifying bodies'/registrar i know.

is it really required that we have to conduct at least 1 internal audit and at least 1 management review before certification audit to iso 9001: 2000?

how ever i put the standard inside-out and bottom's up, i cannot find any requirement saying that we have to do those two "before certification". what were mentioned in the standard are: "shall conduct internal audit at planned intervals" and "shall review the org's qms, at planned intervals".

For example, i am officially implementing my QMS on 2005 June 1. i established an IA procedure stating that we have to do it every 6 months. in the quality manual, we stated that we will conduct the MR in 6-month interval. both documents will be officially executed starting 2005 june 1. we are going to be audited on 2005 september 02. on the standpoint of the CB, we have to conduct both IA and MR or else there will be nonconformity (i think they say it's a major NC). but on our side, i think we'll follow what we have in our own documents that sez every 6 months (counting starts on 2005 june 1) and not the requirement of our CB which comes after 3 months only (3 months earlier than the interval we specified).

i have also read iso/iec guide 62. i believe nothing was also mentioned about this. or is there?

need help...

[Don Palmer]

Others here may offer further information, but I have one question.

How will you demonstrate conformance to standard requirements regarding internal audits and managment review, if you have not accomplished at least one complete cycle including each of these elements prior to your initial audit?

Registrar auditors are keenly interested in determining implementation (paste tense) of the entire standard and the effectiveness of your QMS.

Originally Posted by romelnar

i am in a consulting business and been around for quite some time now (after disconnecting myself from the chain of everyday, neverending audits ). i have some concerns about regulations of certifying bodies'/registrar i know.

is it really required that we have to conduct at least 1 internal audit and at least 1 management review before certification audit to iso 9001: 2000?

how ever i put the standard inside-out and bottom's up, i cannot find any requirement saying that we have to do those two "before certification". what were mentioned in the standard are: "shall conduct internal audit at planned intervals" and "shall review the org's qms, at planned intervals".

For example, i am officially implementing my QMS on 2005 June 1. i established an IA procedure stating that we have to do it every 6 months. in the quality manual, we stated that we will conduct the MR in 6-month interval. both documents will be officially executed starting 2005 june 1. we are going to be audited on 2005 september 02. on the standpoint of the CB, we have to conduct both IA and MR or else there will be nonconformity (i think they say it's a major NC). but on our side, i think we'll follow what we have in our own documents that sez every 6 months (counting starts on 2005 june 1) and not the requirement of our CB which comes after 3 months only (3 months earlier than the interval we specified).

i have also read iso/iec guide 62. i believe nothing was also mentioned about this. or is there?

need help...

[Sidney Vianna]

Read the IAF Guidance for ISO Guide 62 document, available at http://www.compad.com.au/cms/iaf/wor...ssue_3_Pub.pdf . Registrars operating under an IAF signatory accreditation scheme must follow this document.

There are many things that are required in an accredited audit that are not part of the "standard" being audited to. For example, where in ISO 9001 do you read the term "objective evidence"? Not there. Still, during your "never ending" audits didn't you seek for "objective evidence"?

A "planned" QMS is not a certifiable QMS.

[Denis9001]

I'm an auditor with a CB. The other post is correct in that without having done a IQA?MR you will not be able to provide evidence that the system is implement. Like a car that has never been driven claiming it is roadworthy. Your CB cannot insist on 3 months. Change CB. Realistically we would expect annually but that is not set in stone and would depend on the business (activity). In your case your system calls for 6 monthly IQA. You could say that if your system has not been operating for 6 months it is not mature enough ie hasn't been driven 1000 kilometers. Bear in mind the CB knows they are the first IQA/MR's so it is to be expected that there are few results. Your MR report would acknowledge this. remember IQA's don't have to be done in one go. They can be by function over time. So you must have done an IQA. How do you know you are ready for certification if not. You probably did a IQA before setting up the system (gap analysis) as well. Here's an insider tip for you. It depends on the CB a bit but if there is an area you have problems with and the CB will probably pick up on. You raise a NCN in your IQA and decide the corrective action in your MR. The deficiency is now under the control of the system. The CB should not issue a NCN because it is already identified and corrective action is underway. This is not an escape clause but helps in some areas.