"Planned intervals" for Internal Audits and Management Review

[António Vieira]

I don’t think this problem has been discussed before.

According to what’s written in ISO 9001:2000 about the intervals for performing Internal audits and Management reviews, we have the same requirement – planned intervals.
Of course, organizations are allowed to make these activities in “planned intervals” of 2, 3 or even more years.
Why almost all the registrars ask that these actions are made at least once a year?
Really, just according to the standard, it doesn’t make any sense...

About this question one registrar told the audited organization that it was possible for them to have 3 years intervals between each internal audit and each management review (the duration of each certificate), but in that case the number of days of each 3rd party audit made by this registrar, should be increased.
We still don’t have the answer, but in my opinion it was not a very good idea because for sure the accreditation body won’t allow that.

Comments?

AV

[Sidney Vianna]

Originally Posted by António Vieira

Why almost all the registrars ask that these actions are made at least once a year?...Comments?

For the same reason that most calibration intervals are artificially set at 12 months. Perpetuation of "old, tribal knowledge". On top of that, the IAF Guidance to ISO Guide 62 "mandates" the surveillance audits performed by the CB's to happen with a maximum interval of 12 months. You have to draw the line somewhere to create a policy. Otherwise, less than serious certified organizations would artificially set their intervals to meaningless frequencies, such once every decade.
The maturity of the QMS should influence the frequency of internal audits and management reviews, but organizations that believe that internal audits and management reviews are not value added activities typically don't understand the fundamentals of modern principles of managing for Quality.

[harry]

ISO 9001 is a system meant for businesses, not auditors, CBs or ABs. Traditionally, all accounts need to be closed and audited once a year and it's also during this time that top management conduct their annual review, AGMs and what others where the plan for the year are announced. Quality policy and objectives may need review as a result of these changes. To facilitate things, it's only logical that it becomes mandatory for these to be reviewed yearly also.

[Claes Gefvenberg]

Originally Posted by António Vieira

Why almost all the registrars ask that these actions are made at least once a year?

Interesting question, because our registrar does not... The std requires us to plan an audit programme "taking into consideration the status and importance of the processes and areas to be audited, as well as the results of previous audits.", and ISO9004 expands a bit on that.

Our IA procedure states that the results from an audit (Among other things) shall be used to determine the date for the next one, so in effect we have a rolling schedule: A poor result could mean that next audit will take place in as little as six months, while a really good one could keep us away for 18 months (A real breakdown means a re-audit much sooner, of course, but I have had to resort to that only once or twice in over ten years). The external auditors have nothing against this. Quite the opposite.

/Claes

Follow this link to see a flowchart:

[Coury Ferguson]

Originally Posted by Claes Gefvenberg

Interesting question, because our registrar does not... The std requires us to plan an audit programme "taking into consideration the status and importance of the processes and areas to be audited, as well as the results of previous audits.", and ISO9004 expands a bit on that.

Our IA procedure states that the results from an audit (Among other things) shall be used to determine the date for the next one, so in effect we have a rolling schedule: A poor result could mean that next audit will take place in as little as six months, while a really good one could keep us away for 18 months (A real breakdown means a re-audit much sooner, of course, but I have had to resort to that only once or twice in over ten years). The external auditors have nothing against this. Quite the opposite.

/Claes

Follow this link to see a flowchart:

I like the way you have set-up your IA systems. I have never looked at it that way.

I have always set the intervals annually. Maybe I will consider that change to the current IA procedure.

Thanks for that different perspective.

I guess I do learn something new daily.

[DannyK]

There are some registrars that have placed in their conditions of contract, the requirement to cover all clauses within the internal audit and to perform a management review at least once per year.

[Claes Gefvenberg]

Originally Posted by DannyK

There are some registrars that have placed in their conditions of contract, the requirement to cover all clauses within the internal audit and to perform a management review at least once per year.

Really? I have never seen that, but once such a contract is signed one has to live with it of course...

/Claes

[Sidney Vianna]

There are customers that require their suppliers to perform an annual QMS audit. For example, Boeing Commercial Aircraft require that through their Form X31764 - Quality Purchasing Data Requirements.