First external audit coming up, do I need to have performed Internal Audits already?

[ed99999]

Hi,

Quick overview of myself:

I'm a 21 year old Uni student having a year out before returning to do my final year at Uni. I have been given the role I suppose of QA manager in writing the Quality Manual, paperwork and procedures to gain the company ISO status. We have been working on this for about 6 months (with small interruptions for other projects) and finally have our audit date booked for 3 weeks time. All the paperwork is done (i think) and just need to tie a couple of bits up.

My question:

Do we need to have conducted internal audits yet or can I set the audit dates for after the main audit so I don't have to worry about these. Or will my auditor want to see they have been carried out prior to the first audit? I understand I would have to be qualified to perform internal audits (which I am not) but we have other people within our group of companies capable of doing this so wouldn't be a problem.

Regards, Ed

[Jennifer Kirley]

Welcome to The Cove, Ed!

When you say first external audit, do you mean for registration to a standard? If so, yes indeed you will need to have done internal audits. It's generally expected to have at least one complete audit cycle (all processes covered) completed, as well as corrective actions and most, if not all, of their closure.

Please also see related threads listed at the bottom of this page for more insight.

[TamTom]

Hi Ed,

as Jennifer told you it is normally expected and also a logical thing to do an internal audit first, because:

1. Why let the external auditor find issues you can find yourself (Normally a system is not perfect the first trial.)

2. You risk a confirmation of non-conformities with an on site visit from your auditor, this means more costs.

3. All you find the external Auditor find not, so he will praise the system, what is not bad for the Quality Department

Regards,

TamTom

[Phil Huber]

Good morning, Ed
I would assume you did some type of Gap analysis to determine what procedures, etc., were required? Did you not do audits at each point of implementation to confirm the actions taken were effective?

If so, be sure these audits are documented. It would also benefit you management team to put a summary of these activities together and develop additional action plans (for continual improvement). That way you will have achieved:
a) internal auditing
b) verification of effective corrective action
c) management review

If you have not completed these actions, do so prior to the "external" audit. You may find that you will want to move this audit out to a later date.

You will find the Cove to be a valueable resource, I know I have!

[SpongeMouse]

time is short for the external audit and internal audit.

usually, in our case, internal audit comes 1st then after 3 months comes the external audit.

as Phil said, better to move that external audit

[SteelMaiden]

Any of the registrars that I have ever worked with require a complete round of internal audits (and at least one management review, which you wouldn't be 100% compliant on because you cannot report on your internal audits) be completed.

[AndyN]

Ed, from one Brit to another.......

Gotta get your internal audits done, if you expect to be certified to ISO 9001!

It will be a major finding if you don't! You will not be looking good, as a result!

So, you'll have to cover, typically, the whole system at least once - what's often called a 'full cycle'. Also, I believe it would be expected that you'd at least done some to follow up on any actions taken as a result. Apart from anything else, you don't want your CB finding big holes in the system and, you have to demonstrate the internal audit system works too. You can't wait until after the CB audit, now can you.....ISO 9001 says you have to do them....

So, I'd suggest you crank up the audits and do a lot of them. One big system wide one (like the CB auditor(s) will do, and some smaller more focused ones on things your company didn't do 'before ISO', type of thing. They shouldn't take more than a day each to do.

BTW - have you had any training on audits? I would hate for you to also come under scrutiny for 'competency'.......

BTW - 'ow's 'Uddersfield?

[Phil Huber]

Ed,
Looks like we've started to pile on the work for you, sorry!

So,
While we're at it, perhaps a check list of activities to complete prior to the "external" audit:
a) complete your (and others as appropriate) internal auditor training
b) identify the "processes" of the quality system (sequence and interactions-process mapping)
c) audit those processes
d) report out findings and actions to be taken to management
e) implement those actions
f) verify that actions taken are effective

This is the typical "Plan, Do, Check, Act" cycle, continue to perform this cycle. As your quality system becomes more mature, you will find less nonconformances and a greater number of opportunities to improve. Thus the "continual improvement of the quality management system" requirement of ISO 9001.