Opinions on internal audit schedule adjustment

[Randy]

Leave it intentionally vague and say "annually" rather than once every calendar year.

So totally wrong as Mike pointed out, you'd essentially go 2 years with no internal look and "effectiveness" would be in question.

Just define something that says "no more than X number of days" like "annually or no more than 365 calendar days". Give yourself some latitude to set your "period" but elbowroom to allow flexibility.

 

[Jim Wynne]

So totally wrong as Mike pointed out, you'd essentially go 2 years with no internal look and "effectiveness" would be in question.

Just define something that says "no more than X number of days" like "annually or no more than 365 calendar days". Give yourself some latitude to set your "period" but elbowroom to allow flexibility.

Do you know what "annually" means? How can an annual event go two years between events?

 

[Jen Kirley]

Okay, I'm trying to wrap my head around this concept of a rolling basis for audits. Say I write in my procedure that I want a full system audit done once every calendar year. If in Year 1 I do audit components A, B, and C in June, July, and August, but then Year 2 do them all in September, and then Year 3 do them in May and June, would that be acceptable? Even though the timeframe between audit components varies and may be more or less than a year?
Examples would be appreciated!

I don't understand why the schedule needs to be proceduralized. I fully agree with touching everything annually in a new system, then stretch out some lesser risk and well performing processes as the system matures. There should be flexibility to prioritize and schedule based on risk and what is going on/what has gone wrong. It is possible to document this without formalizing it in a procedure.

 

[Randy]

Do you know what "annually" means? How can an annual event go two years between events?

Seriously? OK let me help.........Audit performed 1/1/23, next audit performed 12/31/24 (that's 1 audit per ANNUM). Annual means "once per year", not within 365 days. If you say it can't happen you need to get out into the world, I've seen it as have others.

 

[Jim Wynne]

Seriously? OK let me help.........Audit performed 1/1/23, next audit performed 12/31/24 (that's 1 audit per ANNUM). Annual means "once per year", not within 365 days. If you say it can't happen you need to get out into the world, I've seen it as have others.

"Annually" does not necessarily pertain only to a January-->December calendar year.

 

[Randy]

"Annually" does not necessarily pertain only to a January-->December calendar year.

OK whatever, start the year in July, September, April whatever, it's the same blessed thing and the same silly game that organizations try to play.

 

[KarenA01]

I have a related question...

Lets say in stead on one audit a year you do 3, but each covers different causes. Using Letters in place of clause numbers say in year one you did:
Year 1
Feb:Clause A
Jun:Clause B
Oct:Clause C

Year 2
Feb:Clause C
Jun:Clause A
Oct:Clause B

Our Internal Audit SOP says:

Each main activity comprising the quality management system is audited at least once a year.
In addition to the annually scheduled audits, management may selectcertain activities for more frequent audits, depending on their status, importance, and past compliance history.

Obviously Clause B audits as well as clause A audits would be more than 12 months apart. Is that a potential issue for our surveillance audits?

We just got 9001 about a year ago, and just got 13485 certified about a week ago, so the audits need to cover both standards. Our surveillance audits will be a combined audit for both standards.

Thanks,
-Karen

 

[Randy]

Is that a potential issue for our surveillance audits?

There's always potential............Will the audit be effective at verifying continual "effectiveness" of your MS? YES or NO

And doing a clause based approach is 20 years behind the power curve

 

[KarenA01]

There's always potential............Will the audit be effective at verifying continual "effectiveness" of your MS? YES or NO

And doing a clause based approach is 20 years behind the power curve

I think the audit would be but i was wondering about the timing componenst

Instead of clause think process/departments/areas

Thanks,
-Karen

 

[Randy]

I think the audit would be but i was wondering about the timing componenst

Instead of clause think process/departments/areas

Thanks,
-Karen

The only really wrong way is the way that doesn't work for you and supply the information that you need. There's no right or wrong formula.

When I audit (including developing 3 year certification schedules and audit plans I use a clause and process based approach. No matter what I audit, it doesn't matter, I always look at document management & control. You'll never see any specific time in any audit plan I do (or have done in 20 odd years) that just says "Document Control" or "Records Management" to me that's elementary boob level auditing.

Certification Bodies go by a 3-year cycle and during that 3-year cycle it's gotta be shown that all elements of the MS have been audited as well as anything else planned for during those 3 years. There's nothing that says you can't do that as well as long as you can demonstrate it's effectiveness (and that's where a guy like me steps in).