Problems with our new Auditor (a Ph.D. with four months experience)

[WilBryan]

Background:
I am a QMS Manager for a small design & build engineering corp. We are dual registered 13485:2003 & 9001:2008. We have a deeply committed management team, and staff who see the benefits to our program and have navigated two complete recertification cycles plus one surveillance audit with only four audit findings issued in that time (one of which was for registrar logo font size). Becuase our program's fundamental structures have not changed, we entered our second surveillance audit for our 3rd certification cycle last week with confidence. Apparently, that was a mistake. Our new auditor (a Ph.D. with four months experience as a registrar auditor) advised me the morning of day two (of a 2 day audit) that we already had 3 minor nonconformances and one major for record keeping. After some argument, he reduced the major to three minors, advised through the day there were two more, then closed the audit with a final issuance of four minors.

His first finding is as follows -
Statement of nonconformity:
Mandatory records are not being established and maintained properly.
Objective evidence:
The internal audit schedule is not treated as a record. [Internal record citations] & [Ref. ISO 13485: 2003 8.2.2; ISO 9001: 2008 8.2.2].

Is there a section of the standard I am missing that requires the audit schedule be treated as a mandatory record?
We revise our audit schedule annually (to review processes), leveraging the schedule as a log (with revision control & write protections). The schedule receives added information noting when an audit is completed for easy tracking of the audit program progress throughout the year. Our documented procedure outlines all of this in detail. I dont mean to be disrespectful of our auditor, but I do not see where he is coming from on this finding? Could he be misreading the requirement or laying on the 13485:2016 requirements for records?

Does anyone have any insight? Should I complain or appeal?
Our audit ran long and he didn't have time to discuss the findings during his closing which is why I am posting this now.

 

[Marcelo]

Re: Audit help - please

Do you want the conceptual answer or the practical one?

Here's both, anyway.

- 8.2.2 Internal audit requires that "The organization shall conduct internal audits at planned intervals"... and "The responsibilities and requirements for planning and conducting audits, and for reporting results and maintaining records (see 4.2.4) shall be defined in a documented procedure." So, in principle it would depend on what your procedure say.

- However, the audit schedule is obviously part of the requirement for planned audits, and a schedule would not in principle be a document, it would better fit as a record (as you probably use a template for scheduling each audit), so it does make sense that it needs to be controlled.

Anyway, the Statement of nonconformity is a little misleading because there's no specific mandatory record requirement in 8.2.2. It would be better if he called 4.2.4 Control of records.

 

[Randy]

Re: Audit help - please

If he waited until the 2nd day to inform you of a major and the minors he found on the 1st day he's wrong, totally and absolutely.

As an instructor of over 200 Lead Auditor courses, a qualifying reviewer for a CB and over 15 years of 3rd party auditing I'll stand my ground on this one, he's wrong and he's resting on his PhD to avoid being challenged....File a complaint and demand that he never revisit. If he did this on a team of mine I'd rip his knickers for poor audit conduct.

 

[WilBryan]

Marcelo & Randy,
thanks to both of you for the insight!
Randy - I kind of felt the same way about it and am just figuring out the next steps...

Marcelo -
You cite that the schedule would be a better fit as a record. With respect to your experience and opinion, based on the standard's text in 8.2.2 isn't this our decision to make? If we define clearly what we do regarding our audit schedule (and other audit requirements) and we adhere to those documented procedures, shouldn't we be compliant? As I read it, there is no mandatory audit record required in section 8.2.2 until 13485:2016.

 

[Marcelo]

You cite that the schedule would be a better fit as a record. With respect to your experience and opinion, based on the standard's text in 8.2.2 isn't this our decision to make? If we define clearly what we do regarding our audit schedule (and other audit requirements) and we adhere to those documented procedures, shouldn't we be compliant? As I read it, there is no mandatory audit record required in section 8.2.2 until 13485:2016.

There's what I said is the conceptual answer.

However, there's other requirements that make it more difficult to justify.

For example, the requirement on record mention that:

"Records shall be established and maintained to provide evidence of conformity to requirements and of the effective operation of the quality management system."

8.2.2, as I mentioned before, says:

"The organization shall conduct internal audits at planned intervals"

The question then would be, how do you who's evidence that you are conducting internal audits at planned intervals?

If you have another way of showing the evidence (and again, this would need to be a record by the same record definition), then you would comply. If not, it's difficult to say that you are compliant.

 

[Coury Ferguson]

Marcelo & Randy,
thanks to both of you for the insight!
Randy - I kind of felt the same way about it and am just figuring out the next steps...

Marcelo -
You cite that the schedule would be a better fit as a record. With respect to your experience and opinion, based on the standard's text in 8.2.2 isn't this our decision to make? If we define clearly what we do regarding our audit schedule (and other audit requirements) and we adhere to those documented procedures, shouldn't we be compliant? As I read it, there is no mandatory audit record required in section 8.2.2 until 13485:2016.

In my opinion, the schedule is not a record. It is more of a living document that changes based upon importance. However, the results of that audit are records.

I agree with Randy in regards to the auditor trying to use their degree to make an outcome of the results without challenge. Go back to the Registrar challenge their findings, and ask for another Assessor for the next go around.

Even though the Registrar is a 3rd party that verifies that the system meets requirements at the time of the audit, you are still a client of theirs. In the next future audit, ask to see the resumes/CVs of the auditor(s) they feel would make a good fit to your organization.

 

[Sidney Vianna]

Does anyone have any insight? Should I complain or appeal?

As others already opined, the two standards in question do not require the internal audit schedule to be treated as records and subjected to the requirements of 4.2.4. So, that specific NC should be appealed, in my view.

Since the new auditor admitted being new to this, I would give him the benefit of the doubt and not necessarily require a re-assignment of auditors, if you feel he was objective, balanced and fair. Looking back at my early days of auditing, I now admit having made bad calls too. Who doesn't?

 

[somashekar]

Marcelo & Randy,
thanks to both of you for the insight!
Randy - I kind of felt the same way about it and am just figuring out the next steps...

Marcelo -
You cite that the schedule would be a better fit as a record. With respect to your experience and opinion, based on the standard's text in 8.2.2 isn't this our decision to make? If we define clearly what we do regarding our audit schedule (and other audit requirements) and we adhere to those documented procedures, shouldn't we be compliant? As I read it, there is no mandatory audit record required in section 8.2.2 until 13485:2016.

What is your larger purpose .. To confront OR To continually improve.
If its to improve, then Marcelo has shown the way. If I were you, I would never go by the NC count. Your good performance is never tainted with few NC. I would see this as an opportunity to refine the documented procedure and records requirement. Good Luck ~~~

 

[Mike S.]

The auditor was wrong to write a NC on this – there is no shall being violated.

That being said, we keep our audit schedules as records because it serves us well to do so. It makes it easy to provide objective evidence to all auditors of many aspects of 8.2.2 and it costs virtually nothing to do so.

 

[Nadaabo]

The auditor should plan accordingly to give time to review all the findings with you.
I have never had any auditor challenge me on the audit schedule being a record. We have a documented procedure that lists all the records we keep and how long.
Your Registar should have a process for appeal.
But did you find that any of his findings were going to help you improve your system? if so, then an NC is an opportunity for improvement, if not, then I would talk to the sales Rep of your registar and explain to them that your auditor was not value added.