C
Just because someone comes up with a ridiculous proposition doesn't mean one has to tear round in circles trying to actually do it.
Now, let's see just how ridiculous (or not) this proposition was.
First, my challenge (forget the 15 minutes for a moment) was simply to assess the effectiveness of the QMS. It did not ask for a compliance assessment, as some responses seem to have presumed, nor does it ask for improvement opportunities, a valid goal of internal audits.
Now, why do I add the 15 minute restriction to my challenge? To demonstrate that, more often than not, we - internal auditors - have a very bad habit of losing sight of the prize. We get so "juiced up " over the trees that we can't see the forest. Are we so besotted by our own auditing skills that, like the pathologist who upon examining a heart he has just excised from a cadaver pronouces it "healthy"?
What is the prize?
It is the function of the QMS which, if you chose to use ISO 9001:2000, can be found at paragraph 1.1. (No I am not going to recite it here: look it up for yourselves. I'll bet it's the first time some of us have ever really read it.)
And whose QMS is it?
Para 5.1 and 5.3 pretty much spell it out for us. It's top management's system and, among other things, they need a quality policy and (measurable) objectives which, if we follow the logic, is the quality system's Mission Statement, i.e., what the QMS is expected to accomplish.
If the system is consistently realizing the quality policy as measured by the objectives, does that not constitute effectiveness?
So, how long will it take you to march into the boss' office, ask and get satisfactory answers to these questions?:
a) What is your quality policy?
b) Show me (i.e., objective evidence) that you are realizing it consistently?
The boss either can or can't provide the answers and evidence. The buck starts and stops with him/her. And you have at least 5 minutes left over for a coffee break.
If there is sufficient evidence that the system has been performing effectively over time, exactly what do you think your more detailed audits might uncover of any significance? Nonconformances to the standard or to their own documented procedures? Perhaps. But if the system is working, how troublesome might they be? (Please do not tell me that failure to comply with the letter(s) of the standard might jeopardize the "certificate" because - and here I go pouring gasoline onto the fire - certification has absolutely nothing to do with quality.)
Correspondingly, a qms that is foursquare "in accordance with all requirements of the ISO 9001:2000 standard" is absolutely no guarantee that a single customer is being satisfied. My answer to such a finding - if the system is not effective is - "Your system is broken" (actually my words tend to be more colorful than that since, in such cases, it's time to take out the 2x4 just to get the jackass' attention.)
Am I suggesting we should not do more detailed audits or not do compliance checks? Absolutley not. We have a job to do and we should do it: intelligently and efficiently. But I am more than suggesting that establishing the effectiveness (or not) of the system to consistently achieve its expressed purpose(s) is not just the first thing we should do but we must use the results of that assessment as a basis for our more detailed audit plan. Performance to measureable objectives is "objective evidence" and "Status and importance" really do have meaning here.
Yes, we must venture forth into the forest but we must not check our brains at the edge.
After all, internal auditing is a management activity and the language of management is money/results. Let's keep that ever at the front of our minds and K.I.S.S.
Someone asked if my challenge represented a real life situation. Yes. I pose it at the beginning of every on-site auditor training workshop I conduct and, again, at the end. Few get it right at the outset. All do at the end.
BTW, every one of my own internal audit cyles begins with the boss on the hot seat. The old saw about the head of the fish being the first part to die, is apropos.

