I got this in an e-mail and figured I'd add it...
> Marc,
> Just a quick question you stated that you do internal audits for companies and
> they are on a yearly cycle. Do the Registrars of these companies find this
> adequate? The only reason I ask is that if they are finding problems during
> surveillance audits then internal audits should be occuring more frequently or
> if the CAPA system shows a problem area then that area should be audited more
> frequently. Just wondering???
One time an auditor from a registrar questioned my audit. He said since I found no non-compliances he had reason to believe my qualifications were not adequate. Of course, I was called by my client after the audit. I pointed out that his audit revealed 1 minor and that the previous visit by one of the registrar's auditor (surveillance) revealed no findings. So - how could he determine my audit was deficient by reason of having found nothing 'something' when the company's auditor before me found nothing. The 'finding' was dropped.
How many findings an auditor finds is really a company dependent thing like so many other things. If the company has an internal discipline problem, then minors will be found - an example being employees not completing forms (such as leaving out the date). Look to the findings to determine what the problems are. As opposed to the 'not completing documentation' minor, how about 'not keeping up with corrective actions' or 'corrective actions not acted on in a timely manner'. Ask yourself - is this part of my company's personality? Is it a function of the size of the company? What are the registrar's auditors finding that the internal audits aren't?
> if they are
> finding problems during surveillance audits then internal
> audits should be occuring more frequently or if the CAPA
> system shows a problem area then that area should be
> audited more frequently.
As far as frequency goes, you have to look at your findings. If I saw a consistent problem in an area I would point it out and possibly recommend a re-audit in 6 weeks or something. If the registrar saw it, and then I again saw it 6 months later I might argue for 'more frequent auditing'. To me it's really more of an issue in the corrective action system, however, if the same things keep popping up.
But again - companies have personalities. Some keep the corrective action system very tight and everyone is 'into it'. In other companies the corrective action system is little more than a constant source of internal friction.
So far, the clients I have run pretty tight ships and findings are not easy to come by.
As a reminder: Go back to what your registrar told you. Just because they don't find anything doesn't mean there aren't problems that they may find in a later audit. An audit is a SAMPLE and does not guarantee every problem will be identified (this is their main legal out when it comes to responsibility).
I would be looking at the internal findings and comparing them to the external findings and see how they compare. And remember - your auditors are no better than a registrar's auditors. Just because they find nothing doesn't mean there are no problems. They, as well, are just doing a SAMPLE. Bottom line is check and be able to answer this question:
Are our internal audits effective, and if not why?
Note that when I go in we do all the audits. In, do it, out and report. Most companies which do their own spread them out due to manpower issues.
I know we've had some good discussions here on Auditing Frequency. Do a Search here in the forums - and maybe on the site proper - using those key works --> Audit Frequency