Can an outside consultant audit all the AS9100 requirements including Internal Audit?

[phxsun2001]

Some companies are using outside consultants to conduct internal audit (IA) of all the AS requirements, including internal audit. Is it a violation of 8.2.2.b if the consultant audits (IA)? Should someone else from the company audit IA?

8.2.2.b The selection of auditors and conduct of audits shall ensure objectivity and impartiality of the audit process. Auditors shall not audit their own work.

I audited a small company of 4 employees. They hired a consultant to conduct IA of all the AS requirements. The QA Manager was the process owner of the internal audit. He was the only one trained on AS9100C, including internal audit. He setup the internal audit process. I don't believe he can audit IA either. Should I issue a minor NCR because the consultant audited IA?

-Tony

 

[DannyK]

Re: Can an outside consultant audit all the AS requirements including Internal Audit?

The question is: did the consultant audit his own work and can the consultant audit the process without auditing his own work?

I prefer to have someone else audit the internal audit process but I was told from the technical authority from one of the largest registrars that the internal audit process can be audited by the registrar.

It is best to ask the authority within the registrar for their interpretation.

 

[Jeff Frost]

Re: Can an outside consultant audit all the AS9100 requirements including Internal Au

DannyK has given you a good basic answer to your question. Additionally though you would also want to know if the consultant was competent to perform the audit and if the internal audit process of the organization allow for the use of 2nd party audits. Competence of the consultant could be resolved by his or her resume showing training in audit methods or certification from a second party such as being a ASQ Certified Quality Auditor. A grayer area for some customer auditors relates to if the internal audit process procedure allows the use of 2nd party audits if it is not directly stated in the procedure. Another gray area issue could also be brought up if the consultant is not listed on the register of approved suppliers (AS9100, 7.4.1.a). Again this seems to be a gray area for customer auditors more than CRB auditors.

 

[phxsun2001]

Re: Can an outside consultant audit all the AS9100 requirements including Internal Au

Competency is not the issue in this case. The consultant is a registered AS9100C Auditor. It was verified in the OASIS.

-Tony

 

[Jeff Frost]

Re: Can an outside consultant audit all the AS9100 requirements including Internal Au

To be able to write a non-conformity against a requirement you need to determine what requirement the organization has not met and these requirements would be defined by:

• AS9100
• Organizations own procedures and work instructions
• Applicable regulatory or statutory requirements
• Customer contract requirements

Under the AS&D Audit standard for AS9100 known as AS9101, Clause 4.2.2.5 Note 3 it is clearly stated that “ If there is no evidence of non-fulfillment of a requirement, the auditor cannot issue a nonconformity”. You need to clearly show what requirement of AS9100 was not fulfilled.

 

[phxsun2001]

Re: Can an outside consultant audit all the AS requirements including Internal Audit?

The question is: did the consultant audit his own work and can the consultant audit the process without auditing his own work?

I prefer to have someone else audit the internal audit process but I was told from the technical authority from one of the largest registrars that the internal audit process can be audited by the registrar.

It is best to ask the authority within the registrar for their interpretation.

This is how I look at it. Assuming that John is the QA Manager and also the Quality Rep. who setup and manage the IA program. He has internal auditors performing internal audits. Any of the Internal Auditors can audit the IA function except John because they do not manage the IA function. If John replaces all his Internal Auditors with a qualified AS9100C registered consultant, the consultant should still be allowed to audit internal audit. The only person who cannot audit IA is John, the owner of the IA process. If the AS requirement does not allow the consultant to audit IA, then John's Internal Auditor cannot audit IA either. There is no difference. Then no one in the company can audit IA.

The intent of the AS requirement "Auditor cannot audit their own work" is to make sure that say design engineers do not audit the design project they are responsible for. It is not intended to prevent outside consultant to audit the IA program. In fact it is a good idea to have someone outside the company to evaluate the IA program.

What do you think?

-Tony

 

[Jen Kirley]

Re: Can an outside consultant audit all the AS requirements including Internal Audit?

This is how I look at it. Assuming that John is the QA Manager and also the Quality Rep. who setup and manage the IA program. He has internal auditors performing internal audits. Any of the Internal Auditors can audit the IA function except John because they do not manage the IA function. If John replaces all his Internal Auditors with a qualified AS9100C registered consultant, the consultant should still be allowed to audit internal audit. The only person who cannot audit IA is John, the owner of the IA process. If the AS requirement does not allow the consultant to audit IA, then John's Internal Auditor cannot audit IA either. There is no difference. Then no one in the company can audit IA.

The intent of the AS requirement "Auditor cannot audit their own work" is to make sure that say design engineers do not audit the design project they are responsible for. It is not intended to prevent outside consultant to audit the IA program. In fact it is a good idea to have someone outside the company to evaluate the IA program.

What do you think?

-Tony

Good day Tony,

I often run across this. The "Auditors shall not audit their own work" clause does not mean the audit process owner cannot audit the audit process. It means he/she cannot include in the sample any of the audits he/she has performed. A consultant can do this audit, also a partnering company or sister site of the same company can swap these services. But I tend to see the expectation that the entire system will be included in the internal audit program and the internal audit process cannot be excluded.

 

[howste]

Re: Can an outside consultant audit all the AS requirements including Internal Audit?

The consultant can audit the whole system unless s/he also implemented part of it. If s/he continues to audit though, s/he wouldn't be able to audit the records of the audits s/he conducted.

...I was told from the technical authority from one of the largest registrars that the internal audit process can be audited by the registrar...

The certification body absolutely can't conduct an internal audit. They will audit the internal audit process as part of the external audit, but it won't count for internal audits.

 

[DannyK]

Re: Can an outside consultant audit all the AS9100 requirements including Internal Au

There was an error in my post. I meant that the internal audit can be audited by the consultant not registrar.

 

[ssz102]

Re: Can an outside consultant audit all the AS requirements including Internal Audit?

this is my first heard that inner audit can also conducted by consultant
i think, as long as the method and scope of audit are comply with the standard, it will be ok