Company Conducted Internal Audit Offsite using a Document Review Process

Big Jim

Super Moderator
#21
I am conducting an AS9100:2009 registration audit of this company. They conducted a remote/offsite internal audit of the entire QMS system. It may not meet the intent of the requirements in section 8.2.2 of the standard. It may be OK if there is adequate planning before the audit to use teleconference and ways to pick random samples. It will be difficult to conduct an effective audit to cover section 7.5.

Are you saying that it is OK for any company to conduct offsite audit whenever they like?

-Tony
I've been following this thread for a while, and one question keeps coming to me. Why have you not talked to your certification body about what you have found? They are the one to satisfy.
 
Elsmar Forum Sponsor

phxsun2001

Involved - Posts
#22
I was conducting an AS9100 Aerospace registration audit of this company.
Are you saying that it is OK for a company to conduct remote or offsite audit? You think that offsite audit is as effective as an onsite audit?

There are some section of the standard that internal auditors could perform offsite. For example- section 5.0, Internal audit, HR, customer satisfaction. There are section/requirements of the standard that require onsite audit. They are- control of N/C product, Product ID and traceable, section 7.5 and 7.6 Calibration. To be able to conduct an effective internal audit in these areas, you have to there to collect your samples. Then there is a problem with getting random samples. Asking auditees to scan samples of records and email to an offsite internal Auditors to be audited is not quite acceptable. They could be screening the error free record before send them to the Auditor. What about audit 7.6 calibration? Can I ask the auditee to take pictures of 10 calibration stickers of 10 tools and send them to me for review of out of calibration stickers?

A company may be able to conduct some offsite internal audits, but not all of them. The audit report report should say that some or all of the audits were done offsite. That's what this company failed to do. They have been performing offsite audits for a few years. Their internal audit procedure should say that this could be an option and provide some guidelines to conduct offsite audits.

I wish ANAB would let us do the same thing. We could be auditing at home without any traveling.

-Tony
 
Last edited:

phxsun2001

Involved - Posts
#23
I think it depends on how creative the CB auditor wants to be. For example, 8.2.2 of AS9100C refers to an internal audit. What is the ISO 9000:2005 (normative) definition of audit? So, a CB auditor can question if the virtual/remote approach to internal auditing allows the auditor to obtain audit evidence or not.

Another route is to question the effectiveness (4.1.c) of the internal audit process. One more creative route is to create a PEAR against the internal audit process (going beyond the AS9101D minimum) and deem the internal audit process not effective.

But without knowing exactly what were the processes audited remotely, how impacting, how critical, etc. they are, we would be doing a lot of speculation.
The remote audit was conducted on the entire QMS, top to bottom, 4.0 to 8.0. It was an aerospace AS9100:2009 audit. The internal auditor requested records to be sent to him to be audited offsite. They have been doing it for a few years. This is the 1st time I am auditing this site.

-Tony
 
Last edited:

phxsun2001

Involved - Posts
#24
I wrote it up as a minor NCR and gave it to the Lead auditor who was auditing the Head Office. It was a multi-site audit. I audit 2 of the sites. Another auditor audited sites in Europe. I am auditing the last site this coming week. and will be getting more info. I'll be interviewing the auditor who conducted the remote audits of the other sites.
-Tony
 

phxsun2001

Involved - Posts
#25
If you can let us know, in broad terms, what this company does, that would help. Certain products and services can be quite effectively audited remotely, software development, for example. I'd agree, if it is a metal cutting type enterprise, that it would be difficult to audit that from a ways away...but then it isn't going to be just records and you'll see that the thing goes south very rapidly! No sweat!
There are cutting processes. It is difficult to audit 7.5 and 7.6 calibration offsite. It is difficult to audit Traceability labels in the warehouse offsite. It is difficult to audit control of N/C products offsite without walking around the shop onsite. How do I know if employee know what the quality policy and quality objectives are without asking them onsite?

Then there is the problem of collecting and reviewing quality records that had been reviewed one last time by the auditee before sending them to the auditor.

-Tony
 
Last edited:
E

EllenW

#26
Personally I would consider off site audits using skype etc to be great use of resources and time - good initiative by the company! However think that it should always be noted in the audit document and followed by an in person audit next time round. Would put it as idea for improvement for audit process going forwards and suggest procedure for off site audits documented in not already done so.
 

Golfman25

Trusted Information Resource
#27
I was conducting an AS9100 Aerospace registration audit of this company.
Are you saying that it is OK for a company to conduct remote or offsite audit? You think that offsite audit is as effective as an onsite audit?


-Tony

Respectfully, what you think is not the question. It is what you can show. If you are going to say it is not effective, where is your evidence? You're going to need to come up with actual evidence that their audit was not effecitive. You have identified areas to really look at for that evidence. Good luck.
 

phxsun2001

Involved - Posts
#28
Respectfully, what you think is not the question. It is what you can show. If you are going to say it is not effective, where is your evidence? You're going to need to come up with actual evidence that their audit was not effecitive. You have identified areas to really look at for that evidence. Good luck.
This is all common sense. It you audited a SMT process offsite. Do you think you can show me evidence that the manufacturing processes met these requirement:
1) Reflow oven temperature profiles and feed rate were set to the Engineering requirements.
2) Solder paste taken out of the freezer were given enough time to defrost before use.
3) Nonconforming products were identified and segregated throughout the plant and warehouse.
4) Employees know the quality policy and quality objectives
5) Measuring equipment do not have expired calibration sticker

The list go on and on. Offsite audits are OK for some sections of the requirements (eg 5.0 and internal audit). using desk audit. For requirements in 7.5, 7.6 and others, you have to be there physically to pick your samples witness conformance and interview employees to be effective.

It is my opinion that performing the entire internal audit offsite does not meet the intent of the ISO or AS standard. The company could have hired a local registered AS9100:2009 auditor to perform an internal audit for 2 days. The going rate is about $1,500 total.

On the minor NCR, I did not say that their auditing process was ineffective. I states that their internal auditing process did not meet the intent of the AS standard. I stated that the report did not mention the audits were conducted offsite, how the audit was conducted (inadequate planning) and their procedure did not say that offsite audit was an option. They have been conducting offsite audit for years. So this is actually their normal internal auditing process. This non-standard auditing process should have been documented in their Internal Audit procedure, which is one of the required procedure. Guidelines should be listed in the procedure for planning, execution and reporting offsite internal audit.

-Tony
 
Last edited:

phxsun2001

Involved - Posts
#29
Personally I would consider off site audits using skype etc to be great use of resources and time - good initiative by the company! However think that it should always be noted in the audit document and followed by an in person audit next time round. Would put it as idea for improvement for audit process going forwards and suggest procedure for off site audits documented in not already done so.
I agree that offsite audit could be used to perform desk audit of section 5.0, internal audit .... It is cost effective.

It needs to be documented in the company procedure listing it as an option and provide guideline for the planning, execution and reporting. In the audit report, the auditor has to stated that part of the audit was done offsite. If all these were done, it may meet the intent of the ISO/AS standard.

Tony
 

Jen Kirley

Quality and Auditing Expert
Staff member
Admin
#30
This is all common sense. It you audited a SMT process offsite. Do you think you can show me evidence that the manufacturing processes met these requirement:
1) Reflow oven temperature profiles and feed rate were set to the Engineering requirements.
2) Solder paste taken out of the freezer were given enough time to defrost before use.
3) Nonconforming products were identified and segregated throughout the plant and warehouse.
4) Employees know the quality policy and quality objectives
5) Measuring equipment do not have expired calibration sticker

The list go on and on. Offsite audits are OK for some sections of the requirements (eg 5.0 and internal audit). using desk audit. For requirements in 7.5, 7.6 and others, you have to be there physically to pick your samples witness conformance and interview employees to be effective.

It is my opinion that performing the entire internal audit offsite does not meet the intent of the ISO or AS standard. The company could have hired a local registered AS9100:2009 auditor to perform an internal audit for 2 days. The going rate is about $1,500 total.

On the minor NCR, I did not say that their auditing process was ineffective. I states that their internal auditing process did not meet the intent of the AS standard. I stated that the report did not mention the audits were conducted offsite, how the audit was conducted (inadequate planning) and their procedure did not say that offsite audit was an option. They have been conducting offsite audit for years. So this is actually their normal internal auditing process. This non-standard auditing process should be documented in their Internal Audit procedure, which is one of the required procedure. Guidelines should be listed in the procedure for planning, execution and reporting offsite or remote internal audit.

-Tony
Tony, we are not trying to dispute effectiveness of a completely remote audit. Many of us are, fact rather closely aligned with your philosophy. The point I, for one am trying to make is that in order to call out a nonconformance against the audit program's effectiveness, you need to cite your own observed evidence that the audits were ineffective. Your NC would need to be written against element(s) of AS9100, to which this client is registered.

What have you observed so far that you can point to as nonconforming to which element(s) of AS9100? In what way is their audit ineffective - is there a lack of evidence that one or more audits were completed of critical processes? Is there a lack of evidence of a sample review? If so, how was that apparent to you?
 
Thread starter Similar threads Forum Replies Date
M Transferring ISO 17025 from one company to another ISO 17025 related Discussions 1
P Audit check for IT company (ISO 9001) ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 7
lanley liao Does all of the suppliers need to integrated into the supplier list qualified of the company? Oil and Gas Industry Standards and Regulations 2
F IVD registration in EU - Northern Ireland based company EU Medical Device Regulations 0
W Where does a coatings and paint company fall in IATF? IATF 16949 - Automotive Quality Systems Standard 5
A AS9100D - Clause 8.1 Operation - Coating service company AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 1
O Informational Ford Motor Company Customer Specific Requirements for IATF 16949:2016 - 08 Jan 2021 Customer and Company Specific Requirements 0
L Have been purchased by a corporate company ISO 13485:2016 - Medical Device Quality Management Systems 7
R Advice needed: Shall I report my not complying company to NB / competent Authority (Europe) EU Medical Device Regulations 6
lanley liao What shoud i do if our company top management has been changed. Oil and Gas Industry Standards and Regulations 8
S Malcolm Baldrige Company Dashboard Quality Tools, Improvement and Analysis 3
T IATF Rules for sharing production space with another company IATF 16949 - Automotive Quality Systems Standard 10
J Leveraging another company's ISO 13485:2016 ISO 13485:2016 - Medical Device Quality Management Systems 5
R MDEL and company affiliate Canada Medical Device Regulations 0
E Our company is planning to file MDD not MDR next month. Do we require to show chemical characterization report ? CE Marking (Conformité Européene) / CB Scheme 2
S Is QMS like a set of rules and regulations that a company follows? ISO 13485:2016 - Medical Device Quality Management Systems 10
E Contract manufacturer FDA requirements foreign company US Food and Drug Administration (FDA) 6
J How much to charge for helping a startup company with initial ISO 13485 certification? Consultants and Consulting 3
J Sister-company providing parts is only ISO 9001 registered IATF 16949 - Automotive Quality Systems Standard 7
D IATF 16949 Requirement for CMMI in a Global Company Elsmar Cove Forum Suggestions, Complaints, Problems and Bug Reports 0
T Help to Suggest name for a new certification and inspection company Coffee Break and Water Cooler Discussions 7
M Address change for a company with CE/ISO13485 EU Medical Device Regulations 2
M IT validation for a paper based MD repair company QMS ISO 13485:2016 - Medical Device Quality Management Systems 6
M QMS for a repair/servicing company ISO 13485:2016 - Medical Device Quality Management Systems 2
C Internal Audits in a tiny Dx Company Internal Auditing 33
T ISO 13485 - 5.5.1 Responsibility and authority - Small Company Independence ISO 13485:2016 - Medical Device Quality Management Systems 13
F Quality manual for trading company ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 9
L Implementing the PRRC role in a company EU Medical Device Regulations 7
BeaBea ISO 9001 Customer Feedback Methods - What has worked for your company? Service Industry Specific Topics 17
M Customers Request AS9100 certification - Small Company (less than 20 employees) AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 8
U Document Approval - Software company ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 3
T EQMS for small medical device company ISO 13485:2016 - Medical Device Quality Management Systems 18
qualprod Corona virus Contingency plan - What have you done in your company? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 25
Q Must product name be listed the same name in FURLS, UDI, GUDID and Company Website? 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 1
E Sharepoint for ISO 13485 QMS for small IVD company ISO 13485:2016 - Medical Device Quality Management Systems 11
N Small Company - Internal audit process - Who does the audit? Internal Auditing 16
Z 510(k) usage - Company has 2 physically similar products Medical Device and FDA Regulations and Standards News 2
Q Company Ownership Change ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 13
L Contracted Manufacture Company wanting to be able to design and manufacture own product. 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 7
D ISO9001 for one man company ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 11
T Client Communication - SaaMD company Misc. Quality Assurance and Business Systems Related Topics 3
R Notified Body for MDD 1Q20 - Florida Company Registrars and Notified Bodies 4
E In need of a new TGA sponsor - Small software company Other Medical Device Regulations World-Wide 4
F ISO 17025 8.8 Internal Audits in a segmented company ISO 17025 related Discussions 5
E Company A supplies pharmaceuticals to the MOI - Who is responsible? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 7
J Quality Assurance in China - Developing a quality management system for a California company Misc. Quality Assurance and Business Systems Related Topics 9
S How to determine & document Organizational Knowledge of a company Document Control Systems, Procedures, Forms and Templates 4
U IT Process is Taken From company and Added to Corporate Structure ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 4
G Is ISO 9001:2015 certification worth it for a company that does only contract manufacturing? Quality Management System (QMS) Manuals 14
N Non traumatic edge - Remark in some of my company drawings EU Medical Device Regulations 1

Similar threads

Top Bottom