Creating an Internal Audit Schedule

A

Ahoffman

#21
We just finished our ISO audit with a new registrar today. We switched registrars after 10 years. Our auditor reduced this to an observation but almost wrote up our internal audit system because we had not audited every clause within the standard within a year. I am not prone to arguing with auditors myself and I do respect their role as a guide to improving our QMS, however I asked several times where in the standard does it say that we must audit every clause within a year? Has anyone ever encountered this type of opinion before?
 
Elsmar Forum Sponsor

Randy

Super Moderator
#22
It may be in your contract...read it and see.

Basically you need to audit your system to determine if it has been properly implemented (which you only really need to do once) and whether it is being properly maintained and achieving planned for results.

The "your system" is the key thing to remember. The system is all of those requirment you must fulfill...Remember those "shall" things? Are you effectively meeting them along with your own requirements? All you're being asked is to "show the beef".
 

Colin

Quite Involved in Discussions
#23
Clause 8.2.2 states that the QMS has to be audited to determine whether it conforms to .... the requirements of this international standard .....

Now, if you cannot demonstrate that you have covered all of the clauses, how can you prove that you achieve the above requirement? I usually complete a simple matrix in order to demonstrate that this has been done.
 
#24
We just finished our ISO audit with a new registrar today. We switched registrars after 10 years. Our auditor reduced this to an observation but almost wrote up our internal audit system because we had not audited every clause within the standard within a year. I am not prone to arguing with auditors myself and I do respect their role as a guide to improving our QMS, however I asked several times where in the standard does it say that we must audit every clause within a year? Has anyone ever encountered this type of opinion before?
It's not a requirement, and , as Randy suggests, it may be a contractual issue with the registrar organization. Having a schedule to cover all the elements of the standard is inappropriate IMHO, especially when trying to cover everything in a year. Maybe three years, but one? - no way! It's possible that some aspects of the standard are not even 'used' every year, and, depending on the size of the organization, it could become a huge undertaking.

It is legitimate that an external auditor must cover all requirements (usually in the period the cert. lasts, typically 3 years), but I believe it's a stretch to say that you have to and I'd recommend pushing back to his management.

If you adopt a process approach to auditing, it should be clear that many of the requirements of the standard are touched at each and every audit, so you could offer that. Perhaps you might look at the focus of audits and see if there's an opportunity there to improve how you're covering the requirements.

Colpart is correct in asserting the requirements of ISO 9001, 8.2.2 but that doesn't have to come from the audit schedule, it can be shown by other means.

I'd simply push back on their (mis)interpretation, however.........
 
F

fuzzy

#25
How do you address the 'status and importance' issue of your audit programme?

I know third party auditors don't often make any deal of this aspect (do they know what it means?) but this is a vitally important link to management getting some value from audits, instead of doing them 'because ISO-says-so".

Doing anything once or twice a year isn't likely to address this requirement......
My most recent method for building a schedule included "scoring" audit results by assigning declining values for major, minor NC's, then Observations,and finally OFI's (opportunities for improvement). Whether by clause or by process, you can determine a hierarchy for your schedule; thereby deploying auditing where improvement is needed. :D
 
#27
I LOVE the second attachment (Worksheet to justify your audit plan). It's like a FMEA chart for IA...brilliant!
I too have looked at Patricia's chart and it certainly is a unique method, one I'm sure would knock the socks off most external auditors!

For purposes of clarification on its use, I have some questions regarding the ranking system for the 'status' and 'importance' aspects. What is data is 'behind' the selection of the 1 = low etc.? Who comes up with these?

If we could get a bit more background to the selection of the rankings, I think it'd probably be an awesome tool and one most non-quality management would like to participate in.:agree1:

Thanks, in advance, Patricia!:yes:
 
P

Pazuzu - 2009

#28
I too have looked at Patricia's chart and it certainly is a unique method, one I'm sure would knock the socks off most external auditors!

For purposes of clarification on its use, I have some questions regarding the ranking system for the 'status' and 'importance' aspects. What is data is 'behind' the selection of the 1 = low etc.? Who comes up with these?

If we could get a bit more background to the selection of the rankings, I think it'd probably be an awesome tool and one most non-quality management would like to participate in.:agree1:

Thanks, in advance, Patricia!:yes:

I was just reviewing it and was wondering that too. Seems very subjective for the "status" portion. I can kind of understand the "importance ranking" but IA is listed as a 1...?
 

Patricia Ravanello

Quite Involved in Discussions
#29
I too have looked at Patricia's chart and it certainly is a unique method, one I'm sure would knock the socks off most external auditors!

For purposes of clarification on its use, I have some questions regarding the ranking system for the 'status' and 'importance' aspects. What is data is 'behind' the selection of the 1 = low etc.? Who comes up with these?

If we could get a bit more background to the selection of the rankings, I think it'd probably be an awesome tool and one most non-quality management would like to participate in.:agree1:

Thanks, in advance, Patricia!:yes:
Hello Gentleman,
I'm pleased that my Audit Planning "Tool" aroused some curiosity. You're both right, the justification for the "Status" ranking is not evident in the chart, so let me explain...

Just as a refresher...we know that ISO wants us to consider the following when planning an audit:

1) The status (i.e. the performance status) and importance of the process
2) The frequency and nature of customer complaints
3) The results of previous audits (internal, external, environmental, limited scope, layered process audits etc.)​

First, to address the "Importance" question...this is definitely a subjective ranking (as noted at the top of the chart), and I encourage the Lead Auditor to rationalize the importance of each process. Perhaps ask yourself..."How important is this process to the overall success of the company"... or "What process could we live without, and still survive???... Or..."After the Customer-oriented Processes, which classifications are most critical?" (system-, support-, or management-oriented processes??) Whatever you decide, you just have to be able to rationalize it to yourself, and of course to your external auditor.

Secondly, to address the "Performance Status" of the process, I use the data in my "Metrics DASHBOARD". It's a Metrics Database which I created, wherein each of the metrics in the company is linked to one of the 12 Key Processes. The metric's performance is assessed, at least monthly, and a performance "Status" is assigned, based on 3 factors:
1) Current Period Performance against Plan (or objective)
2) Year-to-Date Trend Performance
3) Projected Trend Performance for the next 4 months​

Based on company "Status" definitions of "Favorable" (Green), "Unfavorable" (Red) or "Needs Improvement" (Yellow), each metric is assigned a "Status". The respective metrics for each of the 12 Key Processes are then averaged together to give an overall "Performance Status" for that process. At the end of a 12 month cycle, the Process Performance is calculated for the past 12 month period, and a numerical value is associated with it for calculation purposes.

Since the standard expects you to consider "process status" as one of the factors to assess in setting your Audit Schedule, this was the best way I could see of doing that...and substantiating it mathematically...Most companies don't do it, and most Auditors don't ask how the Audit Plan was derived...and if they did, they would soon discover that, while some companies have a "partially justified rationale" for performing their audit...they will rarely find that all required criteria have been factored in.

I think this is the most comprehensive "kick at the cat" I can come up with...but I'm always in "Continual Improvement" mode...so I welcome any comments or criticism.

:thanx: and hope this answers your questions...:magic:...no magic really...I just like this little icon!!:magic:
 
Thread starter Similar threads Forum Replies Date
Marc Creating an Internal Audit Program That Works for Your Organization Internal Auditing 0
V Creating an ISO 14001 Internal Audit schedule Internal Auditing 13
A Need help with creating useful, interesting and good internal web site about QMS!!! After Work and Weekend Discussion Topics 5
M Creating interest in being internal auditors Internal Auditing 7
M Fun Quality Stuff - Creating a training plan for new internal auditors Training - Internal, External, Online and Distance Learning 28
M Creating Internal customers within the manufacturing process Statistical Analysis Tools, Techniques and SPC 1
R Accelerated Aging - Creating test samples - Implantable medical device Question Other Medical Device Related Standards 4
L Hazardous Waste - Tips for creating standardized training Miscellaneous Environmental Standards and EMS Related Discussions 2
M Informational Creating a post market surveillance (PMS) system for medical devices – Part 1 Medical Device and FDA Regulations and Standards News 7
J Sample size for creating a data base as a reference to a tested variable Other Medical Device and Orthopedic Related Topics 6
8 Creating Flow and Pull Game Lean in Manufacturing and Service Industries 1
B Main responsibility for Control Plans - creating and maintaining FMEA and Control Plans 15
shimonv Creating a new commercial product based on a modification to an existing product Other US Medical Device Regulations 4
R Creating WIs for a Heavy Civil Engineering Services company Document Control Systems, Procedures, Forms and Templates 19
M Creating a Plant Level Value Stream Map Process Maps, Process Mapping and Turtle Diagrams 1
T IMDS - Creating an MDS out of material and a made item? RoHS, REACH, ELV, IMDS and Restricted Substances 4
D How do I go about creating document logs and registers with the MS Excel Excel .xls Spreadsheet Templates and Tools 2
W ISO9001:2015 - Clause 7.5.2 - Requirements for Creating & Updating Documents ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 6
K Creating together Standard Definition for Prevention and Detection FMEA FMEA and Control Plans 1
M Creating change / Forcing change within a Company Lean in Manufacturing and Service Industries 7
A Creating a policy to evaluate the Third Party Security IEC 27001 - Information Security Management Systems (ISMS) 4
S Creating goals and objectives with targets and measurables for self-evaluations Management Review Meetings and related Processes 2
L Creating a xlsx Customer Complaint file to track Complaints Excel .xls Spreadsheet Templates and Tools 2
S When creating a 510k, which Guidance Document Wins? Other US Medical Device Regulations 9
P GS1 NHRN AIs - Creating Barcodes for Human Product Other ISO and International Standards and European Regulations 4
O Creating a Tool to Track & Verify Mistake Proofing Devices Document Control Systems, Procedures, Forms and Templates 5
B Any suggestion on creating the best paper plane that can hit a target perfectly? Coffee Break and Water Cooler Discussions 2
P Creating a PPAP document for my Suppliers APQP and PPAP 1
L Any recommendations on software for creating hierarchical workflows ? Misc. Quality Assurance and Business Systems Related Topics 2
AnaMariaVR2 Creating Global Giants from a Culture of Israeli Start-Ups Coffee Break and Water Cooler Discussions 0
R Creating a c-chart spreadsheet to use in my department Excel .xls Spreadsheet Templates and Tools 5
R Inspection Database Picker - Creating an Inspection Report Document Control Systems, Procedures, Forms and Templates 1
P Problem with creating VSM current map Lean in Manufacturing and Service Industries 3
G Creating an Organization Chart - AS9100 AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 5
L Creating DHF (Design History File) for Medical Device Systems Design and Development of Products and Processes 8
Q Recommendations for criteria on creating a CAPA (Corrective and Preventive Action) ISO 13485:2016 - Medical Device Quality Management Systems 8
C Creating a Multiple Table SQL (Structured Query Language) Query in Minitab Using Minitab Software 10
C Resources for creating Process Validation Procedures Qualification and Validation (including 21 CFR Part 11) 5
B Creating an Audit Mechanism (System/Plan) General Auditing Discussions 3
A Customer Profiles - Creating a Customer 'Profile' for our Top 10 Customers Document Control Systems, Procedures, Forms and Templates 2
M Creating an Index for our Documents - Imaging Millions of Paper Records Document Control Systems, Procedures, Forms and Templates 13
N ISO 9001 based Audit Schedules: Creating and Maintaining - Template wanted General Auditing Discussions 5
P Creating a Traceability Database with Microsoft Access Document Control Systems, Procedures, Forms and Templates 7
V Creating a Cosmetic Inspection Specification for Powder Coated Painted Finished Parts Manufacturing and Related Processes 7
I Difficulty in creating a Quality Manual Quality Management System (QMS) Manuals 4
J Creating an Audit Schedule & Revamping QMS Internal Auditing 18
L How can you capture many positions held without creating a lengthy resume Career and Occupation Discussions 4
Miner Intro to MSA of Continuous Data - Part 10: Creating gauge families Imported Legacy Blogs 10
E Manufacturing Planning - Creating Improvements Misc. Quality Assurance and Business Systems Related Topics 7
R Creating Quality System and using it before it is complete ISO 13485:2016 - Medical Device Quality Management Systems 8

Similar threads

Top Bottom