Documenting the Root Causes for Internal Audit Non-Conformance Findings

vitortavares

Involved In Discussions
#1
Hi everyone,

In our last certification audit, the auditors had raised a non conformance for the absence of documentation of the root causes in the analysis of the last internal audit.

We had just documented the corrective actions with definition of responsibilities and timeline for implementing, but not the root causes.

Thank you in advance,
Vitor Tavares
 
Elsmar Forum Sponsor

Sidney Vianna

Post Responsibly
Staff member
Admin
#2
Re: Document root causes for internal audit non conformance

Vitor, you did not ask a specific question, but I am going to assume you expect feedback about the auditors position.

While, technically, the ISO 9001:2008 standard does not explicitly state that an organization must record the analysis and (root) cause of a non-conformity, in order for you to have an effective corrective action process, you must perform such investigation.

CB auditors are being continually pressured by Accreditation Bodies and other stakeholders to assess the certified systems for effectiveness. For example, in this Heads Up document, ANAB (the US AB for QMS) states
Where requirements of the standard have not been met, nonconformities should be written. CB auditors should similarly focus on the processes of the organization’s internal audit function, corrective action, and preventive action to maintain the effectiveness of the QMS. While the CB auditor’s periodic surveillance can give an independent assessment of QMS status, it is ultimately the scope and depth of the organization’s ongoing efforts between such audits that assure long-term effectiveness. Internal auditors need to look at process inputs, outputs, and interactions with the same diligence as CB auditors. CB auditors should probe the effectiveness of root cause analyses and corrective action applied by the organization to internally identified nonconformities of products, processes, and the QMS. Similarly, the effectiveness of handling customer returns and complaints should be probed to validate data on perceived customer satisfaction.
Any organization which does not have a robust (root) cause analysis sub-process is destined to repeat the same mistakes due to the fact that they will be attempting to implement corrective actions on superficial causes and failing to affect the real problem.
So, in my opinion, you could appeal the non-conformity, based on a technicality, but you would be doing yourself a disservice and failing to ensure that you have an effective and robust corrective action process.
 

Jim Wynne

Staff member
Admin
#3
Hi everyone,

In our last certification audit, the auditors had raised a non conformance for the absence of documentation of the root causes in the analysis of the last internal audit.

We had just documented the corrective actions with definition of responsibilities and timeline for implementing, but not the root causes.

Thank you in advance,
Vitor Tavares
Were there CAs that had been completed (closed) without cause(s) being documented? Can you provide the verbatim text of the auditor's finding, including her citation of the part of the standard (or your internal requirements) that was allegedly violated?
 
Last edited:
L

LexieB

#4
Hi everyone,

In our last certification audit, the auditors had raised a non conformance for the absence of documentation of the root causes in the analysis of the last internal audit.

We had just documented the corrective actions with definition of responsibilities and timeline for implementing, but not the root causes.

Thank you in advance,
Vitor Tavares

I agree with Sidney. You can't really implement an effective corrective action until you know WHY there was a problem in the first place, and it can't be a superficial analysis or you'll get a superficial fix. The cool thing about doing a thorough root cause investigation is that you might have the same root cause for a lot of problems that all get solved by addressing that root.

(General Example)
Say you have these symptoms: 1. You feel depressed, 2. You feel tired, 3. You snore.

For corrective actions you might: 1. Take anti-depressant medication, 2. Sleep more or drink a lot of caffeine 3. Sleep in another room as to not disturb your partner or get those snoring strips.

Those things might all be bandaids for the symptoms, but you haven't examined why they are happening to begin with.

Root Cause Analysis: You might be 10 or 20 lbs overweight and find that if you exercised and ate healthily, all of those things would disappear at once.

The corrective actions don't necessarily take the RC into account.
 

qusys

Trusted Information Resource
#5
Hi Vitor,
I agree with the other collegues who were very detailed.

Root cause fixing is the basis to definitevely fix a non conformity...
Also G8D approach is clear about this.
However not always it is possible to find the root cause for a problem...sometimes problems are very complex but methodology of problem solving come in support to us....
In this case, a contaiment action is due to solve the problem but not fixing if the root causes is no addressed so far.

So , I do not know if it was your case...
hope this helps

:bigwave:
 

Big Jim

Trusted Information Resource
#6
But you do need to determine the cause. 8.5.2 b.

You also need to eliminate the cause of a nonconformance. Opening part of 8.5.2.

It may help to point out the definitions of correction and corrective action according to ISO 9000. ISO 9000 is a vocabulary for quality management systems.

correction: what is done to overcome a nonconformance.

corrective action: what is done to overcome the cause of a nonconformance.

Lets take an example of a part that didn't get a required hole drilled in it. The correction could be to get the hole drilled. No cause needed to determine this.

Now you investigate to discover who the hole wasn't drilled. You find that the drill broke in the CNC machine. You also discover that the drill had already made over 1000 parts over the course of two days. You check the specs from the supplier and find that the drill had an expected life of 500 operations.

Your corrective action then could be two things. One, change the drill more often. Two, check the specs for the equipment when developing the traveler and the set-up sheets.

I hope this helps.
 
Last edited:
Thread starter Similar threads Forum Replies Date
S Documenting Design Verification Test Results (ISO 9001) Design and Development of Products and Processes 1
adir88 Documenting Risk Control Option Analysis ISO 14971 - Medical Device Risk Management 8
M Defining and Documenting Record Retention CE Marking (Conformité Européene) / CB Scheme 4
J Documenting a Calibration Interval Extension Calibration Frequency (Interval) 7
B Documenting hardware on Form 2 of AS9102 AS9100, IAQG 9100, Nadcap and related Aerospace Standards and Requirements 5
bryan willemot Documenting past problem history for fasteners for AS9100 Rev D AS9100, IAQG 9100, Nadcap and related Aerospace Standards and Requirements 2
Q Documenting Customer Complaints (Records) Customer Complaints 6
R Documenting Expiration Date Extension for a specific lot ISO 13485:2016 - Medical Device Quality Management Systems 12
J ISO 13485:2016 Section 6.2 - Documenting the process for establishing competence ISO 13485:2016 - Medical Device Quality Management Systems 6
S Does IEC 62304 require documenting unresolved anomalies for all safety classes? IEC 62304 - Medical Device Software Life Cycle Processes 4
C Documenting Cleaning Production Lines in Medical Device Pkg facility ISO 13485:2016 - Medical Device Quality Management Systems 1
C Documenting Cleaning Production Lines in Medical Device Pkg facility 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 0
C Documenting Cleaning Production Lines in Medical Device Pkg facility 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 1
L Problems while documenting the SOUPs used for the software we are developing IEC 62304 - Medical Device Software Life Cycle Processes 4
R Documenting Self-Training and Effectiveness - ISO 13485:2016 Training - Internal, External, Online and Distance Learning 4
C Documenting Software Safety Classifications IEC 62304 - Medical Device Software Life Cycle Processes 4
B Approaches to Documenting an ISO 22000 FSMA Food Safety - ISO 22000, HACCP (21 CFR 120) 3
G Process for Product Safety - Ideas for Documenting Process for 4.4.1.2 IATF 16949 - Automotive Quality Systems Standard 3
dubrizo Are you documenting Internal Audit findings as NCRs? Internal Auditing 18
M What is the value of documenting in-process rework for easily-detectable issues? Quality Manager and Management Related Issues 4
R What is the typical industry standard for documenting Usability Risk? Human Factors and Ergonomics in Engineering 16
C Importance of Documenting NCP's and CA/PA's ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 23
D Documenting Meetings through Meeting Minutes or a Form ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 5
Colin Objectives Form - Format for Documenting Information Security Objectives IEC 27001 - Information Security Management Systems (ISMS) 2
O Documenting Processes requiring Customer Notification Misc. Quality Assurance and Business Systems Related Topics 2
M Documenting Vendor (Supplier) Issues Document Control Systems, Procedures, Forms and Templates 4
V Documenting Exceptions and use of Deviation Request Form APQP and PPAP 2
K AS9100 Clause 7.2.2 - Documenting "Special Requirements" and risks AS9100, IAQG 9100, Nadcap and related Aerospace Standards and Requirements 1
K Competence, Training and Awareness - Documenting Training and Confidentiality Aspects ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 12
Q Documenting the Review of Adverse Effects from Rework ISO 13485:2016 - Medical Device Quality Management Systems 4
A Formal Way for Documenting Design Input Requirements 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 1
A Documenting 5S Guidelines in the Sales Department (Office 5S) Quality Tools, Improvement and Analysis 4
C Training Planning - Using Summary Sheet for Documenting Training Activities Training - Internal, External, Online and Distance Learning 3
J Requirements for Documenting Lifetime of a Medical Device ISO 13485:2016 - Medical Device Quality Management Systems 5
A Best Practice for Documenting Design Reviews 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 13
F Documenting Historical Preventive Action at a Daycare Preventive Action and Continuous Improvement 20
N Documenting Medical Device Complaints 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 6
R Documenting Quality Inspections - Material Released prior to Lot Acceptance Quality Manager and Management Related Issues 10
V Approach towards defining/documenting Requirements COTS vs. New-Product Software Quality Assurance 1
Crusader New Documenting Methods for Manufacturing Process Audits? Process Audits and Layered Process Audits 9
M Documenting an outsourced process - Distribution company with some manufacturing ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 2
P Process Map vs. User Guide - Documenting business procedures Process Maps, Process Mapping and Turtle Diagrams 3
T Documenting Effectiveness of Corrective/Preventive Action Nonconformance and Corrective Action 8
M Customer Format - Documenting Customer Software Requirement Specification and DDD Software Quality Assurance 10
D Documenting Machine Shop In-Process Checks Records and Data - Quality, Legal and Other Evidence 9
Crusader Continuous Improvements - How are you documenting them? Preventive Action and Continuous Improvement 66
R Documenting Processes such as Receiving Inspection, and Auditing to Turtle Diagrams Process Maps, Process Mapping and Turtle Diagrams 20
Gert Sorensen Requirement for specified agendas and meeting minutes when documenting projects? Document Control Systems, Procedures, Forms and Templates 2
A Submit a 510(k) to an existing device vs. Just Documenting a Change ISO 13485:2016 - Medical Device Quality Management Systems 2
D Documenting Revision History - Single ?Revision Record? Document Document Control Systems, Procedures, Forms and Templates 4
Similar threads


















































Top Bottom