Does ISO 9001:2015 require a full internal audit annually?

[Eredhel]

You can probably look at it the same way you do your calibration scheduling. The standard doesn't tell you how often on that either.

 

[Tagin]

I'm VERY new to quality, so please feel free to explain things to me like I have no idea what I'm doing.. Because, well, I don't..
I'm a little confused about the internal audit scheduling. People in this thread seem to be saying that you can just base it on risk, but 9.2.1 specifically says "planned intervals". I would love to be able to put in our procedures that we will do them as deemed necessary based on risk, but that's not quite a planned interval is it?

The idea is that you would 1) assess risks of various processes and the consequences of their going astray (i.e., out of conformance with procedure, with the ISO standard, with customer requirements, with regulatory/statutory, etc.), and then 2) plan your schedule based on those risks. That is why some high-risk processes you might plan to audit multiple times a year (e.g. quarterly), whereas other low-risk processes might only need audits once annually or every other year. So, the planned intervals are a result of the risk-based perspective.

 

[AndyN]

This looks good to me. Much like what the registrar does, no

Which is an entirely different type of audit and since it's external and not internal, isn't an appropriate model at all.

 

[Kronos147]

Which is an entirely different type of audit and since it's external and not internal, isn't an appropriate model at all.

I'll bite. Beside the external/internal, are there other features that make it 'entirely different'?

 

[buzzjaw]

I'm VERY new to quality, so please feel free to explain things to me like I have no idea what I'm doing.. Because, well, I don't..
I'm a little confused about the internal audit scheduling. People in this thread seem to be saying that you can just base it on risk, but 9.2.1 specifically says "planned intervals". I would love to be able to put in our procedures that we will do them as deemed necessary based on risk, but that's not quite a planned interval is it?

That's exactly what you can put in your procedure. It's just when you are audited you need to be able to provide the evidence so something which identifies what your risks are, what your audit plans inline with those risks and how you are implementing the plan. The 'planned intervals' bit just means have a program. The program can change as new risks are identified and you reprioritise. Imagine your audit program plans to audit subcontracted work and then your organisation stops subcontracting. The risk profile has changed, so your program needs to change too. No point in documenting too much detail in your procedure, just point to the documented, but dynamic, program and risks.

 

[AndyN]

I'll bite. Beside the external/internal, are there other features that make it 'entirely different'?

Really? I have to explain how different they are? How long a list do you want me to make?

External: No clue about the auditor by client
Internal: Auditor is well known by org.

External: No clue about the business (possibly only general terms)
Internal: Very familiar

External: No time to prepare, study and understand QMS
Internal: All the time necessary

External: No clue about personalities, management style, culture etc
Internal: Knows all those things

External: No clue of contemporary quality issues
Internal: Knows the above

External: No clue about relationships with customers and suppliers
Internal: Knows the above

External: One audit a year
Internal As many as necessary to be effective

External: No clue where skeletons are buried
Internal: Has shovel, knows locations of plots and who's buried there

Should I continue?

 

[Kronos147]

"External: No clue about the auditor by client"

It's supposed to be impartial anyway.


"External: No clue about the business (possibly only general terms)"

Then the context statement is not effective, or the assessor needs to focus more on the site tour.


"External: No time to prepare, study and understand QMS"

I respectfully disagree. There are tons of resources provided to auditors. I have heard auditors mention facts of previous audits done by other auditor. Older audits. They have the time, if THEY are effective. It's not easy to be an effective auditor!

"External: No clue about personalities, management style, culture etc"

A good auditor better pick that up quick. It should also be pretty embedded into the context stuff, else not effective, no?


"External: No clue of contemporary quality issues"

I respectfully disagree. Many external resources of the registrars are still in industry.


"External: No clue about relationships with customers and suppliers"

I respectfully disagree.


"External: One audit a year
Internal: As many as necessary to be effective"

So at your organization the external audit is not effective?


"External: No clue where skeletons are buried"

Auditors should be able to sniff them out, else, the auditor is not there as a fraud police. If an organization plans a system around hornswaggling an auditor, well, I guess it could work.

 

[AndyN]

Kronos: I see you're in California. Can you mail me some of that "good stuff"?

For context, can I ask how many certification bodies, individual auditors and certified organizations (and what standards) you've experienced?

 

[Kronos147]

"For context, can I ask how many certification bodies, individual auditors and certified organizations (and what standards) you've experienced? "

Helped write a Nadcap checklist. That's PRi.

Took an Aerospace company from AS9100 Rev. B to Rev. C - BSI.

Was audited to the Nadcap checklist (first company every to get accredited).

That company worked for the primes so I was audited by Boeing, Northrop, Westco and Crane among others.

Took ESM from AS9100 Rev. C to D. We are with DNV-GL. So that's over 10 years in the aerospace industry as a MR. Three registrars in AS\Nadcap.

Oh, and I conducted over 100 ISO 9001 audits for one of the big registrars. Just hit that number a couple of months ago actually.

 

[AndyN]

Nearly every week, in contrast, I see and hear of the bizarre findings of numerous auditors who leave their ridiculous findings with my clients. It's not too difficult (since AS9100 is fairly well controlled, as far as has been experienced) to see that my observations are what they are - accurate. Having been in the CB world from the outset, I'd suggest that the standard of auditing has declined so much I'm left wondering what the management at most CBs are actually doing to even monitor their auditors' performance. Your experience is valid, however, we see what's left behind after the audit is over and it's not a pretty sight from this viewpoint.