External Auditor Findings when an Internal Audit found a Nonconformance Yesterday

[starfish]

Hello, its me again

Can an external auditor give you the same non conformance as an internal auditor on a certain process? For example a finding given to me today, in an internal audit, can the external auditor give me the same finding tomorrow.

 

[Duke Okes]

Theoretically they could, but if your organization has raised a CAR and has a history of effectively addressing NCs I would think it is unlikely. Of course it might depend on the significance of the NC, what impact it has already had, and whether or not containment and remedial action have already been taken.

 

[Randy]

It would be a very poor and krappy practice.

 

[Sidney Vianna]

Can an external auditor give you the same non conformance as an internal auditor on a certain process? For example a finding given to me today, in an internal audit, can the external auditor give me the same finding tomorrow.

We had a long but worthy discussion about this very issue in this thread. I suggest you take the time to go over the pros and cons. Sometimes, there are valid reasons for the external auditor to be "redundant".

You could also ask the same question, from another perspective; such as: if you are already working on a corrective action for your internally reported non-conformity, what is the harm of responding back to the external CAR with the same corrective action?

Too many games played by registrants out there....:mg:

 

[Wes Bucey]

We had a long but worthy discussion about this very issue in this thread. I suggest you take the time to go over the pros and cons. Sometimes, there are valid reasons for the external auditor to be "redundant".

You could also ask the same question, from another perspective; such as: if you are already working on a corrective action for your internally reported non-conformity, what is the harm of responding back to the external CAR with the same corrective action?

Too many games played by registrants out there....:mg:

That may be (too many games), but why paint every registrant with the same tar brush?

It seems to me (personal opinion) that if an external auditor comes across a nonconformity which has been previously reported by an internal auditor and the registrant states, "It's being worked on." then the question should move on to the status of the root cause search and corrective action. If the registrant is, indeed, "playing games," that might be the source of a DIFFERENT N/C for the auditor to note, not merely acting like an automaton and redundantly noting the original N/C again.

If, however, the registrant is silent about the initial internal audit N/C, then the external auditor is fully justified in noting it as if it were the only time, since to him it is the only time it's been noted.

The whole crux of the matter is two-way communication during any audit, internal or external. If the registrant stands by, silent, hoping the internal or external auditor won't notice anything, and remains silent when and if either auditor notes an N/C, then it seems foolish to talk to strangers later about an issue which could have been resolved on the spot.

Added in edit:
Sorry, somehow I accidentally deleted a large part of the following paragraph (restored part in blue)
If, however, the matter is brought up in the closing meeting, "someone" at the auditee has a responsibility to speak up and clarify whether there is, in fact, an active corrective action process or whether it is all just "lip service." Auditees MUST be clear on all the points raised by an auditor. Some auditors are better than others at inviting questions and discussion on the findings throughout the visit because the "guide" or "escort" may not be knowledgeable enough about the big picture to adequately represent the auditee's interest during the actual inspection tour.

 

[arios]

I've faced this situation before and when I review the said CARS or CAPA's it turns that they don't always cover what the auditee claims they do.

If the CAPA or CAR addresses the issue it may not be necessary to issue a new NC, but I have also seen "abuse" of this practice: Many CAPA's and also many gaps in the system at the same time. When that happens I explain that it's Ok that they found the issue recently but the role of my audits is to determine if the QMS is implemented, and if it is effective. Only looking at opened or identified CAPA's instead of implemented requirements says that the QMS is strong on one side and too weak on the other. This scenario could be a potential for a Major NC.

 

[Sidney Vianna]

but why paint every registrant with the same tar brush?

I did not. And, for those who want a well thought out critical analysis of when and why an external auditor should also report an NC, already uncovered during an external audit, read the hyperlinked thread.

 

[Wes Bucey]

I did not. And, for those who want a well thought out critical analysis of when and why an external auditor should also report an NC, already uncovered during an external audit, read the hyperlinked thread.

The poster mentioned an internal audit [where the previous N/C was noted, and, presumably, a root cause and corrective action were underway], as did I in my post.
(Are we dealing with apples and oranges?)

 

[Jim Wynne]

The poster mentioned an internal audit [where the previous N/C was noted, and, presumably, a root cause and corrective action were underway], as did I in my post.
(Are we dealing with apples and oranges?)

That looks like a fairly obvious typo on Sidney's part.

 

[Sidney Vianna]

The poster mentioned an internal audit [where the previous N/C was noted, and, presumably, a root cause and corrective action were underway], as did I in my post.
(Are we dealing with apples and oranges?)

My mistake. I meant internal, despite the fact that I wrote external.

The underlying issue is that there is no adequate SINGLE answer that fits all scenarios for this question.

For anyone who is semi-knowledgeable about registrar audits and the games played by some of the registrants to infer that 3[sup]rd[/sup] party auditors should never "duplicate" an internally originated non-conformity, is wrong.

I find very telling that nobody attempted to answer my previous question, reversing the perspective on the issue:

if you are already working on a corrective action for your internally reported non-conformity, what is the harm of responding back to the external CAR with the same corrective action?