External Audits without site visit?

S

sudwel

#1
Hi everyone!

The Province of Ontario recently began requiring all municipalities that supply drinking water to their residents to implement Quality Management Systems that conform to the made-in-Ontario "Drinking Water Quality Management Standard" - which is a blend of ISO 9001, ISO 140001 and HACCP.

I came to my current position at this municipality, from a ISO 9001 registered company, a month before the legislated deadline to submit the "Operational Plan" (aka QMS Manual) to the external auditing body for accreditation. Looking at the "Handbook for accrediation" supplied to all municipalities by the registrar, they state that they are going to do the audits on a 3 year cycle, similiar to ISO - but what confuses me, is that they state the Year 1 and 2 Surveillance audits will only be Systems audits - with no site visit!?! Now, my only experience is with ISO - and our registrar came to our site for all surveillance audits, and only selected a small portion of our system to audit. I'm wondering how the heck they can perform a "systems audit" without looking for objective evidence (records etc.) that we are "doing what we say"?!?

Does this type of "systems audit" occur elsewhere, or with different standards?

Just curious!

Thanks,
Darlene
 
Elsmar Forum Sponsor
#2
Hello Darlene:

It seems like you're correct, it is a little strange. However, there may be a good reason for this. When you state 'registrar' who are you writing about?

My guess is that if the organization that does these audits is very specific to this program, then they can do what they want. It's only the (ISO) registrars who subscribe to such groups as IAF etc and also to ISO/IEC 17021 that do what you describe.

Otherwise, pretty much anyone can set themselves up to be a registrar and offer services, it's up to the client or the governing industry to decide if they're qualified - 'accredited'. "Caveat emptor"! Eh?
 
J

Jeff Frost

#3
Are there legal requirements associated with this system or was this system set up to meet legal requirements?

If this is the case then you will be maintaining documentation per the requirement of the law and if you do not follow the law the water district personnel may find that they are getting a paid vacation in your local jail.
 
S

sudwel

#4
The registrar is the Canadian General Standards Board (CGSB) - who was selected by the Ontario Ministry of the Environment as the registrar.

And, yes, Jeff there are legal requirements - this DWQMS was set up under the Safe Drinking Water Act (which was an outcome of an inquiry looking into the "Walkerton Incident" where people died as a result of E.coli contaminination in the drinking water - Google "Walkerton Inquiry" if you are at all interested) - so it is a legal requirement as part of the drinking water licensing process that all municipalities implement and maintain a QMS that conforms with the DWQMS.

Coming from an ISO environment, however, I'm finding that the approach of the CGSB (including how they will be billing us for our audits - by the hour (for document review, travel time and actual on-site audits) - on TOP of the annual registration "fee"!!) - is very interesting. I'm wondering more and more why the government decided to create it's own Standard, when they just could've required all muncipalities (even just the drinking water departments - or as termed in their Standard "Operating Authorities") to become ISO 9001 and 14001 registered.

Oh well - we'll do what we have to do to meet the registrar's requirements to maintain our registration (as according to their document, it CAN be taken away from us - which WOULD result in charges being laid against the municipality, the Mayor, Council plus water personnel!!!) - and I'll continue to shake my head :nope: at some of the hoops they make us jump through!!

Darlene
 
S

somerqc

#5
They recently tried to do the same thing with Health and Safety programs. For the last 2 years, they had been piloting an "accreditation" process for H&S programs in Ontario.

I was always asking (like Darlene is) why? There are perfectly good standards that could be used instead (18001 for instance in the H&S world).

Well, for H&S they just announced that the accreditation program was on hold indefinitely.

Yes, Darlene you will just have to do what they say if you wish to stay out of jail it seems. The goal is sound (avoiding another Walkerton) but the approach to get there seems questionable.

Oh ya, for those of you unaware - the Canadian General Standards Board is a quasi-government agency. I had to deal with them in a former life - I can't say it was a good experience.
 
C

Chris Ford

#6
Hi everyone!

The Province of Ontario recently began requiring all municipalities that supply drinking water to their residents to implement Quality Management Systems that conform to the made-in-Ontario "Drinking Water Quality Management Standard" - which is a blend of ISO 9001, ISO 140001 and HACCP.

I came to my current position at this municipality, from a ISO 9001 registered company, a month before the legislated deadline to submit the "Operational Plan" (aka QMS Manual) to the external auditing body for accreditation. Looking at the "Handbook for accrediation" supplied to all municipalities by the registrar, they state that they are going to do the audits on a 3 year cycle, similiar to ISO - but what confuses me, is that they state the Year 1 and 2 Surveillance audits will only be Systems audits - with no site visit!?! Now, my only experience is with ISO - and our registrar came to our site for all surveillance audits, and only selected a small portion of our system to audit. I'm wondering how the heck they can perform a "systems audit" without looking for objective evidence (records etc.) that we are "doing what we say"?!?

Does this type of "systems audit" occur elsewhere, or with different standards?

Just curious!

Thanks,
Darlene
Sure... this is normal, and it's typically called, "a desk audit". The scope of their inspection/audit seems to be limited to verifying that a system has been established. They can do that simply by reviewing your procedures. Records, interviews, observing processes, etc. verify that the system was implemented and is effective. So, I don't know why they wouldn't want to visit the site for the initial accreditation, but it's not uncommon to conduct a desk audit to verify that a system is established.
 
S

sudwel

#8
So, I don't know why they wouldn't want to visit the site for the initial accreditation, but it's not uncommon to conduct a desk audit to verify that a system is established.
Guess I wasn't completely clear - they are going to do an initial "desk audit" (we submitted May 1st), then we have 30 days to address any NCs they issue based on that audit (at this point we will have "limited scope accreditation") and then have 12 months to complete an internal audit cycle, then they will come to our municipality and do an on-site audit, based on which we will receive our full scope accreditation - the following two years (Year 1 and Year 2, in their documents) will be systems audit (where we send them our documentation), with a re-assessment audit in Year 3 - where they will come to us again. We DO have the option to pay for them to do on-site audits in Year 1 and 2... but considering how cash-strapped most municipalities are these days, I doubt many (including my own) will go for it!
 
S

sudwel

#9
The accreditation & certification protocols for this program are described in the attached document
Thanks... I have this document and the handbook (they don't have the handbook posted on their website yet, as it hasn't been translated into french yet!) The section that details what they are going to look for in the surveillance audit is, I guess, what boggles my mind - as I will have to send to them:

  • results of any internal audits
  • historical responses taken to address CARs made by the registrar
  • results of any management reviews
  • any changes to documentation and implementation of the QMS
So - I'll be sending them copies of my files... and they will let me know if they need more and perhaps do a phone interview.... It just seems like a "backwards" way to do things... and much more time consuming on my end!

Again - it's what they want, so it's what we'll give to them!! Mind you - they are also struggling with knowing *exactly* what they want as it is so new. Since there are over 200 municipalities that are rolling out their systems in the next 2 years, with 10-12 municipalities required to submit every month (beginning January 1) - that means they are being bombarded with paperwork every month - and they are SOOO far behind right now that it isn't funny! The municipalities that submitted January 1st are JUST now beginning to discover the results of the systems audit... but, that's okay, since they are just now receiving their limited scope accreditation - they won't have their on-site audit until next summer - which gives them longer to get their implementation going.

So - it's a learning curve for everyone... and as I said earlier, it is too bad they didn't just use one of the existing ISO systems and let us pick our own registrar - probably would've been a lot less expensive in the long run!!
 

Hershal

Metrologist-Auditor
Staff member
Super Moderator
#10
Since you are dealing with what is known as an AHJ (Authority Having Jurisdiction), you get to play by their rules. Desk audits are not unknown.

However, it has been correctly stated as a Registration. If it is an Accreditation, that would be administered by CALA (formerly known as CAEAL) as that is the Canadian AB for environmental. Accreditation would also be to different standards than 9K and 14K. And CALA does require on-site assessment.

Hope this helps.
 
Thread starter Similar threads Forum Replies Date
J External third party audits Registrars and Notified Bodies 1
R Is it required to have an SOP for external audits? Medical Device and FDA Regulations and Standards News 7
A External Auditor issue with Internal Audits Internal Auditing 7
B Integrating ISO 9001/27001 External Audits - Audit Time Reduced? Discounts? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 4
G Scope of External & Internal Audits General Auditing Discussions 10
W Hiring an External Auditor to perform our AS9100 Compliance Audits AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 5
G Combining ISO 9001 and TS 16949 External Audits ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 2
S How to quantify the Benefits of Internal and External OHS audits? Occupational Health & Safety Management Standards 4
D External Parties performing Internal Audits? TS 16949 Clause 8.2.2 IATF 16949 - Automotive Quality Systems Standard 15
P Can External Audits by Customer be treated As Internal Audits AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 21
E First external audit coming up, do I need to have performed Internal Audits already? Internal Auditing 15
A Audit Database that captures internal, external audits - Prime Part 21 manufacturer Quality Assurance and Compliance Software Tools and Solutions 12
G External Audit Finding - Audits of System Management vs. Process Review ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 5
N Handling External Audits with Internal Vacations General Auditing Discussions 101
B Internal Audits save you from Non-Conformances on external audits? General Auditing Discussions 16
M Preparing for External Audits - Asking Registrar for their Audit Check List(s) Document Control Systems, Procedures, Forms and Templates 19
Crusader Your Internal Audit Team: Internal or Hired External? Outsourcing Internal Audits Internal Auditing 100
Paul Simpson Value Added External Audits - Do External Audits add value to your system? General Auditing Discussions 36
A Meeting the ISO 14001 Periodic Audits Requirement - Internal vs. External Auditing ISO 14001:2015 Specific Discussions 11
J Help settle a disagreement: Should external providers of preventive maintenance be on your ASL? AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 5
J Requirement for Retention of Records of Withdrawn Documents of External Origin Document Control Systems, Procedures, Forms and Templates 3
M Calibration Certificate Result issued by an accredited external laboratory General Measurement Device and Calibration Topics 9
L IATF external audit virtual (remote) IATF 16949 - Automotive Quality Systems Standard 13
A IEC 62304 safety classification, External Controls and off-label use related risks IEC 62304 - Medical Device Software Life Cycle Processes 5
R External Audit and Certificate prorogation due to the pandemic General Auditing Discussions 10
N Audit non-compliance API Q1 - Use of External Documents 4.4.4 in Product Realization Oil and Gas Industry Standards and Regulations 8
J 510(k) for a control kit for an external IVD test kit 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 1
Pmarszal External Standards and Regulations Management Process Document Control Systems, Procedures, Forms and Templates 10
I What kind of wine best complements the Friday that you close out your external audit findings? Opinions are welcome. Coffee Break and Water Cooler Discussions 12
B How to apply external voltage to SIP/SOP IEC 60601 - Medical Electrical Equipment Safety Standards Series 2
P Qualifying commercial off the shelf (COTS) external suppliers ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 10
B Internal and external auditor competency to CSR's IATF 16949 - Automotive Quality Systems Standard 20
N IATF 16949:2016 7.1.5.3.2 External Laboratory - How to approve the Testing Laboratory without accreditation scope IATF 16949 - Automotive Quality Systems Standard 2
A OHSAS 18001 external auditor finding personal interpretation? Occupational Health & Safety Management Standards 5
L External power supplies: How close does the safety report have to match the end-use application? IEC 60601 - Medical Electrical Equipment Safety Standards Series 4
D Reduction of software class based on multiple external risk controls IEC 62304 - Medical Device Software Life Cycle Processes 5
C Identifying and Controlling External Documents Document Control Systems, Procedures, Forms and Templates 3
C External Laboratories and OEM Calibration IATF 16949 - Automotive Quality Systems Standard 0
Q AS9120B flow down to external providers: Records Retention AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 2
Casana IATF 16949 7.1.5.3.2 External Laboratory - On Site Calibration IATF 16949 - Automotive Quality Systems Standard 8
B Using external FDA and ISO 13485 audit as internal audit Internal Auditing 6
C ISO 17025 2017, Requirement 6.6.3 - Communicate requirements to external providers ISO 17025 related Discussions 4
C Determining if Maintenance Contractor is an External Service subject to ISO 9001 Clause 8.4 ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 43
qualprod The Perfect audit? External Audit causes a significant negative impact in a company General Auditing Discussions 9
K AS9100D 8.4.1.1 external providers question - Walmart, Home Depot, our lawn care team. etc. AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 20
R Do we need to treat local law as external origin documents? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 15
D ISO 9001:2015 Clause 8.4.3 "Information for External Providers" buying from online retailers. ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 10
M Applicability of Means of Protection, working voltage in an Automated External Defibrillator IEC 60601 - Medical Electrical Equipment Safety Standards Series 0
D Necessity of external watchdog next to internal watchdog ISO 14971 - Medical Device Risk Management 1
B How to reply NCR on ineffectiveness of corrective action during IATF external audit? This is repeated issue whereby some mistake was done. IATF 16949 - Automotive Quality Systems Standard 7

Similar threads

Top Bottom