Internal audit schedules - Where does it say that I need an annual schedule?

[Ross Simpson]

O.K.,wizards, here's one fer ya !
Just had first survielance audit(six month) and was CARed for the following(this is ver batum)"Internal audit schedules for****and*** facilities have not been created for the year 2000"
Where, oh where, does it say that I need an annual schedule?
Our procedure states that we conduct internal audits quarterly and publish schedules in"a timely manor".
Do I have a case for argument?

------------------

 

[Marc]

ISO or QS? Yup - an audit schedule is expected. The words are:

> ...4.17 Internal quality audits
>
> The supplier shall establish and maintain documented procedures for
> planning and implementing internal quality audits to verify whether
> quality activities and related results comply with planned
> arrangements and to determine the effectiveness of the quality system.
>
> Internal quality audits shall be scheduled on the basis of the status
> and importance of the activity to be audited and shall be carried out
> by personnel independent of those having direct responsibility for the
> activity being audited.

This does not imply a quarterly frequency.

> The results of the audits shall be recorded (see 4.16) and brought to
> the attention of the personnel having responsibility in the area
> audited. The management personnel responsible for the area shall take
> timely corrective action on deficiencies found during the audit.

I can't speak for 'published', but it does say (in so many words) communicated.

In my opinion, if you were cited for "Internal audit schedules for****and*** facilities have not been created for the year 2000", if you had no audit schedule I agree. but I wouldn't be addressing a quarterly frequency and as to publishing I would address communication to the appropriate personnel as well as presentation (at least a macro presentation) during management rview as part of the following:

> ...4.1.2.3 Management representative
>
> The supplier's management with executive responsibility shall appoint
> a member of the supplier's own management who, irrespective of other
> responsibilities, shall have defined authority for
>
> a) ensuring that a quality system is established, implemented and
> maintained in accordance with this International Standard, and
>
> b) reporting on the performance of the quality system to the
> supplier's management for review and as a basis for improvement of the
> quality system.

 

[Marc]

Also see: Internal Audit Schedules - 1
and Internal Audit Schedules - 2
and Internal Audit Schedules - 3

for some thoughts.

 

[barb butrym]

do you have a case????? NOPE
my guess is....some where you say you will audit all elements over the course of a year (or maybe the registrar requires it?)..anyway....you need to Plan and schedule in advance hence the question ....where is the schedule for 2000?
Lots of people do it quarterly, but on a spread sheet saying which areas will be audited each quarter...certainly not required to have a date secured a year in advance. They want to see that you have the opportunity to adjust the schedule based on importance and past results

 

[Marc]

I had a small client - 14 people - the VP of Mfg marked the management meetings and internal audit dates on a calendar on his wall. The auditor thought it was cute - no problem - it was scheduled!

 

[rrramirez]

My guess is:
Your organization could conduct many internal audits if you consider the need for that.
If you "map" the clauses as an interrelated system of cause-effect results then you can do for example, the audit of 4.6urchasing, interrelated with the needs of 4.1.2.1, 4.1.2.2, 4.2.3, 4.5, 4.16, 4.10.2, 4.13, 4.14 and 4.18, and so on; purchasing isn´t isolated clause within a QMS because it need the contribution of, almost, all the clause above.
I have my own interrelated system for the 20 clauses of ISO 9001 since 1995 in order to "map" any of my internal or consulting audits.
Reinaldo Ramirez

------------------
Senior Member ASQ (1986)

 

[Marc]

Originally posted by Ross Simpson:

Where, oh where, does it say that I need an annual schedule?

Our procedure states that we conduct internal audits quarterly and publish schedules in"a timely manor".

After re-reading this post you do have a case (of sorts). My paradigm is a yearly schedule - as I stated above it is expected. If you want to nit pick you could take the stance along the lines of the consultant as management rep.

The standard states:

> Internal quality audits shall be scheduled...

Nowhere is it stated that you shall (must) have a yearly schedule or any other detail. I can see where your interpretation should be acceptable - you schedule them as necessary. Your evidence would be the audit history file.

You are caught in the situation of the expectations (paradigm) of auditors and what are 'standard' interpretations. I would not think a consultant could serve as management rep but if you get down to the bottom line - the words do not prohibit it. Barb exhibited the same paradigm saying: "...you need to Plan and schedule in advance..." Now the question comes back to what you said in your original post: "...Where, oh where, does it say that I need an annual schedule?" You are correct - it doesn't say annual, or imply annual. While QS does, ISO doesn't even say you have to audit every element every year.

To be honest, despite what I said in my earlier post, I can see where you could evaluate your needs (...internal quality audits shall be scheduled on the basis of the status and importance of the activity to be audited...) quarterly and issue a schedule. If I was auditing and it was explained that way I'd probably say "OK fine.." But then again, I was the person who suggested to the company which marked a day on their calendar that they do so. No reason to get all hopped up on the scheduling issue.

You do have a case for argument and if your system is working as evidenced by your audit history, I would judge it compliant.

 

[barb butrym]

Lets not forget the fine print in so many of the registrars contracts requiring that all elements be covered annually...not an ISO requirement, but imposed........ thus leading many to think it is an ISO thing. probably the cause for most of the confusion

I do agree that the schedule may be informal, as in the calendar...nothing wrong with that. I also agree that so early in the year you could get away with "not done yet"..maybe, if history is there.

I perfer a quickie spread sheet with 4 columns (3 months each) saying which quarter i plan to do an element in....it also leaves room for added audits according to need, follow up etc....gives me more flexibility as to when i actualy do the audits, and its easy to keep "on schedule"

 

[David Mullins]

More clarification required?
I believed (rightly or wrongly - and have been told such by several external auditors/registrars) that each element of the standard must be audited at least every 12 months. Surely this is covered in either 9004, 10011 or published interpretations on auditing frequency?

The problem I frequently run into is that performing audits by workplace, and all of the procedures that apply to that workplace, doesn't satisfy external auditors for the interpretational requirement of being able to demonstrate that all elements of the standard are being audited. Even a matrix of procedures against standard elements doesn't satisfy the auditors (and this has been consistent across 3 different certifying bodies / Registrars). Thoughts?

------------------

 

[Marc]

Other in management review, I cannot find that written anywhere.

"4.1.3 - Management Review

The supplier’s management with executive responsibility shall review the quality system at defined intervals sufficient to ensure its continuing suitability and effectiveness in satisfying the requirements of this International Standard and the supplier’s stated quality policy and objectives (see 4.1.1). Records of such reviews shall be maintained (see 4.16).

4.1.3.1 - Management Review

The Management Review requirement shall include all elements of the entire quality system, not only those specifically required in other elements (e.g. 4.14.3.d)."

QS9000 does require it but as I remember it is a registrar requirement (like audit days) as opposed to being specified by the actual spec (QS9000).

I would ask your registrar where that requirement is stated.

Maybe one of the others can correct me and tell me where in QS (or ISO) that this is stated.

This said, by default I always ensure clients plan to audit their entire system yearly. However, I teach that 'auditing' the elements of the standard yearly is a desk audit done by the quality manager (management rep or whoever is responsible) - not internal auditors.

Surely this is covered in either 9004, 10011 or published interpretations on auditing frequency?

Registrars cannot audit you to these. They are NOT requirements.