Internal Auditing a previous Nonconformance?

[Kchnwtch]

I work as QAdmin in a tiny company (15 ppl). Recently the boss told me that a customer had a complaint. Seems a process that they specifically requested wasn't done. The boss confessed that it was probably his error; he was told verbally by the customer to add helicoils to the job, and he forgot to add it to the router. I asked him how he gets his information from this customer and he answered, "bits and pieces...it's complicated."

Now we're in the middle of an IA, and I'm an auditor, but we've only really completed one major audit since we certified (ISO 9001:2008), so I'm pretty new at this. This one job with the complaint really addresses all the questions we have in our audit checklist. The boss and his admin asst. pretty much set up all the jobs from information he gathers from the customer. There's some friction there, because they've been doing it "their way" for 30 some years, and their "system" causes problems sometimes.

My question: Can I use this NC as an audit example, or is that unfair, or bad auditing? I think I might get some real answers rather than, "oh we always do this and that..." I'm due to investigate it anyway (since I'm 2008 I still get to work on "preventive actions"). Can I kill two birds with this one internal audit stone? And do you drop CAPAs on your boss? Thanks for your help!

 

[Sidney Vianna]

Re: Internal-Auditing a previous NC?

The customer complaint could (and should) have triggered a corrective action by itself, without the need to report it via an internal audit.

If your boss really wants the organization to improve and the QMS to drive improvement, he should not object to use the system to fix the failures, so similar problems don't recur. Obviously you have to be tactful, but remember: it is not the boss who is the problem. It is the system...

 

[JoShmo]

How come this proces wasn't audited before? Also why didn't the complaint trigger an audit of corrective actions too?

 

[Kchnwtch]

It happened a few days ago, and we're auditing all month. Corrective actions have been handled, I'm working on preventive actions now. Just wondered if it was proper to use it as both a PA and an audit finding?

 

[Jen Kirley]

It happened a few days ago, and we're auditing all month. Corrective actions have been handled, I'm working on preventive actions now. Just wondered if it was proper to use it as both a PA and an audit finding?

If a nonconformity repeats, a NC should be issued against the corrective action process as it has been ineffective; but I only issue repeats when citing the same standard, the clause, and the same type of issue. This may not be possible if you have already finished auditing the nonconformance process.

I can appreciate your wanting to adhere to sample protocols, but having a repeat of a customer complaint is a big deal and needs to be addressed so as to not lose customers and market share. Therefore:

- Did you audit Customer Satisfaction yet? It could be included there. If customer complaints are not addressed as nonconformities, a NC should be issued. Is that part of your process?

- If you audited customer service, did you audit Contracts yet? Customer requirements need to be reviewed as part of agreement to work. a NC could be issued there.

8.2.2 says an audit program shall be planned, taking into consideration the status and importance of the processes and areas to be audited. The term "program" does not limit us to a rigid schedule; an event is allowed to trigger an audit if the issue is important enough. Why wait a year to address a repeat customer complaint?

 

[JoShmo]

It happened a few days ago, and we're auditing all month. Corrective actions have been handled, I'm working on preventive actions now. Just wondered if it was proper to use it as both a PA and an audit finding?

Auditing all month? HOw did is this organization?

 

[Kchnwtch]

We're not big. We have 2 people with multiple responsibilities working on audit. One person was out for 2 weeks due to injury.

 

[Kchnwtch]

How come this proces wasn't audited before? Also why didn't the complaint trigger an audit of corrective actions too?

The process was audited both in the internal audit before certification, and the CB auditor sat down with the CEO and admin asst. during his audit. The questions were answered satisfactorily then, and there was evidence of conformance. But not all orders are audited, and with a company that's been in business 30 years, not all customers order consistently. My understanding during the previous audits was that all communication and confirmation was done via email. This was the first incident to alert me that not everything was getting recorded for this customer.

When I followed up on the CA, I asked the CEO the questions we ask in audit, such as " how are verbal customer requirements confirmed with the customer before being accepted?" and "How are subsequent changes to customer requirements handled...." and I got the answer "It kinda comes piecemeal, rather than get too elaborate I think the answer to your question is verbally." Not a great answer, so I thought this example would be a good one to use to audit 7.1, 7.2 and 7.3 (2008), so that I could figure out what is actually happening with this customer, since I thought all the customer data was being handled the same way.

 

[JoShmo]

We're not big. We have 2 people with multiple responsibilities working on audit. One person was out for 2 weeks due to injury.

OK, so I have to ask what's taking as long as this to audit? How are you doing your audits? Once a year as a big one, or what?

 

[Kchnwtch]

We're doing the entire audit in advance of our upcoming surveillance audit. We can't stop what we're doing or stop production to do it all at once so we've done it a piece at a time. This is the last piece.