SBS - The best value in QMS software

Internal Auditing in a Multi-Site Environment

G

Greg_F

#1
Hi there,

we are wondering about the scope of the internal audit program in a multisite environment. The question is: needs each site to be fully internal audited each year or are random sample audits in the different sites sufficient taking for granted that every aspect of the system is covered every year.

Looking forward to your expert opinions. What would be the recommended way of working.

Greg F.
 
Elsmar Forum Sponsor

Jen Kirley

Quality and Auditing Expert
Staff member
Admin
#2
Re: Internal auditing in a multisite environment

Good day Greg F,

There is a common assumption that each site must be audited to the entire standard each year. It is a myth. In fact, 8.2.2 of ISO 9001 specifically states that audit planning is to be done based on (paraphrased) importance of the process and process performance, including what happened in the previous audit(s).

That means it is both practical and expected to audit some processes more frequently than others, but be warned that CBs will expect to hear an understanding of why that process is scheduled for every second or third year.

I would not schedule longer than three years, so I would make a matrix to ensure all the processes and parts of the standard (except exclusions of course) get covered at least once in a three year period, but critical processes get scheduled more often. I would additionally find a way to show how your planning addresses process performance, especially if previous audit results showed significant problems. I would speed up the schedule for those processes if they skip a year or two.

I hope this helps!
 

somashekar

Staff member
Super Moderator
#3
Re: Internal auditing in a multisite environment

Hi there,

we are wondering about the scope of the internal audit program in a multisite environment. The question is: needs each site to be fully internal audited each year <snip>
It is never the year that is a benchmark. Rather it is the process and its significance with respect to the overall QMS performance. The multisites may be interacting with each other as well as with the lead site. Changes in a site may effect the performance at an other site. This has to be critically viewed and assessed if internal audit frequency have to be changed at such effected sites. Jennifer has done the neat explanation.
 
#4
Re: Internal auditing in a multisite environment

Hi there,

we are wondering about the scope of the internal audit program in a multisite environment. <snip>
Greg: Running an internal audit programme shouldn't be confused for emulating the CB audit process. The idea that you have to audit the QMS on a specific time frame is not appropriate. Jennifer gave some strong direction as to what you should consider. I'll go a step further and tell you that you don't even have to have any kind of calendar of planned audits! OK, so a couple of audits might have a place in a 12 month cycle, but after that, stop trying to "preduct" where you should audit and think "RISK" and "IMPORTANCE".

Risk comes from new/changed and poor/over performance. Importance looks at the risk from the perspective of the customer or profitability. So, what's new/changed/poorly performing and how does it impact the customer or your own internal operations? THAT's where you go audit! Do it on a rolling 30/60/90 day window. Plan them WITH your management team.
 
M

mguilbert

#5
Re: Internal auditing in a multisite environment

We have a multi-site certificate. As I agree with other suggestions based on risk. We have a dedicated audit team of two. Our department goals are to audit each location twice per year. In addition those recieving the CB audit will be audited a third time. We believe if it is important enough to be included in the scope of our certificate, the process they perform is important enough to warrant at least annual internal audits. Audits for a location may be increased due to findings and risks. We currently have 16 sites in our scope. They are in Arkansas, Oklahoma, South Carolina, Georgia, Tennessee, Mississippi, and Alabama. We, as the ISO department also do presentations, facilitate changes, act as gate keeper for documents, create data analysis tools and electronic documents, and help educate employees on ISO.

Edit: As others have mentioned we do not audit each facility to the full standard. Certain tasks are performed by the corporate office ie. product planning.

I hope this helps. This is just we do.
 
Last edited by a moderator:

Big Jim

Super Moderator
#6
Re: Internal auditing in a multisite environment

Greg: I'll go a step further and tell you that you don't even have to have any kind of calendar of planned audits! OK, so a couple of audits might have a place in a 12 month cycle, but after that, stop trying to "preduct" where you should audit and think "RISK" and "IMPORTANCE".

Risk comes from new/changed and poor/over performance. Importance looks at the risk from the perspective of the customer or profitability. So, what's new/changed/poorly performing and how does it impact the customer or your own internal operations? THAT's where you go audit! Do it on a rolling 30/60/90 day window. Plan them WITH your management team.
Keep this in balance with what the standard says:

"The organization shall conduct internal audits at planned intervals . . . "

and:

"An audit program shall be planned, taking into consideration the importance of the processes and areas to be audited, as well as the results of previous audits. The audit criteria, scope, frequency, and methods shall be defined."

Most of all, the internal audit schedule should be a living document that is modified as frequently as needed to accommodate changing conditions in your QMS.

This isn't going to be easy without a calendar.
 
#7
Re: Internal auditing in a multisite environment

This isn't going to be easy without a calendar.
Planned intervals doesn't mean the same as a time based frequency. In fact, the previous version of ISO9004 actually said that audit scheduling should be flexible. Having a calendar and then keep changing it doesn't make sense...
 
F

Frankie11

#8
Re: Internal auditing in a multisite environment

Hi Greg F,

We do at least one on-site audit at each location every year and try to cover as much of the system as we can during the visit (like a surveillance audit).

We also do monthly remote audits via email. So for example, I would ask all locations to email through the last 2 pages of their non-conformance register and then select one or two NCs and ask for those to be sent through and audit the process that way.
 

Big Jim

Super Moderator
#9
Re: Internal auditing in a multisite environment

Planned intervals doesn't mean the same as a time based frequency. In fact, the previous version of ISO9004 actually said that audit scheduling should be flexible. Having a calendar and then keep changing it doesn't make sense...
Agreed. But having a calendar and modifying it as needed does make sense and it would be easier to handle it with a calendar than without.
 
#10
Re: Internal auditing in a multisite environment

Agreed. But having a calendar and modifying it as needed does make sense and it would be easier to handle it with a calendar than without.
Not in my experience... I based my comments on successfully managing a TS 16949 Internal Audit programme - System, Process, Product and LPAs (for Chrysler) and NOT predicting a calendar for the QMS, which worked very well, without making multiple changes as issues were encountered. This practical experience, leading to a successful TS registration (and multiple product launches) was done with the full collaboration and understanding of the plant staff, with a smooth transition to the TS co-ordinator after I moved on to another assignment.
 
Thread starter Similar threads Forum Replies Date
S ISO 9001:2015 Internal Auditing Internal Auditing 8
A What are the pros and cons of using an audit software for internal auditing? General Auditing Discussions 7
S Risk based internal auditing Internal Auditing 6
F AS9100D Internal auditing requirements Internal Auditing 11
R Does any here use an internal auditing tool that works on different platforms? Internal Auditing 3
W Does anyone have an API Q2 checklist for internal auditing? Oil and Gas Industry Standards and Regulations 1
blackholequasar Internal Auditing Inspiration - Getting volunteers to perform internal audits. Internal Auditing 22
W Internal Auditing carried out by a 3rd party - Review of previous audits AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 3
S Internal Auditing for API Spec Q1 - auditor qualification requirements Oil and Gas Industry Standards and Regulations 6
E Informational Internal Audits - Wear multiple hats what can and can't I audit (so I'm not auditing my own work) Internal Auditing 149
N Online Internal Auditing Course for ISO 13485 - Suggestions ISO 13485:2016 - Medical Device Quality Management Systems 8
U Internal auditing - Company employees or contract second party Internal Auditing 10
K Internal Auditing - Umbrella QMS and Multiple Standards Oil and Gas Industry Standards and Regulations 4
D Auditing Our Outsourced 2nd-3rd Party Internal Audit Company ISO 13485:2016 - Medical Device Quality Management Systems 6
G AS9101 Rev F - Worksheets for internal auditing AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 11
S ISO 13485:2016 and MDSAP internal auditing ISO 13485:2016 - Medical Device Quality Management Systems 6
S ISO 9001:2015 - Internal Auditing - Audit to the Standard? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 6
R Internal Auditor auditing Internal Audit Procedure (AS9100) Internal Auditing 18
M Is Automated Internal Auditing Possible? Internal Auditing 13
C Internal Auditing Requirements (ISO 9001:2008) Internal Auditing 3
L Auditing Design and Development in ISO 9001 (Internal Audit) Internal Auditing 1
sswaim Auditing Internal Laboratory Personnel for Competence General Auditing Discussions 4
K Internal Auditing a previous Nonconformance? Internal Auditing 19
P Recommended books on ISO 27001:2013 Implementation and Internal Auditing IEC 27001 - Information Security Management Systems (ISMS) 4
M Are auditing checklists required for Internal Audits? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 13
B ISO/TS16949 Internal Auditing - How many auditors? Internal Auditing 4
B PFMEA, Internal Auditing, Corrective Action Training In Native Language (China) Training - Internal, External, Online and Distance Learning 1
Gman2 Internal Auditing Requirements before ISO 9001 Registration ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 3
S Auditing TS 16949 Cl. 7.6.3.1 - Internal Calibration Laboratory Requirements IATF 16949 - Automotive Quality Systems Standard 8
T ISO 9001 Internal Auditing Auditor Training in Amsterdam Training - Internal, External, Online and Distance Learning 1
S In an internal auditing desert and I'm the only one here.... AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 15
B Internal Auditing of MDD and CMDR Requirements Other Medical Device Related Standards 5
O Internal Auditing in small Engineering company ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 6
T Looking for a webinar on Internal Auditing General Auditing Discussions 3
R On Auditing Internal Audit Process - How Independence can be Established Internal Auditing 4
D Auditing Abroad - Internal Audits of our European Sister Companies ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 16
R Auditing a process outside the realm of the formal Internal Audit ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 9
G New to Internal Auditing - Best questions to ask? Internal Auditing 17
M Auditing the Internal Audit Process - 8.2.2 General Auditing Discussions 2
J Auditing the Internal Auditing Process - Audit Nonconformance General Auditing Discussions 3
S Internal Auditing related to RISK Internal Auditing 9
W Internal Auditing - Observational Checklist for a Behavior Based System Internal Auditing 3
R Internal Auditing Checklist - Major NCR because the Checklist was not Completed Internal Auditing 17
V Depth of Internal Auditing and Training aspects in Research & Development (R & D) Internal Auditing 4
N Good Internal Auditing Training Courses Training - Internal, External, Online and Distance Learning 13
L Internal Auditing Reports / Documents - Design and Content Document Control Systems, Procedures, Forms and Templates 1
N Recommend internal auditing training 101 please (Tucson or Phoenix, AZ) Training - Internal, External, Online and Distance Learning 1
L Internal Auditing - How can I audit my QMS independently? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 12
C Internal Auditing - How to make it useful? Internal Auditing 36
K Sample Questions for Auditing Management Rep , Internal Audit and Reg. Compliance Internal Auditing 7

Similar threads

Top Bottom