Interpreting AS9100 Clause 8.2.2 Internal Audit Requirements

A

Auditgirl522

Thanks, I understand it would be in AS9100 but I had an auditor come in wanting to see that we hit on the clauses of the standard so I was putting together a matrix to show that all of the clauses were audited too.
 

AndyN

Moved On
Thanks, I understand it would be in AS9100 but I had an auditor come in wanting to see that we hit on the clauses of the standard so I was putting together a matrix to show that all of the clauses were audited too.

Ah, but your auditor is layering in extra requirements! It's simple, if you can show "process A" = clause x.x, type of thing, it shouldn't be too difficult. Of course, when you plan the individual audits, you must be prepared to audit many more things than just "process A". Beware that the auditor MAY be asking you for something, but phrasing it wrongly. But then again, they may also be adding in a myth, like "all clauses each year" etc.
 

John Broomfield

Leader
Super Moderator
Thanks, I understand it would be in AS9100 but I had an auditor come in wanting to see that we hit on the clauses of the standard so I was putting together a matrix to show that all of the clauses were audited too.

Auditgirl,

Instead of doing this for each process as part of your audit record why not show the relationship between the documented parts of your management system and the clauses in the standard?

You could do this with a spreadsheet and use it to manage the ongoing integrity and conformity of your management system (as part of change management) instead of waiting for an audit to report on its conformity or not as it is documented.

Such a conformity matrix can impart confidence of system conformity so everyone can focus on improving the effectiveness of the system and its processes.

Naturally, when auditing processes for effectiveness you'll continue to apply whatever audit criteria as is appropriate and necessary to fulfill the audit objective. Your application of audit criteria is led by the process you are auditing or by the evidence you are evaluating, not by the standard.

John
 
Last edited:
K

Kathie Rae

I know your post was from a while ago but was hoping for some help? I just received a NC from the CB for auditing my own work. I can't give them a root cause that I had to audit my own work because management would not give me the resources to train or hire an additional audit so what do I say? What words do I use to let them know that it was a management decision that I had no control over?
 

Kronos147

Trusted Information Resource
I know your post was from a while ago but was hoping for some help? I just received a NC from the CB for auditing my own work. I can't give them a root cause that I had to audit my own work because management would not give me the resources to train or hire an additional audit so what do I say? What words do I use to let them know that it was a management decision that I had no control over?

If there is a hole in your system you identified, did you write an NCR?

:notme:

One thing we forget here on this forum is that many of us are in the same boat. Make a friend on the forum, and ask them if they will review your internal audit program records, and you will do the same for them. That is a solution that requires no funds.
 
K

Kathie Rae

No there is no hole in the system, Previous CB accepted it as long as it was signed by upper management. This last one did not. Now the company has to give me someone to train as part of corrective action. The only thing I can't figure out is how do I put into words that is acceptable for Root Cause?
 

Kronos147

Trusted Information Resource
[FONT=&quot]If the NC from the auditor said this:
[/FONT]
[FONT=&quot]
[/FONT]
[FONT=&quot]Requirement:
[/FONT]
[FONT=&quot]8.2.2 Internal Audit...[/FONT] [FONT=&quot]The selection of auditors and conduct of audits shall ensure objectivity and impartiality of the audit process. Auditors shall not audit their own work.[/FONT]
[FONT=&quot]
[/FONT]
[FONT=&quot]Nonconformance - there is no objective evidence that the Internal Audit process has been audited.[/FONT]
[FONT=&quot]
[/FONT]
Am I on the right track?

What does your Corrective Action process say how you will assess the root cause? Do you do a 5 why? Fishbone? Brainstorming?
 

Big Jim

Admin
No there is no hole in the system, Previous CB accepted it as long as it was signed by upper management. This last one did not. Now the company has to give me someone to train as part of corrective action. The only thing I can't figure out is how do I put into words that is acceptable for Root Cause?

It is always difficult to respond to a nonconformance that you don't fully understand or buy into.

You are in an awkward spot because the true root cause here is management commitment, and you probably will have a hard time selling that to your top management.

It sounds like you may have already done so and they are allowing you to train an additional auditor.

Another way to phrase it instead of lack of management commitment would be a lack of understanding of the requirements of the internal audit. A lack of understanding or a lack of knowledge is an appropriate systemic root cause.

An appropriate corrective action to this would be to educate top management. For objective evidence provide a training record on that topic to show that top management now understands the requirement.
 
M

Mike_H

It is always difficult to respond to a nonconformance that you don't fully understand or buy into.

...A lack of understanding or a lack of knowledge is an appropriate systemic root cause.

I certainly agree with Jim here. Kathie, you might look at casting your blanket over a larger audience and look at the effectiveness of training plans for QMS requirement flow-down, not limiting your C/A to management as such. Ask if they were actually "trained" in the first place, which is always an interesting conversation.

It's a hard nut to crack but management is just one piece of the jigsaw (that piece you sometimes lose :notme:).
 
Last edited by a moderator:
Top Bottom