ISO 9001 Major Nonconformance Internal Audit Schedule/COVID-19

[mcspanky]

So like many of you, our company has been affected by COVID-19 in the form of telework, furloughs, and no contact between employees. In response, we opened a CAR to deal with procedures that we could not comply with during pandemic mitigation. The corrective action plan was to perform work remotely, leverage technology available, and if necessary, agree to amended or reduced scopes of work. Also allow extended deadlines, verbal or email approvals instead of signatures, and agree to limited/no contact between employees. Evidence was a revised limited scope Internal Audit schedule and extended CAR deadlines among other things.

The auditor wrote up a major NC because we did not comply with the original schedule. He also says that I have to complete all of the audits from the original schedule which means we will audit some processes twice in 2021.

Was I completely off base with thinking this corrective action plan would be acceptable? Also, any suggestions for handling this better would be appreciated.

 

[Sidney Vianna]

The auditor wrote up a major NC because we did not comply with the original schedule. He also says that I have to complete all of the audits from the original schedule which means we will audit some processes twice in 2021.

Assuming that you were not attempting to find loopholes and excuses not to perform the internal audits, the ISO 9001:2015 standard does require the audit program to take into account the changes to the organization. As you have already mentioned, COVID-19 has changed your working/business processes and you would be failing to comply with the Standard if you had NOT changed the audit program/schedule.

It seems to me that you have grounds to appeal not only the categorization of the nonconformity, but the NC itself.

 

[Tagin]

Evidence was a revised limited scope Internal Audit schedule and extended CAR deadlines among other things.

What Sidney said. But...does your "revised limited scope" still comply with the requirements of the standard? Or, is the "revised limited scope" result in an incomplete internal audit?

 

[Jim Wynne]

It would be good to see the full text of the auditor's NC statement. I don't see how an NC, let alone a major, can be justified, but it's still good to see the source.

 

[mcspanky]

It does comply with the standard. We did complete audits (about 1/2 of the original schedule) but there was no way we were going to be able to complete the entire original schedule made before COVID.

 

[mcspanky]

It would be good to see the full text of the auditor's NC statement. I don't see how an NC, let alone a major, can be justified, but it's still good to see the source.

Let me explain before you read the full text.

When revising the schedule I did not delete the audits that could not be performed but in the deadline column put Reference CAR xxx to keep transparency for the changes.

Here is the full text.

The organization shall conduct internal audits at planned intervals.
xxxxx has not performed Internal Audit full system according to the schedule of 2020, The total of the activities are 20, the activities that have been audited only 10.

 

[Jim Wynne]

Let me explain before you read the full text.

When revising the schedule I did not delete the audits that could not be performed but in the deadline column put Reference CAR xxx to keep transparency for the changes.

Here is the full text.

The organization shall conduct internal audits at planned intervals.
xxxxx has not performed Internal Audit full system according to the schedule of 2020, The total of the activities are 20, the activities that have been audited only 10.

So the auditor didn't cite the clause/section of the standard that was allegedly violated? This is totally bogus, and I would push back with great force. I would also let the CB know that the auditor won't be allowed in your building in the future.

 

[Mike S.]

Yeah, that doesn't look like the full text of any NC from a registrar auditor that I've ever seen. We do better than that for internal audits.

 

[outdoorsNW]

Appeal the NC. The standard does not specify a minimum number of audits not does it prohibit changes to the audit schedule. You documented the reason for the changes and the reduction in the total number which seems very reasonable under the circumstances, so you are in compliance.

 

[Randy]

Here's a question from me, who has done almost nothing but remote 3rd party audits since 3/2020 so that's close to 40+ internal audits this year alone with all the craziness................ Is the auditor full time or contracted? (An additional visit to do a special audit after correction can mean $$$$ to a contract auditor).

I agree with the others, appeal. If you did as you stated with the CAR's, changes and everything else then it appears to be bogus HS, Pig&*/t, garbage and tripe...............

Everybody and his brother has struggled this year including the CB's themselves with keeping schedules and everything else, I did an audit last week that was originally scheduled in June and the week before 2 audits scheduled for August (in Canada and Remote because of travel, I'm almost the only one with the proper code and Arkansas ain't in Canada).

That audit program and schedule is yours and yours alone to change, modify, plan, deliver and everything else as long as it's effectively managed and controlled.