Need to do Internal Audit...No Employees Left!

D

Diamondcat

#1
Hello, I am hoping someone here can give me some insight into how I can handle this situation.

We are an automotive engineering company. Last year we were ISO 9001:2008 certified. At that time we had over 50 employees and we had the following groups:
Management
Sales
Recruiting
Auto Group
Defense Group

So the internal audit and the Conformance audit included all of those groups. Well, within the past year we have lost most of our business and therefore we have only 5 people left.
HR
IT
Recruiter
General Manager/Sales
Me (Internal auditor/Auto designer/Defense designer)

So my question is, how do I do an internal audit to the Auto or Defense groups when I am the only person left in those groups? There has been work done in those groups since the conformance audit so I think they have to be audited. Can I audit myself? Or should I "train" the IT guy to audit and have him audit me?

Thanks!
 
Elsmar Forum Sponsor

Randy

Super Moderator
#2
You don't audit people, you audit the system.

Your solution may be the best you can come up with looking at your situation.

Remember, look at the process not the person.
 
#3
And...as long as you don't audit your work, no problem! If you have specific responsibilities in the system that should also be audited, you might look to a local resource to come in and do that - a local ASQ member for example. (if you're located in the USA)
 

somashekar

Staff member
Super Moderator
#4
Hello, I am hoping someone here can give me some insight into how I can handle this situation.

We are an automotive engineering company. Last year we were ISO 9001:2008 certified. At that time we had over 50 employees and we had the following groups:
Management
Sales
Recruiting
Auto Group
Defense Group

So the internal audit and the Conformance audit included all of those groups. Well, within the past year we have lost most of our business and therefore we have only 5 people left.
HR
IT
Recruiter
General Manager/Sales
Me (Internal auditor/Auto designer/Defense designer)

So my question is, how do I do an internal audit to the Auto or Defense groups when I am the only person left in those groups? There has been work done in those groups since the conformance audit so I think they have to be audited. Can I audit myself? Or should I "train" the IT guy to audit and have him audit me?

Thanks!
It is good to have new auditors trained as some trained auditors leave the organization and such new trainees can audit the said functions wherein you are the auditee and this auditing can be part of the learning exercise for the new trained auditor and you as the MR (I presume) assisting him with all transparency and openness. The internal audit is the best mechanism to check, correct and improve your processes and for its best results an unbiased audit is recommended.
 

Jen Kirley

Quality and Auditing Expert
Staff member
Admin
#5
In addition to splitting the audit responsibilities up within the remaining people, which is perfectly allowable if they are appropriately qualified, some companies have succeeded with exchanging audit services among each other; a kind of co-op. If you have an ASQ section or other group where you can meet someone else with a similar problem, both of you could be the answer to the other's prayers:

  • Skills sre in place (you'd need to record your examining and accepting them, and on what basis)
  • It can be way cheaper than training other auditors or hiring out a consultant.
  • The outsider, having no familiarity or ties to your company, may find opportunities missed by insiders.
 
D

Diamondcat

#6
Thanks for the responses!

And...as long as you don't audit your work, no problem!
So if I understand correctly...
I worked in the Defense group where I worked on projects. I used the documented processes to complete those projects.
Then I CAN audit the processes in that group as long as I do not look to any of my projects as evidence of following the process. Correct?
furthermore, as Randy pointed out, I am auditing the Process not the people so technically it shouldn't matter if anyone is left in the group, I should be able to look at the evidence left over to see if the processes were being followed.
Does that sound reasonable?
 
#7
Yes! You've got it. No need to train any more auditors, especially given that your org. appears to be going through some tough times! Find someone locally - as Jennifer says, it could work out very well for you.
 

Randy

Super Moderator
#8
In the end it's unbiased objectivity and impartiality that's important, not independance.

Of course this last statement will probably ignite a firestorm, but here's the dea........Where does the greater assurance of value rest? In the independance of an auditor who is biased and unobjective during the audit or in an auditor that though not independant of the process can exhibit an unbiased, objective and impartial approach?

Of course you didn't mention what type of MS you are auditing and there could be complications and therin lies the problem....While ISO standards like 9001 are for any organization any size, the auditing requirement (8.2.2) comes into conflict with the Standard's Scope (1) and Application (1.2) not taking into consideration the single person company or many other small organizations in their ability to meet the requirements.

Do what works for you while doing your best to meet applicable requirements.
 
D

Diamondcat

#9
Thanks so much for all of your help.

Is my thinking correct on this?
We have four main processes in our system. We were certified last year, which means that our four processes & documentation thoroughly met the standard. So when I do my internal audit, I should just be able to take those four processes, make sure they are being followed, and document evidence of that. If they are being followed then we are meeting the standard, right? So in my internal audit report, do I really have to get into the nitty gritty of the standard. Like, this evidence goes towards 5.6.2 Review Input of the Management Review or 7.4.1 purchasing?
 
#10
Thanks so much for all of your help.

Is my thinking correct on this?
We have four main processes in our system. We were certified last year, which means that our four processes & documentation thoroughly met the standard. So when I do my internal audit, I should just be able to take those four processes, make sure they are being followed, and document evidence of that. If they are being followed then we are meeting the standard, right? So in my internal audit report, do I really have to get into the nitty gritty of the standard. Like, this evidence goes towards 5.6.2 Review Input of the Management Review or 7.4.1 purchasing?
You are partly correct. Auditing isn't just about 'did they follow the process'. Your role is to also confirm that the process is effective! Too many auditors never get to that, so when the find that the process isn't being followed, they omit the 'what results we got' aspect!

You might have 4 main process, but I'm sure you have others - supporting processes - which also must be audited.

It's not necessary to get into the ISO standard in your report IMHO.

I'm a bit worried - for you - that you're asking these type of questions, since the company is already certified. Were you auditing before? Have you had some kind of training? You may have a bit more on your plate if not...
 
Thread starter Similar threads Forum Replies Date
S GM/VP softgrading internal audit finding - need feedback from an audit guru! General Auditing Discussions 11
L Need HELP with Internal Audit Program ISO 13485.2003 Quality Management System (QMS) Manuals 3
D Need to follow-up Internal Audit 'Observations' ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 17
J Setting up a Vendor (Supplier) and Internal Audit System - Need help Internal Auditing 4
E First external audit coming up, do I need to have performed Internal Audits already? Internal Auditing 15
C Internal Audit Findings - Do I need to raise NC for amendments/revisions? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 5
eternal_atlas Internal Audit of Training Need Analysis - Compliance Audit General Auditing Discussions 4
D Is there a need to tie NC found during internal audit to relevant ISO clauses? IATF 16949 - Automotive Quality Systems Standard 13
S Need questions for Internal Audit of Financial departement? Internal Auditing 11
D Designing an ISO 9001 Internal Audit Training Course - Need Help Internal Auditing 6
Howard Atkins What does the internal audit procedure for TS 16949 need to include? Clause 8.2.2 General Auditing Discussions 7
A Need Example of Metrics for Internal Audit Process. Internal Auditing 6
J 8.2.2.4 Internal Audit plans - Need an interpretation Internal Auditing 1
V Internal Audit of China factory of Medical devices - need guidance ISO 13485:2016 - Medical Device Quality Management Systems 5
R Internal audit schedules - Where does it say that I need an annual schedule? Internal Auditing 13
J Supporting Processes - Internal Audits - Need help settling a debate IATF 16949 - Automotive Quality Systems Standard 4
Q Need Outsourced ISO 13485/FDA Internal Auditor for a Medical Device Company Internal Auditing 3
S Need to prepare Internal Customer Satisfaction Survey form for QA department Misc. Quality Assurance and Business Systems Related Topics 5
M TS 16949 Clause 7.6.3.1 - Internal Laboratory - need clarification IATF 16949 - Automotive Quality Systems Standard 3
N Scale with Internal Calibration - Do I need to calibrate? How to document this? Calibration Frequency (Interval) 8
S Do we need to maintain Records of Internal Supplier Evaluation per 7.4.1? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 15
J New to Internal Auditing - Need help and advice Internal Auditing 5
J Need help identifying nonconformities in internal audits Internal Auditing 2
B Do we need an internal auditor training for ISO9001-2008? Internal Auditing 4
M Do Internal Auditors need to be Trained? Internal Auditing 10
D ISO/TS16949 Internal Calibration Lab need to include Production Equipments IATF 16949 - Automotive Quality Systems Standard 26
A Need help with creating useful, interesting and good internal web site about QMS!!! After Work and Weekend Discussion Topics 5
I Looking to be an Internal Auditor - Do I really need to be a Lead Auditor (LA)? Internal Auditing 6
B In house Internal auditor training - Need of a method of training more Auditors Training - Internal, External, Online and Distance Learning 6
D Do we need Job Descriptions for Internal Auditors Internal Auditing 23
V Does an internal calibration laboratory need to be certified on ISO 17025? ISO 17025 related Discussions 3
B Does FDA Registration QSR need to cover non-medical devices for contract repackager? US Food and Drug Administration (FDA) 0
S Need ISO 15189:2012 Documentation toolkit. Document Control Systems, Procedures, Forms and Templates 0
J Need a contract monitoring Tool General Information Resources 0
P UDI-PI requirements on reusable surgical device, do we need serialisation? ISO 13485:2016 - Medical Device Quality Management Systems 0
J Need Help with FPY Data in Assembly Process Manufacturing and Related Processes 7
W 17025 and NIST handbook relationship (need advice) ISO 17025 related Discussions 8
lanley liao Does all of the suppliers need to integrated into the supplier list qualified of the company? Oil and Gas Industry Standards and Regulations 2
K Need procedure for D&D inputs? ISO 13485:2016 - Medical Device Quality Management Systems 4
S Need help on "Country of Origin" Medical Device and FDA Regulations and Standards News 0
Ed Panek Immediate need for 80601-2-56 Consulting expert. PM me for details Career and Occupation Discussions 0
Tagin You're Gonna Need a Bigger Root Cause Coffee Break and Water Cooler Discussions 12
M PSA Suppliers - CSR matrix and need the quality manual of PSA APQP and PPAP 2
M Need Help With Information Security Asset Risk Register IEC 27001 - Information Security Management Systems (ISMS) 2
K "World Class Product" based QM. I need advice. Quality Management System (QMS) Manuals 14
I Do I need to sign off my annual audit calendar? Internal Auditing 2
P Do we need to retrospectively use the "MD" symbol (indicating device is a medical device) on labels, e.g. finished devices within expiration date? EU Medical Device Regulations 2
M Do I need separation in my circuit with a medical charger? IEC 60601 - Medical Electrical Equipment Safety Standards Series 0
V Certified Auditor - Need of additional certification specific to industry ( GMPs) ASQ vs ECA vs others Professional Certifications and Degrees 1
D Low risk IVD study in the UK, do I need MHRA approval? UK Medical Device Regulations 1

Similar threads

Top Bottom