Ofcourse i want both. Implementing a sustainable system and passing the audit at the same. But am a realist.
Let me use a very well known marketing campaign to make a point.
- Attending a lead auditor course - $2,000
- Hiring a consultant - $30,000
- Getting certified - $ 8,000
- Having good management - PRICELESS
The common denominator amongst QMS, EMS, OHSMS, ISMS, etc... is the letter M, which stands for Management. The kind of management that requires senior, top management to be INVOLVED, participating and ACCOUNTABLE.
The top failure mode for all management system implementation efforts is the lack of TRUE management buy-in, who see certification to any standard as an awards game, and once a decision is made to go after the "cert du jour", they delegate all responsibilities to underlings, who will do their best and, in most cases, make the certification happen. But, immediately thereafter and over time, the management system proves unsustainable because it is not linked nor connected with the business processes.
Why don't you use the fact that the auditor found a major gap in your system during the stage 1 audit to really get what you need?
A letter of delegation might make the external auditor "happy", but will it give you AUTHORITY? The intent of having the MR as part of top management is VERY CLEAR. As long as one searches loopholes to pass the audit, one fails to truly implement a system.