J
JoShmo
You won't WANT that auditor back will you?
Interesting Discussion Potential Issues for Auditing ISO 9001:2015
- Thread starter Colin
- Start date
I have requested a CSI survey from the CB for the client to fill out and evaluate the performance of the auditor. In line with the section 9.1.2 and 10.2.1 of ISO9001:2015.
I wasn't there so I can't fully comment on how things went. That said, some of this isn't necessarily out of line.
1. Auditors need to determine what is in your system, so asking for familiar things is not out of line as exploratory questions. If he insists you need them and they are not required, that is wrong, but simply asking exploratory questions is not. For example, I often ask if they keep an approved supplier list simply because that is one of the ways many companies keep part of their supplier approval records. If they have one, that can help with the audit. If they don't, I just explain what I just did, and move on to explore what is required. Remember that if the organization makes it a requirement it is a requirement if the standard requires it or not.
2. You handled his request for an FMEA well as you also did in holding your ground about quantitative risk analysis. Again, though, if it was an exploratory question that could be fine, but if he is trying to create a requirement where none exists that's another matter. I'm reminded how far off base AS9100C got on this topic when auditors were taught to expect something like "green light", "amber light", and "red light" in their risk analysis.
3. Make no mistake, the new standard is all about top management getting on board. Any perceived lack of management commitment won't be accepted well. What I have heard about this so far certainly reaches beyond the actual wording of the standard, but it is what auditors are being driven to do from the CBs and probably from above them. The actual wording I heard from one CB was that it is no longer acceptable for top management to assign "some poor schmuck" to handle everything about the quality management system and side step it all himself. All this because the standard no longer uses the title 'management representative", substituting "top management" in the wording.
Thank you for your feedback. I hope others will also share their experiences as this new standard goes through its teething pains.
J
JoShmo
Asking for something which ISN'T required by the standard isn't good audit technique. IMHO it shows bias. WHatever happened to asking open question? What about finding out IF the customer decided to document their system and WHAT kinds of documents did they create? In fact, given the way the 2015 requirements flow, the auditor should have gotten here from the context of the organization and to how they decided what issues and interested parties might have influences the need for any documentation and/or knowledge retention etc. Flat out asking for a QM these days just shows me that some auditors haven't "got" the new requirements and how they are supposed to work.
Open ended questions don't always work. As unbelievable as it may sound, many auditees really don't know how their system works but expect the auditor to.
I'm all for open ended questions when they work, but when they don't, auditors need to reach for other tools in their tool box.
Something important to know if you don't already, is that even if a quality manual isn't required, they can still be used. According to Nigel Croft, the chairman of TC176, the committee that wrote ISO 9001, the committee expects that most companies will still have one. If they have one, it makes it easier to understand the organization. If they don't, auditors should be able to deal with it.
Paul Simpson
Trusted Information Resource
Congratulations on getting to the end and for your views on the 2015 edition - very interesting feedback.
A lot depends on how this came about. If it was a neutral question along the lines of 'Do you still use a quality manual ... can I see it?' Then that is ok but, as has been said before, to create an expectation that one will be in place is wrong.
Again you are right to push back. There is no requirement for quantitative risk analysis or a tool like FMEA. What you will need is a way of demonstrating you evaluate risks and prioritize the more important ones.
The problem is not the absence of your top manager but it may be you couldn't demonstrate the process s/he followed in demonstrating leadership. It should have been easy to demonstrate in terms of activities the person had done (witnessed by you or others) and evidence in the form of policies produced, meetings attended and other evidence such as email communications.
I'd be interested in an example of when open questioning isn't effective, or auditees not knowing what they do. If you ask an individual about the work they are directly involved in they should be able to describe what they do and what is important. Perhaps I have missed something?
There is of course a difference in an auditee knowing how they work in the system and knowing all details of the system. The auditor should only expect an individual to know what is in their sphere of influence.
Yes. Across ISO and the 'quality industry' the message is going out: 'It is up to you whether you have a manual, procedures etc.' This message is similar to the one that went out in 2000 when the requirement for documented procedures disappeared (apart from the infamous six).
This one bothers me. Could you have taken a vacation during the audit?
Prior to the audit the auditor asked for a copy of a Quality Manual. During the 2000 version we did not really retire or documents. We only rearranged them.Congratulations on getting to the end and for your views on the 2015 edition - very interesting feedback.
Thank you. There is lessons to be learned in humility.
A lot depends on how this came about. If it was a neutral question along the lines of 'Do you still use a quality manual ... can I see it?' Then that is ok but, as has been said before, to create an expectation that one will be in place is wrong.
Again you are right to push back. There is no requirement for quantitative risk analysis or a tool like FMEA. What you will need is a way of demonstrating you evaluate risks and prioritize the more important ones. We presented a SIPOC with a column on Risk. The SIPOC demonstrated how we do things. After along discussion it was not a nonconformance.
The problem is not the absence of your top manager but it may be you couldn't demonstrate the process s/he followed in demonstrating leadership. It should have been easy to demonstrate in terms of activities the person had done (witnessed by you or others) and evidence in the form of policies produced, meetings attended and other evidence such as email communications.
The Management Review compounded everything. There was a NC on Management Review but it was not acceptable, because according to the auditor this is an upgrade and an NC can still be issued on the same clause that was found in the Internal Audit.
I'd be interested in an example of when open questioning isn't effective, or auditees not knowing what they do. If you ask an individual about the work they are directly involved in they should be able to describe what they do and what is important. Perhaps I have missed something?
There is of course a difference in an auditee knowing how they work in the system and knowing all details of the system. The auditor should only expect an individual to know what is in their sphere of influence.
I agree. Any changes to the process should be proposed in the spirit of collaboration and not intimidation.
Yes. Across ISO and the 'quality industry' the message is going out: 'It is up to you whether you have a manual, procedures etc.' This message is similar to the one that went out in 2000 when the requirement for documented procedures disappeared (apart from the infamous six).
Your feedback is highly appreciated. Similar to the rule of IAOB, the auditor should only be allowed to work with the organization for 1 cycle.
One of the interested parties is the CB. The requirement is to notify the CB when there is a change. Of course Top Management can take vacation during audit days but that the CB must be notified. This is called Management of Change process. The CB can either re-schedule the audit (this is the initial audit) or be aware that there is a back-up representation or either call in during the opening meeting to meet that intent. This is no longer the old standard. Top Management must demonstrate ownership, at least during the initial audit. We manage to get this through with difficulty. Thank you for your feedback.
One of the interested parties is the CB. The requirement is to notify the CB when there is a change. Of course Top Management can take vacation during audit days but that the CB must be notified. This is called Management of Change process. The CB can either re-schedule the audit (this is the initial audit) or be aware that there is a back-up representation or either call in during the opening meeting to meet that intent. This is no longer the old standard. Top Management must demonstrate ownership, at least during the initial audit. We manage to get this through with difficulty. Thank you for your feedback.
I can't tell if this means that you agree or disagree with me.
I do like the fact that the CB needs to be notified. It's just that if management is supposed to be taking responsibility, and not simply handing it off to some schmuck (no offense to myself or you or anyone else here!!!!) then you would think they would want to be there during an audit.
I'm glad you worked your way through it!!
