Should a Registrar write a NC on something that was found during the Internal Audit

Should the Registrar write a NC for something identified during an Internal Audit?

  • Yes

    Votes: 6 24.0%
  • No

    Votes: 19 76.0%

  • Total voters
    25

BradM

Staff member
Admin
#51
Re: Should the Registrar write a NC on something that was found during the Internal A

I would not hesitate to talk and explain to an Auditor, especially when they are writing Subjective or invalid findings.

The reason that I have chosen to approach the invalid (in my opinion and will have the AS9100 to support my appeals) NC's will be handled through the Appeals process is because there are times when, first I must protect the Organization, and second, this "challenge" would have been non-productive at the closing meeting. I have chosen the "battleground" with the Appeals process.

The day of the closing meeting I went into the President's Office and suggested that we not challenge the findings during the closing meeting, and I would handle it through the Appeals process and that arguing would be non-productive, and he took that suggestion.

One thing that I have learned throughout almost 25 years in this field, and have dealt with many 2nd and 3rd Party Audits...there is a time that sometimes challenging, even though you fell passionate about a certain thing, it is better not to fight on that Battleground at that time and use the system to determine the results. Sometimes, those arguments get you no where, so you use the tools available to you. In this case the Appeals process. I am also very good on reading a personality of an Auditor, which sometimes, not always, I will call the Auditor on the carpet.

I will however, let everyone know, there is nothing wrong with challenging an Auditor if you feel passionate about something, but chose your grounds, carefully.

I did challenge one finding before if was on the Official Report, and won that battle. That was the right time to challenge.
Great post here, Coury, and follows my thought process on this thread.:agree1:

The Cove seems to be growing at a strong pace each day that passes. For those that may not have ever notice, Marc deals with posts every day (sometimes every hour) about all kinds of stuff about whether someone is selling something, asking a legitimate question, etc. Bottom line: many times it takes a while until you find out.

It is very exciting to be here at this place. When a question is posed, sometimes you don't know what is going on, until you are able to fish for enough information to put the puzzle together. Everyday it seems a question comes along about "I was being audited and they cited xxxxx". As a helpful/experienced audience, most every time the posters go to extract more information before even starting down a path. It could be a good auditor/bad process, bad auditor/OK process, or a combination in between.

Sadly, there are bad auditors out there, and auditees have to deal with them. While you need to cherish and respect the good, you still have to deal with the bad.

In this case, I think the fruits of this scenario should have shown itself. I guess Coury or any other poster for that matter, could be pathologically delusional and make up findings, CAR'S, signatures, and everything else. Sadly I know it goes on. My guts tells me he (and his associates) probably run a pretty good ship; hence the reason he is upset with a bunch of bogus (useless) audit findings.

IMHO, if you are interested in good processes and the organization has already identified opportunities, help them find other opportunities for improvement. If the organization cares about the process, it will show its fruit after a year or so by addressing the previous findings and assuring enacting change to prevent re-occurrence.

Coury, I would take them to task on it. If they have altruistic motive for citing the findings again from the previous audit, I believe they should make those known. Otherwise, they are wasting everyone's time. That's my :2cents:, which isn't worth that much:lol:!
 
Elsmar Forum Sponsor

Jen Kirley

Quality and Auditing Expert
Staff member
Admin
#52
Re: Should the Registrar write a NC on something that was found during the Internal A

I want to make sure I find out how the appeals process turns out. I want to know if the auditor was acting on his own, on the registrar's policy, or accreditation body directives, what.
 

GStough

Staff member
Super Moderator
#53
Re: Should the Registrar write a NC on something that was found during the Internal A

I want to make sure I find out how the appeals process turns out. I want to know if the auditor was acting on his own, on the registrar's policy, or accreditation body directives, what.
Good idea, Jennifer. I would also be interested in how things turn out with the appeals process, Coury.
 

Coury Ferguson

Moderator here to help
Staff member
Super Moderator
#54
Re: Should the Registrar write a NC on something that was found during the Internal A

I want to make sure I find out how the appeals process turns out. I want to know if the auditor was acting on his own, on the registrar's policy, or accreditation body directives, what.
Once the Appeals process begins (I am still waiting for the Registrar's Appeals process procedure) and I have the results, I will let everyone know what the results were.

Kinda :topic: I have talked to a good friend and Business Associate that is the President of a Registrar (not the one we used), and I was told that during the last IAQG meeting the week of July 14 (I believe) there was a meeting, that was held and the topic came up about the Soft-grading of NC's the statement was made...something like this ( I wasn't there so I can't confirm or deny this): If an Auditor is found to soft-grade or not document NC's that they could be suspended for two (2) years. Now, mind you, this was only a statement as I understand, and there is no ruling, or guidance on this discussion.
 
Last edited:

Coury Ferguson

Moderator here to help
Staff member
Super Moderator
#55
Re: Should the Registrar write a NC on something that was found during the Internal A

Brad, I already made my position clear on the two non-conformities Coury volunteered the information about. Concerning "assumptions": one of auditors top commandments is "Thou shall not assume".
Yes I did. If I would post some of the other subjective/invalid findings you would be amazed.

Just because people have good intentions, that does not make for effective processes. For example, one could "assume" that somebody as well informed and experienced as Coury is, about CB's and auditors, would not have to face a lead auditor, who, according to him, wrote up a bunch of bogus NC's which will be contested. One could have assumed that, Coury knowing as much as he knows, would have found ways to protect his organization against this type of poor auditing, but something happened along the way.
As I said, in post #50, there is a time and place when there are challenges. That is why there is the Appeals process that is required by every CB to have in place; and yes I am protecting the Organization. That is why there are tools to be utilized.

You are also, not aware of some of the other trivial/invalid findings, during this assessment. But, I will not post more of these, maybe 2 more that will show the direction from which I have decided to Appeal.

I respect your opinions here Sidney .
 

Paul Simpson

Trusted Information Resource
#56
Re: Should the Registrar write a NC on something that was found during the Internal A

I voted no but, as usual, it depends. :D
It could. As I already pointed out, as an external auditor, I take a lot into consideration. And I would warn people against setting policies cast in stone. For people whom don't have a lot of auditing experience, you would be surprised to learn some of the games auditors have to endure.
Sidney is right - it is a judgement call. Like him I leave audits to the end of the audit (learned from my first Quality Manager who "refused" to release the results of the internal audits as he didn't want to bias the customer's sample :lol: (before the days of third party certification). But more of the game playing later ....

For example, on this specific topic, I remember a case a certified organization I used to audit and they would "falsify" internal audit NC's based on my daily debriefings. I normally schedule my audit of the internal audit process as one of the last ones, so I don't get "biased" by their internal audits. So, this company would listen to my daily, end of the day debriefings, and "create" CAR's to mimic my findings, on the hope that I would decide not to report them. It did not take much for me to figure what they were doing.
I hope you raised a Major Non compliance, Sidney and that they are now no longer registered by your organization. If an organization is prepared to fabricate evidence they have no place as a registered firm. :mad:

Not everybody is serious, not everyone has an effective and robust internal audit and corrective action processes.
Now here is my version of the judgement call.
  • If I have found similar issues on my (external) audit of processes and then when I look at the (internal) audits find that the company has raised the same thing then I investigate the corrective action process to see that correction and corrective action are underway
  • If the audit was a while back and I have found further (recent) examples then the containment / corrective action is not effective - NC
  • If the CAR was closed out then I raise another NC as the corrective action was ineffective
  • If (as in this case) the issue relates to the corrective action system itself I have to make a call as to whether the organization has made any progress in dealing with the issue because if the CAR system is ineffective then it needs recording as a NC (as it is vital to their system)

To have an inflexible policy on what should a CB auditor do, in case s/he finds something already uncovered during an internal audit is unwise, in my opinion.
Agreed - my start position is to give the benefit of the doubt (and not raise an NC) but - depending on the severity - might record an NC if I have found evidence the system is not working.

I would never raise an NC if I had not independently found the same problem looking at the same evidence.
 

Coury Ferguson

Moderator here to help
Staff member
Super Moderator
#57
Re: Should the Registrar write a NC on something that was found during the Internal A

Here are two more of the findings. These will be the last ones that I will post.

Stage 2 Final Report said:
Clause: 4.2.2 Quality Manual

Requirement: The quality manual shall include the scope of the documented quality management system.

Issue Raised: The defined scope does not include AS9100
Now please show me where this is required in AS9100? There is nothing that I see in the standard that requires a reference to AS9100.

Stage 2 Final Report said:
Clause: 4.2.2 Quality Manual

Requirement: The quality manual shall include the identification of any exclusions and justification for those exclusions.

Issue Raised: The organization does not perform servicing as described in 7.5.1.5, but has not excluded the requirement in the quality manual.
Where does it say that I have to exclude something?


As you can see, this is why the findings are subjective/invalid, in my opinion; and the Appeals process will support this.

Any other comments?
 

Sidney Vianna

Post Responsibly
Staff member
Admin
#58
Re: Should the Registrar write a NC on something that was found during the Internal A

:topic:
If an organization is prepared to fabricate evidence they have no place as a registered firm. :mad:
:agree1: I agree, mate. If this "policy" would be evenly applied with a firm hand, we could drop between 20 to 30% of the certified organizations around the World, with a strong concentration in some of the "emerging economies".
 

SteelMaiden

Super Moderator
Super Moderator
#59
Re: Should the Registrar write a NC on something that was found during the Internal A

I'm in the midst of an audit this week, myself. So, I'm kinda paying attention, but not necessarily in the midst of discussions. I found this question very interesting, and thinking from my experience, I've never had a registrar issue a NC on something we had already identified and documented as a CA or PA.

Now, on the EMS side, they did have a registrar's auditor that wrote up a similar finding, but it was of a little broader scope, took in a little more territory.

That being said, since I am being audited, I asked my auditor what she thought. Now, unfortunately, (or maybe fortunately) she is not an AS auditor. First thought "no, I would not reissue an identical finding unless I thought you weren't taking care of the original finding, and then my finding would be about your CAPA system", and then her second question was "is it a requirement to have all findings closed prior to the stage two audit?" She said that she had heard of that requirment being made for AS audits, but hadn't checked the validity.
 
A

Agamemnon

#60
Re: Should the Registrar write a NC on something that was found during the Internal A

Coury,

My initial response would be 'no' to the question, based on years of implementing and being audited to ISO, QS, AS, TS, NADCAP and even some of the oldies such as Ford Q1. To further qualify; the auditor's response depends on his/her level of experience and your ability to defend your position...unfortunate but true. Those of us who are career quality management often are looking for the simple YES/NO response, whereas this specific issue comes preloaded with multiple dynamics.

An external auditor will generally make their findings independent of the internal audit process. If it is later discovered and brought to the attention of the external auditor that a similar finding exists within the internal audit process, then they typically will not write an identical finding. Once again, this depends on the experience of the auditor, the severity of the finding and if evidence suggests that lapses exist in the corrective action process.

Failure to address root cause during the corrective action process is a very serious issue and in fact, demonstrates that corrective action is ineffective. I suspect that other indicators exist to support the auditor's findings as the CA process is not limited to customer complaints or internal audits. Normally, any metric not meeting goal requires some form of corrective action (C&PA, Management Review Inputs & Outputs, Operating Metrics, etc...), consequently there is a target rich environment available to an auditor to determine if root cause is being addressed throughout the organization.

If you can demonstrate to the auditor that this failure is actively and aggressively being addressed, then they would likely view it differently. Evidence may include an immediate increase in audit frequency (a requirement based on severity of issue), output or an action plan demonstrating management committment, immediate inprocess and ongoing root cause training, the use of external resources, etc... If however, there is no evidence of action in progress, then I would tend to vote 'Yes' in support of the auditor and wipe the sweat from my brow knowing how close to a major non-conformance I was...

Ultimately "Should this be allowed?"

As much as it pains me, I think it must be.
 
Thread starter Similar threads Forum Replies Date
Robert Stanley Which Registrar Should I Choose for ISO 9001:2015 registration? Registrars and Notified Bodies 10
M Should Potential Customer Complaint Outcome Define Registrar NC Rating? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 8
P Registrar Auditor's Candid Remarks - Should I report him to his office? Quality Manager and Management Related Issues 9
I Should We Notify Our Registrar - Has Our Scope Changed? IATF 16949 - Automotive Quality Systems Standard 5
Sidney Vianna Should customers influence a supplier's registrar selection? Registrars and Notified Bodies 88
M My site is closing When should I inform my Registrar ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 3
T Should I contact registrar about major downsize ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 5
Crusader Process Approach beef - Registrar says that we 'should' use the process approach General Auditing Discussions 20
Adriane Am I overthinking this or... Should my Registrar be ISO9001 certified Registrars and Notified Bodies 46
A Choosing a Registrar - What Should We Look For in a Registrar? Registrars and Notified Bodies 81
Sidney Vianna Interesting Discussion Should ISO 9004 be changed from a guidance standard to a requirements standard? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 5
A Should I take an online course for a career in Occupational Health and Safety? Career and Occupation Discussions 2
J Should a Class 1 medical device with an option to measure body weight be considered Class 1m? EU Medical Device Regulations 0
K Should APQP/PPAP has its own section in a QM? Quality Management System (QMS) Manuals 1
S What should i choose for "testing procedure" characteristics? (N95) General Information Resources 0
P Should eIFU link per ISO 15223-1:2016 be added to labels out of scope of Reg 207/2012? EU Medical Device Regulations 1
S Which Sampling Plan(s) Should I Use? Inspection, Prints (Drawings), Testing, Sampling and Related Topics 7
A Document release vs its related training. Which should come first? ISO 13485:2016 - Medical Device Quality Management Systems 18
S Which department should prepare the control plan? could you show me a standard regarding to this matter. FMEA and Control Plans 17
J Help settle a disagreement: Should external providers of preventive maintenance be on your ASL? AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 5
N Master Samples - What should we be keeping? IATF 16949 - Automotive Quality Systems Standard 9
G Supplier delivered recent PPAP, should he deliver yearly layout inspection? IATF 16949 - Automotive Quality Systems Standard 4
John Broomfield Vote - Should ISO9004 Become a Requirements Standard? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 11
A Capability Study - in the beginning of your career what should you have known about the tool Quality Tools, Improvement and Analysis 11
J Should Loading and Unloading be Included in Cycle Times? Lean in Manufacturing and Service Industries 14
E Manufacturers should develop a testing device for covid19 Service Industry Specific Topics 0
T 510(k) submission - Which name should I use in the submission? Other US Medical Device Regulations 3
N ISO 19011:2018 - 5.4.2 "...audit program should engage in appropriate continual development..." Training - Internal, External, Online and Distance Learning 4
G Should I perform Gage R&R only at the beginning of a new project? Gage R&R (GR&R) and MSA (Measurement Systems Analysis) 6
DuncanGibbons Should the requirements FAA/EASA Part 21 be addressed within the QMS and AS9100D quality manual? AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 5
M Should 510(k) Predicates be Actively Listed Devices? Other US Medical Device Regulations 12
B Why the Greek god Hephaestus should have done a design FMEA (DFMEA) on his giant robot APQP and PPAP 1
J On PFMEA for danger labels - Label always should be assigned severity 10 ? FMEA and Control Plans 3
H Who should be listed as the manufacturer/distributor on the box? 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 15
M MDR, RED and LVD - Should our device comply with them? EU Medical Device Regulations 3
BeaBea How Many Processes should be created for each Department? Process Maps, Process Mapping and Turtle Diagrams 5
M Should volume of sales be factored into risk probability assessments? ISO 14971 - Medical Device Risk Management 33
MrTetris Should potential bugs be considered in software risk analysis? ISO 14971 - Medical Device Risk Management 5
S Should safety checks be included in the Control Plan? IATF 16949 - Automotive Quality Systems Standard 5
M Which incubation condition should be selected to recover both bacteria and fungus effectively Miscellaneous Environmental Standards and EMS Related Discussions 3
D Is there a specific location for PPE such as safety glass holders and glove dispensers should be mounted Occupational Health & Safety Management Standards 10
M Who should receive the bills from suppliers and vendors, account payable or procurement? Consultants and Consulting 4
V IATF 16949 8.4.1 Control of externally provided processes, products and services - Should the CB be on our Approved Supplier List? IATF 16949 - Automotive Quality Systems Standard 10
A We are ISO 13485:2016 should we be audited to ISO 14971 ISO 13485:2016 - Medical Device Quality Management Systems 16
E Received a Major finding during IATF Surveillance audit for loss of BIQS Level 3 (more than 6 SPPS in 6 months)...how should we address SYSTEMIC CA? IATF 16949 - Automotive Quality Systems Standard 11
J Organization merger. Should we keep two separate ISO 13485 certificates? ISO 13485:2016 - Medical Device Quality Management Systems 6
S Companies that maintain your machine should be in ASL? AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 2
S Use of "Shall" versus "Should" in Procedures ISO 13485:2016 - Medical Device Quality Management Systems 26
D Class II medical device - When should a complaint be closed? Customer Complaints 6
Sidney Vianna IATF 16949 News Presentations from the latest IATF Stakeholder Event - Expectation that IATF 16949 certification should equate with product quality. Misguided? IATF 16949 - Automotive Quality Systems Standard 7

Similar threads

Top Bottom