Stage 2 audit - Requirement for 3 months of records

[luismx]

I have heard that an ISO9001 auditor have to request at least 3 months of records during a stage 2 audit.
Is that a requirement? or just a good practice? or "was" a requirement?
If a requirement, where can I find it?

 

[John Broomfield]

You may find it in the contract with the registrar.

 

[Marc]

It's usually about 3 months. The idea is that it's one thing to have a system in place, it's quite another to have evidence that the system is working. I don't remember if/where it is written, though. Like John says, discuss this with your registrar.

 

[Randy]

1st - the requirement stems from this within the 9001:2015 Standard.......... "4.4.1 The organization shall establish, implement, maintain and continually improve a quality management system, including the processes needed and their interactions, in accordance with the requirements of this International Standard." You can't prove that you've "maintained" unless there is evidence present to verify it against and 90 days has been the norm almost forever, it's been disputed and I don't think ever won.

2nd - The requirement will be in the conditions of contract for the initial certification process with the CB as previously stated and anyone that doesn't agree doesn't have to enter into the contract relationship.

3rd - how does one prove effective management/control of documented information (records) without having documented information (records) to control (it's a time based process)

 

[Sidney Vianna]

I have heard that an ISO9001 auditor have to request at least 3 months of records during a stage 2 audit.
Is that a requirement? or just a good practice? or "was" a requirement?
If a requirement, where can I find it?

Nope, it is not a requirement. At least, not in ISO 17021-1 which would be the primary document defining such expectation. Just another one of those tribal pieces of "wisdom" that permeates the management system certification sector. During the stage 1 audit, one of the PRIMARY objectives is to ascertain the likely readiness of the organization/system to undergo a stage 2 audit with verifiable evidence to be presented to the audit team. You see, auditors are expected to reach audit conclusions based on audit evidence.

Further, you have to realize that records documented information comes in all sizes and shapes, frequency and formats. Some records can be collected hundreds of time a day. Others might take many years to be completed. Instead of getting concerned with these "artificial, unwritten rules", discuss the issue with the auditor at the Stage 1 audit.

 

[luismx]

Thanks everyone for your valuable input.