Using internal audits as part of document reviews

cgaro62

cgaro62

Starting to get Involved
#1
#1
Hi All,

I am an experienced quality assurance professional that includes implementing ISO 9001:2015, 13485:2016, AS9100D management systems, as well as ISO 19011:2018. I was advised by an ISO consultant that internal audits could not be used to meet the requirement of the periodic review of documents for applicability to whatever process the document covered. I cannot find anything in any of the above mentioned standards that states that internal audits cannot be used for periodic review of documents. Does anyone know where this is mentioned, which standard?

If I am assigned to conduct a process audit, part of that audit is to review the current process against the controlled process procedure/documents to determine if the process is compliant to the procedure. Why couldn't I use this review to also meet the requirement to review the document for applicability?

Regards,
Cgaro
 
Download Free White Paper
Elsmar Forum Sponsor
Ninja

Ninja

Looking for Reality
Trusted Information Resource
#2
#2
FWIW, I think you'll get more value out of your IAs if you focus on "are you following the docs?" rather than "are the docs right?"

Based solely on the desire to get as much value as possible out of an IA (see the rest of my posts here)...I suggest that they NOT be combined.

That said, a finding in an IA because the docs are outdated should result (through CA) in updating the docs...but that is an effect, not a cause.
 
C

Cari Spears

Super Moderator
Leader
Super Moderator
#3
#3
I'm not familiar with 13485, but there isn't a requirement for "periodic review" in ISO9001 or AS9100.

We set up our own internal requirement to review the Quality Policy Manual, our Quality Policy, our Interested Parties and Issues List, and our Order Management Procedure annually. Otherwise, we review documents during internal audits, as you described, and if a process changes at any time, any related documents are reviewed and updated.
 
M

Mike S.

Happy to be Alive
Trusted Information Resource
#4
#4
Some auditors think ISO9001/AS9100 7.5.2 and/or 7.5.3 requires periodic review of documents. I don't happen to agree, but if someone had that as a requirement, and the auditee told me they reviewed their documents in advance of the internal audit, I would accept that. If as an auditor I saw that the documets did not truly reflect the practice, that would be a NC.
 
John C. Abnet

John C. Abnet

Teacher, sensei, kennari
Leader
Super Moderator
#5
#5
Good day @cgaro62 ;
As mentioned by @Cari Spears , there is no such requirement for a "periodic review". I have seen this erroneous "requirement" burden other organizations. I even had one client who had annual "due dates" established in a data base and they were holding themselves accountable (their own internal documented requirements), to annually review EVERY document in their QMS as part of some misguided belief that it was a requirement.

I have found that this misguided belief usually comes from 7.5.2 c) of ISO 9001, which requires "review and approval for suitability and adequacy". You will notice two important things, however...

1- There is no stipulated frequency or periodic requirement. In fact....
2- This requirement is within the scope of "Creating and Updating" . In other words, when an organization decides to create a controlled document (i.e. critical to quality, ...i.e. if that document is "wrong or gone" it can lead to a nonconformance), then the organization should review to make sure it is suitable and adequate before releasing that document (or updating it).

Here are the requirements from ISO 9001:
ISO 9001:2015
7.5.2 Creating and updating
c) review and approval for suitability and adequacy.

In regards to ISO 13485, the requirement is specific to ...
1- Prior to use (again, as with 9001, don't implement a document without the necessary review/approvals to ensure adequacy.)
2- The requirement is for a governing process of "Control of documents" which identifies your organization's governing requirements ("controls needed")...necessary to "review, update as necessary, and re-approve documents".

Here are the requirements from ISO 13485:
ISO 13485:2016
4.2.4 Control of documents
a) review and approve documents for adequacy prior to issue;
b) review, update as necessary and re-approve documents;


In regards to your consultants council. Hmmmm. The only way what you are doing is a problem is if REVIEW is not being done at the creation, revision (update) and approval of controlled documents.

Question your consultant's advice in this situation.

Hope this helps
Be well.
 
Last edited:
John Broomfield

John Broomfield

Leader
Super Moderator
#6
#6
To use internal audits as part of document reviews suggests to me that the document reviews themselves are not being audited.

So, would the document reviews continue to audited?

In my experience it is advisable not to compromise the independence of audit (per its definition) by making audit responsible for any control within your system.
 
Tagin

Tagin

Trusted Information Resource
#8
#8
cgaro62 said:
Why couldn't I use this review to also meet the requirement to review the document for applicability?
Click to expand...
19011:2018 4e)
...Auditors should be independent of the activity being audited wherever practicable, and should in all cases act in a manner that is free from bias and conflict of interest. For internal audits, auditors should be independent from the function being audited if practicable...
Click to expand...

You can't do a process and audit a process at the same time. Maybe if you were a one-person company you could argue it...but, realistically, no.
 
lanley liao

lanley liao

Lingli Liao
#9
#9
In fact, the word John said is very right. the question about this "review and approval for suitability and adequacy" has been interpreted as "periodic review" by a lot of persons in these management systems.
 
cgaro62

cgaro62

Starting to get Involved
#10
#10
Ninja said:
FWIW, I think you'll get more value out of your IAs if you focus on "are you following the docs?" rather than "are the docs right?"

Based solely on the desire to get as much value as possible out of an IA (see the rest of my posts here)...I suggest that they NOT be combined.

That said, a finding in an IA because the docs are outdated should result (through CA) in updating the docs...but that is an effect, not a cause.
Click to expand...
************
Hi Ninja - I agree and our IA Program is focused on the value of the audit; our Doc Control procedure allows for 'periodic review' by the creator or SME, sometimes both and we "also use IAs" as a second set of eyes, so to speak. Does that make sense?
 
You must log in or register to reply here.
Thread starter Similar threads Forum Replies Date
D Using consultants for Internal Audits Internal Auditing 24
ScottK Using Customer Audits as part of the Internal Audit Plan for ISO9001 ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 12
A Guidance on using Turtle Diagrams for Internal Audits (main & sub processes) Process Maps, Process Mapping and Turtle Diagrams 11
C Using Outlook to Schedule Internal Audits Internal Auditing 11
A Internal Audits - Can we to perform audit just using process maps? Process Maps, Process Mapping and Turtle Diagrams 19
B Our QS9000 audit team has been using checklists to perform internal audits Internal Auditing 37
A What are the pros and cons of using an audit software for internal auditing? General Auditing Discussions 7
B Using Unreleased Documents & Process Maps for Internal Audit purposes ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 12
B Using external FDA and ISO 13485 audit as internal audit Internal Auditing 6
S Internal Audit Man-days requirements using IAF MD9 General Auditing Discussions 2
V Internal Audit using Plan, Do, Check, Act - Way to go? Internal Auditing 11
P Company Conducted Internal Audit Offsite using a Document Review Process Internal Auditing 65
H "Internal Calibration" using other Calibrated Equipment Calibration Frequency (Interval) 13
T Internal Audit Plan using Oracle GRC (Governance Risk and Compliance) modules Internal Auditing 4
A Swimlane Diagram for Internal Auditing System - Anybody using this? Process Maps, Process Mapping and Turtle Diagrams 13
E Internal Process Audit Sampling using MIL-STD-105-E - 500 operators on 3 shifts Inspection, Prints (Drawings), Testing, Sampling and Related Topics 4
M Internal Audit Checklists - Using the standard itself replace any checklist Internal Auditing 8
M Any alternative method instead of using GR&R Gage R&R (GR&R) and MSA (Measurement Systems Analysis) 26
R Using RPN to Confirm Risk Reduced to an Acceptable Level Risk Management Principles and Generic Guidelines 12
P Comparing Two Test Variables Using Attribute Data Inspection, Prints (Drawings), Testing, Sampling and Related Topics 0
J Using real time shelf life study as accelerated ISO 13485:2016 - Medical Device Quality Management Systems 1
C Clinical Trial using Prototype devices (EU MDR & ISO 14155) EU Medical Device Regulations 4
J Using an online software to maintain your QMS Quality Assurance and Compliance Software Tools and Solutions 7
S Process Monitoring using SPC software Quality Assurance and Compliance Software Tools and Solutions 6
R Using Scrapped NC items for training Medical Device and FDA Regulations and Standards News 15
M What is the Risk of Using Obsolete Versions of C=0 & ANSI/ ASQ Z1.4 Sampling Plans? ISO 13485:2016 - Medical Device Quality Management Systems 8
F Using non-randomized clinical study for change in existing 510(k) device? US Food and Drug Administration (FDA) 1
J Using MD on a flight EU Medical Device Regulations 9
K Using Google Drive/Docs ISO 13485:2016 - Medical Device Quality Management Systems 32
J What risk to cover when NOT using ISO 17025 accredited/certified labs for calibration ISO 17025 related Discussions 3
T Poisson regression using Minitab Statistical Analysis Tools, Techniques and SPC 3
T Using NICE for guidance during CER CE Marking (Conformité Européene) / CB Scheme 0
T Using Review articles from Pubmed for CER CE Marking (Conformité Européene) / CB Scheme 8
Tagin Using a meme generator to poke fun at quality Funny Stuff - Jokes and Humour 2
D Finding Optimum Design Parameters using Taguchi method? Using Minitab Software 2
V MSA - Using a R&R study for a Tape Measure Gage R&R (GR&R) and MSA (Measurement Systems Analysis) 19
D Using electronic lab notebooks in the design control process ISO 13485:2016 - Medical Device Quality Management Systems 3
M Using a Non Certified vendor Supplier Quality Assurance and other Supplier Issues 8
H Using/Selling power banks with your product as a "mobile version" CE Marking (Conformité Européene) / CB Scheme 3
R Select the 1 Supplier based on the Parts Durability from 6 Supplier Samples using Minitab Using Minitab Software 11
M MSA angle issue - Nylon parts using Aberlink 3D Gage R&R (GR&R) and MSA (Measurement Systems Analysis) 0
D Question on using audit checklist ISO 13485:2016 ISO 13485:2016 - Medical Device Quality Management Systems 20
J Using of CE marking - Two CE markings on the product CE Marking (Conformité Européene) / CB Scheme 5
R Using R package to implement Bayesian phase I/II dose-finding design for three outcomes ISO 13485:2016 - Medical Device Quality Management Systems 6
S Defibrillator Protection applicability When using Multiple applied parts IEC 60601 - Medical Electrical Equipment Safety Standards Series 0
P Using Zinc Plated Steel in a Cleanroom Other Medical Device Related Standards 3
J Incoming Inspection Records using Excel File ISO 13485:2016 - Medical Device Quality Management Systems 2
J Using ring gauges General Measurement Device and Calibration Topics 2
M Load Cell Calibration using a totalizer on a flow meter General Measurement Device and Calibration Topics 0
P Can Neoprene be Cleaned Using Isopropyl Alcohol (IPA) Manufacturing and Related Processes 4

Similar threads

Top Bottom