Internal Audits of the QMS
Discussion
After a little bit of advice regarding internal audits of our QMS, more specifically can our organisations Quality Manager undertake the relevant audits.
The audits would not be on the Quality Manager but on the system itself, which of course the QM has written and developed.
We are extremely busy at the moment so my usual Internal Auditor(s) are tasked with fulfilling the orders that we have, whilst the QM is basically doing very little.
We are a small company and the QM has no direct reportees and basically manages himself only.
Obviously I have asked him if he can do some of them but he insists that he is unable to do so as it would be auditing his own work.
The audits would not be on the Quality Manager but on the system itself, which of course the QM has written and developed.
We are extremely busy at the moment so my usual Internal Auditor(s) are tasked with fulfilling the orders that we have, whilst the QM is basically doing very little.
We are a small company and the QM has no direct reportees and basically manages himself only.
Obviously I have asked him if he can do some of them but he insists that he is unable to do so as it would be auditing his own work.
I wouldn't recommend it and it's certainly not good practice. The purpose of quality audit is to independently assess the capability of the system to ensure it is meeting the requirements of the business. I find it difficult to believe a QA Mgr can be independent it they own and built the system. What industry ? As per other poster, if it is in healthcare, prioritising orders v management controls might quit rightly be frowned upon by the regulators.
However...Does your QMS allow rescheduling via change control of the audit plan ? The bigger picture needs to be looked at. Does the audit need to be done "now" ? Usually, an audit is part of a bigger picture (perhaps an annual plan coupled with other management controls) to prove to yourselves and potentially external parties that you are in control. The audit of the QMS might be done annually, or other period, so moving it within the overall plan might be possible ?
However...Does your QMS allow rescheduling via change control of the audit plan ? The bigger picture needs to be looked at. Does the audit need to be done "now" ? Usually, an audit is part of a bigger picture (perhaps an annual plan coupled with other management controls) to prove to yourselves and potentially external parties that you are in control. The audit of the QMS might be done annually, or other period, so moving it within the overall plan might be possible ?
Edited by Steve Campbell on Tuesday 20th June 17:18
Thanks for the replies, our audit procedure is basically one specific audit per month totalling 12 in all - we are currently two behind.
Our business is in fire prevention so it's not difficult to see why we are suddenly so busy although most of our output goes abroad but then may come back into the UK once it has been assembled into its final product.
I'm trying to find out if my QM argument is valid, and on the surface it does, however he is the only person in our company that does almost nothing to help out in busy periods.
Our business is in fire prevention so it's not difficult to see why we are suddenly so busy although most of our output goes abroad but then may come back into the UK once it has been assembled into its final product.
I'm trying to find out if my QM argument is valid, and on the surface it does, however he is the only person in our company that does almost nothing to help out in busy periods.
What is the objective of the audit?
If the objective is to do "what is required" to maintain certification (not ideal but often the case) then there are plenty of workarounds that maintain compliance without causing you issues. If your objective is to genuinely look at the effectiveness of the business system (note - not QMS) then the timing and conflict of interest is actually less of an issue.
What is the scope of the audit?
If you are auditing to confirm compliance to the procedures then the conflict of interest with the QM goes away. Most internal audits are compliance to procedure. If you are looking at audit for compliance to standard then it, although not best practice, you can audit processes that you wrote. There are plenty of small businesses that have small numbers of staff and only 1 auditor who is often the QM and drafter of procedures. If there is a potential conflict of interest then you can state this on the audit report / check sheet etc.
With regards to timing of audits. ISO9001 says nothing about the specific timing for internal audits. External certification body audit frequencies are based on a number of factors ant none of these are covered by ISO9001 but be the requirements of the external certification body. I know of many ways of doing the internal auditing ranging from annual "audit week" through to "1 per week" type plans. I don't know if the medical devices standards state anything more specific but I would doubt it as ISO are doing more work on alignment of management system requirements.
I do a lot of audit work at external suppliers and have previously been the nominated Quality Representative within a £20+m manufacturing site and a small technical development centre. I have never had a problem with rescheduling internal QMS audits based on business work load and never had an issue with presenting different plans to external bodies. If you are able to do a replan and keep to it then do so add a note stating the reasons for a change to the plan and reissue it.
[ISO9001 - IRCA Certified Lead Auditor]
If the objective is to do "what is required" to maintain certification (not ideal but often the case) then there are plenty of workarounds that maintain compliance without causing you issues. If your objective is to genuinely look at the effectiveness of the business system (note - not QMS) then the timing and conflict of interest is actually less of an issue.
What is the scope of the audit?
If you are auditing to confirm compliance to the procedures then the conflict of interest with the QM goes away. Most internal audits are compliance to procedure. If you are looking at audit for compliance to standard then it, although not best practice, you can audit processes that you wrote. There are plenty of small businesses that have small numbers of staff and only 1 auditor who is often the QM and drafter of procedures. If there is a potential conflict of interest then you can state this on the audit report / check sheet etc.
With regards to timing of audits. ISO9001 says nothing about the specific timing for internal audits. External certification body audit frequencies are based on a number of factors ant none of these are covered by ISO9001 but be the requirements of the external certification body. I know of many ways of doing the internal auditing ranging from annual "audit week" through to "1 per week" type plans. I don't know if the medical devices standards state anything more specific but I would doubt it as ISO are doing more work on alignment of management system requirements.
I do a lot of audit work at external suppliers and have previously been the nominated Quality Representative within a £20+m manufacturing site and a small technical development centre. I have never had a problem with rescheduling internal QMS audits based on business work load and never had an issue with presenting different plans to external bodies. If you are able to do a replan and keep to it then do so add a note stating the reasons for a change to the plan and reissue it.
[ISO9001 - IRCA Certified Lead Auditor]
Gassing Station | Jobs & Employment Matters | Top of Page | What's New | My Stuff