ISO 9001 Lead Auditor Training

Module 6 Conducting On-site Activities

6.1.5   Generating Audit Findings
Audit evidence should be evaluated against the audit criteria to generate the audit findings. Audit findings can indicate either conformity or nonconformity with audit criteria. When specified by audit objectives, audit findings can identify an opportunity for improvement.

ISO 9001 Auditor Training - The audit team should meet as needed to review the audit findings at appropriate stages during the audit. Conformity with audit criteria should be summarized to indicate locations, functions or processes that were audited. If included in the audit plan, individual audit findings of conformity and their supporting evidence should also be recorded.

Nonconformities and their supporting audit evidence should be recorded. Nonconformities may be graded or classified. They should be reviewed with the auditee to obtain acknowledgement that the audit evidence is accurate and that they are understood. Every attempt should be made to resolve any diverging opinions concerning the audit evidence and/or findings and unresolved points should be recorded.

6.1.5.1     Evidence gathering process
In order to gain the facts, and enough of them from which to come to a conclusion, auditors have to examine samples of documents, items, products, etc. Only the auditors can decide how many samples should be taken. It would obviously be dangerous to see one example of a system in correct operation (when there are hundreds of examples that could also be looked at) and assume that because one had been seen the system was correct all the time. Similarly, it would also be wrong, particularly if a minor aspect is being considered, to look at every single example.

ISO 9000 Training - Typically, samples size can vary between 6 –30 items. In most cases, this small number will be sufficient as long as some attempt has been made to make it representative. To make a sample representative, it needs to be chosen at random. One way to do this is for the auditor to make the choice of sample with management permission. The “sample” may even be the people to interview. The smaller the set of evidence, the smaller the sample. However, in some cases, a 100% sample might be appropriate. For example, if quarterly management reviews and semi-annual surveillance audits, both meeting minutes would be examined.

The auditor may wish to confirm the manager's understanding of a system is the same as that of the operator. Again, provided the auditor asks for and receives permission, it is good practice to “audit where the action is” and speak to the people doing the work.

The audit will continue in this vein. The auditor asks the departmental representative how something is done and confirms what has been said by examining samples or talking to someone else.
Certain systems, for example, those for documentation control, are company wide and every department has examples of documents. The auditor needs to be clear about who is responsible for what when verifying the correctness of the documents seen in any given department. Auditors should always seek the help of local personnel affected by the system in question in understanding the evidence.

ISO 9001 Auditor Training - Naturally, the kind of evidence often being produced is that which will show a failure of the system or a lack of management control. Provided that the auditor has remained objective, has been open with the people contacted, and has invariably been polite in requests for information, there should be no difficulty in reaching agreement on such points with the responsible persons.

6.1.5.2     Taking Notes
Only the most experienced auditors make sufficient notes of all the relevant things seen and heard during an audit. It is obviously an extremely important technique to develop. The auditors must record enough information to make an informed judgement based on an adequate set of notes containing considerable facts.

Notes need to be taken of references to documents, item identification, batch numbers, job numbers, statements, who said them, job titles, relevant questions asked, etc. This information needs to be legible and needs to be retrievable.
Much of it might be referenced in subsequent audits, either in the next department to be visited, or in a department to be visited by another member of the audit team. It will also be used in the verbal and written reports to the auditee for the purpose of defining areas of nonconformity or raising points for discussion. Notes will form part of the Registrar’s customer record file and might also be referenced by auditors on subsequent audits.

The auditor’s notes during an audit remain part of the record system and as such should be retained for a given period. Clearly, they need to be usable and understandable if there is a subsequent need to reference them (perhaps months or years afterwards).

The format of notes, and the medium on which to write them, are matters for each auditor to decide. Many use clipboards with loose sheets that are then clipped together; others find a notebook more practical. Whichever format they use, auditors must safeguard the confidentiality of the information they gain during the audit.

"Understanding ISO 9001" provides a detailed explanation of each ISO 9001 clause (requirements).

ISO 9001 FAQ provides answers to commonly asked questions about the ISO 9000 family of quality management standards.