ISO 9001 Training

Understanding ISO 9001:2008
Requirements for Quality Management Systems

8.2.2 Internal Audit

ISO 9001 Training - Key Explanation Points and Tips:

Internal audit is the second important tool (required by this standard) used to gauge the health of your QMS. How effective is it in meeting ISO 9001, your own QMS; customer and regulatory requirements?

You must have a documented procedurefor your internal audit process Your procedure must address each of the following control requirements:

The scope of your internal audit program must cover the:

Audit of product realization processes (as planned under clause 7.1) - to determine conformity of both product and product realization processes to customer and applicable regulatory requirements.

Audit of the QMS - to determine conformity to the ISO 9001 standard

Audit of the QMS - to determine conformity to organizational requirements

Audit of QMS processes and their interaction - to determine if the QMS has been effectively implemented and maintained.

The time frame during which the audits specified above will be conducted

In determining the time frame for your audit program, you should consider organization size, complexity of product and processes; health of the QMS; customer, registrar and regulatory requirements; etc. The most common time frame is one year.

Consider adjusting the audit frequency (and perhaps even the audit scope), of specific processes or group of processes, when:

- You experience internal or external nonconformities
- Get customer complaints
- Have critical or high risk processes
- Have frequent or significant changes to processes and product

Your internal audit program should consider the following:

- Input from audited area and related areas

- Key customer oriented processes (see explanation points and tips to clause 4.1)

- Process and product performance results and expectations

- Opportunities for continual improvement

- Feedback from customers

Audit criteria, refers to the specific QMS policies, objectives; ISO requirements; documentation; customer and regulatory requirements, etc., that the audit is referenced to or conducted against. Audit criteria may relate to the whole audit program as well as each individual audit.

Audit methods refer to the specific techniques that auditors use to gather objective audit evidence that can be evaluated to determine conformity to audit criteria (see above paragraph). Examples of audit methods include - interview of personnel, observation of activities; review of documents and records; etc.

You must define the minimum qualification requirements for internal auditors. These requirements include knowledge of - QMS processes and their interaction; related QMS controls; customer requirements; applicable regulatory requirements; the ISO 9001standard; the audit process and audit techniques.

There are some that may argue that internal auditors do not need to be trained in the ISO 9001 standard as they generally audit to specific organizational documentation which must conform to applicable ISO 9001 requirements. Besides auditing for conformity to organizational requirements, you must also audit for conformity to ISO 9001 requirements.

This cannot be done, unless auditors are trained in the requirements of the ISO 9001 standard. Additionally, the ISO 19011:2002 Guidelines for quality and environmental auditing says that auditors should have knowledge of quality management system standards and their application to the organization.

You must have appropriate resources for your annual audit program. These include - having sufficient trained auditors available to conduct scheduled audits; sufficient time to perform audits; availability of department or process personnel to be audited; time and tools to prepare audit records and reports; etc.

Auditor Independence - Auditors can audit their own department provided their objectivity and impartiality is not compromised, but they cannot audit their own work. You must ensure auditor independence when assigning personnel to specific audits.

Process owners must take timely corrective action on nonconformities found in their area. They should use the corrective action procedure (clause 8.5.2) to determine root cause, take appropriate action and follow-up to determine if results indicate that the root cause has been eliminated.

Audit results must be summarized and reported for management review (see clause 5.6.2). The Management Representative must also report any opportunities for QMS improvement (see clause 5.5.2b. The MR must analyze the results of each audit as well as the annual audit program to determine strengths and weaknesses in QMS processes, interactions, functions, products, etc., to identify and prioritize opportunities for improvement.

Audit records include - annual audit schedule; audit planning- (criteria, scope, frequency, methods, auditor selection and assignment, etc); auditor competence and training; audit checklists and forms; audit notes and other evidence gathered; audit findings; nonconformity reports; audit reports; corrective actions and follow-up of internal audit nonconformities; analysis of audit program performance indicators and trends; and identified improvement opportunities.

Like all QMS processes (see clause 4.1), you must have performance objectives (indicators) to measure the effectiveness of your internal audit process and monitor trends in these indicators, to continually improve your audit program. Performance indicators may include reducing the number of - late or delayed audits; incomplete audits; incomplete audit records and late reports; auditor errors; auditee complaints; and use of untrained auditors; etc.

The output of your internal audit program may be used as performance indicators to:

- Determine the degree of conformity of the QMS to ISO 9001; customer and regulatory requirements.

- Determine the effectiveness of QMS implementation and maintenance.

- Determine the degree of conformity of product to contractual and regulatory               requirements.

- Identify areas of the QMS that need improvement.