1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice
You must be a registered member in order to post messages and view/download attached files in this forum.
Click here to register.

Correcting Audit Findings

Discussion in 'ISO 13485 and ISO 14969 – Medical Devices QMS' started by Lindy, Jan 10, 2018.

  1. Lindy

    Lindy Member

    Joined:
    Jan 10, 2018
    Messages:
    14
    Likes Received:
    2
    Trophy Points:
    2
    Hello - new to this forum.

    I have a question regarding internal audit findings and correcting those findings.

    Is the auditor who identified the audit finding allowed to perform any of the actions to correct the finding?

    I am the internal auditor at my company and my boss has me perform the corrections to many of the audit findings, which includes rewriting procedures. I'm nervous that this will muddy the waters of remaining unbiased and separate from the department that I'm auditing. Although I'm more than happy to assist the department/individuals involved in correcting these findings, I don't feel right having the internal auditor who published the report as the person in charge of the action item to correct the finding.

    Would I get in trouble if an outside firm were to audit my company and see that I performed actions to correct the findings, or is it OK to do this?

    Thank you for any insight you may have.
     
  2. Golfman25

    Golfman25 Well-Known Member

    Joined:
    Nov 6, 2015
    Messages:
    816
    Likes Received:
    402
    Trophy Points:
    62
    How big is your company? With a small company, you may tend to wear many hats. In other cases, you may be a good resource to help. So, while I wouldn't put you "in charge" using you as a resource could be a positive. There is nothing worse than a "hit and run" -- auditor finds something and then disappears. Whether that will pass an outside audit would depend I suppose.
     
  3. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Hi Lindy! Welcome!

    So, two things: As long as you aren't doing these corrections actually during the audit, then yes, fine. Also, if you are doing editorial changes to documents which aren't your process(es) and they are being brought up to date with the actual practices, then that's fine too. The key thing here is that as long as it's not YOUR work you are auditing, that's best - unless you can show the audit process has ensured objectivity (factual) and there's no bias (you looked at things you did, maybe 3 - 6 months ago perhaps).

    If the audit findings require a different process, then it's best NOT to be involved. BTW, what position is your boss?
     
    Last edited: Jan 11, 2018
  4. Lindy

    Lindy Member

    Joined:
    Jan 10, 2018
    Messages:
    14
    Likes Received:
    2
    Trophy Points:
    2
    Thank you all for your responses!

    My company is stretched a little thin regarding available resources, so it isn't usual for various employees to be asked to help out in other areas. I don't like to be the grenade-throwing type auditor who takes off, but I also need to figure out where to draw the line of helping a finding get corrected, and doing the corrections myself.

    My boss in the VP of Quality and Regulatory, so there isn't anyone else I could raise my concerns to. I'm glad I found this forum to be able to get an outside opinion!
     
  5. Serious Man

    Serious Man Active Member

    Joined:
    Oct 24, 2017
    Messages:
    79
    Likes Received:
    28
    Trophy Points:
    17
    Auditor's job is evaluating adequacy of determined root cause, proposed corrections and corrective actions.
    Doing it personally exclude possibility of auditing it in future. So after some time maybe there will be almost nothing to audit.
    When company is small, it should outsource internal audit process, if resources available to make corrections are limited.
     
  6. Golfman25

    Golfman25 Well-Known Member

    Joined:
    Nov 6, 2015
    Messages:
    816
    Likes Received:
    402
    Trophy Points:
    62
    So it should cost small companies double -- pay once for an internal audit and once for a third party?
     
  7. Serious Man

    Serious Man Active Member

    Joined:
    Oct 24, 2017
    Messages:
    79
    Likes Received:
    28
    Trophy Points:
    17
    If someone does not take internal auditing serious, can save money and continue fake job.
     
    Andy Nichols likes this.
  8. Golfman25

    Golfman25 Well-Known Member

    Joined:
    Nov 6, 2015
    Messages:
    816
    Likes Received:
    402
    Trophy Points:
    62
    Actually in smaller companies internal auditing is a waste of time. Generally, in small companies true non-conformances make themselves readily apparent -- there is no place to hide. But heck, if it give everyone a warm fuzzy feeling inside, go for it.
     
  9. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Only if you see audits through the eyes of the CB - too many internal audits are done emulating the CB process. I can show you much more effective internal audits, I've done for small companies which were worth a ton of money...
     
  10. Golfman25

    Golfman25 Well-Known Member

    Joined:
    Nov 6, 2015
    Messages:
    816
    Likes Received:
    402
    Trophy Points:
    62
    I wouldn't disagree with that. Please share. But would they get past a CB auditor? My experience is they get really uncomfortable with something different.
     
    Andy Nichols likes this.
  11. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Happily! And FWIW, I also understand the reaction with CB auditors. I also have had plaudits from them (through my clients' feedback) about my approach...

    I really believe we should stop being ruled by these lack luster CB auditors. I heard yet another trainwreck story about an IATF auditor today...
     
  12. normzone

    normzone Well-Known Member

    Joined:
    Aug 3, 2015
    Messages:
    137
    Likes Received:
    77
    Trophy Points:
    27
    Yes, and I'd like to stop tectonic drift also.

    One audit will accept an overview with a summary and call it effective, another will not and the only way to counter that is to use the checklist full element review model.

    Damned if we do and damned if we don't
     
  13. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    inconsistency I understand. Why oh why do you allow someone who has little/no experience of your business, who spends only one or two days in your facility dictate HOW you run your business? Ask someone at a Business School what they'd say to that as a model of business operations...
     
  14. Jennifer Kirley

    Jennifer Kirley Moderator Staff Member

    Joined:
    Jul 31, 2015
    Messages:
    1,071
    Likes Received:
    722
    Trophy Points:
    112
    Location:
    USA
    I am also bothered by inconsistency in CB auditors. I often audit a system with previous NCs having been accepted with the barest minimum of corrective action plans, whereas we are required through accreditation to 17021:2015 to:

    <<9.4.9 Cause analysis of nonconformities
    The certification body shall require the client to analyse the cause and describe the specific correction
    and corrective actions taken, or planned to be taken, to eliminate detected nonconformities, within a
    defined time.
    9.4.10 Effectiveness of corrections and corrective actions
    The certification body shall review the corrections, identified causes and corrective actions submitted
    by the client to determine if these are acceptable. The certification body shall verify the effectiveness
    of any correction and corrective actions taken. The evidence obtained to support the resolution
    of nonconformities shall be recorded.>>

    CBs have procedures, but application is as wide as the river Nile and there is no successful program to "calibrate" auditors that I've seen. But don't blame it on the auditor; the documentation is supposed to go through a review and it is at that point that management can exert its influence.
     
  15. Jennifer Kirley

    Jennifer Kirley Moderator Staff Member

    Joined:
    Jul 31, 2015
    Messages:
    1,071
    Likes Received:
    722
    Trophy Points:
    112
    Location:
    USA
    I have rarely seen internal audits that were worth the paper they were printed on. 9.2.1 says internal audits will be conducted to determine if the QMS is (b) effectively implemented and maintained. This could be from a number of reasons, but the truth is that value-added auditing (while verifying conformance with the standard at the same time) is not easy. Persons who are thrown into those roles too often do not understand how to audit for value or discover underlying issues.

    Corrective actions are worse, in many cases repeating the symptom and failing to address cause(s) that could enable the problem to repeat or occur elsewhere (10.2.1(b).

    The auditor in question isn't here to defend himself, so it is easy to beat up on him. We do have the right to require specific types of responses - and rightfully so. That said, I do ask my clients to produce thoughtful, meaningful corrective actions that will, we dare to hope, avoid a recurrence because repeating nonconformities in 3rd party audits get escalated almost by default. I suppose someone out there is complaining about me too. :)
     
  16. Golfman25

    Golfman25 Well-Known Member

    Joined:
    Nov 6, 2015
    Messages:
    816
    Likes Received:
    402
    Trophy Points:
    62
    The problem is the tool CBs use is a hammer. Every problem isn't a nail. Having a full 8d type analysis isn't always necessary.
     
    Andy Nichols likes this.
  17. Jennifer Kirley

    Jennifer Kirley Moderator Staff Member

    Joined:
    Jul 31, 2015
    Messages:
    1,071
    Likes Received:
    722
    Trophy Points:
    112
    Location:
    USA
    What standard are you being audited to? I audit to 5 standards and have not once seen an 8D required for corrective action.
     
  18. Golfman25

    Golfman25 Well-Known Member

    Joined:
    Nov 6, 2015
    Messages:
    816
    Likes Received:
    402
    Trophy Points:
    62
    TS/IATF 16949. Simple corrections of oops isn't enough according to our cb.
     
  19. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    The "iceberg" principle...
     
  20. Golfman25

    Golfman25 Well-Known Member

    Joined:
    Nov 6, 2015
    Messages:
    816
    Likes Received:
    402
    Trophy Points:
    62
    Maybe, maybe not. Everything isn't always applicable everywhere. Especially when dealing with nit pic "findings."