1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice
You must be a registered member in order to post messages and view/download attached files in this forum.
Click here to register.

9.2 QA activities Outsourced Internal Audit to be conducted BEFORE or AFTER Management Review?

Discussion in 'ISO 9001:2015 - Quality Management Systems' started by Micheal Lenka, Apr 3, 2019.

  1. Micheal Lenka

    Micheal Lenka Member

    Joined:
    Jan 29, 2018
    Messages:
    10
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    South Africa
    Good afternoon all. Im responsible for QMS as SHEQ Coordinator in terms of conducting Internal Audits and after i have conducted them for all processes, i outsource internal audit for QA (i'm responsible for) and Management activities ( i'm not at Management level nor part of Management ).

    Kindly advise if Outsourced Internal Audit for QA and Management activities should be done before Management Review or after the Review because Management Review as a process, it falls under QA & Management.
     
  2. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    I guess the answer is going to be very much dependent upon your understanding of why internal audit results are included as an input to management review. Since internal audits are in "input" to management review, it follows they should be done before?
    What is being audited in "QA" or "Management Activities"? What processes are these?
     
    RoxaneB likes this.
  3. RoxaneB

    RoxaneB Moderator Staff Member

    Joined:
    Jul 31, 2015
    Messages:
    926
    Likes Received:
    1,081
    Trophy Points:
    92
    Location:
    Ontario, Canada
    Andy raises some good questions.

    Are you saying that you outsource the internal audit of management activities because of your position? If so, I'm not quite sure I understand why. If anything, being completely removed from management activities would imply a lack of bias and you wouldn't be auditing your own work. Or did I misunderstand your statement?

    By the way...congrats on making your first post!
     
  4. Micheal Lenka

    Micheal Lenka Member

    Joined:
    Jan 29, 2018
    Messages:
    10
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    South Africa
    QA and Management activities are activities done to ensure Quality Assurance performed by myself (SHEQ Coordinator), Control of Documented Information,Internal Audits, Nonconformance & Corrective Actions, and Management activities include Context of the Organisation, Leadership, Support (Resources), Management Review, Improvements
     
  5. Micheal Lenka

    Micheal Lenka Member

    Joined:
    Jan 29, 2018
    Messages:
    10
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    South Africa
    my junior position would limit me in auditing Top Management as i may not be privy to some information at a STRATEGIC LEVEL . eg Quality Policy and Quality Objectives established for QMS should be compatible with context and strategic direction of the company - how do i verify that if my position does not allow me to consume some information at Strategic level?
     
  6. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    So, I see a flaw in your internal audit programme. Some of these things should be done when other processes are being audited. Having said that, if YOU are the internal auditor, why would management not share things with you regarding the Quality Management System? What could possibly be in any strategic information (btw - Quality Policy, Quality Objectives aren't) that can't be audited by anyone?

    You should a) be concerned that your management don't understand the use of the QMS and b) that the internal audit is there to ensure effective implementation. Why wouldn't they communicate policy and objectives to everyone? And, that would include you, as auditor or not.

    Are you ISO 9001 Certified?
     
  7. Micheal Lenka

    Micheal Lenka Member

    Joined:
    Jan 29, 2018
    Messages:
    10
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    South Africa
    My concern is that if im audited before Management Review , then Management Review as a process would have not been audited and if im audited after management review, then the outsourced internal audit cant be captured and discussed during Management Review.
     
  8. Micheal Lenka

    Micheal Lenka Member

    Joined:
    Jan 29, 2018
    Messages:
    10
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    South Africa
    Yes we are certified, i must be clear and say i include Management Process for outsourced internal auditing assuming that they may not allow to share strategic information with me and with that i dont mean Quality Policy and Objectives. i mean Strategic Direction of the company
     
  9. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Why are you concerned? There will always be internal audits "after" management review. It's a fact of life. How many times have you done management review at your organization? I understand being concerned, but without background information, how can we help you resolve your concerns?
     
    Last edited: Apr 3, 2019
    KieuAn likes this.
  10. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Then outsource the audit of this. BTW - they are not supposed to define the strategic direction, under the Context, just the (internal and external) issues which can AFFECT that.
     
    Micheal Lenka and KieuAn like this.
  11. Golfman25

    Golfman25 Well-Known Member

    Joined:
    Nov 6, 2015
    Messages:
    816
    Likes Received:
    402
    Trophy Points:
    62
    Don't view management review and auditing as a singular event. They both should be continuously happening. So if you have a management review, you might only have a portion of audit results available. The balance would be available at the next management review. Just keep the wheel turning and you should be fine.
     
    Micheal Lenka and KieuAn like this.
  12. tony s

    tony s Well-Known Member

    Joined:
    Sep 10, 2015
    Messages:
    1,350
    Likes Received:
    1,054
    Trophy Points:
    112
    Location:
    Laguna Philippines
    When presented with a question like this, it seems that Micheal's organization carries out their management review once a year. If internal audits and management reviews are done more frequently, this should not be an issue. For example, the results of the audit for the processes that were covered for the first quarter should be part of the inputs on the 1st quarter management review. The results of the 2nd set of processes covered in the 2nd quarter internal audit should be an input on the 2nd quarter management review, and so on. Internal audit for the Management processes (e.g. internal audit, management review, etc.) can be set on the 3rd or last quarter of the year. Then the cycle starts again on the next year.
     
  13. Micheal Lenka

    Micheal Lenka Member

    Joined:
    Jan 29, 2018
    Messages:
    10
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    South Africa
    Thats correct, Management Review is done annually hence my dilemma
     
  14. Micheal Lenka

    Micheal Lenka Member

    Joined:
    Jan 29, 2018
    Messages:
    10
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    South Africa
    We do internal audits annually and the following month we conduct Management Review also annually and after two months its Surveillance Audit done by Certification Body also done annually. and outsourced Internal Audit should be done to audit my work and Top Management Processes and the question is when should it ideally be held.
     
  15. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Do you mean one audit in a year? If so, and only one management review a year, you don't have an effective management system - even of it is certified. You have bigger problems to address than the timing of just one audit.

    I would suggest that your management team go back and revisit why you have a Quality Management System (other than to get a certificate). Since management review is there to review the performance of the business's processes and the product/services's ability to satisfy customers, it's useless to wait a whole year before discovering what's going on! Scheduling one audit is the least of your worries...
     
  16. Micheal Lenka

    Micheal Lenka Member

    Joined:
    Jan 29, 2018
    Messages:
    10
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    South Africa
     

    Attached File(s): 1. Scan for viruses before using. 2. Report any 'bad' files by reporting this post. 3. Use at your own Risk.:

    Last edited by a moderator: Apr 5, 2019
  17. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    It looks like what you are doing is simply copying what the Certification Body does. That's not an internal audit. If you understand 9.2, and forget what the CB does (or possibly what your audit trainer told you) and consider WHY ISO 9001:2015 requires internal audits etc you'll be better off. Currently, I'd bet if you asked your management why internal audits are done, they can't tell you, except to say "ISO-Says-So", or "to keep us certified"...
     
  18. tony s

    tony s Well-Known Member

    Joined:
    Sep 10, 2015
    Messages:
    1,350
    Likes Received:
    1,054
    Trophy Points:
    112
    Location:
    Laguna Philippines
    Micheal, instead of lumping all the processes in one month to audit them, spread them throughout the year. Audit the core processes (e.g. sales, production) on the 1st quarter, support processes (e.g. human resource, maintenance) on the 2nd quarter, the management processes (e.g. business planning, management review, internal audit) on the 3rd quarter, and so on. After each quarter perform your organization's management review. Each review doesn't need to cover all the required inputs. Only those that are relevant to cover.

    Since your CB audits your organization every month of July, they might ask evidence of the internal audit for management processes. Present your schedule and this should not be a problem to them. If they raise an issue concerning the schedule, require them to audit your organization on the last quarter.
     
    Micheal Lenka likes this.
  19. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Better still, you know this calendar approach isn't actually required? The standard talks about auditing "frequency" but that doesn't mean everything is audited to the same frequency, just as music notes are all the same frequency. Similarly, not all processes are important. Don't wait until later in a year to audit things which are a) important to the customer and b) not working effectively. It's too late!
     
    Micheal Lenka likes this.
  20. Golfman25

    Golfman25 Well-Known Member

    Joined:
    Nov 6, 2015
    Messages:
    816
    Likes Received:
    402
    Trophy Points:
    62
    Even if Management Review is done annually, it's still a wheel. At some point you'll have a full audit cycle available to review. You might use a mix of last years and this years audits. In other words, any audit that wasn't an input into the last management review becomes an input into the next management review.

    As an aside, I am sure your management reviews the organizational metrics and such on a more frequent basis than annually. That's "Management Review" too. I would try to capture that and use it.