1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice
You must be a registered member in order to post messages and view/download attached files in this forum.
Click here to register.

Boundaries of the external auditors.

Discussion in 'ISO 9001:2015 - Quality Management Systems' started by Nick1, Feb 14, 2016.

  1. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,104
    Likes Received:
    2,560
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    No. There are two or three options: 1) use a surveillance visit (or 2) to accomplish the transition. 2) use a reassessment (3rd year) visit to upgrade or (if the others didn't work) have a special, additional visit (at extra cost).

    No new stage or 2...
     
  2. MCW8888

    MCW8888 Well-Known Member

    Joined:
    Aug 17, 2015
    Messages:
    642
    Likes Received:
    198
    Trophy Points:
    42
    Thank you Andy
     
    Andy Nichols likes this.
  3. Nick1

    Nick1 Member

    Joined:
    Jan 27, 2016
    Messages:
    49
    Likes Received:
    20
    Trophy Points:
    7
    They conduct both stage 1 and 2. At least in my case they did.
     
  4. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,104
    Likes Received:
    2,560
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Really? That sounds expensive! You were already 2008 certified?
     
  5. Jennifer Kirley

    Jennifer Kirley Moderator Staff Member

    Joined:
    Jul 31, 2015
    Messages:
    1,071
    Likes Received:
    722
    Trophy Points:
    112
    Location:
    USA
    The ISO/TC 176/SC 2 Home Page is a good place to visit for information describing the expectations of the revised standard, and to your question, IAF ID 9:2015 gives Transition Guidance. Please keep in mind this document might change; I have seen the document about Risk Based Thinking change, and replace N1222.

    Anyway, The rules I am required to follow are: Transition must be done with Stage 1 and Stage 2, and the audit time cannot be reduced based on familiarity through past audits, etc. A gap analysis might serve as a Stage 1 depending on the outcome. It makes sense to do this at a recertification time because of the cost, but everyone is expected to have transitioned by September 2018 (I don't remember which day).

    Meanwhile, auditors are expected to audit to the current standard; but if I were to see demonstration of risk based thinking and identifying relevant interested parties/stakeholders, who am I to argue? After all, risk has been inherent in the 2008 version and we've always been expected to identify the requirements from customers; regulation is mentioned in 4.1 and a blanket blurb is expected to make clear (though it often is not) that services are a type of product in the 2008 version.

    I hope this makes sense!
     
    Somashekar and MCW8888 like this.
  6. Jennifer Kirley

    Jennifer Kirley Moderator Staff Member

    Joined:
    Jul 31, 2015
    Messages:
    1,071
    Likes Received:
    722
    Trophy Points:
    112
    Location:
    USA
    Training in my case included a case study in identifying potential stakeholders, and determining relevance.

    If your product is subject to, for example Underwriters Laboratory requirements due to industry/customer requirements, auditors will expect to see the organization has identified that. Some things are obvious that way. Others might not be clear to everyone, but can be raised as questions if auditors observe something that could impact the organization (picket signs?) and wonder if the organization has thought to include, for example unions as internal relevant interested parties/stakeholders. If there is an impact on the organization that went unnoticed, there could be a nonconformity but I would not be comfortable issuing action requests based only on my opinions and ideas.
     
    Somashekar and MCW8888 like this.
  7. Jennifer Kirley

    Jennifer Kirley Moderator Staff Member

    Joined:
    Jul 31, 2015
    Messages:
    1,071
    Likes Received:
    722
    Trophy Points:
    112
    Location:
    USA
    This absolutely should not happen. Giving someone a template is consulting. Such behavior should be reported, ideally as an action item dispute if it has reached that point.
     
  8. MCW8888

    MCW8888 Well-Known Member

    Joined:
    Aug 17, 2015
    Messages:
    642
    Likes Received:
    198
    Trophy Points:
    42
    Well Jennifer, who says an auditor cannot consult?
     
  9. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,104
    Likes Received:
    2,560
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    ISO/IEC 17021 says that someone who audits can't have consulted within (from memory) 2 years of the audit (or vice versa)
     
    Jennifer Kirley likes this.
  10. Jennifer Kirley

    Jennifer Kirley Moderator Staff Member

    Joined:
    Jul 31, 2015
    Messages:
    1,071
    Likes Received:
    722
    Trophy Points:
    112
    Location:
    USA
    Andy is correct. CBs are accredited to, among other things, ISO/IEC 17021.
     
  11. Nick1

    Nick1 Member

    Joined:
    Jan 27, 2016
    Messages:
    49
    Likes Received:
    20
    Trophy Points:
    7
    Yes we were. We got a full audit for 9001:2015. I actually though it was common practice for the new HLS. Now you mentioned it, it might have been pretty extensive because they started to dig in a lot of other stuff as well, while we have been audited last year.
     
  12. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,104
    Likes Received:
    2,560
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    The structure of the requirements shouldn't affect the duration of the audit! Why a stage 1 is required, I have no idea. You have a system in place and it's been audited. It's incomprehensible to me that you'd have to do the whole thing over - didn't happen at the 2000 changes and, IMHO those changes were FAR greater in impact.
     
    Nick1 likes this.
  13. Leonid

    Leonid Well-Known Member

    Joined:
    Jan 4, 2016
    Messages:
    164
    Likes Received:
    31
    Trophy Points:
    27
    Location:
    Moscow
    IAF ID-09:2015 does not require Stage 1 at a transition aufit from 2008 to 2015 version; it states "Where transition audits are carried out in conjunction with scheduled surveillance or recertification (i.e. progressive or staged approach), additional time is likely to be required to ensure that all activities are covered for the existing and new standards.
    Please refer to http://www.iso.org/iso/iafid9transition9001publicationversion.pdf
    ABs and CBs I know do not require Stage 1 at the transition audit.
    It would be interesting to know which CB required Stage 1.
     
    Nick1 likes this.
  14. Jennifer Kirley

    Jennifer Kirley Moderator Staff Member

    Joined:
    Jul 31, 2015
    Messages:
    1,071
    Likes Received:
    722
    Trophy Points:
    112
    Location:
    USA
    The Transition Planning Guidance document IAF ID-9:2015 is a guidance document, and as such is not the place to look for specific requirements.

    That said, please see page 8, 4.2.1: "Where transition audits are carried out in conjunction with scheduled surveillance or recertification (i.e. progressive or staged approach), additional time is likely to be required to ensure that all activities are covered for the existing and new standards." See also 4.2.2 (iii). This being the case, registrars I have reviewed describe transition as being possible at the scheduled point of Surveillance, but more time may be required to ensure conformance to the revised standard throughout.

    For the sake of avoiding certification gap and minimizing the risk of sending multiple auditors to a site for up to a week, only to discover a set of Majors that could disrupt the timeline, some CBs have set a process inn which preliminary reviews and calling it a Stage 1. It isn't easy to find CBs' published declarations of this process.
     
  15. Leonid

    Leonid Well-Known Member

    Joined:
    Jan 4, 2016
    Messages:
    164
    Likes Received:
    31
    Trophy Points:
    27
    Location:
    Moscow
    Jennifer, please see I cited in my post the same quotation from IAF ID-9:2015.
    Many Certification Bodies have been already accredited by Accreditation Bodies to carry out certification to 2015 version
    and no IAF Mandatory Document on transition process will likely be issued. Stage 1 at transition audits is not required.
     
  16. Sidney Vianna

    Sidney Vianna Well-Known Member

    Joined:
    Jul 30, 2015
    Messages:
    127
    Likes Received:
    172
    Trophy Points:
    42
    It is very important to keep in mind that the requirements coming from the IAF, as well as any standard, for that sake, are minimum. AB's and CB's can augment the process requirements to transition a registrant certificate to include Stage 1 if they so deem it necessary, based on the context and risks associated with such transition process. Obviously, any CB going above and beyond the minimum requirements should be prepared to explain to their client base why they, the clients are expected to do (and pay) more than the minimum "mandated" by the IAF.

    Some CB's might see an positive risk opportunity to increase revenues during the transition, but should not disregard the risk of client defection if and when they believe they are being taken advantage of.
     
    Jennifer Kirley likes this.
  17. Brian@Trident

    Brian@Trident Member

    Joined:
    Feb 26, 2016
    Messages:
    6
    Likes Received:
    1
    Trophy Points:
    1
    They did the same with me.