audit programme - consideration factor

how u guys show to auditor that the audit programme has take into consideration of the below:

9.2.2 The organization shall:

a) plan, establish, implement and maintain an audit programme(s) including the frequency, methods, responsibilities, planning requirements and reporting, which shall take into consideration the importance of the processes concerned, changes affecting the organization, and the results of previous audits;

 

Usually the program itself (an overview) is documented (the 'plan' part) in a procedure or Quality Manual, and records are kept of the result and frequency (the 'maintain' part). The criticality is determined based on defectives data or some other measure of the process performance. I generally submit this in the management review in the form of a risk matrix, and that determines the order of the internal audits. The 'frequency' depends on criticality, some processes need to be monitored more often than others. I avoid hard and fast dates and schedules, basing the need on the above, and the fact we have very limited resources to do this (just me usually). Some may be once a year or more, some may be longer, it depends on the process and what it can effect.

 

Show the documented procedure, the plan, the competency of auditors,the records of audits,minutes of meeting of management review ,where is revised the audit status, the findings report, etc.
Regards

 

actually our annual audit program are repeated every year where all area are cover once in a year. Off course previous year are analyzed but we didn't really "use it" to incorporate into our program.
I would say what the auditor expect is something like urs where process criticality are taken into consideration to decide frequency of audit.
will that mean that every year ur audit frequency will change depends on previous result?

 

Great insights into this aspect. I have got a query, i.e.

Does the standard require ..?
a) to cover all clauses in 3-year window?
b) to cover all process at each site at least once in 3 years
c) to show the matrix of clauses elements covered against at the time of re-certification audit.
For system clauses like Management review, control documents & records - should it be site wise each year, or process wise

I'm aware that standard doesn't state requirements of these accept it should be based on the importance and status, but would like to seek your experience and recommended guideline for an organization having 4 sites, strength 300 staff and multiple processes.

 

Does it mean, that there are no requirements of such to cover all elements of ISO9001 ?

 

I know, but the question is how the previous audit result deciding your audit program and frequency? problematic area need to audit more often?

 

ya....mind to share your annual audit program?
does it mean that:
i) critical process / dept are audited more often
ii) previous audit result with high findings are audited more often
iii) however, none of the process can be excluded and must be audited once a year?

 

i) yes
ii) yes
iii) possibly, although our procedure states "the goal of the audit program is to audit each process annually, however this is subject to the allocation of resources and considerations of criticality and importance."

 

does that mean that your yearly program is different from year to year after taking into the above consideration factors?

 

yes, the order and frequency varies year to year, however the initial order is set at the final year end management review for the coming year. It may change, but we have 'planned' the audits at that time.

 

Please take a look at the attached file, it might help? The tracker is a bit rough around the edges, but it covers 3 different process dimensions/characteristics, and other factors [No. of customer complaints/CA/NC,etc.] to derive a score that determines the audit frequency for each process entered. This feeds through to the audit programme, the audit finding schedule and OFI/NC charts. Basically, it maps our interpretation of the PDCA approach to auditing our system and our processes.

I've recently developed it as way to substantiate most/all of the above keywords/requirements from clause 9.2.2 and other clauses such as 10.2. Our project's management team, which includes client representatives seem to think it's the right approach, which is always a step in right direction!

Inspiration came from some older, similar trackers that i had downloaded from Elsmar's [RIP] file attachments over the years. The tracker is a hybrid of many useful nuggets [hence avatar] i found there.

Anyway, hope it helps!

 

Essentially I do what QR said above, calculate a RPN number from the data I have, then set a priority order based on this. This is proposed as the "audit schedule" for the coming year, yet our wording allows us to deviate from the schedule should other factors suddenly arise during the coming year. As such, the proposed schedule may not end up exactly that way, but should be close.