Double auditing?

Good day Qualmx,

It is possible to apply more than one clause to a finding. That said, some may apply more specifically to given situations than others.

The standard is essentially set up in Plan-Do-Check-Act. 4.4.1 is in planning, 8.1 is in control (doing). 8.1 includes more detail in what that process control planning and implementation is to include. It might help to purchase the document ISO/TC 9002:2016, Quality management systems — Guidelines for the application of ISO 9001:2015. In 4.4.1 it begins by saying:

In 8.1 it begins by saying:

If people are doing activities critical to customer satisfaction but processes and their controls have not been defined, I would cite the "plan" clause(s) as applicable: 4x, or perhaps 6x.

If processes have been identified and developed but are not being followed, I usually apply the "do" section of clauses, such as 7.x and 8.x.

If I find three controlled documents being used in wrong revision, it is generally a nonconformity. Control of versions is best found in 7.5.3.2. ISO 9002:2016 describes it in part as:

When outdated versions are found in use, yes they need to "correct it" but that also includes discovering and resolving why the wrong revision is in use at the place of work. This second step is intended to help prevent recurrence or occurrence elsewhere, a requirement of 10.2.

 

Is the scope "compliance vs ISO 9001:2015? If it is, that's your problem. You shouldn't be auditing "clauses". You really should be auditing processes and then decide which are the applicable requirements of ISO 9001 which are affected. I'm left wondering that, with such a basic question, what your audit training told you to do. Did you get some auditor training?

 

I have written a book on auditing you could try.

What you describe is a compliance audit. But all clauses don't have to be covered by all processes. You don't have to check everything every time.

 

While we are required to assess effective implementation of the standards' requirements, I agree with Andy that the focus should be on the customer and the process. Identifying clauses takes a "back seat" in priorities. I also agree that not all clauses are to be audited in each process. We identify which apply to what process. In case it helps, I have attached a tool kit in the Resources forum that has an example matrix that suggests which clauses might apply to which process.

Craig Cochran has excellent books on ISO 9001:2015 In Plain English. One of them is about auditing.

 

Amazon A Guide to Effective Internal Management System Audits

 

Infrastructure is only part of 7.1. The rest is resources, a wide assortment of types. If you have a process that does not require resources, please feel free to leave that out.

Similarly, if you have processes that do not need competence to succeed, feel free to leave that out. (I am not aware of any.)

Internal audit is a process that reviews other processes; but although Procurement would at some point be audited, the Procurement process is not usually responsible for the requirements listed in 9.2.

Organizational knowledge is specifically planned in order to ensure required skill sets are not lost if a key person leaves. Not all processes will likely carry that concern. The organization decides.