Internal Audit must be announced?

Hi, newbie here trying to gain valuable insights i can apply to our organization.
Our CB keeps on insisting that our internal audit should be announced, and be at a regular interval which they explained that if our planned interval is every year, then site A audited in Jan 2019 must be audited in Jan 2020?
By the way, our organization is in the banking industry, and that we deem our IA is integrated in our regular operations audit. And that we do unannounced audit because of cash count component. Further, the conduct of IA to sites is based on approved risk analysis. Lastly, our IA is recognized compliant much above the standards of global audit organizations.
May i know your thoughts, please?

 

Hello. Thank you for the reply.
I meant our Internal Audit for our QMS which is done by our Internal Audit Group. Only, said internal audit is subsumed during regular operations audit in the organization. Say, as we are a bank, when the IAG conducts its operational audit in a branch, they also check QMS implementation in said branch. So because the regular operations audit is not announced, then it follows so for the QMS Audit for that branch to be a surprised audit even if it is not intended to be.

Are we doing it correctly? By the way, is there a documentation that says a QMS Audit should be announced?

Thanks again.

 

ISO 19011:2018 (Guidelines for Auditing Management System) section 6.2.2g specifies: "The audit team leader should ensure that contact is made with the auditee to: g) make arrangements for the audit including the schedule".

 

Is this applicable to an IMS Internal Audit?

OR

to a CB auditing its client?

TIA.

 

Yes.

 

Yes. ISO 19011:2018 Introduction stated this:

"This document adopts the combined audit approach when two or more management systems of different disciplines are audited together. Where these systems are integrated into a single management system, the principles and processes of auditing are the same as for a combined audit (sometimes known as an integrated audit)".​

Could be. However, CB audits are required to satisfy the ISO/IEC 17021-1:2015 (Conformity Assessment - Requirements for Bodies Providing Audit and Certification of Management Systems).

 

So can they raise an NC with our methodology?

 

If NC against ISO 9001, then, definitely NO. There's no categorical statement in ISO 9001 standard that requires internal audits must be announced.

 

Yes. That's one thing i would want to clarify. Because our CB has just raised an NC with the grounds that our internal audit is done unannounced.

 

ISO 9000:2015 defines nonconformity as "non-fulfillment of a requirement". There must be a requirement first before an NC can be raised. Even ISO/IEC 17021-1:2015 (Requirements for bodies providing audit and certification of management systems), in section 9.4.5.3, mentions "A finding of nonconformity shall be recorded against a specific requirement..." Where in the standard did the auditor raise the issue against? You have to make an appeal.

 

Where in the heck is the "shall" for that? We haven't "announced" our internal audits for years. We are small company an expect things to be working without an announcement. So many bigger things to deal with. Good luck.

 

We perform weekly audits that are unannounced. Since they are weekly they are somewhat expected so it is really not an issue. An external audit is always announced however.

 

We do weekly audits on work cells. This stems from some real problems we encountered in one department and the audits just carried over to include other departments as well. It covers some ISO stuff but mostly procedures and documentation related items.

 

No these are not management systems audits. Sorry if I implied that. Yes, we are ISO9001:2015.