Stealth Quality Series QMS Audit Program Manager

This audit program tool kit has been updated for the ISO 9001:2015 standard. It is designed to help with process auditing, and includes a risk-based Corrective Action log that charts results in a number of categories. This tool kit can be formatted to suit other quality standards by adding subclauses to the Audit Planner sheet.

Feel free to adapt it for your own use, but please remember this tool kit is copyright protected against redistribution and sale.

 

Jennifer Kirley submitted a new resource:

QMS Audit Program Manager - Audit Program Manager 9001 - risk based

Read more about this resource...

 

Jennifer - I have a quick question. I see "scope" mentioned, however, where is the audit criterion considered? ISO 9001:2015 doesn't require process-based internal audits and there may be a case for audit scopes and criteria which are a) not ISO 9001:2015 and b) not a process (per se). How are these considered?

 

This is a guide. Its instructions page says "Audit Planner suggests which clauses should be covered in each process." An organization is of course welcome to adapt to their own needs.

If a set of activities is being performed that supports customer satisfaction, why wouldn't it be part of the QMS, and as such part of the QMS scope? Can you give examples of what you're thinking about?

While I agree the 0.3 reference to process approach is not a binding "shall", a number of CB auditors have been specifically told not to accept audits that essentially look like a gap analysis: that is, a yearly once through with a canned checklist. I will welcome observing the pushback, if any, via disputes (I'm ready with the popcorn). Until then, the Audit Manager is provided as a means to help with planning and demonstrate how the process audit approach can help ensure the entire standard gets covered in the appropriate times.

 

I was thinking of audit "scopes" and "audit criteria" as mentioned in 9.2.2. In my mind this means that an internal audit might be against a contractual specification (criterion) and the "scope" might be "New Product Development", or "Packaging".

I'm not specifically asking about what CB auditors may or may not have as a bias - they frequently get it wrong in my experience (and their management do, too, because they are far removed from the reality of what an internal audit should actually be like). Certainly, doing one honking big internal audit (gap or whatever you wish to call it) isn't likely to be satisfactory for the client's organizational needs, their management and shouldn't be for the CB auditor - (but amazingly, is for all the wrong reasons) - and is certainly not compliant with the old nor the new ISO 9001:2015 requirements.

I can find nothing in 0.3 which implies that internal audits should be done to a process (only)

 

"New Product Development" and "Packaging" are processes, not audit scopes.

It is my viewpoint that an annual gap analysis is of little to no value, but my viewpoint is not audit criteria. I don't have enough detail to be able to justify the expectation for process auditing. I recall it was what the accrediting body wants, but can't say for sure and I can't point to the "shall" as I described.

I went through this with AIAG too, when told we CB auditors were expected to require the core manuals be followed. Later, no one would own up to that but I could swear to you the instructor said so. I know my old employer's auditor tried to enforce it, but when we pushed back he threatened a NC but then did not write it - for obvious reasons (no customers required it and TS 16949 didn't either).

I do hope people push back, though the annual gap analysis is really of little use. I'd like to see how this shakes out.

 

I find this statement shocking, Jennifer. I don't know how to respond.

 

From ISO 19011:2011, 3.1.4

The Note following 3.1.4 elaborates:

 

This is an example of where ISO 19011's "one size fits all" style - putting ALL kinds of QMS and EMS audits in the same guidance goes off the rails...IMHO. The definition is fine - "extent and boundaries" - can be "Product Development", can't it? The note doesn't say all those are criteria are necessary (and CBs don't include all that stuff in their scopes on certificates, either)

 

Extent and boundaries of what? If Product Development is part of the organization's QMS scope, then as listed in 8.3 the following apply:

8.3.2d) responsibilities and authorities - see also 5.3
8.3.2e) documented information - see also 7.5.1
8.3.2i) relevant interested parties - see also 4.2
8.3.3c) statutory and regulatory requirements - again, 4.2
8.3.4c) verification activities - do instruments need to be calibrated to ensure outputs meet the input requirements and an appropriate environment in which to function? If so, then see also 8.5.1.

And so on.

I used a matrix approach in the tool to help provide an alternative to listing all of these related activities, and ensure they get included in a process audit. Since the standards don't say "The organization shall list every single thing the audit covers in their audit report" then the matrix approach can work. But it would be helpful for organizations to understand what scope means, including in audit planning and execution.

 

If we consider "scope" we must also consider criteria to be used to audit against. The list is only ISO 9001:2015 requirements - which isn't always useful. It's often assumed to be the default, but there are many many criteria which can be used to audit against. Sadly, it's far too rare to see actual customer requirements being used - a single requirement from a contractual specification, for example. Instead, too many ONLY audit to ISO requirements (it's what is taught in the vast majority of auditor training classes, after all). Such an approach makes for - IMHO and experience - less than effective audit programs (measured by the organization's managements support and actions).

 

I am merely trying to assist our readers with the concept of planning a process audit, and demonstrating that all of the expected related clauses are also addressed as well - process interaction and all that.

This is of course assuming they are doing their internal audits to ISO 9001:2015. By all means, add other requirements. Add whatever you like. Integrate it with medical, aerospace, environment, safety, customer specific cleanliness requirements - whatever. The tool is meant to use as a guide, serve as a baseline, and add structure without everyone having to dream it up on their own. That's all.