Setting up the ISO9001 for a sole proprietor company

Hi all,

I would like to seek experience from members here, if you have any experience helping clients to set up their ISO9001:2008 or ISO9001:2015, if the client is a sole-proprietor, i.e. he/she is a "One-person company".

I have a friend who is running a small trading company, and he is basically a 'One-man company', where his operation is fairly simple. The operations is basically to understand the customers needs (he is in premium gifts business), and forward all his customers needs to his suppliers / contractors (outsourced) to produce them. he will sell them back to the customer.

Now that he has acquired a job with a large company, and one of their policies is to have vendors ISO9001 certified. He is trying to go for the certification.

Now, basically, if we are to read the ISO9001 requirements, everyone / every company regardless of size can be certified ISO9001. The whole implementation should not be difficult.

Just a quick questions, in this case, how he/she is to perform "INTERNAL QUALITY AUDIT" ?


Thanks

 

To subcontract a competent external auditor.
This approach is used regardless the number of employees.

 

The guide is ISO 9000:2015 cl.3.10.1 Note 3 which reads “Internal audits… are conducted by, or on behalf of, the Organization itself…” Please refer to “on behalf of”.
Internal audits can be conducted, on behalf of the organization, by either a freelancer(s) or a CB. The freelancer can be a CB auditor. (The CB shall not provide internal audits to its certified clients - ref to ISO 17021:2015 Part 1 cl. 5.2.6).
Internal auditors shall implement requirements of 9.2 which are similar to those implemented by CB auditors.

 

I would like to go with the concept of hiring a competent external auditor that does process audit. (Could be working for a CB or any other institution) - the key is - let the auditor explain to you how they would add value (without excess bureaucracy) to your QMS.

 

The internal audit is very hard for very small companies. Typically they operate in niches where bringing another business in (exchange auditing) can cause loss of business or stolen proprietary information. They typically cannot return the favor because as a one person show they do not have the time to reciprocate with another business. Having a education option sounds interesting, but would require to to be close to schools or colleges that would do this. Hiring out for the average "tiny business" is a big expense also, as it must be a full audit, since the one operator show is directly responsible for every process (its all his own work), although the 2015 version has dropped this language, so maybe there is some leeway there.
I have always believed that certification is much harder financially on very small operations, and this discourages adoption, after all, if his customer did not require it, he would likely stay uncertified, right?
On the plus side, control in a small company is more easily accomplished since the decision making is concentrated.

 

1. About a freelancer being CB auditor.
CB widely contract freelance auditors to do audits. Usually these auditors are trained and qualified by the same CB. Each auditor signs a statement of impartiality and no conflict of interest.
2. About self-auditing:
ISO 9001:2015 cl.9.2.2 reads: "The organization shall: c) select auditors and conduct audits to ensure objectivity and the impartiality of the audit process. Please pay attention to "impartiality". Self-audit wil not be impartial.
ISO 17021:2015 Part 1 cl. 4.2.4 reads: "Threats to impartiality may include but are not limited to the following: b) Self-review: threats that arise from a person or body reviewing the work done by themselves.

 

I think self audit can be impartial under certain conditions, such as following a premade audit checklist composed by others outside the area of review. If issues are found, then followup would have to be by an 'impartial' auditor, but for overall evaluation, a checklist will work in this case.

 

I don't know. They way I see it, I know people who where multiple hats: consult, do internal audits for small companies, and third party audits for CBs.

With a one person show, internal audits obviously become problematic. So contracting with someone to do the audit is simple, if not expensive. I am intrigued by the apparent allowance to audit your own work.

 

The Note at the end of 9.2 references ISO 19011 for guidance, which I believe also calls for independence from the activity being audited. As much as I support the idea, especially for small businesses, I just don't see being able to convince a CB that self-auditing is acceptable.

 

Any CB auditor will evaluate self-auditing as nonconformity since indepndence of the audit is not ensured. Refer to ISO 9000:2015 cl 3.13.1 "audit is ...independent...process ...".

 

If I have to look in a mirror, do I need somebody in my side to tell me those that need fixing?