Your advice, please

Is this a hypothetical to start a discussion? Or a real thing you are facing?

My advice:
1. Internal auditor should audit the areas they were brought in to audit, auditing against the 2015 version, and write the findings. (In short, do their job)
2. Sounds like they do have a design process...in short, it reads "Find an outsource partner".
3. So what? Is it bad to have references to fried chicken as well? Does the 2015 version require that no references to 9001:2000 may exist? The question is whether or not the documentation satisfies 2015.

Go ahead with the audit.
Write the findings.
Risk to the CB auditor is nil if they do their job. Risk is high if the company reports them (they wont)... but who cares? People tend to be at high risk when they don't do their jobs.
Company "should" respond by updating to the degree needed to meet the requirements of 9001:2015.
Company likely "will" respond differently given the anecdotal evidence already given.
So someone found that BG auditor ... I'm the last one that would ding them for it.

 

I do a bit more research so I knew what I was stepping into. I would want to see the last few CB audit reports. Maybe the stuff is there but I am missing it? If it is, then problem solved. If not, then audit and document findings. Go from there.

 

Well @Andy Nichols ;
Shall we assume you are "asking for a friend" or is this, sadly, a real world situation ?

My professional opinion is simply "do the right thing". "Swallow the medicine", "rip off the band-aid" and any other applicable metaphors.

The purpose of the QMS (as you well know) is not to please the CB, but to benefit the organization and its customers in a manner which meets the requirements of the standard. To do that, diligence, transparency, and (sometimes) bravery is needed.

If I came into a leadership role in an organization, and on my first day my team came to me with this exact scenario, the aforementioned is what I would tell them.

Hope this helps.
Be well.

 

??? no idea where to go with that one

Which bullet point or clause is that violating?
If they outsource all aspects of design, and take responsibility for the result...they are design responsible.

The question is whether the internal audits ensure compliance to 9001:2015.
It's easy enough to rev that document to say "9001" instead of "9001:2000" and be done with it...the document isn't the point, the internal audit function is.

 

IDK. To me it seems like something else is going on. Are you saying they are certified to 2015 but have nothing related to the updated 2015 standard implemented? If so, it would seem like some type of fraud is going on.

 

At the end of the day, I typically default to...do it right, whatever it is you are charged to do or paid to do.
If someone else was cutting corners (or committing the above mentioned fraud) and me doing it right shines a light on it...at least it wasn't me committing fraud, or intentionally doing it wrong.

Pertinent question: Do you have a dog in this fight? Or are you just hired to do a job right? If it hits the fan, are you part of the splatter-mess?
I might suggest a different approach if that answer is "yes".

 

Sounds to me like the company has excellent 'auditor handling skills'. I applaud them.

 

How about this? Rather than doing it thru an internal audit, do it thru a gap analysis. Go in and fix the known issues, then do the audit. Fixes the issue without the CB auditor "knowing" about it. Obviously, the conversation eventually has to be regarding a new auditor.

 

Not sure how to reply, or even whether to...but here it is so that's one decision made...

I've seen, admired, agreed with, disagreed with, applauded, etc. many of your posts and advice over the years...I think I know where you're coming from, what you want to see in a healthy company and some of your pet peeves.
FWIW, it seems (on a typed forum, so who knows?) that you are reacting out of some of those pet peeves...so I'm showing some of the other side as the advice you asked for.

I'm not trying to tangent onto anything...simply pointing out that obsolete references not being updated are not 'non-compliance'. It took us years to remove all the references to QS9000 when that went away. The old references didn't hurt anything.

From what you describe, the documentation in the company has not been effectively updated for decades. My ask is simply whether the documentation is effective enough for running the business the way the company chooses to run the business.

We will disagree on design responsibility, so there's no point hashing any deeper into that one.

You say this is a real world situation, and you are asked to perform an internal audit.
I (safely) assume that this is your first internal audit for this company, else stuff would have been fixed already and you wouldn't be asking for advice.
Not knowing the reason they called you, instead of using whomever they have been using (if any)...I advise to do the job they are paying you to do, and to help them retain/regain/establish compliance to the standard against which you are auditing. The end.
I have oft stated that I WANT internal auditors to do "consulting" along the way if they feel it warranted...this one seems like a case in point...they need more than an internal audit.

If some other has been dropping the ball for a decade or more, and finally gets caught...that's not your problem (unless it was you, which I doubt).
If the company learns valuable information about their CB auditor(s), I say good.
If someone who has been charging these folks for a decade, but not doing their job gets fired/sued/reprimanded...that also is not your problem (unless it was you, which I doubt).

So you're really down to two options: Do the job right, or don't take the job.

I hope I haven't offended, either in this post or above, it certainly was not the intent.

 

Were the results of the internal audit affected the surveillance audit?