TL-9000 Certifying Body Issue - Auditor failed to find an issue for 10 years

We had out annual TL certification audit and were told that we had been collecting and calculating one of the data sets incorrectly. My issue is we have had the same CB for over 10 years and this was never brought to our attention. Is it wrong to depend on the CB to find these types of issues and what should my company do about this? We are being told that we will have to go back several years and investigate the data, recalculate and re-enter the information. Any advice would be helpful. Can we write a corrective action against the CB for not performing a complete audit?

I feel your pain. You should reject the issue back to the CB, citing that a) this auditor is incompetent or b) all the previous auditors were incompetent. This is pretty fundamental to TL9000 and shouldn't be an issue after 10 years. You might also reach out to the QuESt forum for validation of your approach to generating metrics.

AndyN said:

I feel your pain. You should reject the issue back to the CB, citing that a) this auditor is incompetent or b) all the previous auditors were incompetent. This is pretty fundamental to TL9000 and shouldn't be an issue after 10 years. You might also reach out to the QuESt forum for validation of your approach to generating metrics.

Click to expand...

Thanks. I guess we depended on them to assure we were doing everything right and now we know. This auditor is the one who found the issue so I can't fault him, but for the last ten years...………...

Coasterguy500 said:

were told that we had been collecting and calculating one of the data sets incorrectly.

Click to expand...

But are they correct in their assertion? Has the auditor pointed out WHY they arrived at this conclusion?

AndyN said:

But are they correct in their assertion? Has the auditor pointed out WHY they arrived at this conclusion?

Click to expand...

IT was the definition of Network Element. I can see his point but why wasn't if found earlier. I get that we made a mistake, but isn't that the point of being audited? It is just very frustrating.

Coasterguy500 said:

I can see his point but why wasn't if found earlier

Click to expand...

Hence your need to point this out to the CB's management and that they have participated in the "approval" (since they didn't "test" it) for 10 years...

And don't let them fob you off with the "it's a sample" routine...

Coasterguy500 said:

I can see his point but why wasn't if found earlier. I get that we made a mistake, but isn't that the point of being audited?

Click to expand...

The responsibility for the system is ALWAYS with the organization that implements it. So, as you said yourself, YOU (the organization) made a mistake. So, you have to own it. As for as why the previous CB auditor(s) never reported the issue, it is a valid question and you should bring it up with the CB. You can even provide anonymous feedback to the Quest Forum/TIA via the Anonymous Audit Feedback Survey link.

Good luck.

They are likely to get away by saying that Auditing is done on sampling basis and whatever samples they selected so far, did not surface this issue. This is the irony in Auditing. Auditing as an exercise fulfills compliance, not necessarily the effectiveness of it. I personally have never relied on sampling basis audits. 0 NCs does not mean that you have a great system and a few NCs does not necessarily mean that you have a broken system. I have even noticed external auditors making such remarks in the Opening Meetings they conduct before start of the audit process.

Try to find out if this could have been an obvious miss or sampling theory holds true here. Also another thing to note here is that your own Internal Auditing has also missed it, so better try to find root cause of this miss.

patkim said:

Auditing as an exercise fulfills compliance, not necessarily the effectiveness of it

Click to expand...

True, but CB audits are supposed to evaluate effectiveness - they don't.

patkim said:

Auditing is done on sampling basis and whatever samples they selected so far, did not surface this issue.

Click to expand...

In this case, the TL metrics have a very high significance and should have been closely evaluated. It's not a case of whether it fell into the "sample". It's a bogus response, in this case.

Coasterguy500 said:

I guess we depended on them to assure we were doing everything right

Click to expand...

Bad. It isn't really their job. A company should never assume that an auditor will find every mistake they are making, even after 10 years. Obviously eventually an auditor did, though.

Coasterguy500 said:

I can see his point but why wasn't if found earlier.

Click to expand...

In every pre-audit meeting I have ever attended, to absolve themselves of responsibility they always make a point of telling the company they are auditing that they are looking at a sample and are not going to be able to look at everything.

patkim said:

They are likely to get away by saying that Auditing is done on sampling basis

Click to expand...

@patkim is right on. I have been through so many audits over the years that after the audit sighs of relief rang out such as "I'm glad they didn't look at <whatever>" or "Boy, am I glad they missed <whatever> in those records (or whatever) they looked through".