Opinions on internal audit schedule adjustment

Hey all! I've spent a lot of time browsing this forum, but this is my first time posting and not just silently lurking in the background. I have a bit of a situation regarding internal auditing I was hoping to get some opinions on.
Brief background: I run a very small materials testing lab as part of a larger organization - I only serve internal customers. I am the technician, lab manager, and quality manager all rolled into one. There's two other scientists in the lab, but the testing they do is outside of the ISO scope. The lab was recently accredited to ISO/IEC 17025.

I'm trying to set up an internal audit. The last internal audit was June 2022, so several weeks ago I set the schedule and notified my 2 internal auditors that it would be June of this year as well. It was written in the management system that complete system audits would be done at least every 12 months.
One of the auditors just notified me that he can't do it until mid July. The way I see it, I have a couple of options:

1. Do the audit in July and issue a nonconformance. (not sure if a corrective action would then be needed, or what it would look like?)
2. Before June, issue a revised internal procedure for internal auditing to give myself more flexibility (maybe every 15 months?)
3. Do the audit in July, hope the AB auditor doesn't look at internal procedures or make a comment about it (terrible option, I know)

Opinions?

I already know that this is a going to be a completely ineffective audit. I'm just trying to meet standard requirements. Realize that management just wanted a shiny accreditation logo and had absolutely no idea of what the accreditation entails or means or requires, and dumped the entire project on me two months after I started with the company (me, not even knowing what ISO was and having no experience in quality!). No one else in the company takes this seriously. I'm trying to make the best of a really crappy situation and just stay afloat until I can make my escape.

Issue a nonconformity, do a corrective action, schedule and conduct the audit..........

Next, put on your parachute, look for a safe place and BAIL!

I did find this in a search about 17025 internal audit requirements;

Laboratories are required to have a program of internal audits to assess whether their operations comply with ISO/IEC 17025 requirements on an ongoing basis. This involves auditing both management and technical activities to identify gaps, and to drive improvements.

If this is correct (the plural use of "audits"), I think you are setting yourself up for failure by doing one huge all encompassing audit once per year. I've been involved in interval audit programs (but not 17025 based) where we spread the load out over the year. You also will avoid the "we better do things right, it is audit month" tendency. For exomple, you mentioned one of your two auditors was not available until July. Could the remaining auditor get started in June to get some portion of the audit underway?

DblHelixx said:

One of the auditors just notified me that he can't do it until mid July. The way I see it, I have a couple of options:

1. Do the audit in July and issue a nonconformance. (not sure if a corrective action would then be needed, or what it would look like?)
2. Before June, issue a revised internal procedure for internal auditing to give myself more flexibility (maybe every 15 months?)
3. Do the audit in July, hope the AB auditor doesn't look at internal procedures or make a comment about it (terrible option, I know)

Opinions?

I already know that this is a going to be a completely ineffective audit. I'm just trying to meet standard requirements. Realize that management just wanted a shiny accreditation logo and had absolutely no idea of what the accreditation entails or means or requires, and dumped the entire project on me two months after I started with the company (me, not even knowing what ISO was and having no experience in quality!). No one else in the company takes this seriously. I'm trying to make the best of a really crappy situation and just stay afloat until I can make my escape.

Click to expand...

Here's another option - get an effective audit by hiring a competent external auditor / team.

ISO/IEC 17025:2017 clause 6.1 General
"The laboratory shall have available the personnel, facilities, equipment, systems and support services necessary to manage and perform its laboratory activities."

clause 6.2.1: "All personnel of the laboratory, either internal or external, that could influence the laboratory activities shall act impartially, be competent and work in accordance with the laboratory's management system."

If they want to keep the badge, tell management that the procedure requires that internal audits be done on time, and auditors not being available is only acceptable if auditors all across the world are not available.

You can tell them that (though it's not true) to see how much they are willing to support the system & accreditation. If they aren't then I'd strongly support Randy's advice.

Steve Prevette said:

If this is correct (the plural use of "audits"), I think you are setting yourself up for failure by doing one huge all encompassing audit once per year. I've been involved in interval audit programs (but not 17025 based) where we spread the load out over the year. You also will avoid the "we better do things right, it is audit month" tendency. For exomple, you mentioned one of your two auditors was not available until July. Could the remaining auditor get started in June to get some portion of the audit underway?

Click to expand...

I agree that doing all the audits at once is probably not the best idea. The implementation consultant set it up this way, and not really understanding the audit purpose at the time, I just went with it. I am going to take a look at rewriting the procedure manual to allow for "rolling" audits.

For exomple, you mentioned one of your two auditors was not available until July. Could the remaining auditor get started in June to get some portion of the audit underway?

Click to expand...

If I do this, wouldn't the audits that take place in July still be a nonconformance, given that the current procedure states "every 12 months"?

qualitymanagerTT said:

Here's another option - get an effective audit by hiring a competent external auditor / team.

Click to expand...

I did suggest an external audit, but of course management won't approve the cost. I've also tried to get the internal auditors to take a training course, but again they don't want to spend the money (or time). So frustrating!

I could have someone else in the company do the internal audit, like one of the scientists who work in the lab, but they don't know much about the standard. I could also have just the one available internal auditor do the entire thing? That option just seemed like it would make the process even less effective. What are the downsides to waiting until July and issuing a nonconformance? As long as a corrective action is taken, this isn't necessarily a bad thing?

Randy said:

Next, put on your parachute, look for a safe place and BAIL!

Click to expand...

Working on it! This has at least taught me that I am interested in quality management. Silver linings, right?

>>If I do this, wouldn't the audits that take place in July still be a nonconformance, given that the current procedure states "every 12 months"?

It depends on if you get credit for STARTING the audit within the 12 months. Probably worth documenting the issue, and say the corrective action is to transition to a rolling schedule. Plus when you set up the schedule, I would suggest making it a "resource loaded schedule" which who will be doing what when, and informing those folks who will be doing the audits and gettting concurrence on he schedule from their managers,

This would still be better than doing nothing and waiting until July to start with both people.

I don't know 17025, but can't you just revise the procedure now, implement rolling audits, prioritizing them based on risk (start doing some in June), and move ahead? Thus, no nonconformance, right?

Sadly, your company might not be a minority as far as wanting the badge but not really embracing quality or wanting to do the work to maintain the badge.

DblHelixx said:

Silver linings, right?

Click to expand...

Could very well be, you never know. I'm not in Quality or Quality Management per se.

Mike S. said:

I don't know 17025, but can't you just revise the procedure now, implement rolling audits, prioritizing them based on risk (start doing some in June), and move ahead? Thus, no nonconformance, right?

Click to expand...

I'm thinking this is the route I might take. It's a very tight timeline and might raise some questions if an external auditor were to look closely. I still might log a corrective action or put it on the agenda for the management review meetings so it is documented.

DblHelixx said:

I'm thinking this is the route I might take. It's a very tight timeline and might raise some questions if an external auditor were to look closely. I still might log a corrective action or put it on the agenda for the management review meetings so it is documented.

Click to expand...

That's sticking a plaster on the wound.

Based on what you say, management is not providing resources necessary for the existing management system, and trying to avoid an NC is masking the much bigger and deeper problem.

It's your decision whether you want an effective MS, or just a certificate on the wall.