ISO 9001 Internal Audit

What Sydney said!

People turn on your brains and think about what an internal is supposed to do - and not do. For Deming’s sake please think.

Small companies often have their own, basic way of doing it. It could be lack of buy in to iso9001 a sort of necessary evil to do business. This could result in a once a year UA to check that list for certification.

Imho risk is different across the iso9001 clauses and any company's processes. So you ideally need to audit internally certain processes often. It really depends on what iso9001 certification means to the organisation. It could really add value or just be a cost of business certification requirement. The latter is a missed opportunity and a waste of time.

I suspect the issue is with both the company being audited and the 3rd party auditor. It is too often about paper certificate and chargeable time for auditors / money earned for the auditor organisation. Both sides acting as co-dependants. That's toxic to the employee who believes in iso9001 and wants to do things right. Been there! Hope I'm not still there but in a big company.

qcman said:

Our QMS states internal audits will be done annually. Due to circumstances out of our control our 2024 internal audit will be a month over due. Will this be a finding in the 3rd party audit and if so can we just send an email stating an exception for this year?

Click to expand...

Probably missing some details. Year 2024 is not finished yet, why are you saying there will be a delay?

You've got between 1/1/24 & 12/31/24 to do an "annual" audit unless you specifically say "1 year from the last audit" or "365 days" or something along that line.

Technically you can do an audit on 1/1/this year and go all the way to 12/31/next year to do your audit.

If your procedure specifically says "annually" and you've got an audit planned for anytime in 2024, regardless of month, and your 3rd party goon tries to take exception to it, tell him/her to "pack sand".

Now, your auditor, if and only if, can show, with objective evidence, that your audits are not "effective", then all bets might be off. Many 3rd party types aren't that swift.

Sidney Vianna said:

Threads like this one just provide more anecdotal evidence that, as we approach 40 years of ISO 9001, organizations still derive no business benefits of internal audits, because, if they did, top management would be the first ones ensuring these events took place. Sad state of affairs for the industry out there.

The standard REQUIRES (not suggests) that internal audits MUST be planned/scheduled taking into consideration, status, importance and past performance. Irrespective of the organization size, a full cycle of internal audit in one full swoop does not comply with that requirement. As I mentioned several years ago here in this space, the CB community (myself included) is also to blame for allowing totally ineffective internal audits to fester in the business world.

Click to expand...

Really. Many small companies usually have "working management" -- they actually spend time on the floor and are involved with the daily tasks. Issues are generally well know and are readily dealt with as they arise. As a small company with less than 20 employees, a once per year audit push does just fine for us.

Jane's said:

Hi, we are a small company and do the same, one big annual IA. We were not only late one calendar year, we completely missed the IA (did it in March of next year instead of November of that year), and for that received a finding the next year, despite a memo we put on file that this deviation is approved by the top management.

Try with changing the language of your quality objective that drives the process, assuming you have one, or your IA procedure, to say “IA’s to be conducted with frequency of 12 months +/- 5.5 months, and you may avoid a finding. I hope that helps.

Click to expand...

Of course you did. I am reading through the thread, and I am not understanding why only one a year even if the company is small. Why is there only 1 audit a year?

mindytanner said:

Of course you did. I am reading through the thread, and I am not understanding why only one a year even if the company is small. Why is there only 1 audit a year?

Click to expand...

Obviously I can't answer for the OP, but a single audit is easier to manage. Don't have to constantly chase for completion. We divide up the processes between three auditors and say lets get them done in the next 2-3 months. Don't forget, in a small company people usually wear many hats and are generally busy with their day to day obligations. Scratching time out for internal audits isn't easy.

Thanks for all the inputs. My only concern is we state annually and the last one was conducted 13 months ago. I don't believe this will be an issue but thought I would ask. I could leave it be, change it to each year, annually ± a couple months or spread it out over the year.

Golfman25 said:

Really. Many small companies usually have "working management" -- they actually spend time on the floor and are involved with the daily tasks. Issues are generally well know and are readily dealt with as they arise. As a small company with less than 20 employees, a once per year audit push does just fine for us.

Click to expand...

Ditto. We are a 9 ppl lean, mean machine

Golfman25 said:

Obviously I can't answer for the OP, but a single audit is easier to manage. Don't have to constantly chase for completion. We divide up the processes between three auditors and say let’s get them done in the next 2-3 months. Don't forget, in a small company people usually wear many hats and are generally busy with their day to day obligations. Scratching time out for internal audits isn't easy.

Click to expand...

Absolutely. You also prevent bad blood by having someone external do it, plus it’s probably the only way to avoid ppl auditing their own work (I.e. many hats).