Auditing (FAQ)

Can anyone in my organisation carry out audits of the QMS?

Yes, but they must have been trained in auditing before being allowed to carry out this activity.

Does Corrective Action have to be taken immediately?

It depends on the seriousness of the nonconformance. Any major nonconformance needs to be attended to immediately, but nonconformances of a minor nature can be addressed over a period of time.

Does the auditor have to be an expert on the area of the business being audited?

Not necessarily. Obviously it helps a great deal to know something about the processes being undertaken, but it can often be a distinct advantage not to be an "expert" as one can then approach the audit process with no preconceived ideas of how the business should be run and perhaps be able to question and challenge what is happening in a way that someone steeped in the history of the processes would not do.

Does the notice of audit have to be written?

It is normal practice for an auditor to prepare an audit plan detailing what is to be audited and when. For the auditee to arrange for people, access or escorts to be available at the right times it is necessary to be advised of the plan and having a copy facilitates this. The Notice of Audit and Audit Plan then become part of the Audit Report.

How do we know if appropriate corrective action has been taken?

Major nonconformances will be re-audited within a defined timescale that will be detailed in the individual QMS documentation. Minor nonconformances are usually not re-audited until the next scheduled audit.

How much notice should be given of an audit?

This depends on what the requirements of individual systems are, but typically a minimum of seven days notice should be given.

If a re-audit is done does it cover the whole depth of the original audit?

No, a re-audit only covers the particular area where a nonconformance was identified.

Is there any limitation on what they can audit?

Yes. ISO 9001: 2000 requires that, "auditors do not audit their own work."

Should audits be carried out unannounced and as a surprise to the auditee?

Definitely not. The whole object of carrying out audits is to obtain accurate data to continually improve the sytem. You want the auditee to be cooperative, frank, open and helpful in identifying system failures, and not defensive, reticent and reluctant to share his/her knowledge of the system.

What happens if nonconformances are found?

Any nonconformance identified during an audit is noted and a Corrective Action (or similarly titled) Request is raised to initiate action to identify the root cause of the problem and to take action necessary to eliminate the cause of the nonconformance and prevent its recurrence.