Published 8/1/2000

Exploring ISO 9000 - Part 17 Internal Quality Audits

A Series of International Standards for Quality Management and Quality Assurance: Clause 4.17 Internal Quality Audits.

Bernard Carmell, President and Senior Consultant, Resource Development Group, Inc.

Q9000-2-1997 Guidance Provides Valuable Information About Internal Quality Audits

"Internal quality audits should be carried out by the supplier in order to determine whether the various quality system elements are effective and suitable to achieve the stated quality objectives. The frequency of periodic audits should be defined in an internal audit schedule.

The supplier should select and assign qualified auditors for the activity being audited. The requirement for the audit activity to be carried out by personnel independent of those having direct responsibility for the activity being audited does not preclude persons who have specific functions and responsibilities within the organization from being internal auditors of other functions and areas within the organization.

Periodic internal audits may be performed on parts of the quality system or the whole quality system:

To determine the adequacy and conformity of the quality system elements with the requirement for their documentation and implementation requirements.
To determine the effectiveness of the implemented quality system.
To give an opportunity to improve the supplier's quality system.
To facilitate external quality audits.

In addition to the periodic internal audits, an internal audit may be initiated for the following reasons:

Initially to evaluate the quality system where there is a desire to establish a contractual relationship.
Within the framework of a contractual relationship, to verify that the quality system continues to meet specified requirements and is being implemented.
Where significant changes have been made in functional areas - for example, reorganization and procedure revisions.
When safety, performance or dependability of the products are - or are suspected to be - in jeopardy due to nonconformities.
When it is necessary to verify that required corrective actions have been taken and have been effective.

The results of audits should be stated in a written report and the records should indicate the deficiencies found and corrective action(s) required. Target dates for responding to audit findings also should be included. The audit result should be communicated:

To management personnel responsible for the department or function being audited.
As input to management reviews (see 4.1.3).

It is important that follow-up audit activities demonstrate and confirm that corrective action has been taken and is effective (see 4.16)."

Note: This guidance series does not add to or otherwise change the requirements of Q9001, 2 or 3.

Before addressing the specific requirements of Element 4.17, it is important to mention selection and training of auditors. Begin to think about this need early in your quality system development process to plan events in time for effective execution. Offer all employees the opportunity to volunteer to be trained and become internal auditors. Plan auditor training to coincide with quality system implementation. In this way, newly trained auditors immediately can conduct audits using new skills. Provide reward and recognition for auditors and continue to add new auditors to your program. You will experience turnover for a number of reasons, including:

New auditors may not like the pressure of the work.
May be reassigned by management to a new position with no free time.
May leave for personal reasons.
Can't perform to expected levels.

If you have not planned for turnover by training additional auditors, your audit schedule could fall behind. Consequently, remember that you can always hire a third party auditor to help complete internal audits (see sample training agenda).

Clause 4.17 Internal Quality Audits

A. "The supplier shall establish and maintain documented procedures for planning and implementing internal quality audits ..."
B. "To verify whether quality activities and related results comply with planned arrangements and ..."
C. "To determine the effectiveness of the quality system."

Action Items

A. The key words are planning and implementing. You are required to develop procedures for both planning and implementation of internal audits. The word audit means system audit.

Q10011-1-1994 defines quality audit as "A systematic and independent examination to determine whether quality activities and related results comply with planned arrangements and whether these arrangements are implemented effectively and are suitable to achieve objectives."

Planning means both the programs for conducting audits and the actual conduct of the audit. You will develop a yearly schedule as part of the program plan. Keep it simple. Use a table with the months (top, horizontal) and the departments (left side, vertical). Place Xs by department, by month (see Table I). If you have 15 departments, your schedule will identify each department and the month's audits are planned. Most companies plan to audit the complete quality system twice per year for the first two years after Registration. Before Registration, most companies have completed at least two full quality system audits. This requires a very active audit team conducting three or four audits per month. Once you have positive audit results, you can reduce the audit frequency.

The next planning step is to develop an Audit Matrix by Department and Element (see Table II), which identifies each department within your company and the ISO 9000 Element/Clause applied to that department. This table is valuable as an audit team-planning tool to identify those procedures and work instructions applicable to each department. It also helps each department by clearly defining ISO clause requirements. The department knows what elements the auditor will be auditing before conduct of the departmental audit.

Your procedures will clearly document each step in the audit process. Most companies support the audit process by requiring all auditees to schedule time for audit completion.

Trained auditors will use checklists as reference documents during the audit and keep copious notes about activities that either comply or do not comply with requirements and why. Because an audit is a snapshot in time, some activities will not be checked as frequently as others based on audit results. However, an audit finding must always be considered important and representative as a sample reflecting possible additional nonconformities.

Your Registrar auditor(s) will look at your audit schedule to see if you are current; at your audit plan to see if you met your plan requirements and at your audit procedures to see if you followed stated procedures as written.

Action Items

B. Compliance with planned arrangements. A system audit is a documented activity performed to verify, by examination and evaluation of objective evidence, that applicable elements of the quality systems are appropriate and have been developed, documented and effectively implemented in accordance and in conjunction with specified requirements.

With this definition in mind, think about those quality activities that affect the ability of a product to satisfy its stated or implied needs. It is not enough for your internal auditors to verify that procedures are being followed. They have to take the next step to see if the results or outputs of the procedure(s) comply with planned arrangements or requirements. Auditors will ask questions about contracts, objectives and departmental goals, stated specifications, customer complaints, etc. as part of the audit process. So, be sure to define in your procedure what planned arrangements are and/or include.

Action Items

C. Effectiveness of the quality system. How do you define quality system effectiveness? Is effectiveness completion of a full audit cycle with no nonconformances? NO! You could be doing everything your procedures state, but still not satisfying your customer.

Your audit practice must identify problems present during the audit. Remember that the audit process is designed not to place blame on individuals, but to identify system deficiencies or areas of opportunities. Auditors will investigate progress by department toward achieving set goals, benchmarks or targets. Issues identified as continuous improvement opportunities and preventive action opportunities also support system effectiveness. Internal audit program effectiveness and quality system status is further validated by Registrar continuing assessments.

Effectiveness is linked to Management Review Clause 4.1.3. This clause requires Management to review the quality system to ensure continuing suitability and effectiveness in satisfying the Standard and your quality policy and objectives. Management includes audit results, customer complaints, cost of quality, customer survey results and critical evaluation of each Element of the Standard to determine overall quality system effectiveness.

Clause 4.17 Internal Quality Audits

A. "Internal quality audits shall be scheduled on the basis of the status and importance of the activity to be audited and ..."
B. "Shall be carried out by personnel independent of those having direct responsibility for the activity being audited."

Action Items

A. Schedule audit activity based on status and importance. The Audit Matrix (see Table II) developed for your company identifies activities to be audited. They are all considered important at the start of your first audit cycle. After completion of three audit cycles, your audit reports will show departments with high numbers of nonconformities. By this time, your quality system is mature enough to provide adequate objective evidence supporting compliance or noncompliance. You now have historical data to figure out the next audit schedule based on status. If your data for purchasing, for example shows -0- findings during three audit cycles, you can reduce the audit schedule frequency from twice per year to once per year. However, if purchasing history shows multiple nonconformities for each audit performed, you can increase audit frequency.

The importance of the activity is for you to decide if, in the purchasing example above, the nonconformity resulted from not signing after review of each P.O. as required by the procedure (this action does not create further negative results) or if the nonconformity resulted from not conducting the P.O. review (this action resulted in receiving the wrong raw material causing three presses to be shut down).

The importance of the second situation is much greater than first one. So, if you experienced the second situation, your action would be to increase the frequency of purchasing audits based on the high level of importance (receiving the necessary raw materials for production).

Action Items

B. Independent auditors. Independence means freedom from bias and external influences. The audit is performed by a person not responsible for production in the area being audited. For example, if you work in the quality department, you cannot audit this department. You can use your auditor knowledge to work with your superior and peers to improve the department outside your auditor responsibility. Use the audit matrix in Table II to identify and ensure auditor independence.

The reason for independence is clear. If you audited your own department, your audit results would be reported to your boss or the department head. This individual is responsible for your performance review, raises, work assignments and advancements. You would be pressured by fear of loss to overlook nonconformities to make the department look good.

Clause 4.17 Internal Quality Audits

A. "The results of the audit shall be recorded (see 4.16) and brought to the attention of the personnel having responsibility in the area audited."
B. "The management personnel responsible for the area shall take timely corrective action on deficiencies found during the audit."

Action Items

A. Audit records and management responsibility. Auditors should be trained to record both positive results and audit nonconformities. Each finding must be supported with objective evidence, or lack of such, and include the ISO element requirement not met. Audit practice is most effective when the nonconformities within a department are reported and reviewed with the department head, manager or supervisor. Gaining agreement before a closing meeting or report generation is critical.

Audit Master Software is recommended as an aid to develop audit reports. (Audit Master Software by Harrington Group is recommended based on its simple input requirement, low cost and ease of use.) There are many software products available on the market for your selection. You also can develop your own reports using word processor programs, Access database, etc.

Your audit report will include all audit results - both compliances and noncompliances. Each noncompliance should include identification of the standard's requirement, the department and location of the finding, objective evidence supporting the finding and the reason for noncompliance. Do not include prescriptive ideas.

Action Items

B. Timely corrective action by responsible management. Your procedure 4.14 Corrective and Preventive Action can be linked to Element 4.17 to define timely corrective action. This procedure includes a mandated response time, usually 30 days - requiring, at the minimum response, an action plan for root cause analysis and estimated time for closure for each nonconformity.

In practice this is a difficult time management issue the management representative (MR) has to deal with. The MR is not supposed to hold hands and prompt action to receive completed corrective action documentation. However, with "other" projects/assignments rated urgent and important, babysitting is often required to get results. Don't make this a practice or as a MR you will not have time to carry out your full responsibilities. The manager, department head or supervisor who assigned the corrective action is responsible for figuring out time requirements. Timely for one finding may not be timely for another. So, there must be flexibility built into the procedure, which allows reasonable time based on the complexity, scheduling, cost, labor requirements, etc. to respond to corrective action.