Audit, Inspection and Compliance Verification
What to know
Distinguish inspection (checking compliance at a point in time, often regulatory) from audit (systematic, independent examination of a management system against criteria). Know audit types: first-party (internal), second-party (supplier), third-party (certification). Understand the audit cycle: planning, opening meeting, evidence gathering, findings, closing meeting, report, and follow-up.
Evidence comes from observation, interviews, and documents/records. Findings are classified as major nonconformity, minor nonconformity, observation/opportunity for improvement, or conforming. A nonconformity must cite the requirement, the evidence, and the gap. Root cause analysis (e.g. 5 Whys, fishbone) drives corrective action; corrective action addresses cause, corrective/preventive action prevents recurrence.
Traps
- Confusing correction (fix the issue) with corrective action (fix the cause).
- Auditing only documents, ignoring observation and interview.
- Writing findings without referencing the standard/requirement.
- Treating an observation as a nonconformity, or vice versa.
Rule of thumb
Every finding needs three elements: requirement + evidence + gap. If you cannot state all three, it is an observation, not a nonconformity.
Worked example
A fridge log shows a missing day. Requirement: daily temperature records. Evidence: log gap on 12 May. Gap: no record, no corrective action noted. Finding: minor nonconformity. Root cause via 5 Whys: no backup when the responsible person is absent → corrective action: designate a deputy and add to checklist.