Fixed audit days, a familiar face, and a 24-hour plant
A certification body runs the EMS audit programme for a waste-to-energy operator with three sites, each with one incinerator line operating 24 hours in three shifts. The three-year programme, approved by the technical manager, allocates a fixed 1.5 auditor-days per site per surveillance audit regardless of headcount, tonnage, number of permits or nonconformity history. Site B has received a major nonconformity in each of the last two audits. The auditor assigned to Site B was that plant's own engineering manager until 14 months ago; the programme manager says this is "why we picked him - he knows the incinerator". No competence evaluation or witness audit is recorded for him. The Site B audit plan covers the day shift only.
1. Identify the failures in the management of this audit programme against ISO 19011 clause 5 and the relevant certification-body requirements, and explain why each matters.
Read the worked answer
1. The programme is not risk-based (19011 5.4). Programme extent, duration and frequency must reflect the risk and importance of the processes, prior audit results, and changes. A flat 1.5 days across three dissimilar sites, with no allowance for Site B's repeat majors, is a schedule, not a programme. Site B should be receiving more time and more scrutiny, not the same.
2. Audit time is not justified (IAF MD 5; ISO/IEC 17021-1). Audit time must be determined from effective number of personnel, complexity, regulatory regime, number of permits, shift patterns and prior performance, and the calculation must be recorded and defensible. A 24-hour, three-shift incinerator with multiple permits cannot be adequately sampled in 1.5 days. The programme manager must be able to show the calculation; "we always use 1.5" is not one.
3. Shift coverage is inadequate. If the plant runs three shifts, the audit must sample night/back-shift operations, or record a justified reason why not. Unsampled shifts are an unmanaged limitation on the conclusion.
4. Competence is asserted, not demonstrated (19011 7.2–7.5). Waste incineration, emissions monitoring and permit compliance require sector and legal knowledge, plus audit skills. There is no evaluation record and no witness audit, so the CB cannot show the auditor meets the competence criteria for this scope.
5. Impartiality (17021-1 clause 5.2). Employing a person who was the site's engineering manager 14 months ago threatens impartiality and breaches the two-year cooling-off expectation for personnel who have been employed by the client. Even if the individual believes he can be objective, the threat is not manageable by assurance alone and must be eliminated by reassignment.
2. What would you, as the programme manager, have to put in place before the Site B surveillance audit could proceed? Be specific about decisions you must take and record.
Read the worked answer
Decisions, each documented with rationale:
- Reassign or remove the auditor from Site B. Not negotiable given the 14-month gap; use him elsewhere in the sector. Record the impartiality analysis.
- Build a team with demonstrated competence: incineration/emissions technical competence, knowledge of the applicable permit and waste legislation, and a competent auditor/lead who can manage the audit. Interview or witness-evaluate before assignment; record the evaluation against the competence criteria (19011 7.3–7.5).
- Re-calculate audit time using MD 5 inputs: effective personnel, three-shift coverage, number of permits and significant aspects, complexity of the incinerator, previous NC history. Record the number and justify it; expect an increase.
- Set risk-based objectives for this audit explicitly - e.g. verify effectiveness of corrective action for the two prior majors, verify 9.1.2 evaluation of compliance against current permits - and reference them in the plan (19011 5.4, 6.2).
- Revise the plan to include back-shift and night-shift sampling, the CCR/control room, the ash and residue handling, and interviews with operators, not just the plant manager.
- Consider a different sampling emphasis and whether an unannounced or extended element is warranted.
- Inform the client of the changed team and time before the audit, without disclosing the reasons in a way that compromises the individual.
If the client objects to the increased time, the CB decides on the basis of its own justified calculation; the audit does not proceed on an unjustifiable time budget.
3. How should two consecutive major nonconformities change the programme itself, not just the next audit?
Read the worked answer
Consecutive majors at one site are a programme-level signal, not an audit-level inconvenience. Actions:
- Increase frequency and/or duration at Site B for the remainder of the cycle; revisit the site's position in the sample of sites.
- Test the corrective action system, not just the defects. Two majors in two years suggests 10.2 is not identifying root cause or that actions are not effective. Verify effectiveness at the next audit rather than closure on paper.
- Review the CB's own performance (19011 5.6/5.7): were the audits that closed these NCs adequate? Was the same weak team, the same short time, the same day-shift-only plan used? If so, the programme is producing the failures it is meant to catch.
- Consider whether the 9.2 internal audit and 9.3 management review at the client are functioning - repeated external majors usually mean internal audit is not.
- Escalate to the certification decision-maker: sustained non-effectiveness can affect continued certification, and the CB's procedure for suspension must be considered, not deferred.
- Feed lessons into programme review (risk register, competence needs, time model) and record the changes, so the programme is demonstrably improved rather than merely repeated.