CQI IRCA QMS LA cheat sheet

ISO 9001:2015 clause structure: 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.

The seven quality management principles are customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making and relationship management.

Clause 6.1 requires the organization to determine risks and opportunities, plan actions to address them, integrate the actions into QMS processes and evaluate their effectiveness; risk-based thinking is not a separate clause.

Only requirements in clause 8 may be determined not applicable; the justification must be maintained as documented information and reflected in the scope statement (clause 4.3).

'Documented information' replaces 'documents' and 'records': it is information the organization must control and maintain, and it is required only where the standard specifies it (clause 7.5).

Clause 9.2 requires internal audits at planned intervals; clause 9.3 requires management review at planned intervals, with defined inputs and outputs.

PDCA maps onto the clause structure: Plan (4, 5, 6, 7), Do (8), Check (9), Act (10); the process approach requires identifying process inputs, outputs, sequence, interaction, controls and performance indicators.

There is no mandatory quality manual and no fixed set of documented procedures; the mandatory documented information is limited to what clauses 4.3, 4.4, 5.2, 6.1, 7.5, 8.1, 8.5.1, 9.2 and 9.3 specify.

An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.

ISO 19011:2018 sets out seven audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.

Audit types by party: first-party (internal audit by or for the organization itself), second-party (audit by a party with an interest, e.g. customer auditing a supplier) and third-party (independent certification or accreditation audit).

An audit programme is a set of arrangements for a set of audits planned for a specific time frame and directed at a specific purpose; it is managed by establishing, implementing, monitoring, reviewing and improving.

Audit objectives state what the audit is to achieve; audit scope defines the boundaries (locations, units, activities, time period); audit criteria are the requirements used as the reference.

Combined audit = one audit against two or more management system standards; joint audit = one audit carried out by two or more auditing organizations.

ISO 19011 is guidance only and is not a certification standard; it applies to all organizations and to audits of management systems of any type and size.

An audit programme may cover internal audits, supplier audits and certification audits, and its scope and extent should be based on the size, nature and risk of the auditee's activities.

Auditor competence is the demonstrated ability to apply knowledge and skills; it comprises education, training, experience, audit knowledge and skills, and personal attributes.

ISO 19011 personal attributes of an auditor include ethical, open-minded, diplomatic, observant, perceptive, versatile, tenacious, decisive, self-reliant, acting with fortitude, open to improvement, culturally sensitive and collaborative.

Lead auditor competence adds the ability to manage an audit and lead a team, plan and prioritize, communicate with client and auditee, prevent and resolve conflict and reach conclusions.

Auditors must be independent of the activity being audited wherever practicable, free from bias and conflict of interest, and internal auditors must not audit their own work.

Ethical conduct requires integrity, fair presentation, confidentiality and impartiality, and refusal of gifts, hospitality or benefits that could influence audit judgment.

Competence is evaluated against defined criteria using methods such as record review, feedback from auditees and peers, interviews, observation and testing of knowledge.

Auditors maintain and improve competence through continuing professional development, participation in audits, and reassessment against the competence criteria.

Audit plan content per ISO 19011: audit objectives, scope and criteria, dates and places, expected time and duration, roles and responsibilities, resources, audit methods and sampling.

A pre-audit review of documented information determines whether the auditee's documentation meets the audit criteria and identifies areas that need attention and sampling.

Working documents include checklists, sampling plans, forms and the audit plan itself; they are retained until no longer needed and handled under confidentiality requirements.

Audit criteria are the set of requirements used as a reference against which objective evidence is compared, and may include standards, procedures, regulations and contracts.

The audit plan is agreed with the client and communicated to the auditee; the auditee may object to a specific team member on grounds of conflict of interest, and the objection is resolved by the lead auditor and client.

Audit sampling is based on a sample of the available information; the sampling plan should be representative and weighted by risk, importance and previous findings.

A feasibility review confirms that the audit can be conducted: sufficient information, adequate resources and time, and cooperation from the auditee.

The audit plan is a working document and may be adjusted as the audit progresses if the evidence indicates a need.

The opening meeting confirms the audit plan, scope and criteria, introduces the audit team, explains the methods, and confirms communication channels, confidentiality, safety arrangements and the closing meeting.

Open questions beginning with what, how, when, where or why yield explanation; leading, closed or multiple questions bias or narrow the response.

Objective evidence is verifiable data, records or statements of fact relevant to the audit criteria, and evidence sources are interviews, observation of activities and conditions, and review of documents and records.

Auditors examine a sample of the available information; a finding based on a sample may indicate a systemic issue and can be escalated in grading.

Tracing a process end-to-end (audit trail) verifies the process approach by linking inputs, outputs, controls, responsibilities and performance indicators.

Evidence should be corroborated from more than one source before a finding is raised, and unverified statements are recorded as such rather than presented as findings.

Evidence records should state what was seen or heard, who was involved, where and when, so that the finding can be substantiated and later verified.

Nonconformity is the non-fulfilment of a requirement; findings are raised against the audit criteria, not against personal preference or general best practice.

A major nonconformity typically involves absence of a required system element, a systemic breakdown, or a failure that would likely cause the QMS to fail to deliver conforming product.

A minor nonconformity is an isolated or single observed departure from a requirement that is not systemic and does not by itself indicate a breakdown of the management system.

Grading rules are set by the audit programme or certification body; the lead auditor determines the final grade with input from the audit team and based on risk.

Each nonconformity statement should contain the requirement not fulfilled (criterion), the objective evidence observed, and the location, process and date where it was found.

An opportunity for improvement is not a nonconformity and does not require corrective action, although the auditee may choose to act on it.

Findings are reviewed with the auditee to confirm factual accuracy; disagreements are recorded and resolved by the lead auditor, not by withdrawing a supported finding.

The audit conclusion summarizes conformity and effectiveness of the management system against the audit criteria and is stated in the report.

The audit report covers objectives, scope and criteria, dates and locations, audit team and participants, findings, conclusions and any statement of conformity; it is issued within the agreed time frame.

The report is the property of the client and is confidential; distribution is controlled by the client unless the audit programme or certification rules require otherwise.

The closing meeting presents findings and conclusions, explains the grading of nonconformities, agrees correction and corrective action timescales and confirms follow-up arrangements.

Correction fixes the immediate nonconformity; corrective action eliminates the cause and prevents recurrence, and requires root cause analysis before action is planned.

Follow-up verifies both implementation and effectiveness of corrective action and may be by desk review or on-site, or deferred to the next scheduled audit.

Verification of effectiveness asks whether the nonconformity has recurred and whether the affected process is now controlled and capable of meeting the requirement.

A nonconformity is closed only when objective evidence shows the corrective action was implemented and is effective, not merely when a document has been revised.

The report should be factual, clear and complete, and should not attribute blame to individuals; it describes evidence against criteria.

ISO/IEC 17021-1 specifies requirements for bodies providing audit and certification of management systems; ISO 19011 provides guidance on auditing management systems.

An accreditation body (for example ANAB, UKAS, CNAS or JAS-ANZ) assesses and accredits certification bodies, and IAF arrangements provide international recognition of accredited certificates.

Certification consists of a stage 1 audit (readiness: documented information, scope, internal audit and management review completed) and a stage 2 audit (implementation and effectiveness).

Surveillance audits take place at least once a calendar year after initial certification, except in the recertification year; the certification cycle is typically three years.

Impartiality rules prohibit a certification body from providing management system consultancy, and an auditor cannot audit an organization they have consulted for within the defined period.

The certification decision is made by the certification body on the basis of the audit report; the lead auditor recommends but does not grant, maintain or withdraw certification.

Lead auditor responsibilities include planning and leading the audit, assigning tasks, communicating with the client, controlling the audit, determining findings and conclusions and signing the report.

Special audits include short-notice and unannounced audits triggered by complaints, significant changes, or consideration of suspension, withdrawal or scope reduction.