CQI IRCA QMS LA common mistakes
CQI IRCA QMS LA · Understand the traps and how to avoid them.
Writing a nonconformity as a bare conclusion - e.g. 'Document control is not effective' or 'The procedure was not followed' - with no document ID, date, sample, record reference or quoted requirement.
Candidates think in conclusions and want the finding to sound authoritative; under time pressure they write the summary they would say verbally instead of the evidence chain.
What to do instead
Use a fixed three-part structure for every nonconformity: (1) the requirement - quote the 'shall' from ISO 9001 or the organisation's own document with its ID and clause; (2) the objective evidence - record/document ID, revision, date, sample size, what was actually seen; (3) the failure - one sentence stating how the evidence fails the requirement. Read it back and ask: could an auditee who disagrees challenge any word? If yes, add evidence.
Embedding the correction or corrective action inside the nonconformity - writing 'the calibration label was missing and the lab should re-label all equipment and retrain staff'.
Candidates want to be helpful and fear the finding looks incomplete without a solution; it also feels faster than separating the two clauses.
What to do instead
Write the nonconformity only as requirement-versus-evidence. Put any action in a clearly separate 'correction/corrective action proposed by auditee' field, or leave it for the auditee to complete. In third-party audits, never propose the action at all - that is consultancy and a breach of impartiality.
Grading inconsistently: raising a major for a single missing signature in one file, then raising a minor for a whole process with no evidence of monitoring across three departments.
No explicit grading criteria are held in mind, so severity drifts with the auditee's reaction, the auditor's fatigue, or how early in the audit the issue appears.
What to do instead
Apply a stated test before assigning severity: major = a required element of the QMS is absent, entirely not implemented, or a systemic breakdown that would likely prevent the QMS from assuring conforming product; minor = an isolated lapse in an otherwise implemented and effective control. Check whether the same issue recurs elsewhere (sample across areas) before calling it major or minor, and record the rationale in one line next to the grading.
Auditing clause by clause against a checklist of ISO 9001 requirements, or reading procedures at a desk instead of walking the process, so the report never addresses process interaction, process performance or process interfaces.
The standard's numbering is easy to follow and feels like a safe, complete coverage plan; candidates worry about missing a clause and default to clause coverage over process coverage.
What to do instead
Build the audit plan around processes and their sequence and interaction. For each process, trace a real product or service from input to output, sampling records at each step, and test the process against the relevant clauses rather than testing clauses against the process. Use a process (turtle) diagram to prompt inputs, outputs, resources, controls, performance indicators and interfaces.
Asking leading or closed questions ('You do calibrate all gauges, don't you?') and recording the auditee's verbal assurance as evidence without corroborating records or observing the activity.
Candidates want confirmation of what they already expect, are nervous about silence, and verbal answers are faster than sampling evidence.
What to do instead
Use open questions ('Walk me through what happens when an instrument is found out of calibration'), then follow with 'show me' - ask for the last three instances and inspect the records. Record the evidence source, not the assertion. If an auditee says 'we always do that', ask for the last time it happened and verify it.
Verifying corrective action by checking that a corrective action form was completed and signed, without testing the root cause analysis or whether the problem has actually recurred.
The evidence of activity (form, signature, revised procedure) is easy to find and looks like closure; testing effectiveness takes extra sampling time the candidate has not planned.
What to do instead
Verify three things separately and record each: the root cause is credible and addresses the cause rather than the symptom; the action was implemented (evidence of implementation, not just a plan); and it is effective (sample post-implementation records, trend data or audit results showing no recurrence). If effectiveness cannot yet be judged, record it as not verified rather than closed.
Over-running the first process or department, then rushing or skipping remaining planned areas; sampling only the first available records (for example, only this month's file) and not recording what was sampled.
The first area yields plenty of findings and feels productive, so time control slips; sampling feels arbitrary and the candidate lacks a defensible sampling rationale.
What to do instead
Allocate plan time by risk and process size, and keep a running time check against the plan. Use a stated sampling basis (e.g. all records from a period plus all exceptions, or a random spread across shifts/sites), and log the sample - what, how many, which period - in the working documents. If time runs out, record the planned area as not audited rather than implying coverage.
Citing the wrong ISO 9001 clause or a general clause for a specific failure - for example citing 8.5.1 for a missing incoming inspection record, or 7.5 for an unavailable work instruction that is really a control-of-production issue - or citing a clause that contains no requirement the evidence breaches.
Clause numbers are memorised as a list rather than as requirements with specific intent, so candidates match the topic word rather than the actual requirement that failed.
What to do instead
Before writing the clause, read the requirement text and check that the evidence breaches that specific 'shall'. Ask: what did the organisation fail to do, and which requirement demands it? Cite the most specific applicable clause, and where ownership of a control is genuinely shared, cite the primary requirement and note the secondary one in the detail rather than listing several clauses to cover uncertainty.
Drifting into consultancy - suggesting solutions ('you should introduce a kanban board', 'I'd recommend weekly toolbox talks') in the closing meeting or report, or accepting hospitality/gifts and continuing to audit, or auditing an area the auditor previously managed.
The auditee asks 'so what do you suggest?' and the candidate wants to appear expert and helpful; conflicts of interest are not always obvious until they arise.
What to do instead
State the finding and stop: describe what is wrong and against which requirement, and let the auditee design the action. Where a solution is proposed by the auditee, test it against the requirement rather than improving it. Declare any prior employment, consultancy or personal relationship before the audit, decline gifts and hospitality, and record the declaration.
Confusing audit types and their purpose - running a certification audit exactly like an internal audit with no Stage 1/Stage 2 distinction, not confirming scope, criteria and objectives at the opening meeting, and treating the audit criteria as the organisation's documents alone.
Candidates prepare for one generic 'audit' and do not differentiate internal, second-party and third-party audits, or the readiness/effectiveness split between Stage 1 and Stage 2.
What to do instead
Before planning, state explicitly: audit type, objective, scope (boundaries, sites, exclusions), criteria (ISO 9001 plus the organisation's own documents plus applicable statutory/regulatory requirements) and the stage. For certification, use Stage 1 to confirm readiness - documented system, scope, internal audit and management review completed, resources - and reserve Stage 2 for evidence of implementation and effectiveness. Open the audit by confirming these five items with the auditee and record agreement.