Calibration Breakdown and Scope Dispute During a Two-Day Surveillance Audit
An audit team of three is conducting a two-day ISO 9001:2015 surveillance audit at a supplier of sterile-packaged injection-molded components. The audit scope covers molding, assembly, and packaging; design is excluded because the supplier does not design the part. On day one, an auditor sampling 60 calibration records finds 14 gauges past due, including the vision system used for the final 100% appearance check. The quality manager says the vision system was "functionally verified" daily and calls the finding an observation, not a nonconformity. Later, an auditor reviews a design change to the runner and begins writing a nonconformity against design control. The audit is behind schedule, one auditor is a contractor who has never audited molding, and the supplier's general manager has asked that the closing meeting be moved up by three hours so he can attend a customer event. The certification body expects a recommendation by Friday.
1. How should the calibration finding be classified, and what immediate and systemic actions should follow?
Read the worked answer
Fourteen of sixty records overdue (23%), including the vision system used to release product, points to a systemic breakdown of calibration control under ISO 9001:2015 clause 7.1.5.2 rather than an isolated lapse. Classification: a major nonconformity is appropriate where the system failure affects the organization's ability to ensure conforming product; a minor is appropriate where the lapse is isolated and does not affect product. Here the affected gauge is a final acceptance control, so treat it as major unless evidence shows otherwise.
Do not accept 'daily functional verification' at face value. A functional check confirms operation, not accuracy against a traceable standard. Ask for the check records, the standard used, and whether it detects drift.
Immediate actions:
- Contain: identify all product released since the earliest due date, quarantine or re-verify with calibrated equipment, and document traceability.
- Correct: calibrate or replace the gauges, label status, and review calibration intervals.
- Root cause: why the recall process failed - ownership, software, escalation, or workload.
- Corrective action: systemic fix plus an effectiveness check at the next audit.
Report the product impact assessment, not just the record count.
2. What should the lead auditor do about the design-control nonconformity and the audit scope?
Read the worked answer
Do not write a nonconformity against design control. The audit criteria and scope exclude design, so the auditor lacks the criteria and sampling basis to conclude a design-control failure. Writing it would be appealable and would weaken the report.
Instead:
- Record it as an observation or opportunity for improvement, clearly labeled as outside the audit scope.
- If the runner change was implemented without customer approval, audit the change control process under production (clause 8.5.6) and customer-specific requirements, which are in scope. Verify validation of the change, notification records, and approval.
- Refer the design concern to the certification body's technical reviewer or to the customer's supplier quality function if product risk exists.
- Note that the supplier is not design-responsible, so a design clause may not apply at all; confirm the exclusion is documented and justified.
This keeps the audit defensible while ensuring a real risk is not lost. The lead auditor should brief the team so other auditors do not duplicate the scope error.
3. How should the team handle the closing-meeting request, the behind-schedule status, and the contractor's competence gap?
Read the worked answer
The closing meeting is a required audit activity, but its timing is a scheduling decision, not a finding. Do not compress it to three hours early at the cost of omitting findings. Options: hold the closing meeting with the management representative and quality manager, then brief the general manager separately; or reschedule within a reasonable window and document the reason. The lead auditor should present all nonconformities and the audit conclusion, not a partial list.
For the schedule: prioritize in-scope areas, adjust sampling, and if coverage is genuinely incomplete, extend the audit or mark the conclusion as limited. Do not skip clause coverage to hit a deadline; the certification body expects a defensible recommendation.
For the contractor: auditor competence under ISO 19011 includes sector and technical knowledge. Pair the contractor with a technical expert for molding, assign only areas within competence, or reassign the auditor. Record the competence decision. If the contractor already made the scope error, review their findings before the report is issued.