The Quality Manager Audits Everything
A 180-employee manufacturer has an internal audit procedure requiring annual audits by trained auditors. Twelve employees are trained, but the schedule shows all 14 audits assigned to the Quality Manager, who also owns the QMS, and to one production supervisor. The Quality Manager audited top management, her own QMS processes and production. Internal audit reports for the last three years show zero nonconformities and four observations, all closed the same day. Management review inputs state 'internal audit results: no issues.' An external surveillance audit then found seven nonconformities in production and maintenance. Auditor training records are current, but there are no competence evaluations and no evidence that audit frequency considered risk or previous results.
1. Evaluate conformity to ISO 9001 clause 9.2 and identify the systemic issues in this audit programme.
Read the worked answer
Clause 9.2 requires internal audits at planned intervals, an audit programme that considers importance and previous results, objective and impartial auditors, and reporting to relevant management. The Quality Manager auditing her own processes and top management is a direct independence failure. The production supervisor auditing production is also auditing their own work. The three-year record of zero nonconformities while an external audit found seven production and maintenance nonconformities is strong evidence that the programme is not effective. The same-day closure of all observations and the absence of audit results in management review reinforce that the programme is a paper exercise. The auditor should sample auditor competence evaluations, the risk basis of the schedule, audit reports, corrective actions and management review inputs.
2. Draft a nonconformity statement and justify its classification.
Read the worked answer
NC statement: 'The internal audit programme does not ensure objective and impartial audits. The Quality Manager, who owns the QMS processes, audited her own work and top management; a production supervisor audited production. In addition, the programme has reported zero nonconformities for three years while the external surveillance audit identified seven nonconformities in production and maintenance. Audit results have not been used as a management review input.' Clause: 9.2.2.
Classification: major. The failure is systemic across the whole programme, not a single missed audit, and it undermines the organization's ability to detect and correct problems. The external findings confirm the effectiveness failure.
3. Recommend corrective action and state whether previous internal audit results can be relied upon.
Read the worked answer
Corrective action: revise the audit schedule so auditors do not audit their own work; use the 12 trained auditors and evaluate their competence; base frequency on risk, process performance and previous findings; require audit reports with objective evidence; add internal audit results to management review; and re-audit production and maintenance within a defined period.
The organization should not rely on the previous three years of internal audit results for certification confidence. The auditor should verify implementation through records and interviews, not just a revised procedure. If the certification decision depends on internal audit evidence, the certification body may need a special audit or deferral.