Four weeks to a certification audit: what to fix, what to disclose, what to postpone

Closeable in four weeks with real evidence:

• Calibration: calibrate or quarantine the two overdue instruments now, record the impact assessment for any product released using them since the due date (7.6). This is a one-day fix plus an honest impact review.
• Supplier approval: raise a retrospective evaluation for the packaging supplier using certificates, a questionnaire and incoming history, and record the interim risk decision and the date by which a full evaluation will be completed (7.4.1). Declaring it 'approved' with nothing behind it is worse than a documented, time-bound risk acceptance.
• Quality manual: update clause references - cosmetic, quick, and its absence signals a document control problem.
• Management review: cannot be recreated retroactively. What can be done is to hold a proper review before the audit with full inputs and recorded decisions and actions (5.6.2, 5.6.3), and to present the February event honestly as inadequate. Backdating minutes is falsification.

Disclosable but not fully closeable:

• The second site and the new product family. This is a notification matter, not an audit-preparation matter (see next task).
• Internal audit coverage: purchasing and the warehouse can be audited in the remaining weeks by a competent, independent auditor; the production manager's audit of her own area cannot be undone and must be disclosed.

Cannot be fixed in four weeks: the independence defect in the completed internal audit. It is a fact about the past; the fix is the corrective action and the re-audit, not a reissued report.

The ranking rule: fix what produces objective evidence quickly and what touches product safety or regulatory reporting first; disclose what is structurally wrong; never manufacture evidence.

Clause 8.2.4 requires auditors to be objective and impartial and not to audit their own work, and requires the audit programme to cover all processes with a schedule that considers process status and importance. Ardent has both a coverage gap and an independence breach.

Correction (fix the immediate gap):

• Assign an auditor independent of production to audit production; someone from quality or engineering with the right competence, or a contracted auditor.
• Audit purchasing and the warehouse before the certification audit, using the planned checklist and criteria, and issue the reports with findings.
• Record the reason for the additional audits in the audit programme - the programme can legitimately be revised.

Corrective action (fix the cause):

• Rewrite the audit programme: annual schedule covering every process, auditor competence criteria and training, an independence check at the planning stage, and a rule that no auditor audits their own function.
• Determine why the production manager audited her own area: likely a resource or competence shortage because only one or two people are trained as auditors. Train two additional auditors from non-production functions - this is a resourcing decision that management review must take, which conveniently also demonstrates management engagement.
• Add a review step where the audit programme is approved by top management, so coverage cannot be silently dropped under time pressure.

What the auditor will test: whether the new audits actually happened and produced findings, whether the auditors were independent, and whether the programme has the coverage and scheduling logic the standard requires. A revised procedure alone will not satisfy them; the evidence of audits performed after the corrective action will. Be prepared to explain the original deficiency plainly, because the auditor will find it - the credibility gain from self-identification is much larger than the risk of admitting it.

Notification. Certification bodies require advance notification of changes that affect the QMS or the certification - typically new sites, significant scope extensions, major process or ownership changes, and changes affecting the audit duration. Ardent has added a packaging and labelling site, which brings additional processes and personnel into scope, and a new product family, which may extend the technical scope and requires the appropriate technical competence on the audit team. Both should have been notified when they occurred. Notifying now, in writing, with the dates of the changes and a description of the affected processes, is the correct action.

Consequences of not notifying: the audit team may lack the competence and time to cover the second site, the certificate may not cover the new product family (so the commercial benefit is lost anyway), and the certification body may treat the omission as a failure of the client's obligation to inform - which can affect the validity of the certificate or trigger a special audit at Ardent's cost.

Should it proceed? It depends on the notification outcome. If the certification body can add a site visit and a technical expert within the window, proceed, accepting a revised audit plan and duration. If not, postpone the stage 2 audit and use the time to complete the internal audits and a proper management review - a failed stage 2 typically means re-audit at full cost with a mandatory interval, which is worse than a delay of four to eight weeks.

Before proceeding in any case: the internal audit corrective action must be implemented (not merely planned), the management review must have recorded outputs, and the six pre-assessment gaps must be either evidenced as closed or honestly reported as open with a plan. Closing items by email assertion is precisely what an auditor samples for, and a single fabricated closure undermines every other record in the system.