Seven Self-Audits and a Management Review That Decided Nothing
Craftline Furniture, a 95-person contract furniture manufacturer, has operated its QMS for nine months and plans to book a certification audit in three months. The quality manager has personally performed all seven internal audits, including audits of the processes she owns; her reports are one-page clause checklists marked 'compliant' or 'not compliant' with no evidence. Two nonconformities from March - missing inspection records on a hospital order and a supplier delivering wrong-gauge steel - remain at 'containment done'. KPIs are reported monthly: on-time delivery 91% against a target of 96%, first-pass yield 94.2%, 11 customer complaints in the quarter with four repeats, and customer satisfaction 3.4/5 from a survey with a 12% response rate. The June management review produced no minutes beyond an attendance list and ended with 'continue as is'. A customer audit in July raised the same inspection-record issue.
1. Assess the internal audit programme against clause 9.2 and set out the minimum changes needed before the certification audit.
Read the worked answer
The internal audit programme does not meet 9.2, and the deficiency is systemic.
9.2.1 requires audits at planned intervals, planned considering the importance of processes, changes and previous results. 9.2.2 requires each audit to define criteria and scope, ensure objectivity and impartiality (auditors must not audit their own work), and report results to relevant management.
Against that:
- Impartiality: the quality manager auditing processes she owns violates 9.2.2(c). The organization is small enough that full independence is hard, but cross-auditing with trained process owners, or an external auditor for the QMS core processes, is the proportionate solution.
- Coverage: seven one-page clause checklists do not demonstrate that each process was audited against defined criteria. The audit should ask whether the process achieves its intended results, not whether a clause number has a matching document.
- Evidence: 'compliant/not compliant' with no evidence cannot support follow-up or management review.
- Follow-up: two nonconformities still at containment show the programme does not drive correction.
Before the certification audit: schedule the remaining processes, assign competent cross-auditors, rewrite checklists around process criteria and risks, and treat the audit programme itself as a nonconformity under 10.2.
2. Are the KPIs being analysed and evaluated as required by 9.1? Explain what the numbers themselves indicate and what you would change.
Read the worked answer
9.1 requires evaluation, not just reporting. The data exist, but the organization is not using them to judge performance.
The indicators show the QMS is not effective:
- On-time delivery at 91% against a 96% target is a sustained miss; reporting it monthly without cause analysis or action means 9.1.3 analysis and evaluation is not happening.
- 11 complaints with four repeats is the strongest signal: repeats show corrective action (10.2) is closing symptoms, not causes.
- First-pass yield at 94.2% needs a baseline and trend, otherwise it is a number without meaning.
- The satisfaction score of 3.4/5 from a 12% response rate is weak evidence; 9.1.2 requires monitoring customer perception, and a low response rate plus four repeat complaints suggests the survey is not capturing the real signal. Use complaint categories, returns and customer audit findings alongside it.
What to change: for each KPI define the target, frequency, owner, analysis method and the decision it triggers; produce a short quarterly performance evaluation that states conclusions (for example, 'the delivery miss is concentrated on two product lines after the March steel issue') and feeds 9.3.2. The certification auditor will look for evidence of use, not the existence of a dashboard.
3. The June management review is being relied on as evidence for certification. Evaluate it against 9.3 and state what must happen before the audit.
Read the worked answer
The June review does not meet 9.3 and must be redone before certification.
9.3.2 lists required inputs, including the status of actions from previous reviews, changes in external and internal issues, customer satisfaction and feedback, the extent to which quality objectives are met, process performance and product conformity, nonconformities and corrective actions, audit results, external provider performance, resource adequacy, effectiveness of actions on risks and opportunities, and opportunities for improvement. An attendance list and 'continue as is' show none of these were considered, and no outputs were recorded.
9.3.3 requires outputs including decisions and actions related to improvement opportunities, any need for changes to the QMS, and resource needs. Without those, the review cannot feed 10.1 and 10.3.
Before the certification audit:
- Hold a proper review with a structured agenda and a pack issued in advance; record decisions with owners and dates.
- Close or properly investigate the two open nonconformities, including root cause and an effectiveness check (10.2.1).
- Use the review to address the delivery miss and repeat complaints, so the record shows the QMS reacting to its own data.
If this cannot be done credibly before the booked date, postpone; a weak management review is a predictable Stage 2 finding and undermines confidence in the whole system.