The clean audit record at Greenfield Training Group
Greenfield Training Group delivers apprenticeships from five sites. Its internal audit programme has one auditor, the quality manager, who audits every process once a year against a twelve-item checklist. Audits are announced four weeks in advance, and the annual schedule is fixed each January regardless of what has changed during the year. In two years the programme has raised no nonconformities. Over the same period, learner complaints rose from 40 to 210, with 68% concerning late assessment feedback, and one site failed an external health-and-safety inspection. Corrective actions are logged, but every entry is closed with the same phrase, retrain staff, including one raised three times about the same late-feedback problem. Management review meets twice a year; the standing agenda is finance, enrolment numbers and marketing, and actions from previous reviews are not tracked. The chief executive says the clean audit record proves the management system is working and wants to book the certification audit for next quarter.
1. Judge the effectiveness of the internal audit programme against Clause 9.2 and state what must change.
Read the worked answer
The 9.2 test. The audit programme must be planned considering the importance of processes, changes affecting the organization and the results of previous audits. Audit criteria and scope must be defined for each audit. Auditors must be selected so that objectivity and impartiality are safeguarded. Results must be reported to relevant management.
Why this programme fails.
- Independence: the quality manager audits the quality manager's own process, breaching the impartiality requirement directly.
- Static planning: a January schedule that ignores change - the health-and-safety failure, the complaints surge - is not planned on risk or on previous results.
- Narrow criteria: a twelve-item checklist defines what can be found. Issues outside it cannot surface.
- Announcements: four weeks' notice lets the auditee prepare the evidence rather than demonstrate normal operation.
- Competence and reporting: one auditor with no evidenced audit training, and no route for findings to reach the chief executive other than the log.
Interpreting zero findings. No nonconformities across two years while complaints rise more than fivefold is not evidence of a healthy system; it is evidence that the audit is not testing the right things. The health-and-safety failure is a further signal that the audit scope missed a significant process.
What to change. Assign auditors from another site or function to audit the counterpart area, with a technical expert where needed; build a risk-based programme that audits assessment and feedback more often; widen criteria to include performance data and complaint trends; record auditor competence; and require findings to be reported to the process owner and to management review. The certification audit should be booked only after a cycle of the redesigned programme, because an auditor will test whether internal audit provides assurance, not whether it produces clean records.
2. What must the management review cover, and why is the current agenda a nonconformity risk rather than merely a dull meeting?
Read the worked answer
9.3.2 inputs. The review must consider the status of actions from previous reviews; changes in external and internal issues; performance information including trends in learner satisfaction and feedback from other beneficiaries; the extent to which objectives have been met; process performance and conformity of educational products and services; nonconformities and corrective actions; monitoring and measurement results; audit results; the performance of external providers; the adequacy of resources; the effectiveness of actions taken to address risks and opportunities; and opportunities for improvement.
9.3.3 outputs. Decisions and actions relating to opportunities for improvement, any need for changes to the management system, and resource needs.
Why the current agenda is a problem. Finance, enrolment and marketing cover perhaps two of the listed inputs, and untracked actions mean the review cannot close the loop between decision and result. A twice-yearly review that never examines 210 rising complaints, audit results, corrective-action effectiveness or provider performance is not performing its intended function. That is a nonconformity against 9.3, not just a boring meeting - and the missing inputs are precisely the ones that would have surfaced the late-feedback problem.
Fix. Issue a standing agenda mapped directly to the 9.3.2 inputs, with a data pack circulated in advance, and require every action to carry an owner and a date. Open each review with the status of previous actions so that effectiveness can be judged. Note that 9.3 does not require a single meeting: the review may be spread across sessions provided all inputs are covered and outputs are recorded, which is a practical route for a small organization.
3. Every corrective action is closed with retrain staff, including one raised three times for the same problem. Assess this against Clause 10.2 and describe what a defensible corrective action would contain.
Read the worked answer
10.2 requirements. On a nonconformity the organization must react - control and correct it and deal with the consequences - then evaluate the need for action to eliminate the cause so that it does not recur, implement the action, review its effectiveness, update the risks determined in 6.1 if necessary, and change the management system if necessary. Documented information of the nonconformity, the actions taken and the results must be retained.
Testing the log. Retrain staff is a valid corrective action only if the cause is competence. Late assessment feedback recurring after three separate retraining actions is strong evidence that the cause lies elsewhere: process design, marking workload at fixed deadlines, unclear responsibility, or missing tracking. Repeating the same action and closing the record is a failure to evaluate effectiveness, and is itself a nonconformity, because 10.2 requires the review step.
What a defensible action looks like.
- Root-cause analysis: why are marks late? Marking volume concentrated at a fixed deadline, no cover, no tracker, no escalation.
- Redesign: staggered submission dates, a marking tracker with an escalation point, a named owner per programme.
- Measure: percentage of marks returned within the stated turnaround, reviewed monthly.
- Review date: a scheduled check that the recurrence has stopped, with the record showing the result.
- Risk update: the risk register entry revised to reflect the new control.
If retraining is genuinely part of the fix, it becomes one element of a wider action, not the whole of it.
Judgement. The chief executive reads the clean audit record as a verdict on the management system. The stronger reading is that the system is measuring itself too gently: clean audits, repeated identical corrective actions and rising complaints are three symptoms of the same weakness, and the certification auditor is likely to reach that conclusion first.