ISO 21001 Lead Implementer study materials
ISO 21001 Lead Implementer study resources

Weak monitoring and internal audit at a business faculty

ISO 21001 Lead Implementer · Put your knowledge to work in context.

All case studies

Weak monitoring and internal audit at a business faculty

Westfield University's Faculty of Business has 4,300 students and 210 staff. It tracks module pass rates, currently 86%, a learner satisfaction survey scoring 3.9 out of 5 with a 31% response rate, graduate employability within six months at 78%, and average complaint resolution time of 12 working days. Data are compiled by a faculty administrator in spreadsheets and presented to the faculty board twice a year. Internal audits are performed by a single quality officer who audits all nine departments, including the one she manages; the checklist has not changed since 2019 and focuses on document control. The last audit produced 14 findings, all closed by staff retraining with no root-cause analysis. The management review agenda covers the four KPIs and previous actions only. A new dean wants to use the EOMS to improve outcomes but is unsure whether the current monitoring is adequate. The next certification audit is in five months.

1. Evaluate the adequacy of monitoring, measurement, analysis and evaluation under 9.1. What is missing, and what should be added?

Read the worked answer

Clause 9.1 requires determining what to monitor and measure, the methods, when, who analyses and evaluates, and retention of evidence. The four KPIs are mostly lagging outcome measures and are not enough. Missing elements include process measures such as timeliness and quality of feedback, assessment moderation, curriculum review cycle, attendance and engagement; equity analysis of pass rates by demographic group and campus; external provider performance; complaint root causes and recurrence; and data quality, since a 31% response rate limits representativeness. The spreadsheet process is fragile and lacks validation. Add a small set of leading indicators, define data definitions and owners, and analyze trends against objectives. Also monitor learner safety and wellbeing indicators, and the effectiveness of actions taken, not just outcomes.

2. Evaluate the internal audit programme against 9.2. Identify at least three deficiencies and propose a revised programme.

Read the worked answer

Deficiencies: first, independence. The quality officer audits her own department, contrary to 9.2; auditors must not audit their own work. Second, the audit programme is not risk-based or updated; the 2019 checklist focuses on document control and misses core processes. Third, audit competence and criteria are not defined, and one person auditing nine departments is not sustainable. Fourth, findings are closed by retraining without root-cause analysis, so recurrence is likely. Fifth, reporting to management may not be effective. Revise with a programme covering all clauses and key processes over a cycle, auditors selected for independence and competence, risk-based frequency, documented criteria and scope, auditor training, and follow-up that verifies effectiveness of corrective action. Include at least one cross-department audit and one audit of the assessment process.

3. Recommend management review inputs that are missing and explain why each matters.

Read the worked answer

Missing 9.3 inputs include the status of actions from previous reviews; changes in external and internal issues; interested party feedback from learners, staff and employers; the extent to which objectives are met; performance and effectiveness of the EOMS, including nonconformities and corrective actions; audit results; adequacy of resources; risks and opportunities; and improvement opportunities. The current agenda covers KPIs and previous actions only. Add a standing review of the risk register, a summary of learner complaints and appeals, staff feedback, external provider performance, and resource decisions. Outputs should include decisions on improvement and resource needs. Without these, management review cannot demonstrate that the EOMS is suitable, adequate and effective.