Maintenance backlog, misleading KPI and safety-critical calibration
Crestline Foods operates a chilled ready-meal plant with an ammonia refrigeration system, 11 production lines and a 2,400-item asset register. The site's ISO 55001 certificate covers 'manufacture and cold storage of ready meals'. The CMMS shows 412 preventive maintenance work orders overdue by more than 30 days out of 3,100 scheduled; 38 of the overdue tasks are statutory pressure-system inspections. The monthly asset management KPI pack reports 'PM compliance 98%' because it counts only statutory inspections completed on time, and even that figure excludes the refrigeration contractor's work. In an interview, the maintenance planner says the backlog is 'normal for us' and that budget constraints mean two planned shutdowns were cancelled. Twenty sampled work orders include six with no completion evidence and two signed by the same person on the same day for work at opposite ends of the plant. An ammonia detector calibration certificate is dated 14 months ago and the procedure requires six-monthly calibration. The operations manager says the detector is 'tested weekly by the shift team' but cannot show records.
1. Assess whether the audit evidence is sufficient to conclude on maintenance control and what additional evidence you would seek.
Read the worked answer
The evidence is relevant but not yet sufficient on its own: CMMS backlog report, KPI pack, interview with the planner, 20 sampled work orders and a calibration certificate. Corroborate with the PM procedure and its risk-based intervals; the CMMS data extraction method and whether overdue dates are reliable; contractor reports and refrigeration service records; shutdown cancellation approvals and risk assessments; detector test logs and shift handover records; management review minutes and any actions on the backlog; interviews with the asset manager, operations manager and a technician.
Observe the detector and ask for the weekly test method; check whether the test is a functional test or calibration. Sample work orders across criticality, not just 20 randomly. Determine whether the two same-day signatures at opposite ends of the plant indicate a recording practice, delegated sign-off or falsification; ask the signer and supervisor.
The conclusion should distinguish between a documentation weakness and a failure to control maintenance. If the CMMS dates are unreliable, the auditor needs to verify the backlog through physical checks and maintenance records before concluding.
2. Write the nonconformity or nonconformities you would raise, with criteria, evidence and classification. Justify major versus minor.
Read the worked answer
Likely nonconformity: clause 8.1 and 9.1. The organization has not controlled preventive maintenance: 412 of 3,100 PM orders overdue by more than 30 days, including 38 statutory pressure-system inspections; six of 20 sampled work orders have no completion evidence; two work orders signed the same day for work at opposite ends of the plant; two planned shutdowns cancelled without evidence of risk assessment. Classification: major, because the failure is systemic across the maintenance process and affects safety-critical equipment; it is not an isolated lapse.
A separate nonconformity for the ammonia detector may be raised under 8.1 and 7.5: calibration certificate 14 months old against a six-month procedure, with no records of weekly tests. If the detector is a safety control, major; if the weekly test is effective and only calibration records are missing, minor may be arguable, but the absence of both calibration and test records supports major.
Write findings objectively: state the requirement, the evidence and the location. Do not use 'poor culture' as the finding. Separate the maintenance backlog from the detector issue if the causes and process owners differ.
3. How should the auditor handle the '98% PM compliance' KPI and the possibility that management is being misled?
Read the worked answer
The KPI is defined as statutory inspections only, yet it is labelled 'PM compliance'. That is a misleading indicator, not necessarily fraud. Trace the KPI definition to the procedure, ask who approved it, and check whether management review or the board received the limitation. If top management knows the definition, the issue is a nonconformity against 9.1 and 7.5 because the information is not fit for purpose. If management believes 98% covers all PM, the organization lacks effective monitoring.
Do not accuse individuals of dishonesty in the report; record facts and ask for an explanation. If evidence suggests deliberate misreporting, raise it with the team leader and client top management in line with the audit programme's integrity procedures. Consider whether it affects the reliability of other evidence and expand sampling.
The finding should focus on the control failure, not the label alone: what decision did the KPI drive, and did the backlog remain invisible as a result?