An auditor demands a risk register the standard never asked for
Cendral Health Services runs a 300-person sterilization and sterile-packaging operation for hospitals. Its internal audit programme uses two trained auditors; one of them is the deputy to the operations manager. During the latest audit, an auditor raised a minor nonconformity: "Clause 6.1 not implemented - the organization has no documented risk register and no documented risk assessment methodology." The QMS manager assembles what exists: a monthly senior management team review that walks through a risk-and-opportunity table last updated three weeks ago, a business continuity plan with tested failover for the sterilization autoclaves, a complaints trend analysis that triggered revalidation of the sealing process, and an internal audit schedule that was extended after a spike in near-misses. None of it is titled "risk assessment". The auditor's position is that ISO 9001 requires documented information about risks and that a register is the recognized way to provide it. Separately, the same auditor audited her own department's processes in the previous cycle.
1. Is the nonconformity valid? Evaluate the 6.1 requirement precisely and say what would change your answer.
Read the worked answer
The finding as written is not valid, because it prescribes a method the standard does not prescribe.
6.1.1 requires the organization to determine the risks and opportunities that need to be addressed to give assurance that the QMS can achieve its intended results, enhance desirable effects, prevent or reduce undesired effects, and achieve improvement. 6.1.2 requires it to plan actions to address those risks and opportunities, integrate the actions into its QMS processes, and evaluate their effectiveness.
What the standard does not require: a risk register, a risk matrix, a scoring scale, a named methodology such as ISO 31000, or a document titled "risk assessment". Risk-based thinking is a principle; 6.1 is its operational requirement, and it is output-oriented. Documented information is required only where necessary for the effectiveness of the QMS (7.5.1 b).
On the facts stated, Cendral can demonstrate all four elements: risks determined (SMT table, near-miss analysis), actions planned, actions integrated into processes (sealing-process revalidation), and effectiveness evaluated (autoclave failover tested). That is 6.1 implemented.
What would change my answer:
- If the SMT table were a list of generic categories with no actions, no owners and no dates, the determination would be a document rather than a process.
- If the effectiveness step were missing - actions taken but never reviewed - 6.1.2 would be unmet.
- If risk determination existed only at strategic level and operational processes showed no evidence, coverage would be incomplete. Absence of a register is a style issue; absence of determination-and-effect is a real one.
2. How would you handle the finding itself as an audit output? Distinguish between the organization's obligation to respond to a finding and the finding's technical correctness.
Read the worked answer
Two separate questions must not be merged.
1. The correctness of the finding. A finding must state the requirement and the evidence of its absence. "No risk register" describes a method, not a requirement, so it is a finding of the auditor's opinion. The correct route is the audit report review step in the audit programme: the lead auditor (or the function that manages the programme) evaluates the finding against the criteria before it becomes an action item. A well-run organization challenges it with evidence, in writing, and records the resolution.
2. The organization's obligation. Even a disputed finding triggers a decision. Under 10.2 the organization must evaluate the need for action - it may conclude no action is required, provided that decision is reasoned and recorded. The wrong response is to create a risk register purely to close an audit line: that produces a document that is filled in for auditors and used by nobody, which is worse evidence than none.
3. The response that adds value. Use the dispute to strengthen the demonstration rather than the paperwork: add a short cover page to the SMT risk-and-opportunity table stating the method used, who determined each risk, which process it was integrated into, and when effectiveness was last evaluated. That closes the evidence gap without adopting a template. Also verify that risk-based thinking reaches operational level (sterilization parameters, sealing validation, supplier changes), since that is where the auditor's instinct may legitimately have come from.
3. The auditor audited her own department. What does the standard require of the audit programme, and what would you do next?
Read the worked answer
The requirement. 9.2.2 requires the organization to plan, establish, implement and maintain an audit programme, including frequency, methods, responsibilities, planning requirements and reporting. It must consider the importance of the processes concerned, changes affecting the organization, and the results of previous audits. It must define the audit criteria and scope for each audit, select auditors, and conduct audits to ensure objectivity and impartiality of the audit process. 9.2.2 also requires results to be reported to relevant management and documented information retained as evidence of implementation and results.
An auditor auditing a process she manages is a direct 9.2.2 failure, independent of whether her conclusions were sound. The provision exists because the risk is not malice but normalisation: a manager does not see her own workaround as a workaround. Her subsequent unsupported finding on 6.1 illustrates the point - a rigorous second reader would have caught the method-prescribing error before it reached the auditee.
What I would do next:
- Re-assign that audit: either swap auditors between the two trained staff so neither audits her own area, or bring in a competent person from outside the function.
- Review all findings produced in the affected cycles and re-validate any that touch the auditor's own department.
- Check auditor competence (7.2) and whether both auditors were trained on the criteria and on writing findings against requirements.
- Raise a corrective action on the audit programme itself, not on the auditor: the root cause is a programme with only two auditors and no independence rule, which will recur at the next cycle.
- Confirm the programme revision is risk-based rather than simply re-shuffled - if independence was impossible with two auditors, the plan should have stated how impartiality would be achieved, for example by contracting an external auditor for that process.