A Comfortable Audit and a 45-Minute Management Review
A laboratory's annual internal audit programme consists of one audit, performed in November by the quality manager, covering sample reception and housekeeping. The quality manager also manages sample reception. Two findings are raised - a missing signature on a chain-of-custody form and an unlabelled reagent bottle - and both are closed two weeks later with the note 'staff retrained'. The December management review lasts 45 minutes. The minutes record a discussion of revenue, sales pipeline and staffing costs, and conclude that the management system is effective. No inputs are recorded on the status of actions from previous reviews, changes in external issues, adequacy of resources, results of risk identification, or results of external assessments. In June the laboratory added a new test method for heavy metals in soil; it was not included in the audit scope. An accreditation assessor is preparing a surveillance visit.
1. Evaluate the internal audit programme against the requirements for internal audits. Rank the deficiencies by severity.
Read the worked answer
Independence - most severe. The quality manager audited the area she manages. Auditors must be objective and impartial, and auditing one's own work cannot satisfy that regardless of how good the findings are. From the outside, the two findings look like exactly what a manager would find in her own area: tidy, administrative, non-threatening.
Scope. One audit covering reception and housekeeping is not a programme covering all laboratory activities at planned intervals. No process audit of testing, reporting, equipment control or data integrity took place. The heavy metals method added in June - new work, new risks, new competence requirements - was never audited.
Risk basis. The programme must consider the importance of activities, changes and the results of previous audits. A newly introduced method is a textbook trigger for scheduling an audit, and it was ignored.
Closure. Both findings were closed by 'retraining' with no cause analysis and no verification of effectiveness. An unlabelled bottle is a labelling-process failure, not a knowledge failure; retraining a person does not install a process.
The programme therefore provides assurance about tidiness, not about whether the management system is effectively implemented and maintained - which is the stated purpose of the audit.
2. Assess the management review. What would a competent reviewer conclude about a review that ends with 'the management system is effective'?
Read the worked answer
The review fails on both inputs and outputs.
Inputs. The minutes show revenue, sales pipeline and staffing costs. The required inputs are absent: status of actions from previous reviews; outcome of internal audits; corrective actions; assessments by external bodies; changes in the volume and type of work, which would have captured the new method; customer and personnel feedback; complaints; effectiveness of improvements; adequacy of resources; results of risk identification; and the outcome of activities assuring the validity of results. Several failures in this laboratory - an unaudited new method, an uninvestigated systemic nonconformity - would have surfaced if those inputs had been tabled.
Outputs. 'The management system is effective' is a conclusion without a decision behind it. The review should record decisions on the effectiveness of the system and its processes, on improvement, on resource needs and on any need for change, each with an owner and a date.
Conclusion. A 45-minute meeting on financial metrics is a management meeting, not a management review. It cannot detect what the review exists to detect. Declaring effectiveness on that basis is worse than holding no review at all, because it manufactures false assurance and gives the quality manager and top management a defensible-looking answer for the assessor.
3. Formulate the corrective actions you would raise, and specify how effectiveness would be verified at the surveillance visit.
Read the worked answer
Raise system-level nonconformities, not just the two original findings: the internal audit process and the management review process.
Audit programme actions. Define scope and schedule by process and by risk, with the new method audited immediately. Assign auditors independent of the area being audited, and confirm their competence and the audit criteria used. Specify what closure evidence is acceptable, so that 'retrained' is not an option without cause analysis and objective evidence. Reopen or re-examine the two closures.
Management review actions. Build the agenda from the required inputs so that each is tabled with data, require the pack in advance, minute decisions with owners and dates, and carry outputs forward to the next review as tracked actions.
Effectiveness verification. At the surveillance visit the assessor should look for: an audit schedule covering all processes including the new method, with auditor independence documented; a sample of findings closed with cause analysis and evidence rather than training alone; management review minutes containing every required input and decisions with owners; and evidence that at least one decision from the review changed something. If the same findings recur after these actions, the corrective action addressed the paperwork rather than the cause - the identical mistake the laboratory made when it closed findings with retraining.