Northvale Laboratories: a low-yield internal audit programme that never reaches the risky processes
Northvale Laboratories has 45 staff across three sites and is accredited for chemical, microbiological, materials and calibration testing, issuing about 2,500 reports a year. Its internal audit programme consists of one audit of the whole management system each November, performed by the quality officer and a trained chemist using a 200-item clause checklist over two days, always in the same four work areas and always announced. The quality officer audits her own section, including document control and complaints handling. Over three years the programme has produced seven minor nonconformities, all about document and record formatting, and none in sampling, calibration or method validation. Management review receives a two-page summary table. Since the last audit Northvale has introduced an LC-MS/MS method, replaced its laboratory information management system, opened a new sample receipt area at the smallest site, and received two complaints about turnaround time.
1. Evaluate this programme against clause 8.8 and separate requirement breaches from mere ineffectiveness.
Read the worked answer
8.8.1 requires an internal audit programme at planned intervals to provide information on whether the management system conforms to the laboratory's own arrangements and to the standard, and requires the programme to be planned taking into account the importance of activities, changes and previous audit results, and to define frequency, methods, responsibilities, planning requirements and reporting. 8.8.2 requires auditors to be objective and impartial.
What meets the requirement in form: there is a programme, a stated frequency, named auditors and a report.
What fails: the programme is not risk-based. A single annual sweep of every clause is coverage, not risk assessment; the importance of activities is not considered, since calibration and sampling carry high risk to results and are never audited; changes are ignored, although a new LC-MS/MS method, a new information system and a new sample receipt area all arrived since the last audit; previous results are not used to re-aim the programme; and the fixed four work areas mean whole processes are never sampled.
Self-auditing the quality officer's own section breaches 8.8.2 on its face - that is a nonconformity, not a weakness of style.
The uniform findings profile - seven minor items, all formatting - is a signal rather than a breach: it suggests the checklist, not the process and risk, is driving the audit, and that technical processes are never sampled deeply enough to fail. The programme therefore does not demonstrate that the management system conforms, which is the purpose 8.8.1 sets. A finding against 8.8.1 is supportable if the laboratory cannot show that importance, change and previous results were considered in planning.
2. Design a risk-based audit programme for the next cycle: scheduling, coverage, methods, auditor assignment and how to handle the quality officer.
Read the worked answer
Start from the risk register, not the clause list. Rank processes by risk to results and to customers: sampling (never audited), calibration (never audited), validation of the new LC-MS/MS method, change control and data integrity in the new information system, sample receipt at the new site, then the routine chemistry and microbiology benches.
Schedule: LC-MS/MS validation and the information system within three months, because both are new and both touch reported results; sample receipt at the new site within three months as a short focused audit; sampling and calibration within six months as process audits tracing a sample or a calibration from request to report; the remaining areas annually, spread across the year rather than pinned to November, and with some audits unannounced.
Methods: process tracing and interviews, not checklist completion; take several reports per process and trace back to raw data, including at least one report per site and one shift that is not normally covered. Define audit criteria explicitly for each audit, drawn from the laboratory's own procedures and the standard.
Auditors: assign the quality officer's section - document control and complaints - to the trained chemist or to a trained auditor from another site, with a technical expert for document control if needed. The quality officer can audit other areas but not her own. Define competence criteria for internal auditors, including technical understanding of the processes they audit, and review that competence annually.
Document the schedule with the rationale, planned dates, criteria and sampling logic, and keep it capable of being re-aimed when something changes. That flexibility is what 8.8.1 is asking for.
3. How should audit results feed management review, and how would an external assessor treat this programme - nonconformity, observation, or a reason to sample deeper?
Read the worked answer
8.9 requires management review to consider, among other inputs, the results of internal audits, and to result in decisions and actions. A two-page table of formatting findings gives top management no basis to judge whether the management system is effective. The reports should show the process audited, the risk rationale, the evidence, root causes where relevant, actions taken and verified, and open items carried forward; the presentation should show trends and residual risk, not counts.
Useful effectiveness measures: whether audits detect real problems, tested against complaints, proficiency testing failures, nonconforming work, external assessment findings and problems raised by staff; whether findings recur; whether coverage matches the risk register; and whether auditees found the audit useful.
An external assessor's treatment depends on evidence, not on the low number of findings. The self-audit of the quality section is a nonconformity against 8.8.2. A programme that ignores changes and previous results, with no documented planning rationale, is a nonconformity against 8.8.1 - usually minor unless the consequence is that whole high-risk areas have never been internally audited. A merely shallow audit, with no requirement breached, is better expressed as an observation.
In all cases the internal audit weakness is also a reason to sample deeper. If the new information system has never been internally audited, the assessor should examine system records and data-integrity controls directly rather than rely on the absence of internal findings. Ask for the programme, the schedule and its rationale, three audit reports with follow-up records, and the management review minutes; then test whether the outputs changed anything.