Evaluating an Internal Audit, Management Review and Proficiency Test Investigation
A 30-person testing laboratory has been accredited for three years. Last year's internal audit covered only clauses 7.5 to 7.9 because the quality manager, who performed all the audits herself, considered those the risky areas. No audit of personnel competence, equipment or traceability has been carried out for two years. The checklist has not changed since 2021. The management review met once, for 55 minutes, reviewed four inputs (complaints, internal audit, proficiency tests and workload) and recorded no decisions, owners or dates. In the past 12 months the laboratory had two unsatisfactory proficiency test results; in both cases the analyst re-tested the proficiency test sample once, obtained a satisfactory value and the case was closed. The risk register was last updated 14 months ago.
1. Evaluate the internal audit programme against clause 8.8 and design a three-year risk-based programme that fixes the coverage and objectivity problems.
Read the worked answer
Evaluation. Clause 8.8 requires audits at planned intervals to determine whether the management system conforms and is effectively implemented. The programme must be planned considering the importance of activities, changes and previous results, and each audit must define criteria and scope. Auditors must be objective and impartial, meaning they cannot audit their own work.
The current programme fails on three counts: coverage (clauses 6.2 to 6.5, which carry traceability and competence risk, have not been audited in two years), objectivity (the quality manager audits her own processes), and stagnation (an unchanged checklist tests paperwork, not effectiveness).
Three-year programme.
- Build a risk ranking of processes: data integrity, traceability, competence, equipment, subcontracting, complaints, reporting.
- Require each clause and each process to be audited at least annually at process level, with all clauses covered across the cycle.
- Make at least half the audits vertical, tracing one sample from contract review to report.
- Audit any changed or new process within six months of introduction.
- Rotate auditors: train two internal auditors from other functions, use a peer laboratory or an external auditor for the quality manager's own areas.
- Track findings through corrective action to verified closure, and report audit performance at management review.
2. Critique the management review against clauses 8.9.2 and 8.9.3. Which missing inputs matter most here, and what outputs must the next review produce?
Read the worked answer
Critique. A 55-minute meeting with four inputs and no recorded decisions does not meet the intent of 8.9. The review exists to decide whether the management system remains suitable, adequate and effective, and to set direction; without outputs it is a briefing, not a review.
Missing inputs that matter most here. The outcome of actions from previous reviews (there appear to be none recorded, which is itself a finding), results of risk identification and the status of the risk register, the outcome of ensuring the validity of results, including the two unsatisfactory proficiency tests, feedback from customers and personnel, assessments by external bodies, changes in the volume or type of work, and the adequacy of resources. Given the proficiency test history, validity of results is the single most important omission, followed by the risk register and the follow-up of prior actions.
Required outputs under 8.9.3. Decisions and actions on improvement opportunities, any need to change the management system, and resource needs. Concretely: an owner and date for each proficiency test corrective action; a decision on auditing clauses 6.2 to 6.5; a resource decision on a second trained auditor; a refresh of the risk register with a review date; and confirmation of the laboratory's objectives for the coming year.
Practical fix. Structure the agenda around the required inputs, circulate a pre-read pack, minute decisions with owner and date, and open the next review with their status.
3. Assess whether re-testing the proficiency test sample is an acceptable investigation. State what the laboratory must do under 7.7, 7.10 and 8.7, including how to establish effectiveness.
Read the worked answer
Not acceptable. Proficiency test material is intentionally homogeneous. Re-testing the same sample and obtaining a satisfactory value demonstrates short-term repeatability at best; it does not explain why the laboratory differed from the assigned value, and it lets the laboratory grade its own performance. As an investigation it has no diagnostic value.
Under 7.7. The unsatisfactory result must be analysed for cause: calibration status of the instrument, standard and reagent lots and their preparation, extraction recovery, matrix effects, analyst technique, and environmental conditions. The analysis and conclusion must be recorded.
Under 7.10. Evaluate whether routine results produced in the affected period are compromised. If a bias is plausible, identify the affected reports, notify customers, re-test retained samples where available and reissue reports where necessary. Deciding that no client results are affected is acceptable only with a documented rationale.
Under 8.7. Determine the root cause, check whether a similar problem exists elsewhere, implement the corrective action and then verify effectiveness. Effectiveness is not the satisfactory re-test; it is the result of the next proficiency test round or interlaboratory comparison, supported by interim quality control data within control limits.
Also. Review the pattern of two failures in 12 months and ask whether the root causes are related. Assessors routinely ask to see the original proficiency test report, the investigation record and evidence of closure.