Internal audit report review
Our company contracts an external party to conduct our Internal audits. This typically is the same auditor coming in (once annually)
The auditors comment on his last audit visit was he could not be seen to be auditing his own work so he was not going to review the previous internal audit report ( beyond checking previous NCs raised had been addressed). He advised us to be doing this part of the audit ourselves.
We have now received his report so what would you suggest is the best method to do this review? What would be deemed as suitable documented evidence to show this has been done?
Assign topic to the user
ISO 9001 DOCUMENTATION TOOLKIT
Step-by-step implementation for smaller companies.
Find out more 
ISO 9001 DOCUMENTATION TOOLKIT
Step-by-step implementation for smaller companies.
Find out more
ISO 9001 DOCUMENTATION TOOLKIT
Step-by-step implementation for smaller companies.
Find out more
I will not comment your auditor’s comment about doing the follow-up.
Please consider this flowchart:
When you receive the audit report a first step is to separate minor from major nonconformities.
About the minor nonconformities
The auditor found one nonconformity. As a good practice your organization should check if there are other situations not audited with the same nonconformity. A minor nonconformity requires a correction. An action to eliminate the nonconformity. Define the correction, implement that correction and shortly after check that the nonconformity was removed. For example, the auditor found an outdated form at the warehouse. Your organization check all forms in use and finds another outdated form at the sales department. Remove outdated forms and distribute the updated ones. One-week later check that the right forms are being used at the warehouse and the sales department. All these steps should be recorded in a form for treating audit minor nonconformities.
About the major nonconformities
The auditor found one nonconformity. As a good practice your organization should check if there are other situations not audited with the same nonconformity. A major nonconformity requires both a correction to eliminate the nonconformity and a corrective action to eliminate the cause of the nonconformity. Define the correction, implement that correction and shortly after check that the nonconformity was removed. At the same time, investigate what are the possible causes of the major nonconformity and determine the root cause(s) of that major nonconformity. Then determine a corrective action to eliminate that/those root cause(s). Implement that corrective action and shortly after check that the corrective action was implemented. After some agreed time, check that the implemented corrective action was effective. For example, an organization took to much time to answer to complaints. Their internal procedure mentioned less than 24 hours for a first answer while they had on average more that 60 hours. 3 months after implementing the corrective action they concluded that the average time for the first answer was 12 hours. The corrective action was effective.
Please ensure that implementation and effectiveness is verified by someone not working on the department or area where the nonconformity took place.
You can find more information below:
- Major vs. minor nonconformities in the certification audit - https://advisera.com/27001academy/blog/2014/06/02/major-vs-minor-nonconformities-in-the-certification-audit/
- Free webinar on demand - How to perform an ISO 9001:2015 internal audit - https://advisera.com/9001academy/webinar/how-to-perform-an-iso-9001-2015-internal-audit-free-webinar-on-demand/
- ISO 9001:2015 Internal Auditor Course: https://advisera.com/training/iso-9001-internal-auditor-course/
- Book - ISO internal audit: A plain English guide: https://advisera.com/books/iso-internal-audit-plain-english-guide/
Comment as guest or Sign in
Jun 01, 2020