Interpretation of audit report

Is the auditor looking for a documented procedure and a record of the type and extent of control?”

Answer:
In my interpretation the auditor is not asking for documented procedures. In my interpretation the auditor is asking for a clear and systematic answer to the questions: Is there any kind of planned control for purchasing? Does your organization control all incoming materials, services and subcontracted processes the same way? For each incoming materials, services and subcontracted processes: What do you control? Who controls? What are the specifications? What are the sampling quantities? Where are results recorded? Do you need to check subcontracted processes? By whom? With what frequency? Where do you record those control activities?

As far as I remember “old” ISO 9001 vocabulary, “special processes”, now in clause 8.5.1 f), need to have some kind of process capacity control. For example, in welding we require welder professional certification, in pasteurization we require temperature and process control. Your organization should require some kind of evidence that special processes such as NDE are done correctly, with people and equipment able to deliver the right results.

The following material will provide you information about purchasing requirements:
- ISO 9001 – How to establish process validation in the QMS - https://advisera.com/9001academy/blog/2017/01/31/how-to-establish-process-validation-in-the-qms/
- How to control outsourced processes using ISO 9001 - https://advisera.com/9001academy/blog/2015/05/05/how-to-control-outsourced-processes-using-iso-9001/
- free online training ISO 9001:2015 Internal Auditor Course
– https://advisera.com/training/iso-9001-internal-auditor-course/
- book - ISO Internal Audit: A Plain English Guide - https://advisera.com/books/iso-internal-audit-plain-english-guide/