How Far Back Do Auditors Tend to Review?
I was curious as to what your experiences have been with auditors. During our recent audit, the auditor wanted to view a Corrective Action that was over a year old. During that time we were not Five Why Charting all of our NC's for our corrective action reports. We had since then put the Five Why process into effect, documented, trained and showed a thorough root cause analysis as well as monitoring on our CA reports. All of this was provided. The auditor gave us a minor for the past corrective acion requests stating that we did not conform to section 3.7.1 stating that we did not perform a proper root cause analysis and proper verification of effectiveness. The CA's in question were rather minor and hygiene related and staff had recieved 2 refresher training 's since. We had to go back and re-do a root cause analysis for these old NC's. What are your thoughts on this and how far back have you had an auditor request records from?
I am an Auditor and I might go back a year, and sometimes even more - it depends on what is being reviewed at the time. With that said I don't understand why you didn't challenge the auditor on this, clearly the process that you started to comply with 3.7.1 wasn't in effect at the time. Even though it's a "minor" I would suggest a challenge on it, even though it is after the fact and hopefully you didn't sign anything that said you accepted the findings, that does make it a bit harder.
Hi EmmE
I also work as an auditor how far back you go depends on various factors including the audit standard, when the last audit was, risk. If the food business had an audit 6 months ago I tend to go back 6 months worth of records. IF it was 12 months ago, I go back 12 months of records.
As for non-conformance's and root cause analysis not being completed I would have also given a CAR but based on when the change was made in that time. Stuff from say 2 years ago - well no, but you would need to show the full documentation leading to the change being made ie your own internal audit that had picked up the issue, what was done, time frame etc. If you made the change like a week before the audit - a CAR would be raised (especially if you have been certified to a particular standard for a while).
Undertaking root cause analysis is not a new thing in any of the GFSI standards. Based on what you have said, you completed a 'corrective action' by way of re-training staff but the part of verifying effectiveness is an often missed area. I believe that if you do your root cause and verification correctly - you won't (and should not) see the issue happen again.
The way that I check this is to look at previous non-conformances and see if they are still re-occurring.
In my experience they have not gone past the date of the prior audit, typically less than that date. e.g. for an anual audit they may go back 3 to 6 months.