Determining Internal Audit Frequency

I would be interested to hear how you determine the frequency of internal audits e.g. annual plan, all processes audited at same frequency, critical processes audited more frequently, risk assessment used etc. Off the top of my head I can't remember what it says in ISO 9001:2000, I'm sure it doesn't specify frequency though. I'll check tomorrow.

Regards,
Simon

OK - ISO 9001:2000 8.2.2 Internal Audit:

"An audit programme shall be planned, taking into consideration the status and importance of the processes and areas to be audited, as well as the results of previous audits..."

The above extract from the standard does intimate that some sort of risk assessment should be used when constructing the audit schedule.

Does anybody do anything scientific on this?

Regards,
Simon

This little gem is something the cert bodies are starting to use with their big sticks

I know it is reasonably consistant with '94, but I had a 'bit of a discussion' regarding my audit schedule at the last surveillance visit. I had to agree to review my schedule, not necessarily change it, but I also blinded him with a few facts.

Our 'Important' bit is the manufacturing area. Now the schedule shows that the appropriate 'parts' are visited once a year. However as Non-conforming product, status, customer property, corrective action, records, documents, and numerous others actually 'hit' the production facility it gets 'seen to' many more times than once.

The schedule now has numerous notes to reflect this.

But again, using the vertical auditing method, if you wander into the warehouse and pick a product and work back to the order receipt, that tends to cover most things as well.

Bit of a long winded reply i'm afraid.

Our 'Important' bit is the manufacturing area.

Sure it's the place where the cake is baked. So you audit this area more frequently than say 'document control' because there are more opportunities for failure and improvement in manufacturing. Is this what you are saying?

Goodnight God Bless,
Simon

Simon,

Sure do.

But we also check the document control at the same time. If you remember from my Manual, various items are stated in one of the diagrams.

In fact document control and records are not in the audit plan as a bespoke audit!!

Management review gets one audit, essentially this is usually an annual event and therefore not as 'important'. However management review is the cornerstone of the system, and many of the 'System audits' lead back to the review, as they should. My Independant auditor actually takes 2 days with the management review audit and this really does dig into many areas.

My audit plan for 'Quality' has shrunk, but we now do more 'micro' audits, follow-ups from non-conformances, suggestions for improvements etc.

Feeling a bit tired, see you in the morning.

Chris

The above extract from the standard does intimate that some sort of risk assessment should be used when constructing the audit schedule.

Simon,

You must remember we are in injection moulding and not the food supply chain, and therefore our selection is made easier.

In effect you shall be performing a risk assessment to identify the important processes or parts of processes.

Normal thing, document this as a note in the audit schedule, and away you go.

Chris

Hello all,

We haven't done anything scientific. We have only specified a time frame,documented in our Internal audit QMS, of 1 year for a complete systems audit. We ensure that each QMS is audited as scheduled.However we do select, so to speak " sensitive" issues or QMSs such as....... demonstration of calibration methods, FIFO,validation, etc.

Thanks for your input Silvio. :)

Regards,
Simon

I produce a league table of departments.
Each department is audited at least three times a year, for the quality system and on a monthly basis for Hygiene.
They are awarded points for good audits and points are deducted for bad, number depending on how good/bad.

This then goes onto a league table with the worst performers being audited more often and the best being congratulated. As I have only been doing this for a short period, I am thinking that by the end of the year, to reward the best departments, and make it an annual event.

Nadine

Nadine,

I'm all for creativity and I applaud your novel approach. I'm not saying it won't work but I have some reservations with the league table approach, as the process of making winners by default makes lot's more losers. This could have a negative impact on the business and could lead to functional protectionism, empire building and even deliberate spoiling tactics.

Don't get me wrong it may fit perfectly with the culture of your organisation, I'm just being a grumpy old git.

Regards,
Simon

Pretty much described our site there!!

There has always been complete departmentalism (!?!) in our place, and no matter what we try to do, it just can't be broken down, so I thought if I can't bread down the barriers use them to appeal to everyone's competitive spirit!

Nadine

How about trying some job swapping? Let people spend a few days working in each others departments to create a bit of understanding, relationship building, improve communication and have a bit of fun at the same time.

Regards,
Simon