You are conducting a third-party audit to ISO 9001 and the next item on your audit plan is ‘internal auditing’.

You are conducting a third-party audit to ISO 9001 and the next item on your audit plan is ‘internal auditing’.

When reviewing a sample of audit records up to 5 years previously, you find that many contain non-conformance reports and no actions have been taken. You interview the Quality Manager.

You: "I have noted that many of the older files contain non-conformances that have not had any corrective action taken."

Quality Manager: "Because the business is always changing, the departmental managers tell me that the non-conformances are no longer applicable. I made a decision that any non-conformance over 3 years old is automatically closed"

You: "Do you obtain any confirmation beforehand from the appropriate departments that the non-conformances are no longer applicable."

Quality Manager: " No, because they are so old I consider that they are no longer appropriate. Please remember that we take a risk-based approach which means we audit where and when it is considered important to do so.

Select one course of action you would now take from the options.
A . Interview Top management to determine whether they were aware of and agreed the actions of the Quality Manager
B . Review all non-conformances reports related to clause 9.2 of ISO 9001
C . Interview relevant Departmental managers to assess whether the older non-conformances are still valid.
D . Raise a non-conformance report against clause 9.2.2.e of ISO 9001

View Answer

Answer: D

Explanation:

According to ISO 9001:2015, clause 9.2.2.e, the organization is required to retain documented information as evidence of the implementation of the audit programme and the audit results. This includes the records of the nonconformities identified during the internal audits and the corrective actions taken to address them. The organization is also required to verify the effectiveness of the corrective actions, as per clause 10.2.2.

Therefore, in the scenario given, the Quality Manager’s decision to automatically close any nonconformance over 3 years old without obtaining any confirmation from the relevant departments or verifying the effectiveness of the corrective actions is a clear violation of the requirements of clause 9.2.2.e. This indicates a lack of control and follow-up of the internal audit process, as well as a potential risk of recurrence or occurrence of the nonconformities in other areas. This also undermines the credibility and value of the internal audit programme, as well as the risk-based approach claimed by the Quality Manager.

Hence, the best course of action to take is D, to raise a nonconformance report against clause 9.2.2.e of ISO 9001, and to communicate the audit findings to the relevant management. The other options are either insufficient or irrelevant to address the issue, as they do not directly relate to the noncompliance with clause 9.2.2.e.

Reference:

ISO 9001:2015(en), Quality management systems ― Requirements, clause 9.2.2 and 10.2.2

ISO 19011:2018(en), Guidelines for auditing management systems, clause 6.4.4 and 6.7.2

ISO 9001 Lead Auditor Training Course | IRCA Certified | BSI, section “Learning objectives”

ISO 9001 Lead Auditor Course Material | 3FOLD Education Centre, module 5 and 6