ISO 9001:2000 Internal Auditing Introduction
In addition to the periodic external audits, ISO9001:2000 certified companies must perform routine internal audits.
Section 8.2.8 of the ISO standard lists the basic requirements for an internal auditing program. In general, it is a good idea to audit the ENTIRE quality system at least once per year. This can be done using audit checklist like the one presented on this web site or you can purchase one from several different on-line stores. You can also audit using a copy of the ISO 9001 standard.
If you are an experienced auditor you do not need to follow a check sheet, you can simple follow a process from beginning to end. Starting with the initial customer contact, following the order process is a great way to get to understand the business. This style of auditing can be very useful for generation of improvements to the quality system. You may want to plan every alternating checklist audits with process based audits. Every auditor has a different style so chose the one that works for you.
The first task in setting up an audit program is finding a team of auditors. You must have either multiple auditor or hire and independent auditor to make sure that there is no conflict of interest caused by someone auditing their own area. Auditors must be objective.
Once you have selected your auditor team, they will need training. This training can be done in-house by and experienced auditor or you can send your auditor to an ISO9001 training class. Sending your employees out to a class in your area will cost about $3000 per employee. For larger teams you may want to train the trainer and then have them train the rest of the team. On the other hand, the more trained your auditor, the better the results of each audit.
Now you will need an audit schedule (sample audit schedule). The schedule should leave room for flexibility in the timing. Don't schedule audit in December, this time of year is too busy and you risk slipping into the next year if the schedule gets tight.
Audit should be preformed in small reasonable chunks. The checklist on this site is broken into five groups (based on the sections of the standard). Plan on 20% preparation, 50% auditing, and 30% of your time for completing the report and summary.
During the internal audit, you should find as many non-conformances as possible. It is always better for the internal audit team to find the problems, not the external audit team. If you have an effective corrective actions system, then internal audits are the best way to generating input for corrective actions.
Audit reports must be maintained as a quality record. The simplest way to do this is to create a notebook (or set of notebooks) for holding the internal audit reports. You can tab them by their audit date for quick reference. Each report should include:
The audit checklist or document used to guide the audit. This document will have specific details about document numbers (found and missing), who was audited, and information about non-conforming areas. I usually include an additional sheet that summarizes the non-conformances. This sheet should go to top management so they can be aware of the quality system status.
The audit summary sheet should also be used as input for the preventive and corrective action system. I recommend generating an Engineering Change Request (ECN) for each finding or group of similar finding. The ECN/ECO can be used to assign resources to eliminate the non-conformances. The ECO system should also include a system for validation that the problem is solved before the next internal audit.
The final requirement is for follow up of non-conformances. As part of each audit plan, you should review outstanding items and re-audit them to confirm that the Engineering Change Order system has corrected the problem. If you are finding non-conformances and fixing the problems, you have evidence that the quality system is continuously improving.
Sample Internal Auditing Procedure
Sample Internal Audit ScheduleSample Internal Audit Check sheets