Annex B-3 Quality audit

1. Objectives of internal audits 

1.1  The laboratory or inspection body should conduct internal audits of its activities to verify that its operations continue to comply with the requirements of its quality management system.

1.2  These audits should check that the quality management system fulfils the requirements of ISO/IEC 17025, whichever is applicable, or other relevant criteria documents, i.e. that there is conformity.

1.3  These audits should also check whether or not the requirements stated in the organisation’s quality manual and related documents are applied at all levels of work.

1.4  The non-conformities found in internal audits give valuable information for the improvement of the organisation’s quality system and should thus be used as input to management reviews.

2. Organisation of internal audits

2.1  The internal audits should be carried out according to a documented procedure.

2.2  Internal audits should be programmed such that each element of the quality management system is checked at least once a year. In large laboratories or inspection bodies it may be advantageous to establish a plan whereby the different elements of the quality management system or different sections of the organisation are audited throughout the year.

2.3  The quality manager is normally the audit program manager and may be the lead auditor.

2.4  The quality manager should be responsible for ensuring that the audits are carried out in accordance with the established plan.

2.5  Such audits should be carried out by qualified personnel who have sufficient technical knowledge of the operations they are auditing, and who are trained specifically in auditing techniques and processes.

2.6  The quality manager may delegate the task of performing audits provided that the person used is familiar with the organisation’s quality management system and accreditation requirements and meets the requirements set out in 2.5.

2.7  In large organisations carrying out calibration and/or testing and/or inspection over a wide range of technical disciplines, it may be necessary for audits to be carried out by a team of individuals under the control of the quality manager.

2.8  In small organisations audits may be carried out by the quality manager alone. The management should, however, ensure that another person is given the task of auditing the quality manager's activities to ensure that the quality function is carried out satisfactorily.

2.9  Wherever resources permit, the auditor should be independent of the activity to be audited. Personnel should not audit their own activities or activities under their own direct responsibility except where there is no alternative and it can be demonstrated that an effective audit can be carried out. Laboratories and inspection bodies should pay particular attention to checking the effectiveness of an internal audit where it has been carried out by staff members who are not independent of the audited activities.

2.10 here an organisation is accredited for calibration and/or testing and/or inspection at a client's site, or for sampling in the field, these activities should be included in the audit program.

2.11 Audits carried out by other parties, such as customers or an accreditation body, should not be considered as a substitute for internal audits.

3. Planning of internal audits

3.1  An audit plan including the audit scope, the audit criteria, the audit schedule, reference documents (such as the organisation’s quality manual and audit procedure) and the names of audit team members, should be established by the quality manager.

3.2  Each auditor should be assigned specific quality management system elements or functional departments to audit. These assignments should be made by the lead auditor in consultation with the auditors concerned. Assigned auditors should have some technical knowledge of the departments they are to audit.

3.3  Working documents required to facilitate the auditor's investigations and to document and report results may include: criteria documents such as

• ISO/IEC 17025 and any supplementary documents

• laboratory or inspection body manuals and documents

• checklists used for evaluating quality management system elements (normally prepared by the auditor assigned to audit that specific element)

• forms for reporting audit observations, such as a “non-conformance” form or “correction action request” form. These permit the recording of the nature of the ”nonconformity”, the agreed corrective action, and the eventual confirmation that the action has been taken effectively.

3.4  An audit timetable should be developed by each auditor in conjunction with the auditee to ensure the smooth and systematic progress of the audit.

3.5  Prior to the actual audit, a review of documents, manuals, previous audit reports and records should be carried out to check for conformity with the quality management system requirements and to develop a checklist of key issues to be audited.

4. Implementation of internal audits

4.1  The key steps of an audit are planning, investigation, analysis, reporting, follow-up corrective action and close-out.

4.2  The opening meeting should introduce the audit team, confirm the audit criteria, review the audit scope, explain the audit procedure, clarify any relevant details, and confirm the timetable, including the time or date, and attendees for the closing meeting.

4.3  The investigation process for gathering objective evidence involves asking questions, observing activities, examining facilities, and examining records. The auditor examines the conformity of the activities with the quality management system.

4.4  The auditor uses the quality management system documents (quality manual, system procedures, test methods, work instructions, etc.) as references, and compares what is actually happening with what these quality management system documents state should happen.

4.5  At all times during the audit the auditor seeks objective audit evidence that the quality management system requirements are being fulfilled. Evidence should be collected as efficiently and effectively as possible, without prejudice, and without upsetting the auditee.

4.6  Nonconformities should be noted and should be investigated further by the auditor to identify underlying problems.

4.7  All audit findings should be recorded.

4.8  After all activities have been audited, the audit team should carefully review and analyse all of their findings to determine which are to be reported as nonconformities and which can be included as recommendations for improvement.

4.9  The audit team should prepare a clear, concise report, supported by objective audit evidence, of nonconformities and recommendations for improvement.

4.10  Nonconformities should be identified in terms of the specific requirements of the organisation’s quality manual and related documents against which the audit has been conducted.

4.11  The audit team should hold a closing meeting with the senior management of the organisation and those responsible for the functions audited. The main purpose of this meeting is to present audit findings and to report to senior management in such a manner as to ensure that they clearly understand the results of the audit.

4.12  The lead auditor should present observations, taking into account their perceived significance. Both positive and negative aspects of the operations should be presented.

4.13  The lead auditor should present the audit team's conclusions regarding the quality management system's conformity with audit criteria, and the conformance of the operations to the quality management system.

4.14  Nonconformities identified during an audit should be noted, and the appropriate corrective action and the time frame for correction agreed with the auditee and recorded.

4.15  Records of the closing meeting should be kept.

5. Follow-up corrective action and close-out

5.1  The implementation of the agreed corrective action is the responsibility of the auditee.

5.2  Whenever a non-conformity that may jeopardise the result of a calibration, test or inspection is discovered, the corresponding activity should be halted until the appropriate corrective action has been taken and has been shown to lead to satisfactory results. In addition, results that may have been affected by the non-conformity should be investigated and customers informed if the validity of corresponding calibration, test or inspection certificates/reports is in doubt.

5.3  The formal corrective action procedure may need to be followed to reveal the root causes of some problems and to implement effective corrective and preventive actions.

5.4  The auditor should check the effectiveness of corrective actions as soon as possible after the agreed time frame has elapsed. The quality manager should have the ultimate responsibility for confirming the clearance of nonconformities by the auditee and then closing them out.

6. Records and reports of internal audits

6.1  A complete record of the audit should be maintained even where no nonconformities have been found.

6.2  Each of the nonconformities that have been identified should be recorded, detailing their nature, their possible cause(s), corrective action(s) required.

6.3  Following the audit close-out, a final report should be prepared which should summarise the outcome of the audit and include the following information:

• the name(s) of the auditor(s);

• the date of the audit;

• the areas audited;

• the details of all areas examined;

• the positive or good aspects of the operations;

• any nonconformity identified, linked to references to relevant documents;

• any recommendations for improvement;

• corrective action agreed, the time frame agreed for completion, and the person responsible for carrying out the action;

• corrective actions taken;

• the date of confirmation of completion of corrective action;

• the signature of the quality manager confirming close-out of corrective actions.

6.4  All records of audits should be stored for an agreed period of time.

6.5  The quality manager should ensure that the audit report and, where appropriate, individual nonconformities, are brought to the attention of the organisation’s senior management.

6.6  The trends in results of internal audits and corrective actions should be analysed by the quality manager and a report prepared for review by senior management at the next management review meeting.

6.7  The purpose of such reviews is to ensure that the audits and the corrective actions are contributing to the continuing effectiveness of the quality management system as a whole.

7. References

APLAC Asia Pacific Laboratory Accreditation Body (2002) Internal Audits for Laboratories and Inspection Bodies – APLAC TC 002 Issue No. 2

ISO/IEC 17025 (2005) General requirements for the competence of testing and calibration laboratories

ISO 19011 (2002) Guidelines for quality and/or environmental management systems auditing