Auditing to ISO 9001:2008
There are two types of auditing required to become registered to the ISO 9001 standard: auditing by an external certification body (external audit) and audits by internal staff trained for this process (internal audits). The aim is a continual process of review and assessment, to verify that the system is working as it’s supposed to, find out where it can improve and to correct or prevent problems identified. It is considered healthier for the internal auditor to audit outside their usual management line, so as to bring a degree of independence to their judgments.
Under the 1994 standard, the auditing process could be adequately addressed by performing “compliance auditing”:
- Tell me what you do (describe the business process)
- Show me where it says that (reference the procedure manuals)
- Prove that that is what happened (exhibit evidence in documented records)
How this led to preventive actions was not clear.
The 2000 standard uses the process approach. While auditors perform similar functions, they are expected to go beyond the mere iso audit for “compliance” by focusing on risk, status and importance. This means they are expected to make more judgments on what is effective, rather than merely adhering to what is formally prescribed. The difference from the previous standard can be explained thus:
Under the 1994 version, the question was broadly “Are you doing what the manual says you should be doing?”, whereas under the 2000 version, the question is more “Will this process help you achieve your stated objectives? Is it a good process or is there a way to do it better?”.
The ISO 9001 1994 standard left a lot to be desired as an auditing technique to the point that an organization could meet the standard but not necessarily the actual QUALITY of the product. The 2000 version is more process and product oriented. We still audit for COMPLIANCE but we also look at EFFECTIVNESS of procedures and processes. Effectively we look for documentation and implementation. In addition to desktop auditing a certain amount of Product Audits should be carried out to ensure that the compliance produces the desired product at the desired quality.