QIC Guru

There are two types of auditing that are required, to become registered to the standard: auditing by an external certification body (external audit) and audits by internal staff trained for this process (internal audit). The aim is a continual process of review and assessment, to verify that the system is working as it’s supposed to, find out where it can improve and to correct or prevent problems identified. It is considered healthier for the internal auditor to audit outside their usual management line, so as to bring a degree of independence to their judgments.

Under the 1994 standard, the auditing process could be adequately addressed by performing “compliance auditing”:

• Tell me what you do (describe the business process)
• Show me where it says that (reference the procedure manuals)
• Prove that this is what happened (exhibit evidence in documented records)

How this led to preventive actions was not clear.

The 2000 standard uses the process approach. While the iso internal auditor performs similar functions, they are expected to go beyond mere auditing for rote “compliance” by focusing on risk, status and importance. This means they are expected to make more judgments on what is effective, rather than merely adhering to what is formally prescribed. The difference from the previous standard can be explained as follows:

Under the 1994 version, the question was broadly “Are you doing what the manual says you should be doing?”, whereas under the 2000 version, the question is more “Will this process help you achieve your stated objectives? Is it a good process or is there a way to do it better?”

ISO 9001:2008 only introduces clarifications to the existing requirements of ISO 9001:2000 and some changes intended to improve consistency with ISO 14001:2004. There are no new requirements. A quality management system being upgraded just needs to be checked to see if it is following the clarifications introduced in the amended version.