What does the ISO external audit review?

This article introduces how to prepare for an external audit. For reference only. If there is anything wrong, please correct me. 1. Treat external audits correctly 1.1 Each audit has a purpose. For example, accept a third-party audit, pass certification, and obtain a certificate; accept a second-party (customer) audit and hope to become their supplier, or for other purposes. Preparations must be made around this purpose. 1.2 Based on the establishment and implementation of a system that meets the requirements. The prerequisite for passing certification and gaining customer recognition is that a quality management system that meets standards, corresponding regulations, and customer requirements has actually been established, and the organization must demonstrate its ability to provide products and services that satisfy customers. Therefore, you must be able to use objective evidence to prove your ability to effectively implement this quality management system. 1.3 Actively demonstrate your abilities. No matter what the purpose of the audit is, facing an external audit is an opportunity to demonstrate your capabilities. It must be treated correctly, especially the non-conformities found in the audit. Being unqualified is not a good thing, but it can be turned into a good thing. Know it from the positive side. Because if it is not in line with objective existence, if it is not discovered and corrected this time, it will always bring greater losses in the future than now. 1.4 Actively cooperate with the auditor to complete the audit work. The successful completion of the audit is the joint responsibility of the auditor and the auditee. An audit is a systematic, independent and documented process for obtaining audit evidence and objectively evaluating it to determine the extent to which audit criteria are met. The auditor hopes to obtain sufficient evidence from the site as soon as possible to believe that the auditee's quality management system is in compliance with the audit criteria and is effective; the auditee should actively display various evidence that complies with the audit criteria to prove the system it has established. Standard requirements are met and implementation is effective. 2. How to do this work well, mainly grasp the following aspects: 2.1 Clarify the purpose and scope of the audit. The management representatives and the supervisors responsible for the audit must understand and confirm the following information as early as possible in advance: 2.1. 1Purpose of audit. Is this audit a certification (2008 version certification audit), a second-party audit, or some other purpose. 2.1.2 Judgment criteria for audit. Different audit criteria should be used for different audit purposes. Usually the quality management system standards, its own manuals, procedures and other system documents and product documents, as well as contracts signed with customers, as well as various applicable laws and regulations, etc., are all audit criteria. However, different audit purposes have different focuses. For example, second-party audits focus more on requirements related to their products. Third-party audits focus on processes and customer requirements. 2.1.3 Scope of audit. Determine the location, functions, products, etc. scope of the audit (SGS will provide an audit plan at that time). 2.1.4 Number and grouping of reviewers. Usually, you will receive written notice from the auditor including the above aspects one week in advance, so you can fully prepare. 3. Organization and implementation 3.1 Determination of accompanying persons at the company level The company must assign an accompanying person to each auditor of the certification body (customer). This person(s) should be familiar with the standards, company structure, division of labor and business, and have certain communication and expression skills. Responsible for communication within the company and with all related functions. Usually performed by experienced internal auditors. 3.2 Designate persons to be audited at each level. According to the division of labor of the quality manual organizational structure, the units and departments related to this audit shall designate a person to be audited in advance (usually the manager, supervisor, or the main backbone of the department). If necessary, designate an alternate. If the receptionist is unable to receive the call for any reason, or is unable to answer the question, the person on standby will be the one to serve. The task of the person receiving the audit is to try to use objective evidence to demonstrate that the department he is responsible for complies with the audit criteria and prove that the system is implemented effectively. Mainly: 3.2.1 Representative units and departments shall select and prepare typical evidence materials in advance according to the audit plan, including documents, records, physical objects and on-site introduction and reception. Proactively provide it when undergoing audit as objective evidence to prove the compliance and effectiveness of your system. 3.2.2 Answer the questions raised by the auditor on-site and provide additional objective evidence. Meet the auditor's requirements.

3.3 Training of accompanying personnel and audit personnel 3.3.1 Inform the above personnel of the audit plan in advance and provide simple training. The time should not exceed 1 hour. If there are any questions, please ask them in advance and make training records. (Get the audit plan and then conduct training) 3.3.2 Unify the division of responsibilities in terms of understanding. Who is responsible for providing evidence on behalf of the company regarding what elements of the system. Which functional department is responsible for whom. Check for yourself whether the objective evidence you are prepared to provide, taken together, fully demonstrates the compliance and effectiveness of the system. 3.3.2 Communicate. In fact, the content of Article 3.3.2 above in this document has been clarified when establishing the system. It is just a temporary re-emphasis and reminder to achieve the purpose of communication. At the same time, let everyone know each other's communication methods and information, such as office location, landline and mobile phone numbers, etc., so that they can communicate effectively when the time comes. 4. Ideological mobilization to welcome the review 4.1 Let employees know at the appropriate time and through a certain method, let all employees of the company know what review they will receive within a certain period of time. (External Audit Notice) 4.2 Know how to receive 4.2.1 Require each employee (at least those employees who are in the position at the time of the audit, including management and technical staff) to identify their own scope of work. Be prepared for the previous section 3.2. For example, you can answer the questions about the work you are responsible for, the documents you execute, and explain the relationship between your work and the achievement of the company's quality goals. Choose typical evidence materials to prove that the work you do complies with standards, regulations and customer requirements, and meets the target requirements. Prepare your evidence in advance. What evidence can you provide when the auditor asks you to show it? For example, standards, company documents (quality manuals, procedure documents, work instructions/drawings), form records, etc. 4.2.2 What questions are expected to be asked during the audit? How to answer. 4.3 Each employee should be able to answer some critical questions. Every employee may be audited. Therefore, in addition to preparing questions about the scope of work for which he is responsible, he must also determine some issues that require common knowledge. . It should be determined according to the purpose of the audit, for example: 4.3.1 ISO9001 standard section 5.5.2.c) requires, "Ensure that the entire organization meets the improvement of customer requirements awareness." Employees need to know what they do. What are the requirements of this job? What file is executed? 4.3.2 Clause 6.2.2.d), “Ensure employees understand the importance and interrelationship of their work and how they contribute to achieving the company’s quality objectives.” Employees should know the nature of their work Who is the recipient? Who are the external and internal customers? What is the key to my job? What is being measured? How was it achieved? How I met these requirements. If it is not done well, what consequences will it bring to the customer, etc. Employees and clerks in the quality control department must also understand some basic concepts of statistical technology based on their own work. For example, what is variation, common causes and special causes of variation, what is excessive interference, insufficient control, etc. It would be better if it can be explained with actual examples from past work. 4.3.3 Let employees know that not all questions raised by the auditor must be answered. Employees only need to answer some questions related to the company's general quality management system, such as quality policy, the connection between their work and the company's goals, as well as questions within their own scope of responsibilities. When being audited, everyone is working normally in their position. Greet each other with a smile. When the auditor asks a question, answer it politely and realistically. But only answer questions that you do or are within your own responsibility. Any other questions, tell him politely. "This is not my responsibility." If you ask again, politely say, "Please ask my boss", or let the accompanying person help solve the problem. 5. Welcome the first meeting of review 5.1. On the first day of a normal review, an initial meeting of less than half an hour will be held. Hosted by the reviewer. The company's top managers, management representatives, relevant functional receptionists (managers/supervisors) and accompanying personnel should participate. The positions and names of the people attending the meeting must be submitted in writing to the other party as evidence. 5.2 Execute the audit according to the plan. Each department is hosted by a receptionist (manager/supervisor). Evidence that needs to be provided by other departments shall be communicated through accompanying personnel and provided in a timely manner.

5.3 Clarify the inconsistent facts. If the auditor believes that there is a non-conformity, he should clarify what are the objective facts of the non-conformity? According to what audit criteria is it said that it is not met? Facilitate corrective action. 5.4 Communicate how to close the non-conformity report before the final meeting. The root cause of the nonconformity and the corrective action plan, the planned completion date (no more than three months), and what objective evidence will be provided after the corrective actions are implemented to close the nonconformity report must be discussed with the auditor. 6. Internal auditors of an organization can take advantage of opportunities to learn from external auditors and improve themselves. 6.1 Several specific questions 6.1.1 It is recommended that company leaders not put any too much pressure on employees. Don't make policies based on personal interests. For example, whoever gets a report that does not meet the requirements will be punished, how, and even punished. Practice has proven that whenever employees encounter such pressure, they tend to cover up non-conformances. As long as it does not conform to objective existence, problems will definitely occur in the future, and the result may be heavy losses. It should be realized that most of the reasons why employees do not do their job well are not the individual but the system. Including quality accidents caused by the party's ability or negligence, the main reason lies in the system, not the individual. It is just a personal reason, but it can also be traced back to the fact that the system does not put the right people in the right positions. This is still an area where the system deserves improvement. 6.1.2 Maintain a daily routine. No special arrangements should be made. If you have established and effectively implemented a quality management system, if anyone comes to inspect, other than accompanying personnel and meeting the other party's requirements accordingly, no other "emergency" preparations are required. For example: 6.1.2.1 Do not arrange special cleaning. Because you are usually very clean and tidy like this; you don’t need to post any signs, which means there are no special arrangements. Let customers and certification parties believe that this is the real situation of the system operation that they want to see. 6.1.2.2 No special files are required. Fake records and documents should not be written. The leader arranges to do this to hint to his subordinates, and he can also do this to you to hide his mistakes. If you do this, a big accident will happen sooner or later. The result is often self-harm. 6.1.3 What should I do if I find that the system is inconsistent shortly before the reception? The company's system should have channels. For example, in the "Corrective Action" procedure in Article 8.5.2 of the Standard and the "Preventive Action" procedure in Article 8.5.3 of the Standard, employees should know how to raise issues or make reasonable suggestions for improvement. Alternatively, the company can arrange some focused internal audits, issue non-compliance reports for non-compliance issues, take corrective measures in accordance with standard requirements, prepare a plan, and implement it according to the plan. During the external audit, as long as the plan is implemented as scheduled, the external audit should not issue a non-compliance report. In response to non-compliance issues, do not arrange for subordinates to use improper means to deal with external audits, and do not advocate fraud. 6.1.4 What should you do if you find that your preparations are insufficient? After showing an immature system to others, it will be difficult to restore the bad impression even if you spend ten times the energy. If possible, request an extension for the review. 6.1.5 What should I do if I have different views on non-compliance? First, we must determine the objective facts. Consider whether further objective evidence can be provided to prove compliance. If everyone has the same understanding of the objective facts, they just cannot have the same view on whether the audit criteria are met. Respect the other party and don’t argue too much. You can sign the auditor’s non-compliance report first. Afterwards, you can submit your opinions to the certification body where the auditor works, or even complain and ask them to re-judge. 6.2 Don’t miss the opportunity to learn. 6.2.1 Independent third-party audit (customer). Usually external auditors are more experienced than us, and we should take advantage of this opportunity to ask for their advice. Certification bodies generally won't tell you what you should do to meet the requirements of the standard. Doing so violates the impartiality principle of certification. However, we can ask them for advice on how to correctly understand the standard requirements. Especially when non-compliance is found, it is better to have a more detailed plan for taking corrective measures to facilitate closing the non-conformity report. 6.2.2 Second-party audit (certification body). You should use this opportunity to understand your customers' needs and expectations in order to meet their requirements. 6.3 Strive to pass the inspection in one go 6.3.1 What does it mean to pass the inspection in one go? For example, an inspection reveals some problems.

No matter how big or how many the problem is, the auditor will usually discuss it with the company and give some time to take corrective measures, usually up to three months. Let the auditee improve the system and close the unqualified items. After demonstrating evidence of the effectiveness of corrective actions, usually by mail or going to the certification company, a recommendation for issuance of a certificate will be made. 6.3.2 If the inspection finds major systemic problems, the certification company may do it again, and this will not be considered a "first time" pass. In this way, the company will not only spend more money, but more importantly, it will have a bad reputation. Customers' trust in the quality of the company's products will be lost. If the development continues, orders will be transferred to other companies. Without customers, a company cannot survive. Therefore, whether the review can be passed in the first time is a matter of vital interest to the company and employees. If you are fully prepared, I believe that with this arrangement, there should be no problem in passing in one go. I wish you success. If you have any questions during preparation, please communicate with the ISO team.