Just What Makes A Good Audit Sample?

Now if you are responsible for internal audits at your place of work there is a fair change you are limited for time. You therefore accept that you are only going to check a sample in relation to the process being audited – but just how many records does that mean?

Now, I am not getting into a discussion here as regards statistically valid numbers, more of deploying some common sense based on what I have seen over the years. You, like me, start off with good intentions so perhaps half a dozen orders may get sampled at the start, then that reduces to three or four but as time goes on you fall into one of two traps.

You start picking just one order out and worse still you keep using that one to satisfy several questions on your checklist/ flow chart as both time and energy start to ebb away.

Ok, well that ‘s understandable on the basis that it tails off at the end, but the real issue is if you only ever start with one order right st the beginning. So, what then is the rule of thumb?

I am a great believer in the rule of three so do my best to use that at the start. Hopefully you find all three are good so move on, but if not do remember to resample before writing out that CAR. If the second sample re-enforces your view that there is something untoward then fair enough, but at least you have given it a fair chance.

One final point. If what you find is simply of an admin nature – signature missed, reference number missing or paperwork misfiled – can I suggest you get it sorted during the audit rather than being dogmatic and raising that CAR. That helps all concerned :)

However, I am not suggesting for one moment that my numbers are set in stone so do share how you deal with this part of the audit process.

Companies certified to ISO 9001 could have a surprise in store when the standard eventually gets revised from the 2008 version to that of 2015. Ok, so there is now an alleged delay I hear in that we won’t see this published until the autumn now but don’t rest on your laurels.  You need to get ahead of the game on this one and hear’s why.

Some say it is the most significant change they have seen to the standard

However, companies will doubtless leave it to the last-minute thus putting themselves under pressure having less time to talk it through with staff  and then introduce all the changes required of them. Certainly the Owner,CEO or MD is being asked to be more hands on in the running of the system so that’ll come as a shock to most.  No longer can it be bolted onto the business or simply viewed as a delegated task for one unsuspecting member of staff.  Also, have they seen the significant changes in relation to that person’s role anyway or the documents that are removed and the processes that are added? Will they understand how to introduce risk management for example.

What action can I take?

Well, I am already chatting to certified companies to paint a picture as to what is coming their way with the new standard. I have attended sessions with no less than three certification bodies and am about to undertake my auditor transition course. I trust you are making similar arrangements whichever side of the fence you see yourself.

A good place to start

Here is a trailer of my recent webinar “9001:2015 – What’s All the Fuss About” to set the scene for you.

If you see the need to chat further then email me at pete@iso9001supportcentre.com and remember that you can also see it on my App in the Masterclass section. Just search on Apple or Android for :9001 Support”.

This is not a new subject as such on this blog but one that needs constant attention. So many companies I work with don’t get how important it is to allow sufficient time on corrective action when they come to fill in the form.

The correction and containment is the immediate and short term action that needs taking to resolve whatever problem has been flagged up. You then move onto using the 5 whys to determine the root cause as to why you had it.  It is absolutely critical to get this right and investigate what is the real cause so that the subsequent correction action doesn’t chase the wrong reason.

Then comes the corrective action to stop it happening again.  In addition to an action, which might be feasible in a matters of ‘days’, you need to allow time so that the people involved ( not the auditor ) can convince themselves the action has been effective.  Then you call back the auditor. Now this might take ‘weeks’ or even ‘months’, particularly if linked to a subsequent report or meeting.

For example, you appoint someone to cover some duties that have fallen over. Fine, that might be done very quickly – but how do you know the person is going to be effective?  You give them a month or two to demonstrate that backed with some report or presentation into management. A process falls over so you agree to add an extra control to prevent it happening again.  That is introduced immediately – say via a computer procedure – but you need time to demonstrate the problem has been effectively sorted.

The two actions on a CAR form are not both quick fixes so that you can get them off your back.  Whilst the standard requires you to deal with them in a timely matter, it is not the green light to shortcut the process. Corrective Action needs time.

It is stating the obvious that more and more communications are taking place on mobile devices such as phones to tablets – so why should we Quality Management Specialists miss out?

I am in the throws of designing an App with a colleague here in the UK that I feel will add value to those running a QMS – but I would love to know what you think should be included.

Given all that a QMS has to cover, what are the major elements you think would look good in the palm of your hand. Whilst this will work really well for CPD purposes for yourself, also think of practical issues where having that information or form on a mobile device would really add value.

You can make use of simple text, pictures, audio, video, surveys, email and more so don’t feel there are any limitations – make the suggestion and leave it for us to decide if it is doable.

The plan is to launch it in September and I’ll make sure you have the opportunity to be first in queue when it is ready to download. Looking ahead, there are already some exciting ideas getting short-listed so please give me some feedback here so we can consider yours. It will get credited if it is included.

For any small company the requirement to appoint someone to look after the QMS can be a difficult decision. Invariably someone takes it on in addition to there main job which is bad enough, but the most difficult choice is when the Production Manager draws the short straw.  Surely, it is a blatant conflict of interest so shouldn’t be entertained?

However diligent they may be and competent in their QA skills, there will surely be occasions when they are faced with a choice – get deliveries out each day irrespective of the fact that non-conformances should be raised for one thing or another. At Goods Inwards, allowing receipts to proceed when they should be investigated further because the pressure is one to get the material allocated and used.

Keeping instruments in use perhaps when they are known to be out of calibration or damaged because withdrawing them would stop the production line.  The list goes on and on and I’m sure you have seen and could add many more scenarios. On top of that he is excluding himself from being able to audit so many aspects on the internal audit schedule because he is clearly not impartial to the workings of the process.  

So, care needs to be exercised when making the selection.  Production staff have enough to do already so look around the company and see if this role can be an opportunity for someone to show their potential perhaps. There is saying that if you want a job doing well then give it someone who is busy, but on this occasion perhaps not.

Have you ever faced that situation?  How have you got the company to reconsider? Please share.

First off, I need to say a quick ‘welcome’ to the new members of this group.  Many thanks for coming on board after seeing the blog. This is where we kick around some fresh ideas about 9001.

Now this time, instead of telling a story in the usual format, I have decided to throw a case study into the mix.  Let’s see how well you respond to the challenge of actually putting your knowledge into practice.  It’s just a bit of fun but, in all seriousness, I am sure you like me want to keep your skills honed and there is no better way in my opinion.

Bear in mind these two questions and leave your replies in the box at the bottom:

a. Would you raise a CAR based on what you know already and if so what would it be and which paragraph would you raise it against.

b. Are there any other areas where you are thinking there is a possible CAR but would seek out more evidence before making a decision?


The company is a single site and fabricates cabinets out of metal sheet by using a computerised laser cutting machine; a forming press; general machining and TIG and MIG welding.

You discuss the control of documents with the QA Representative and start by asking to see the Index and Change Control system. You are handed the Quality Manual and told that the index is at the back in an appendix. You verify a list of procedures only but note that there is no revision number included, only the title. When you query this you are told “Well if we added that then every time we amend a procedure then we would have to amend the manual which would be a real bind”.

When you ask if there is any other document containing this information then you are told “No, we’ve always done it that way”. You ask to see a copy of the relevant procedure for Document Control but are told they have never been told they need one which is when you spot it is not on the list.

You enquire as to how the procedures are authorised and reviewed before issue and how the company then communicates with staff that amendments have been made. You are shown that each procedure has the author’s name typed into the footer of each procedure with the date of issue and that staff aren’t told of amendments.

New or amended procedures are filed in the main binder with a copy in each of the 4 departmental binders (Sales and Purchasing office, Drawing office, Warehouse and shop floor) and the old version shredded.


I look forward to hearing your opinions and I will send an Amazon voucher as a thank you to whoever I feel puts together the best case.  Make your Quality stand out!

BarryNot surprisingly, this is a very common question from companies during my time on site whilst I am creating the QMS.

First, let us assume the the company has someone who they are putting forward as the QA Representative – not always the case I know.  Also let us work on the basis that this person (you?) has another job, a main job, around which they have to find the time to look after the system. Now, there is a 4 – 6 month period ahead of you that involves a stage 1 audit before ending with the stage 2 audit.

To cope in this second phase when the system has been launched and staff start to work in accordance with it, I always suggest a day a week is required.   This is based on the fact that there will be invariably be at least 2 audits a month to do because the 12 month schedule has to covered in half the time.  On the first traunch of audits there will be CARs raised so they all have be be communicated, actioned – and chased?. There is all that data to locate and analyse on a regular basis; perhaps the approved suppliers list to amend because new suppliers are being sourced and then that Management Review meeting to fit in – and aren’t the majority of the actions going to be for you!

On top of that you have to make sure you know your way around the system, whether it is hard copies or an intranet or both, so you can speak about it with confidence when the auditor is on site. Don’t forget that procedures will need amending and perhaps forms as well so the whole change control process needs time allocating to it.

Mmm, quite a bit to do. It is important that the company and the staff see this commitment on a regular basis as you endeavour to make it all part of the company culture. I find a day a week to be a good test of that Management commitment, but I feel it is a fair and realistic allowance. What’s your experience?

If all that sounds a daunting prospect don’t forget help is at hand in the form of site visits, mentoring over the web and auditor training at the 9001 Support Centre.

ps: Next time I’ll move onto the commitment after the stage 2 when it’s all died down a bit – or has it?