ISO 9000: Encyclopedia II - ISO 9000 - Auditing

ISO 9000 - Auditing

Two types of auditing are required to become registered to the standard: auditing by an external certification body (external audit) and audits by internal staff trained for this process (internal audits). The aim is a continual process of review and assessment, to verify that the system is working as it's supposed to, find out where it can improve, and to correct or prevent problems identified. It is considered healthier for internal auditors to audit outside their usual management line, so as to bring a degree of independence to their judgements.

Under the 1994 standard, the auditing process could be adequately addressed by performing "compliance auditing":

• Tell me what you do (describe the business process)
• Show me where it says that (reference the procedure manuals)
• Prove that that is what happened (exhibit evidence in documented records)

Under the 2000 standard, the approach should be different, reflecting the different aspects and the processs approach. While the auditor does perform some similar functions, they are expected to go beyond mere auditing for 'compliance' and to focus on risk, status and importance. This means they are expected to make more judgements on what is effective (or not), rather than merely adhering strictly and safely to what is formally prescribed. The difference could be exemplified thus: Under the 1994 version, the question was broadly: are you doing what the manual says you should be doing? whereas under the 2000 version, the question is more: will this process help you achieve your stated objectives? is it a good process or is there a better one/way to do it better?

The ISO 19011 standard for auditing should be applied to ISO 9000.

Adapted from the Wikipedia article "Auditing", under the G.N U Free Docmentation License. Please also see http://en.wikipedia.org/wiki