9.1 Internal Systems Audits (ISO 19011)

While Layered Process Audits (LPA) check if the operator is following the rules today, the Internal Systems Audit asks if the rules themselves are compliant, effective, and actually being read. This is the health check of the Quality Management System (QMS). If you treat the internal audit as a "checkbox exercise" to satisfy ISO 9001, you are wasting resources. The goal is to find the cracks in the foundation before the external auditor (or the customer) finds them.

The Auditor's Mindset: Fact Finder, Not Fault Finder

An audit is not an interrogation; it is a sampling exercise to verify conformity. The auditor's authority comes from the standard, not their title.

Independence Logic:

• If you manage the process → Then you cannot audit the process. Conflict of interest invalidates the result.
• If the auditor reports to the Production Manager → Then the audit is compromised. Auditors must have a direct line to Quality Leadership.

The "Show Me" Rule:

Stop accepting verbal assurances.

• Auditee: "We always calibrate the torque drivers on Mondays."
• Auditor: "Show me the calibration log for the last three Mondays."
• If the log is missing → Then it didn't happen. Write the finding.

Risk-Based Scheduling

Do not audit every department with the same frequency. Allocate resources where the risk lives.

Scheduling Logic:

• If a process had a major CAR or Customer Complaint last quarter → Then increase audit frequency (e.g., from Annual to Quarterly).
• If a process involves "Special Processes" (Soldering, Coating, Welding) where output cannot be verified by inspection → Then audit heavily.
• If a department (e.g., HR) has been stable for 3 years → Then reduce frequency to minimum compliance levels.

Classifying Findings

Not all problems are equal. Use rigid definitions to prevent "argument creep" during the closing meeting.

Major Non-Conformance:

• Definition: A total breakdown of a system requirement or a direct risk to the customer.
• Example: No control plan exists for a new product line; Shipment of non-conforming product without a waiver.
• Action: Immediate Management Review.

Minor Non-Conformance:

• Definition: A single observed lapse in discipline that does not threaten the system's integrity.
• Example: One document in a sample of 10 was unsigned; A calibration sticker fell off a bin.
• Action: Fix within 30 days.

Opportunity for Improvement (OFI):

• Definition: The process is compliant, but inefficient or risky.
• Example: "Consider digitalizing this log to prevent handwriting errors."
• Action: Optional implementation.

Final Checklist