9.1 Internal Systems Audits (ISO 19011)

While LPAsLayered Process Audits (LPA) check if the flooroperator execution,is Internalfollowing Auditsthe verifyrules today, the managementInternal systemSystems Audit againstasks if the rules themselves are compliant, effective, and actually being read. This is the health check of the Quality Management System (QMS). If you treat the internal audit as a "checkbox exercise" to satisfy ISO standard.9001, you are wasting resources. The goal is to find the cracks in the foundation before the external auditor (or the customer) finds them.

The Auditor's Mindset: Fact Finder, Not Fault Finder

An audit is not an interrogation; it is a sampling exercise to verify conformity. The auditor's authority comes from the standard, not their title.

Independence Logic:

• Independence:If Auditorsyou manage the process → Then you cannot audit theirthe ownprocess. department.Conflict Engineeringof auditsinterest Purchasing;invalidates Purchasingthe audits HR. This ensures objectivity.result.
• Evidence-Based:If Findingsthe auditor reports to the Production Manager → Then the audit is compromised. Auditors must behave supporteda bydirect Objectiveline Evidenceto (samples,Quality records,Leadership.

observations).

The "IShow think"Me" Rule:

Stop accepting verbal assurances.

• Auditee: "We always calibrate the torque drivers on Mondays."
• Auditor: "Show me the calibration log for the last three Mondays."
• If the log is notmissing a→ validThen auditit didn't happen. Write the finding.

Risk-Based Scheduling

Do not audit every department with the same frequency. Allocate resources where the risk lives.

Scheduling Logic:

• The Audit Schedule:If Auditsa mustprocess had a major CAR or Customer Complaint last quarter → Then increase audit frequency (e.g., from Annual to Quarterly).
• If a process involves "Special Processes" (Soldering, Coating, Welding) where output cannot be scheduledverified basedby oninspection risk.→ CriticalThen areasaudit heavily.
• If a department (SMTe.g., Reflow,HR) IQC)has been stable for 3 years → Then reduce frequency to minimum compliance levels.

Classifying Findings

Not all problems are auditedequal. moreUse frequentlyrigid thandefinitions low-to prevent "argument creep" during the closing meeting.

Major Non-Conformance:

• Definition: A total breakdown of a system requirement or a direct risk areasto the customer.
• Example: No control plan exists for a new product line; Shipment of non-conforming product without a waiver.
• Action: Immediate Management Review.

Minor Non-Conformance:

• Definition: A single observed lapse in discipline that does not threaten the system's integrity.
• Example: One document in a sample of 10 was unsigned; A calibration sticker fell off a bin.
• Action: Fix within 30 days.

Opportunity for Improvement (TrainingOFI):

Records).

• Definition: The process is compliant, but inefficient or risky.
• Example: "Consider digitalizing this log to prevent handwriting errors."
• Action: Optional implementation.

Final Checklist

AuditControl ComponentPoint	Critical Requirement	StandardRisk Avoided
ScheduleIndependence	Risk-BasedAuditor Frequencymust not belong to the department being audited.	AnnualConflict Coverageof MinimumInterest / Bias
AuditorEvidence	IndependentFindings ofbased Areaon Objective Evidence (Records, Photos) only.	CertifiedHearsay Internal/ AuditorSubjective Disputes
ReportingFrequency	ObjectiveSchedule Evidencedriven by Risk and Past Performance.	Non-ConformanceWasting Reportstime (NCR)on stable processes
ClosureClosing	CAPANo Verificationsurprises. All findings discussed before the final report.	Adversarial relationships
Follow-up	Verify Auditeffectiveness of CAPA, not just "closure."	Recurrent Findings