Quality Audit

A business may have a written procedure for inspecting goods before shipment, and an auditor reviews records, observes work and asks relevant staff how the procedure operates, aiming to assess it against stated criteria. Criteria might come from the company's own procedures, a customer contract or an adopted standard, and they should be named in the audit plan.

Without criteria, a report can become an opinion about what the auditor prefers. ASQ defines a quality audit as systematic and independent gathering of objective evidence to see whether criteria are met, and notes that audits rely on samples.

It describes first-party, second-party and third-party audits: the first is internal, the second may be a customer review of a supplier, and the third uses an independent audit organisation. Independence does not always require an outside company, since an internal auditor can work within the organisation while avoiding responsibility for the area being reviewed.

ISO 19011 gives guidelines for auditing management systems, including quality systems, but it is guidance for conducting audits, not a certification by itself, so a company should not be called "ISO 19011 certified" simply for using the guidance. A quality audit can focus on a system, process or product, and the scope should say which sites, dates, activities and requirements are covered.

A narrow audit of packing cannot claim the entire factory passed. Plan the audit with a clear objective, timing and access to records, and gather enough representative evidence to support findings, because a few conveniently chosen perfect files can hide a recurring problem.

Evidence may include documented procedures, completed forms, transaction records, observations and interviews, corroborated where possible, and a missing record can itself be a finding when records are required. Auditors should also be competent for the subject, since independence without competence does not make conclusions reliable.

A finding should be specific, so a remark that workers are careless is not useful, whereas three of ten sampled inspection records lacking the required approval names the sample, gap and criterion. A nonconformity is a failure to meet a requirement, while an opportunity for improvement is a suggestion without a breached requirement, and the two should be distinguished.

The auditee can respond with a correction and a root-cause action, because reprinting a missing form fixes one case but not the system that repeatedly omits signatures, and follow-up checks whether the action worked. A quality audit differs from everyday quality control, where a routine inspector checks each batch within production, and passing an audit is not proof of zero defects because sampling misses some events.

A failed audit is not necessarily a reason to abandon a supplier; review seriousness, response, repeat history and risk, and set corrective-action deadlines under the contract where appropriate. A fictional distributor that samples temperature logs and finds several missing readings should investigate why rather than fill blanks afterwards, report what was examined, criteria, sample, findings and limitations, limit the report to the authorised audience, and schedule reviews by risk rather than one generic rule.