Mature ISO 9001 quality systems may encounter problems within their internal audit programs:
insufficient resources to complete internal audits;
internal audit results which confirm that the quality system has been followed, but do not lead to system improvements.
Many companies during 1999 undertook major software projects to insure that the business and quality systems were Y2K compatible. As these pressing projects reached maturity, fewer internal resources were available to conduct the audits that "shall be scheduled on the basis of the status and importance of the activity to be audited…".
With constrained internal resources, a contract auditor becomes a viable option. Acceptance criteria for selecting the contract auditor should include:
Expertise in ISO 9001. Using consultants more familiar with military specifications than ISO quality systems may be perilous.
Orientation. Seek an auditor familiar with your business, products, or market. If there are regulations germane to your industry, verify that the contractor has the necessary expertise to audit your system to the legal requirements. Familiarity with your industry means you will spend less time orienting the auditor to your systems.
Expertise in auditing. While many consultants are adept at setting up systems, they are not necessarily certified lead assessors.
Expertise in consulting. While contract auditors may be adept at assessing quality systems, they may have no interest in revealing how the system may be improved. Suggested improvements may enhance the efficiency and scope of your audits and uncover meaningful quality improvements to your products, processes and services.
Reputation. While reputation alone is insufficient to select a contract auditor, recommendations from other companies can help assure the results of the audit will meet your needs.
Availability and scheduling flexibility. If the contractor cannot meet your schedule or cannot adapt to changes to the schedule, they may miss important areas in the rush to complete the job.
Cost effectiveness.
Reporting. Determine how the resultant reports will be delivered, and in what format so that your time is spent evaluating the audit findings and distributing the information, rather than reformatting text files.