12.2 The Audit Process: Planning, Performance, and Reporting

12.2 The Audit Process: Planning, Performance, and Reporting

The Audit Programme Versus the Individual Audit

ISO 19011 separates two levels that candidates frequently merge.

A common audit finding is not that an individual audit was done badly, but that the programme left an entire process, a night shift, or a remote warehouse unaudited for two years. Frequency is risk-based: a process with a history of escapes, a new product line, or an area with recent personnel turnover is audited more often than a stable one.

---

The Three Things That Must Be Agreed Before Anyone Walks the Floor

1. Audit Objectives

What the audit is intended to achieve: determine conformity to the standard, evaluate effectiveness in meeting objectives, prepare for a registrar visit, qualify a new supplier, or verify corrective action from a prior finding. Objectives set the depth.

2. Audit Scope

The physical and organizational boundary: which sites, buildings, cells, shifts, product lines, processes, and time period. A vague scope ("the quality system") produces an audit that never finishes and never proves anything. A usable scope reads like: "Machining cell 4 and the associated incoming inspection crib, first and second shift, for product shipped between 1 January and 30 June 2026."

3. Audit Criteria (Reference Standards)

The set of requirements the evidence is compared against. Criteria are layered, and an auditor must know which layer a finding is written against:

[!IMPORTANT] An auditor cannot write a finding against an opinion. Every nonconformance must cite a specific requirement from an agreed criterion. "The operator should have used a torque wrench" is an opinion; "Contrary to control plan CP-118 Rev B, which requires a calibrated torque wrench at operation 40, the operator tightened fasteners with an impact driver" is a finding.

---

Phase 1: Preparing the Audit

The Audit Plan

The audit plan is the document that the auditee receives in advance. ISO 19011 expects it to cover:

• Audit objectives, scope, and criteria
• Locations, dates, expected time, and duration of activities
• Audit methods (on-site, remote, interview, document review, observation)
• Roles of the audit team and any accompanying persons or observers
• Resources required and any confidentiality or information-security arrangements
• Logistics: escorts, safety induction, access to areas and systems

The plan is agreed with the auditee before the audit, and changes made during the audit are agreed as they arise. A plan that surprises the auditee wastes the audit day chasing unavailable people.

Document (Desk) Review

Before the floor work, the audit team reviews the quality manual, the relevant procedures, previous audit reports, open corrective actions, customer complaints, and process performance data. The desk review tests adequacy: does the documented system, on paper, satisfy the criteria? The on-site audit then tests implementation and effectiveness.

Checklist Preparation

Checklists and other working papers are built from the criteria during preparation, never improvised on the floor. Section 12.3 covers their construction.

---

Phase 2: Conducting the Audit

The Opening Meeting

Short, formal, and recorded on an attendance sheet. A standard agenda:

1. Introduce the audit team and confirm attendance.
2. Confirm the audit objectives, scope, and criteria.
3. Confirm the schedule and the time of the closing meeting.
4. Confirm audit methods and the sampling approach, including the fact that the audit is based on samples and therefore carries an element of uncertainty.
5. Confirm communication channels, escorts, and how findings will be raised during the audit.
6. Cover safety, emergency procedures, PPE requirements, and any restricted areas.
7. Confirm confidentiality and information-security arrangements.
8. Answer questions and confirm resources and facilities are available.

Gathering Evidence

Evidence is collected by interviewing, observing activity, examining records, and re-performing or re-measuring where appropriate. Interview technique matters:

• Open the topic with an open question: "Walk me through how you set up this operation at the start of a shift."
• Follow the answer with evidence: "Show me the setup record for this morning."
• Close with a confirming question: "So the first-piece must be bought off by quality before production continues?"
• Never ask a leading question: "You do calibrate this gage, don't you?" invites the answer the auditor wants and produces no evidence.
• Audit the process, not the person. The auditor is testing whether the system works, not whether an operator can be caught out.

Auditing to the Process

Strong process audits follow the inputs, activities, and outputs of a single process and check the supporting elements at each step: who performs it and how competence was established, what equipment and gages are used and how they are controlled, what documents and revisions are in use, what measurements and criteria apply, and what happens when the process produces a bad result.

Recording and Managing Findings

• Record what was examined, not only the conclusion: part numbers, record identifiers, dates, serial numbers, gage IDs. A finding that cannot be traced back to the exact evidence cannot be defended.
• Raise potential nonconformances with the escort and the area supervisor as they arise, so the auditee can produce contrary evidence before the closing meeting. Auditors should never spring findings at the closing meeting.
• Manage the clock. A common novice failure is to spend the whole day on the first process and leave half the scope unaudited.

---

Phase 3: Classifying and Writing Findings

The Three-Part Nonconformance Statement

Every nonconformance statement contains three elements, and an NCR missing any one of them is unusable for corrective action:

Write facts, not opinions or solutions. The auditor identifies the gap; the auditee determines the cause and the fix.

Grading the Finding

[!CAUTION] Accumulated minors become a major. Five separate minor findings against calibration control in five different cells is not five minors; it is one major systemic breakdown of the calibration system. Recognizing this pattern is the difference between an auditor who reports symptoms and one who reports the failure.

The Closing Meeting

1. Thank the auditee and re-confirm scope and criteria.
2. Restate that the audit was based on sampling and therefore does not guarantee that all nonconformities were found.
3. Present each finding with its objective evidence and confirm the auditee understands it.
4. Present the audit conclusion, including what is working well.
5. Agree the timetable for the corrective action response and the method of follow-up.
6. Record attendance and any disagreements, including the auditee's position where consensus is not reached.

---

Phase 4: Reporting, Corrective Action, and Closure

The Audit Report

The report is the formal record. It normally contains the audit objectives, scope, and criteria; the identification of the audit team, auditee representatives, and dates and locations; the audit findings with their evidence and grades; the audit conclusion; a statement of the sampling-based uncertainty; and a distribution list. It is issued within the time stated in the audit programme, and it becomes a controlled quality record.

Evaluating the Corrective Action Response

The auditee returns a corrective action plan. The auditor evaluates it before accepting it, and a plan is rejected if it:

• Addresses only the specific instance found (correction) with no cause analysis;
• Names "operator error" or "retraining" as the sole cause and action;
• Has no verification of effectiveness step or no due date;
• Does not consider whether the same weakness exists elsewhere (read-across, Section 13.5).

Verification and Closure

The auditor verifies implementation by objective evidence: a revised procedure with a new revision level, updated training records, re-inspection results, or a follow-up audit of the area. Only when implementation is verified — and, for significant findings, when effectiveness has been demonstrated over time — is the finding closed. The audit is not complete when the closing meeting ends; it is complete when the findings are verified closed and the records are retained per the audit programme.

---

Worked Example: Turning an Observation into a Defensible Finding

What the auditor saw: In the plating area, a technician recorded bath temperature on a log sheet. Three of the last ten entries were blank.

A weak write-up: "Plating logs are not being filled out properly. The area needs better discipline." This is an opinion, cites no requirement, and gives the auditee nothing to analyze.

A defensible write-up:

• Requirement: Control plan CP-220 Rev F requires bath temperature to be recorded once per shift on form QF-220.
• Evidence: Form QF-220 for tank 3, covering 2026-09-04 through 2026-09-13, has no entry for second shift on 09-06, 09-09, and 09-11. The tank was in production on all three dates per job travelers 55088, 55093, and 55101.
• Nonconformity: A required process control measurement was not recorded for three of the ten shifts sampled.

Grading: Three misses in a ten-shift sample on one tank, in an area whose other tanks are complete, is a minor. If the same gap appeared across all tanks, or if the missing readings coincided with product later found non-compliant, it escalates to major.

---

Common Exam Traps for CQT Candidates

[!CAUTION] Trap 1: Confusing the audit programme with the audit plan. The programme covers a period and a population of audits; the plan covers one audit.

Trap 2: Writing a finding without citing a requirement. No requirement, no nonconformance. An auditor who cannot cite the criterion has an observation at best.

Trap 3: Presenting a surprise finding at the closing meeting. Findings are communicated as they arise so the auditee can produce contrary evidence.

Trap 4: Letting the auditor prescribe the fix. Auditors state the gap; specifying the corrective action destroys independence and makes the auditor unable to audit the result.

Trap 5: Treating repeated minors as unrelated. Repeated minors against the same requirement in different areas indicate a systemic failure and should be graded major.

Trap 6: Closing a finding on a promise. Closure requires objective evidence of implementation, and for significant findings, evidence of effectiveness over time.