Internal Audit Question: What about out-of-scope NC's?

So your company is certified to ISO 9001:2015 and you are the lead auditor on a team of two for an internal audit. The scope for this audit is Planning (Clause 6), for which you are interviewing, and Operation (Clause 8), for which the other auditor is interviewing. On reviewing the records for Design and development inputs (8.3.3) the other auditor finds that the latest specifications have not been reviewed and approved as is required in the Product Design SOP and writes up the following:

Requirement	7.5.2(a) When creating and updating documented information, the organization shall ensure appropriate review and approval for suitability and adequacy.
Finding	Nonconformity
Evidence	Interviewed Engineer Abel Baker. Sampled design specs for Project "Daisy Chain". The following design records have not been reviewed and approved: DES-677, DES-678, DES-679.

The Engineering Manager cries foul, that the finding is out of scope.
What do you do?

This case is easy because the requirement for review and approval is stated in the company's own requirements for its quality management system: the Product Design SOP.

Internal audits are mandated by clause 9.2 of the ISO 9001:2015 Standard which states in 9.2.1:
The organization shall conduct internal audits at planned intervals to provide information on whether the quality management system:
a) conforms to:
1) the organization’s own requirements for its quality management system;
2) the requirements of this International Standard;
b) is effectively implemented and maintained.

The Engineering Manager was half right. The N/C as stated was, indeed, out of scope. Nevertheless, it was an N/C, but against the organization’s own requirements for its quality management system. The wrong requirement was stated by the internal auditor.

Third Party (CB) auditors have to audit to the Standard - whichever standard they are certifying to. But it is a mistake to think that internal auditors have to audit in the same way as third party auditors and always quote a requirement from the ISO Standard. The Standard merely states WHAT is required. It is the Quality Management System (QMS) in the form of a Quality Manual (QM), Standard Operating Procedures (SOP's) and Work Instructions (WI's) that describe HOW the requirements of the Standard will be implemented in the form of integrated processes.

On certification the CB auditor has already declared that the QMS effectively implements the Standard. Really, employees of the company, including internal auditors, should only have to worry about the processes documented in the QMS.

ISO 9001:2015 - FAQ's in support of Annex SL in ISO Standards

I came across this document while I was looking for something else and got distracted by it: JTCG Frequently Asked Questions in support of Annex SL. It is put out by an esoteric group who call themselves, "ISO/TMB/JTCG Joint technical Coordination Group on MSS (TAG 13)". Who are they? If you have to ask the question then you probably won't find the answer terribly interesting. Let's just say they are something to do with ISO, the international organization for standards that develops management system standards (MSS) among other kinds of standards.

Logo of the ISO organization

I found some of the FAQ's interesting and relevant to some discussions I have followed on Linked, especially with regard to the newly released ISO 9001. Anyone needing to transition from ISO 9001:2008 to ISO 9001:2015 may find this of interest.

4. What was the Vision behind Annex SL ? 

All ISO management system “requirements” standards will be aligned and ISO will seek to enhance the compatibility of these standards, through the promotion of identical:
• Clause titles
• Sequence of clause titles
• Text, and
• Terms and definitions that are permitted to diverge only where necessitated by specific differences in managing their individual fields of application.

7. What benefit is there to harmonization ? 

Where organizations are implementing and operating several Management Systems they are often confronted with different and sometime contradicting requirements, terms and definitions. Annex SL will be particularly useful for those organizations that choose to operate a single (sometimes called “integrated”) management system that can meet the requirements of two or more management system standards simultaneously.

10. Why does the common text not include a specific clause on “Preventive Action” ? 

The high level structure and identical text does not include a clause giving specific requirements for “preventive action”. This is because one of the key purposes of a formal management system is to act as a preventive tool. Consequently, a MSS requires an assessment of the organization’s “external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcome(s)” in clause 4.1, and to “determine the risks and opportunities that need to be addressed to: assure the XXX management system can achieve its intended outcome(s); prevent, or reduce, undesired effects; achieve continual improvement.” in clause 6.1. These two sets of requirements are considered to cover the concept of “preventive action”, and also to take a wider view that looks at risks and opportunities

15. What is the difference between the terms "determine" and "identify" ? 

The terms are used interchangeably in general English but "identify" can have translational problems, as it can be mistaken for e.g. putting a label on something to identify it.
"Determination" is an indication of an assessment rather than "identify" which indicates that something has been noted.
Dictionary definitions give:
Determine = establish or find out with certainty by research, examination or calculation
Identify = establish the identity of something or somebody

16. Why is there explicit distinction between requirements for "top management " and "the organization" ? 

The success of the management system depends on the leadership and commitment of top management; however it would be unreasonable for top management to perform all activities within the management system, therefore it is necessary for such tasks to be assigned to other roles within "the organization"

19. What does “issues” mean ? 

An "issue" is "an important topic for the organization, problems for debate and discussion, or changing circumstances".
This term was used in Annex SL identical text after referring to dictionary definitions (e.g. the Oxford English Dictionary).

20. What is the difference between “stakeholder” and “interested party” ? 

Traditionally management systems standards used the term "interested party" because "stakeholder" created translation problems for a number of languages. The term "stakeholder" has gained wider acceptance even in translation, and some MSS now have chosen to use the term. The two terms are defined as being interchangeable, but with "interested party" as the preferred term.

22. What is the difference between “as applicable” vs. “as appropriate” ? 

Dictionary definitions give:
Applicable = relevant; appropriate; possible to apply
Appropriate = suitable (for, to)

In most cases appropriate implies some degree of freedom, whereas applicable implies that if it can be done it shall be done.