“审核时间”的符合性评审

- 1 - 日期：2007年 1月 19日 认可评审实践工作组指南 IAF GD2附件2“审核时间”的符合性评审 确保管理体系认证的价值和可信性的一个关键问题是配备审核资 源。审核资源是指对 QMS 符合适用要求的情况进行有效、可靠的审核所 需的有能力的审核员数量和审核时间。QMS 认证机构必须配备足够的审核 资源。本文件的指南针对认可机构应当怎样根据 IAF 指南来评审认证机 构是否解决好了这个问题。 当认可机构根据 IAF 对 ISO/IEC 导则 62 的应用指南（IAF GD2）对 认证机构审核活动的符合性进行评审时，认可评审组应当采取基于过程 的评审方法，而不是“检查单”方法。 认可评审的目的应当是确定认证 机构是否按照自己的程序来实施 审核，这些程序是否遵循了 IAF GD2 附件 2 的原理，是否考虑了与下列 方面相关联的风险： - 拟审核 QMS 所覆盖的产品和过程； - 受审核方的行业领域； - QMS 用到的组织资源和人力资源。 IAF 指南的目的是为认证机构确定自己的审核准则提供一个框架，并 就下列方面给出了建议： - 配置满足能力要求的人力资源（例如审核员）； - 使用适宜的程序或指导； - 根据审核的条件，正确地为实施有效、可靠的审核分配时间。 认证机构的规则可以允许根据审核员的知识、技能和专业能力对这 些因素进行调整。 - 2 - 附件 2 不是要规定最短或最长的时间（表示为审核员人天数），而 且，认证机构在贯彻 IAF 指南关于实施有效审核的意图时，以及在认可 评审组对认证机构的贯彻情况进行评审时，不宜脱离实际情况机械地照 搬附件 2。 认可评审组需要确定，认证机构是否建立了一个过程，来确保在任 何情况下，都为审核的实施配置足够的时间和资源，以及认证机构是否 能够证实该过程是有效的。 请注意，在采用上述过程分配审核时间时，一些情况下，所需的审 核时间可能少于附件 2 表中给出的时间，而在另一些情况下，所需的审 核时间可能要多于附件 2表中给出的时间。 从实际操作的角度来说，认可评审可以分为三步走： 1. 对认证机构过程的合理性进行验证 (第 1 步)； 2. 评价认证机构人员对上述过程的理解和正确应用情况（第 2 步）； 3. 在审查相关记录的基础上，寻找过程得到有效实施的证据（第3步）。 第 1 步 该步骤的目的是验证下列方面： - 认证机构的过程和程序建立在附件 2所述的方法之上； - 已正确识别了与受审核方的经济活动领域相关联的风险，而且有相 应的指导书可以用于正确地处理这些风险； - 该过程正确地考虑了认证机构从不同行业和不同类型组织（例如大 型组织和小型组织，国内组织和跨国组织，服务行业和制造行业， 等等）的审核中获得的经验； - 对偏离附件 2 数量限制的情况，该过程有相应的机制来判断该偏离 是否合理正当。 第 2 步 该步骤宜评审： - 3 - - 认证机构参与该过程的所有人员对过程本身都有着充分的了解和 一致的理解，包括应收集的数据和信息以及应做的记录； - 上述人员经评定有能力从事所作的工作。 第 3 步 该步骤宜评审相关的记录以确认： a) 认证机构已按照确定的程序实现了该过程； (注：如果认可评审组发现任何违反这些程序的情况，都宜开具不符合，不管 审核时间是否存在问题)。 b) 可以获得相应的信息来为审核时间的确定提供支持，并为判断偏离 附件 2所述审核时间的情况是否合理正当提供支持。 认可评审组应仔细审查认证机构在确定审核时间时所考虑的 因素，特别是偏离附件 2审核时间的情况所依据的准则。认可评审 员尤其宜检查减少审核时间的情况，但这并不排除对增加审核时间 的情况进行审查。 认可评审组在判断审核时间是否合理时，宜考虑到审核时间应 当足以对 QMS 进行全面检查，识别关键区域可能存在的问题，以及 在通常情况下为受审核方提供增值。 如果认可评审组发现上述因素和准则没有形成文件，或者发现 它们不清楚、理由不充分或不符合附件 2 的原理和上述基本原则， 则应开具不符合。 如果发现一个认证机构的审核时间总是与附件 2 表中的数值保持一 致，宜引起认可评审组的警觉。这种情况下，认可评审组宜要求认证机 构提供证据，证明这些审核时间确实足以对质量管理体系一致地提供满 足顾客和法规要求的产品和服务的能力进行审核。 - 4 - 当然，如果所用的审核时间少于附件 2 表中的数值，除非这种减少 有非常好的理由，并且这些理由能够被认证机构的过程清晰地、客观地 证实，否则上述要求将不太可能得到满足。 认可评审组在向认证机构管理层提出不符合时，宜清晰说明不符合 的原因，该原因应基于对认证机构过程的正确分析，并有已发现的证据 提供支持。 认可评审组对认证机构进行见证评审，将有助于确认认证机构符合 IAF 指南的情况。 - 5 - Date: 19 January 2007 Accreditation Auditing Practices Group Guidance on: Auditing conformity with Annex 2 of the IAF's Guidance IAF GD2:2003 "Audit Times" Putting forward the audit resources – i.e. number of competent auditors and time devoted to the audit –necessary to perform effective and reliable assessments of the compliance of the evaluated quality management system (QMS) with the applicable requirements is a key issue for ensuring the value and credibility of management system certifications and is a must for the conformity assessment bodies (CABs) operating in this field. This paper provides guidance on how Accreditation Bodies (ABs) should assess the proper accomplishment of these duties by the accredited CABs, based on IAF guidance. When an AB assesses the conformity of the audit activities carried out be a CAB to the provisions of Annex 2 of IAF Guidance to ISO/IEC Guide 62, the AB’s audit team should follow a process based auditing approach rather than a “check list” approach. The AB’s assessment should aim to determine whether a CAB perform its audits in accordance with its own procedures – which should themselves be based on the rationale of Annex 2 – and whether such procedures take into account the risks associated with: - the product and processes covered by the audited QMS; - the auditee’s business sectors; and - the size of the organizational and human resources involved in the QMS. The IAF Guidance aims to define a framework for the CABs when establishing their audit criteria and makes recommendations on: - the allocation of competent human resources (e.g. auditors); - the use of appropriate procedures or instructions; and - the allocation of appropriate time to perform an effective and reliable audit, depending on the audit conditions The CAB’s rules may allow these factors to be varied, depending on the knowledge, expertise and skills of its auditors. Annex 2 is not intended to fix either the minimum or maximum audit times, in terms of manpower required, and should not be used, automatically and separately from the general context, both by the CAB and by the AB’s audit team, when respectively seeking and assessing conformity with the intent of IAF Guidance regarding the conduct of effective audits. The AB's audit team needs to determine whether the CAB has in place a process (or processes) to ensure that it allocates sufficient time and resources for the appropriate conduct of the audit, in all respects and in all circumstances, and whether the CAB can demonstrate that the process(es) is(are) effective. - 6 - Note that such a process could lead to the allocations of audit times which may be shorter than those derived from the Table of Annex 2, in some cases, but could also require longer audit times in other circumstances. From an operational point of view, the accreditation assessment can be structured in three phases: 1. the verification of the soundness of the CAB process(es) (phase 1); 2. the evaluation of the understanding and correct application of such process(es) by the CAB’s personnel (phase 2); and 3. the search for evidence of its(their) effective implementation, based on examination of records (phase 3). Phase 1 This phase should aim at verifying that: - the process(es) and procedures established by a CAB are based on the analytical approach described in Annex 2; - the risks associated with an auditee’s sector of economical activity have been properly identified and instructions are available to deal with them properly; - the process takes due account of the CAB’s experience acquired from auditing different sectors and different kinds of organizations (e.g. large versus small, national versus multinational, service industry versus manufacturing, etc..); - the process has mechanisms in place to justify deviations from the numerical limits established by Annex 2 of the Guidance. Phase 2 It should include an evaluation of whether: - all the CAB’s personnel involved in the process(es) have adequate knowledge and harmonized understanding of the process itself, including on the data and information to be collected and records to be prepared; - the above personnel have been properly qualified to do their job. Phase 3 This should include an examination of the records to confirm that: a) the process(es) has(have) been realized according to the procedures established by the CABs; (Note: the AB's audit team should issue a non conformity if any violation of these procedures is found, regardless of the issue of the audit time duration in itself). b) information is available to support the selection of audit times and to justify any departure from the audit times specified in Annex 2. The AB’s audit team shall carefully review all the elements considered by a CAB when establishing its audit times and, in particular, the criteria that would support a deviation from the audit times indicated in Annex 2. The AB’s auditors should especially examine cases where there has been a reduction in the allocated audit times, but should not exclude examining cases where longer times have been used. - 7 - In deciding if such allocations are reasonable, the AB’s audit team should take into account the fact that the audit times should allow for a comprehensive examination of the audited QMS, as well as for the identification of possible problems related to critical areas and for providing, in general, added value to the auditee. If the above elements and criteria are not documented or are found to be unclear or insufficiently justified or not in compliance with the rationale of Annex 2 and the general principles outlined above, then the AB's audit team shall issue a non conformity. The AB’s audit team should be wary of situations where it finds that a CAB’s audit times are consistently in numerical agreement with the data given in the Table of Annex 2; in these circumstances, the AB's audit team should require the CAB to provide evidence that such times are really those needed for an effective assessment of the management system, focused on its substantial ability to consistently provide products and services complying with the customer and regulatory requirements. Of course, if the audit times employed are shorter than those indicated in the Annex – unless very good reasons exist for such reduction and can be clearly and objectively demonstrated by the CAB’s process – it is unlikely that the above requirements will have been fulfilled. When presenting non conformities to the CAB’s management, the AB’s audit team should clearly state its reasons, based on an appropriate analysis of the CAB’s process(es) and supported by the evidence of what it has found. Confirmation of the adequacy of the CAB’s conformity to the IAF Guidance, will be enhanced by conducting witness audit.