One of the most typical internal audit findings (nonconformities) is discovering that workers are not following procedures or work instructions. Surprisingly, while ISO 9001 requires you to establish procedures as needed, no ISO clause requires anybody to follow such plans! What ISO 9001 clause is used in writing audit findings for not following procedures?
Which ISO Clause is Used for Not Following Procedures?
The standard does not directly address this issue. The old standard (ISO 9001:2008) had better language and used “implement actions necessary” under clause 4.1.f, which is obsolete now. As a result, auditors frequently struggle with how to write an audit finding or nonconformity (NC), even though all such NCs must be based on a provision in the applicable ISO standard.
If you discover that employees are not following the defined procedures, work instructions, process maps, or the “plan” for the work in your, then first I would suggest
1. Clause 8.5.1 Control of Production and Service Provision
Clause 8.5.1 Control of production and service provision requires organizations to implement production and service provision under controlled conditions, which includes adhering to documented procedures. Procedures are one control type, which is especially relevant if nonconformances occur in the production area.
However, other clauses might also be relevant depending on the context and details of the non-conformance. For example:
2 ISO 9001 Clause 4.4 Quality Management System and its Processes
Clause 4.4 quality management system and its processes require that the processes needed for the QMS be established, implemented, maintained, and continually improved. This is in the “plan” part of PDCA related to ISO 9001, which means you have identified a gap between what the company requires and what the company is doing. I would cite the “planning” documentation as a reference or the criteria not being met by the results.
3. ISO 9001 clause 8.1 Operational Planning and Control
Clause 8.1 Operational Planning and Control discusses, “The organization shall plan, implement and control the processes needed to meet the requirements for the provision of products and services…by (e) determining, maintaining and retaining documented information to the extent necessary and to have confidence that the processes have been carried out as planned.”
This means you have identified a gap in confidence while conducting your ISO 9001:2015 Internal Audit. Employees are not executing the process as planned in the documentation. It isn’t ideal, but it comes close because the requirement requires you to plan the processes with (“documented information”), and also requires you to “implement” the documented information.
4. Clause 7.5.1 Documented information
Clause 7.5.1 Documented information ensures that documented procedures are maintained and used as intended. The language is vague, but when it says “documented information determined by the organization as being necessary for the effectiveness of the quality management system.” It implies that you must use it as intended.
5. Clause 9.1.1 Monitoring, Measurement, Analysis, and Evaluation
Clause 9.1.1 Monitoring, measurement, analysis, and evaluation involves ensuring that the “methods for monitoring, measurement, analysis, and evaluation needed to ensure valid results.” It means that the method (procedure) established to ensure results needs to be consistently monitored (followed) and measured against established procedures. The language is also vague; we must read between the lines here. This may be appropriate for failing to do in-process inspections at a work cell.
ISO 9001 Clause Used for an Audit Finding for Not Following Procedures
The next time you conduct an ISO internal audit (this also applies to AS or IATF) and encounter a process where workers are not following procedures, you can use clause 8.5.1 or one of the other clauses, depending on what area you need to emphasize. This is an ISO 9001 Frequently Asked Question within ISO internal Audits.
