Internal quality audit: closing the non-conformance loop

The number that describes an audit programme is not the count of findings raised. It is the count of findings still closed twelve months later. A plant can raise forty findings a year, close all forty in the system, and still fail the same supplier audit twice, because thirty of those closures were a signature and a training slide rather than a change to the process.

A non-conformance loop closes when the next audit would not find the same condition. Everything in the loop exists to make that test pass: containment protects the parts already made, root cause explains why the process allowed the error, corrective action changes the process, and the effectiveness check produces evidence from parts made after the change. Skip any one and the finding returns, usually with a customer complaint attached.

What is the difference between an internal audit and an inspection?

An inspection checks product; an audit checks the system that produced it. That distinction decides who does the work, what evidence is examined and what a finding is allowed to say.

ISO 9001:2015 clause 9.2 requires audits at planned intervals, with defined criteria and scope, auditors who do not audit their own work, and results reported to relevant management. It does not prescribe a checklist, a frequency or a form. The clause sets the conditions for an honest look at the process; the plant decides how deep that look goes.

That is why an audit finding is written against a requirement, not against a person. "Housekeeping is poor in the weld bay" is an opinion. "At station 4 on 12 March, three of five fixtures had swarf in the locating pins and the work instruction requires pins to be cleaned at each changeover; the changeover record shows no cleaning entries for that shift" is a nonconformity, with a condition, a requirement and evidence. Only the second version can be corrected, because only the second version says what the process failed to do.

The distinction matters to a buyer as well. When you audit a supplier, the finding you can act on is the one that names the record and the requirement, because that is the one the supplier can trace back to a control plan limit.

The loop, stage by stage

The table sets out the six stages, the question each one answers, and the timing that keeps a loop from stalling. The timings are working targets, not clauses; the standard asks for action proportionate to the effect of the nonconformity, and a safety-critical bracket deserves a faster loop than a cosmetic panel.

Two rows carry the weight. Root cause decides whether the action is worth taking, and the effectiveness check decides whether it worked. A loop that is strong on the first four rows and weak on the last two produces a plant that is busy correcting and never improving.

Containment is not a corrective action

Containment is the fastest part of the loop and the most often mistaken for the whole of it. When a bend angle is found outside tolerance at final inspection, containment is to hold every panel from that shift, re-inspect 100% of them and quarantine the suspect stock. That protects the customer and it does nothing for the next shift.

The containment decision has to answer three questions: how far back does the suspect period go, what is the disposition of the parts already made, and who signs the release. For a formed part, the suspect period usually starts at the last verified first-off and ends at the moment the condition was found, which is why the first-off record has to be timed and kept.

Root cause that survives the next audit

The common failure is a root cause that stops at the person. "The operator did not check the hole position" is a description of the detection failure, not its cause, and the action that follows is retraining, which changes nothing about the process that allowed the miss.

A root cause statement should name two things: why the condition occurred, and why the process did not catch it before the part moved on. The hole was drilled from the wrong datum because the drawing showed two datums with equal weight — that is occurrence. The first-off check measured the hole to the edge rather than to the datum — that is detection. Fixing one without the other leaves half the loop open, and the next audit finds the same hole out of position with a different explanation.

Data makes the difference between a hypothesis and a cause. If the bend angle drifts after 200 strokes, the springback data across the run shows it, and the action is a compensation table or a tool change interval, not a reminder to the operator. If the coating thickness falls on one hanger position, the DFT readings by position show it, and the action is a jig change.

What a corrective action has to change

A corrective action is credible when it changes one of five things: the fixture, the tool, the drawing, the control plan or the check frequency. Those are the levers that hold a process in place after the auditor has left.

• Fixture. A locating pin that allows the part to load in two orientations is a mistake-proofing problem. Add a pin that only fits one way.
• Tool. A punch that has worn past its limit is replaced on a stroke count rather than on a visual check.
• Drawing. Two datums with equal weight become one primary datum and one secondary, so the shop floor and the inspection room measure the same thing.
• Control plan. A characteristic checked once per shift becomes a first-off plus every twentieth piece, with the result recorded against the lot.
• Check frequency or method. A go/no-go gauge replaces a vernier reading on a feature that is checked two hundred times a day.

Retraining belongs in the list only when the process was correct and the instruction was ambiguous or unavailable. Even then, the action includes the change that removed the ambiguity: a photograph at the station, a marked-up drawing, a check sheet that asks the question the operator was expected to ask.

Verifying effectiveness with numbers

The effectiveness check is a sample of the future. It has to be large enough to catch a recurrence at the rate the defect actually occurs, and it has to run long enough to cover a tool wear cycle or a shift pattern.

Thirty pieces across three consecutive lots is a workable default for a dimensional characteristic: it covers three set-ups, three operators and three material batches, which are the three variables most likely to bring the defect back. Where the defect rate was low, thirty pieces proves very little statistically, and the honest verification is a longer window — 90 days of lot records, or 100% inspection of the next three lots where the part is safety-related.

The verification also needs a defined pass condition before it starts. "No recurrence" is not a pass condition unless someone has said what would count as a recurrence: any single out-of-tolerance reading, two consecutive readings on the same side of nominal, or a trend on the control chart. Write the condition into the finding when the action is agreed, not after the sample has been measured.

What a repeat finding means

When the next audit finds the same condition, the loop failed, and the failure is in the closure, not in the audit. The repeat is escalated to management review with the original finding, the original action and the verification evidence attached, and the question asked is specific: did the action change the process, or did it change the record?

Repeat findings are also the most useful input to the audit programme itself. A process that produces a repeat finding moves to a six-month cycle, and the audit sample for that process widens from five records to fifteen. The programme responds to risk instead of running on a calendar.

What Ganesh runs

Ganesh works inside an ISO 9001:2015 and ISO 14001:2015 system, with an independent internal quality department and five units in Mumbai (Vasai) and Nagpur. Findings from internal audits, customer complaints and in-process inspection feed one corrective action log, and the log is reviewed with the process owners rather than filed by the quality team alone.

The evidence a customer sees is the output of that loop: first article inspection reports, in-process inspection records, material traceability to mill certificates, and PPAP documentation where a programme requires it. The plant, quality and sustainability hub indexes the articles on the control plan, calibration and first article inspection that sit around this loop, and the welded assemblies capability shows the process controls a fixture-led route depends on.

Related reading: the 5S on a fabrication floor: what it changes in practice and the Calibration register: how instruments stay traceable take the same problem further.