Internal audits and management review (clauses 8.8 and 8.9)

Clause 8.8 requires internal audits at planned intervals to determine whether the management system conforms to the laboratory's own requirements and to the standard, and is effectively implemented and maintained. Clause 8.9 requires management to review the system at planned intervals.

Management-review inputs the standard lists

• Changes in internal and external issues.
• Fulfilment of objectives; suitability of policies and procedures.
• Status of actions from previous reviews.
• Outcomes of internal audits, corrective actions, external assessments.
• Customer feedback and complaints.
• Results of interlaboratory comparisons and proficiency testing.
• Effectiveness of improvements; adequacy of resources; risk identification; quality assurance results.

Outputs are decisions on effectiveness, improvements, resources and any need for change. A review without recorded decisions is not a review.

Two activities that get confused

Internal audit and management review are both periodic and both produce actions, which is why they end up merged into a single annual meeting. They ask different questions. The audit asks whether the laboratory is doing what it said it would do; the review asks whether what it said it would do is still the right thing. Merging them means one of those questions is not being asked.

Planning an audit programme that finds things

Clause 8.8.2 asks the programme to take into account the importance of the activities, changes affecting the laboratory, and the results of previous audits. That rules out the schedule most laboratories actually run: every clause, once a year, in clause order. It is predictable, it spreads effort evenly over areas of very different risk, and by the fourth year it finds nothing because everyone knows what will be asked.

A programme that works audits by risk and by trail instead. Follow one certificate backwards from the customer to the raw data, the person, the reference standard and its certificate, and the method version — and see whether every link is there. That single exercise touches clauses 6.2, 6.4, 6.5, 7.2, 7.5, 7.6 and 7.8 at once, and it finds the breaks that a clause-by-clause checklist walks past.

The review inputs that are usually thin

• Proficiency testing and interlaboratory comparison results, read as trends rather than as pass marks. Three consecutive z-scores of +1.6 are all passes and all pointing the same way.
• Customer complaints, including the ones settled informally. A complaint resolved by a phone call is still an input.
• Adequacy of resources, stated honestly. This is the input that lets the laboratory record that it is under-resourced, and the one most often softened.
• Effectiveness of improvements from the last review — which requires the last review to have recorded decisions specific enough to assess.
• Risks and opportunities identified under 8.5, and whether the actions taken worked.

A review without recorded decisions is not a review. Minutes that list inputs discussed and end with no actions, owners or dates are the most common nonconformity raised against clause 8.9.