Page 5 - Sept NL 2016a
P. 5
A2LA Updates
Continued from page 4
Specific program requirements completed by the inspection body deficiencies. Understanding why an
(examples) staff or contracted consultants of the event occurred is the key to developing
organization are acceptable. effective corrective actions. In some
R310 – Specific Requirements: Special cases, the root cause is singular and
Inspection Agencies Inspection Body Question: My internal audit process easily discerned; in most cases it is not,
Accreditation Program (only for special consists of only completing the A2LA and there may be multiple root causes.
inspection agencies) C301 checklist - is this sufficient to Because of this, there is no single
demonstrate a complete internal audit ‘recipe’ that can be followed. While it
R311 – Specific Requirements: Federal per Section 8.6.1 of ISO/IEC 17020? is impossible to create a procedure that
Risk and Authorization Management would apply to all scenarios, there are
Program (only for FedRAMP) RESPONSE: Not necessarily - The some guiding principles which can be
standard calls for the inspection body to employed, the most important of which
R318 – Specific Requirements: Forensic “verify that it fulfills the requirements is that the root cause should address the
Examination Accreditation Program of this International Standard, and that question: “Why did this deficiency occur?”
(only for forensic inspection) the management system is effectively
implemented and maintained.” An Other points to consider:
R332 – Specific Requirements: NFPA inspection body must provide evidence
Field Evaluation Bodies (only for NFPA that their internal audit consists of at n Statements of root cause which
field evaluation bodies) least the following: are essentially a restatement of
the nonconformity provide no new
QUESTION: Per Section 8.4.2 of n Determination of compliance with all information beyond the facts of what
ISO/IEC 17020, what is the minimum ISO/IEC 17020 requirements; was found and are not considered to
amount of time I must retain records? be an acceptable response.
n Determination of compliance with
RESPONSE: In some instances all policies, procedures, inspection n Each nonconformance should be
processes, instructions, etc. that form evaluated independently.
external requirements, standards your management system;
n While each nonconformance and
and specifications provide specific n Determination of compliance its associated root cause should be
with all relevant A2LA policies and approached individually, trends in
requirements for the retention of requirements. the identified root causes for a group
of non-conformances is a strong
records. If there are no specifics This can be done on the C301 checklist indicator that further investigation
by confirming compliance and providing is needed. For example, upon
provided then A2LA’s R102 - Conditions detailed notes on the objective evidence conclusion of an assessment during
reviewed in making that determination. which 8 non-conformances were
for Accreditation, item 4 states, “Retain Where such detailed information on the cited, it is determined that the root
C301 is not provided, the inspection cause of 6 of the 8 non-conformances
all quality records and technical body must maintain additional pertain to employee training. In this
evidence that all requirements noted example, additional investigation
records supporting reported results above were audited. into the employee training program
would be prudent and should be
throughout the period between A2LA QUESTION: Per Section 8.7.4(b) evident in a response.
of ISO/IEC 17020, what is meant
full assessments bearing in mind that by “determining the causes of Additional resources that may be of
nonconformity” and how do I go about help:
adequate records must be available this?
“Presentation on Root Cause Analysis”
to demonstrate full compliance with RESPONSE: Determining the cause https://www.a2la.org/guidance/
of nonconformity is deemed equivalent Root_Cause_Presentation.pdf
the requirements for accreditation.” to root cause analysis. Root cause
analysis can be the most challenging The February 2007 Issue of the A2LA
Therefore, at minimum records shall be part of the corrective action process and Newsletter
should be used as a tool for continuous https://www.a2la.org/newsletters/
retained for the period of time from one improvement, which may reduce or a2lanews_feb2007.pdf
eliminate the likelihood of future
full assessment to the next.
QUESTION: Can the results of an
external audit be accepted as part of or
entirely in place of an inspection body’s
internal audit?
RESPONSE: No. ISO/IEC 17020 section
8.6.3 requires that the inspection body
conduct internal audits. With the
understanding that it is the inspection
body’s responsibility to conduct their
own internal audit, third party audits of
the organization are not acceptable for
meeting any portion of this requirement
of the standard. Only internal audits
Continued on page 6
5
