ISO 9001:2015 QUALITY MANAGEMENT SYSTEMS

AUDITOR/LEAD AUDITOR TRAINING COURSE

Case Study 1
WIDGETS ENGINEERING LTD
(Issue 5)

© 2011 SGS Société Générale de Surveillance SA

All rights reserved
WIDGETS ENGINEERING LTD

Widgets Engineering is engaged precision engineering. The initial audit to ISO

9001:2015 is being undertaken by a team from a Certification Body comprising a
Lead Auditor and an Auditor.

The areas covered were the high level discussion with Top Management,
Engineering Office, Purchasing Department, the Calibration Room and some areas
of Production.

The organisation has had certification to ISO 9001:2008 for five years prior to
upgrading to the requirements of ISO 9001:2015.

Case Study – Widgets Engineering 22-10-2015

Page 2 of 17
 Opening meeting and discussion with Quality Manager (QM) and
Managing Director (MD)

The auditor introduced himself, to both the QM and MD and, after formalities
and scope was discussed. The Quality Manager discussed how his
organisation decided to keep the documented manual mandated by the
former standard, even though the 2015 version was longer “

“Really” said the auditor, “why is that?”

The QM replied, “I felt it should be kept as the existing documentation gave

us control and added value.”

The auditor asked to see the previous management review, which was
produced. “So, one of the requirements from the new standard is
understanding the context of your organisation and accepting that there are
interested parties and issues both internal and external that have an effect
on your QMS. How do you do this?”

The MD asked the auditor to turn to page 14 of the review report, which
included a SWOT analysis.

The QM explained “in addition to our annual board meeting where we

discuss how to take the organisation forward, and along with our marketing
and finance team who highlight a strategy for three year period, you can see
on page 14 we have discussed our Strengths, Weakness, Opportunities and
Threats to our business. Strengths and weaknesses are collated with our
data analysis – discussed throughout that document”.

“Ok,” replied the auditor, the review of the SWOT analysis showed that the
topics discussed were customer issues, opportunities for work in Oil and
Gas. However a threat from this opportunity was the risk that ISO
9001:2015 will no longer be a bench mark for QMS systems in this industry
especially within service suppliers.

“Ok, so you have identified a risk there, what do you plan to do, if anything?”

The MD then replied “ISO 9001:2015 mandates that we assess risk in

various areas of our QMS. In this case we have identified that if we want to
move our business into the oil and gas industry we may need to amend our
system to meet API Q1, in this case our marketing team are assessing the
cost in upgrading this, and how it would affect us versus the potential
business we may get”

“Once we analyse this information we will then take a decision on the

method forward”.

The auditor then asked, “How do you assess and mitigate risks in the
business in general”, the QM then replied

Case Study – Widgets Engineering 22-10-2015

Page 3 of 17
 “We had developed a process map of our operations to gain certification to
the 2008 Standard, this is in Appendix 1 of the Manual.

“Yes” said the auditor, “we will review these in more detail later in the audit,
thank you”

ENGINEERING OFFICE

The Auditor accompanied by the Quality Engineer (QE) arrived in the Drawing
Office just after leaving the initial meeting held in the Conference Room. As he
entered, the Auditor immediately observed the physical layout and general
appearance. The auditor then approached one of the graduate engineers,
introduced himself and proceeded to ask:

“What is the company’s quality policy?”

“I have no idea” he said the auditor went on to ask “what KPI’s or quality objectives
do you work too in this office”,

“Ah”, said the graduate engineer (GE), “in this department we have a turn-around
time of ten days to produce a CAD/CAM program for production. Our actuals at this
time are 12.9 days. This has been addressed to MD and he had decided to provide
another software licence and engage with another GE to develop this department”.

“What involvement does the MD have on your job role” the auditor asked.

“To be honest directly none, but every day there is a walk-around the site with
management, our MD is there” the GE replied.

The Auditor was introduced to the Engineering Office Supervisor who proceeded to
explain how the Office worked. All drawings were produced using a Computer
Aided Design System (CAD). The Auditor noticed that there was quite a difference
in the ages of some of the personnel and asked the Supervisor who checked the
drawings of the younger, less experienced staff. Receiving this request, the
Supervisor explained that besides himself, there was one other member of the
Office who had sufficient experience and training to be allowed to check his own
drawings but the rest were checked before release on completion.
“May I review your training plan and competency assessment please?” the auditor
asked.

“I don’t have one” replied the supervisor.

“What training have you been given?” the audit said.

“Well to be honest I have not been given any formal training in my 5 years here, all
of it has been on the job”

“What is a geometrical tolerance?” the auditor asked.

“Oh yes, those are dimensional constraints to aid matching and mating
components”, replied the supervisor.

Case Study – Widgets Engineering 22-10-2015

Page 4 of 17
 The Auditor had a copy of the engineering office process diagram with him
(Appendix 2)

“Ok, one of the risks identified is key personnel attrition. How was this risk identified
and how was it mitigated”.

“Well” said the supervisor, “the MD took us all out on a lunch and learn session,
explaining that we are going for certification for 9001:2015. One of the fundamental
requirements is assessing risk in our service/product, we had been using these
process maps, we call them ‘turtle diagrams’ for the previous three years, we
decided to add an additional leg onto the map for identifying risks in that process”.

“At this stage we have only identified two risks, there are more, but we have
decided to solve this problem in small chunks. Isn’t the standard about continual
improvement anyhow, we don’t need to have a best in class system at this stage”.

“Who was involved in the makeup of these diagrams in general terms?”

“Key employees in every process were involved in designing these diagrams and
ascertaining risk.”

“Ok, now that you have identified a risk, what happens next?” said the auditor.

“We transfer these risks to a matrix and identify mitigation. You can see evidence
of this here” (Appendix 3).

The auditor reviewed the matrix. He found that while a number of risks had been
identified only certain risks had been mitigated, the department in question had no
mitigation.

“Why has this department’s mitigation not been completed?” the auditor asked,

“We are expecting this risk – with the economic climate being as it is, losing
personnel is expected”.

The Auditor made a few notes and immediately after this looked at a random
selection of drawings, noting the area they were held, the Supervisor’s name,
drawing number and revision number. After this he thanked the Supervisor for
giving his time saying he would be back for further drawings later and asked the
Quality Engineer to take them out on to the shop floor.

The auditor went to the area of the machine shop where the job he had noted in the
Engineering Office was being carried out. He noted at the CNC (Computer
Numerical Control) machine that the drawing was at an earlier revision number from
the one he noted in the Office.

The auditor asked the operator “why is this drawing at an earlier revision from your
engineering department?”

“hmmmm, I don’t know, this part is a component we have been making for the
customer over the past 2 years, as it has never changed, I keep the drawing in my
desk. I am the only person on the site who performs this job”

Case Study – Widgets Engineering 22-10-2015

Page 5 of 17
 At this point the Quality Engineer said. “Most areas are quite small and the
Supervisor has copies of the drawings he holds, and will automatically be aware of
who he has given drawings to. If any revisions or changes come through he logs
them as he gives them out”.

The auditor noted that all risks in this process have not been identified because the
operator has an earlier drawing revision to the one issued by engineering an.
The auditor asked the QE, “how do you know that any parts made to this earlier
revision meet the requirements in the later version?”

The QE thanked the auditor for ascertaining a weakness in their current system and
all parties moved onto the procurement office.

PURCHASING OFFICE

Meanwhile, the Lead Auditor was being accompanied by the Quality Manager
around procurement and supplier control. He was introduced to Mrs Watts and Mrs
Coats to two process owners for procurement and supply chain departments

“How do you manage the procurement and supply chain operations?” the Lead
Auditor asked

“Well, we actually have two turtle diagrams” (Appendix 4 & 5). Both documents
were produced and the auditor took time to study these and asked “please give a
brief over-view of these two documents”?

The more senior of the two operators said. “These two process maps are our
method of controlling supply chain and procurement activities”

Both turtles called out two procedures IP7.01 and IP7.04.

“How often do you review these procedures? Where do you keep them?”

The operator replied, We use these documents as training material and reference,
and they are reviewed at internal audit to ensure we are still following them”

The auditor went on,

“One of your inputs to this procurement process is customer requirements, what’s

all that about”

The operator replied, “That is looked after at contract review. In addition one of the
inputs is a BOM (Bill of Materials) from engineering at the design stage”,

“Why is that not on process map?” said the auditor.

“We don’t need to document everything; we have records to back up what I have
said.”

“Can I see two purchase orders for Aluminium 2024 and Pressure Gauge rated to
10 Bar please?” said the auditor

Case Study – Widgets Engineering 22-10-2015

Page 6 of 17
 The operator who had not spoke produced turned to her computer screen and
pulled up first one and then a second purchase orders. The first, one detailed an
order to a supplier that, she said, they had been using for four years for
“Aluminium”. This was the only information on the purchase order. The second
purchase order described the gauge to be procured and defined 10 Bar and
additionally requested a copy of the calibration certificate.

“Is there a risk that your supplier may supply you with the wrong grade of
aluminium?” the auditor asked.

“No, we have been using that supplier for a period of time, we never buy any other
material”

“What would happen if the supplier had a temporary member of staff, who doesn’t
know your usual order, is there a risk that you may get the wrong grade”?

“Well, that’s not my problem, they need to sort their own side out. Besides I thought
aluminium is a metal, I wasn’t aware there are grades of metals, I’ve learned
something today. I am not an engineer”, said.

Moving onto the supply chain process, the auditor asked.

“May I see your on-time delivery KPI’s?” These were produced showing that the
targets were being met.

On reviewing the two turtle diagrams the auditor suggested that they are quite
similar, and as an improvement, they may be able to be collated into one document.

Continuing with his questioning, he asked “Do you ever get an incorrect delivery
from a supplier, if so, what do you do?”.

The operator replied, “We send it back and ask for correct delivery”

“How many suppliers do you have”?

“Around 200” said the more senior operator,

“Who is your worst performing supplier and your best performing supplier?” the
auditor asked.

“Don’t know” she said.

“Do you record anything relating to incorrect deliveries?”

“No, we just have a phone call, we may also send an email, but for these particular
PO’s, I won’t have the email, as our records retention policy mandates that emails
over three months are to be deleted.”

“So how do you evaluate your supply chain?”

“The suppliers we use are legacy, long before my time with company, I have just
been told to use these suppliers, which are on our approved vendors listing.”

Case Study – Widgets Engineering 22-10-2015

Page 7 of 17
 “ Well your procedure IP7.04 states that where a supplier has provided consistently
poor service they will be removed from the supplier list in the Sage Accounting
system and use of their services will cease, so if you don’t record this how do you
control this?”.

At this stage the QM who was with the party spoke.

“I know all the suppliers’ performance. I keep control of this with my diligence as a
manager in this organisation for thirteen years”

“Ok, so who is your worst supplier? How many times have they provided poor
service, and have they then been removed from Sage?” the auditor asked.

“JPIM Ltd is the worst supplier”, but I can’t remove this supplier because they are
critical to our operations”

“Have you assessed this risk?”

“No, replied the QM”

“Have you brought any new suppliers on board recently?”, asked the auditor.

“Yes” said QM

“So what is your criteria for selection?”

“As per procedure IP7.04”, he replied. This stated that all ex-legacy suppliers will be
required to have.

“Can you show me your suppliers’ list, please?” asked the auditor. The QM turned to
the computer screen and accessed the spreadsheet showing the current list of
suppliers. The supplier listing also displayed the length of time the site had been
using the suppliers. The auditor randomly picked three new suppliers and asked to
see current QMS certification. The QM followed the screen links and found pdf files
of three certificates. However two were out of date.

“How do you control this?” the auditor asked.

“We have been extremely busy over the past few months. The spreadsheet shows
our suppliers, it’s my diligence that keeps control of this but I have let that slip over
this period of time.”

CALIBRATION

The Lead Auditor was with the Quality Manager in the calibration area and had just
been introduced to the Tool Room Supervisor who ran the calibration system. The
Lead Auditor explained that he had reviewed the documented information covering
calibration but would like the Supervisor to explain how he ran the system. The
Supervisor explained how the operators verified their own instruments used on the
shop floor at intervals and recorded this on computer log sheet.

“Why do you not calibrate this equipment?” the auditor asked.

Case Study – Widgets Engineering 22-10-2015

Page 8 of 17
 “Because we are not required, we may verify these, which we do, with calibrated
slip gauges, we calibrate the slips every five years and we have certification for
those slips” Records were produced.

After this, they did a brief tour of the Tool Room calibration area where the Lead
Auditor checked a sample of the calibrating instruments to see they were suitably
identified and in a state of calibration.

“How do I know this equipment is OK for calibration when there is no identification

on it?” the auditor asked.

“If you look at all equipment, you will notice a green sticker on them, this signifies
OK to use as per our procedure” the tool room supervisor said.

“May I see the procedure”, said the auditor,

“Oh, we don’t have a written procedure” was the reply.

“Ok”, said the auditor, “Perhaps you can describe to me the process by which
instruments come to you for calibration?”

“Certainly”, was the reply “It’s quite simple. We have a list of all equipment we use
onsite – we are quite lucky as we can verify all our equipment ourselves, this saves
us money – we verify all equipment every two weeks and record this on the
spreadsheet, relating to that piece of equipment. As mentioned earlier we calibrate
the slips every five years and have certificates to prove this. See, here they are” he
added pointing to the screen.

MACHINE SHOP

At around about this time the Auditor and the Quality Engineer were having a look
around the machine shop and in particular at the issue drawings. He determined
that all the drawings issued to the engineering department were identifiable and
correct, and that the Supervisor had a logbook for issuing all drawings to the work
force which was up-to-date and correct. After this they walked around the area as
the Quality Engineer explained to him how they had run a number of one-day
induction courses on Quality Assurance for all staff and what the content was.

They stopped at one particular machine running a complicated operation and, after
being introduced to the Turner, asked him to explain his operation for setting up a
run for the first time. The Turner explained how he drew the appropriate
documentation from the Supervisor’s Office and on this basis drew materials from
the area bonded store as well as the necessary jigs and fixtures.

“What do you do about measuring instruments?” he was asked.

“Oh, well”, he said, “they have to be verified every two weeks”, and he showed the
Auditor several micrometers he was using, all readily identifiable with a green
sticker as being in a state of calibration.

“Where do you perform these checks?”, “Here” said the Turner, “what is the
ambient temperature in this shop”, said the auditor, “it fluctuates up and down

Case Study – Widgets Engineering 22-10-2015

Page 9 of 17
 dependent on the season” was the reply. “What sort of tolerances are you working
with said the auditor” “normally 50 Microns”, was the reply.

“What do you do with jigs and fixtures?”

“What do you mean?” said the man, slightly puzzled.

“How do you know they are fit for use?”

“Well, they come from the store and all have a CMM (Co-ordinate Measuring
Machine) report from manufacturer” said the supervisor. In addition we run a first
off and measure all key dimensions and record this on job sheets, before
highlighting to operations to carry on with further manufacture”

The Auditor turned to the Supervisor and asked him.

“Where do you keep the formal records with the results of your checks on jigs and
fixtures?”

At this point the Quality Engineer interceded. “There aren’t any kept. All these
people are skilled tradesmen, time served. If they can’t tell when something is
wrong with a jig or fixture who can? You don’t have to tell them what to do, they’ll
check, its part of their craft training”. “We can show you the first off for any part you
may wish to see.”

The Auditor spoke again to the turner and asked him what checks he carried out.

“Well, like he said, I always make sure certain instruments are verified and if the
documentation calls for a test run of jigs and fixtures I do that, but when it’s a
standard run I just draw the gear from the store”. “We always perform a first off
check with any part made”.

“Anyway, said the Quality Engineer, “You are in a similar situation to steel rules and
tapes. You can’t calibrate them”.

The auditor noted that all equipment around the machine shop had its own
protective cover.

PLATING SHOP

After lunch and a short meeting with the Lead Auditor, when they compared notes,
the Auditor was on the factory floor looking at the Plating area where the Quality
Engineer introduced him to the Supervisor.

The Auditor walked around the Plating area where several people were working and
after having been introduced and the purpose of his visit explained, he found the
drawings bearing the numbers he had noted and verified that they were correct and
bearing up to date revision numbers.

“How long have you been working here?” the auditor asked. “Around 6 months”
was the reply?

Case Study – Widgets Engineering 22-10-2015

Page 10 of 17
 “What’s your back-ground in plating?” asked the auditor. “I worked for the civil
service for 10 years, I fancied a change, I know the MD, and he gave me a job”

“In respect of the quality control aspect of your job, what checking is completed?”

“What do you mean” said the operator.

“Ok, so you plate a piece of material, obviously there should be a certain thickness
of plating on the material, how do you know you have enough plating on the
material”?

“Ah, said the operator, “our engineers have given me this job sheet it highlights that
I should keep the material in the bath for 10 minutes. Once complete I sign this
piece of paper and job done”.

The QE highlighted to the auditor that this process has been qualified with various
trails trials (?) and had been agreed with customer – evidence was available to
show this.

PUMP ASSEMBLY AREA

Immediately after being introduced, the Lead Auditor asked the Supervisor to show
him how he dealt with non-conformance.

The auditor asked, “Do you always get the job done correctly first time?”

“We have on certain occasions had to rework some parts, for issues found at final
testing”,

“What were the issues”? the auditor asked

“Unfortunately we don’t know”.

“Can I see your non-conformance log?” the auditor replied,

“We don’t have one”, replied the supervisor.

“So how do you understand your non-conformance trends affecting your

processes”?

“Good question, we don’t know” was the reply.

“What would you consider the main risks in your process?” asked the auditor.

“Well a few months ago, I was invited by engineering to help in writing a Failure
Mode Effects Analysis (FMEA)., We consider a pro-active approach to mitigate
issues. I have told engineering about the issues at final testing, perhaps they have
added this to that document, as we continue to review it as it is a live file”.

“Ok, great”, said the auditor”, so essentially you test the pumps here. Where were
do you buy the pressure gauges from?”

“I buy these online from a reputable supplier, then just claim back the value as a
personal expense, I have been doing this since I started here”.

Case Study – Widgets Engineering 22-10-2015

Page 11 of 17
 “Why do you not go through your procurement department”, the auditor said,

“It takes too long, that way. My Manager knows I do this. All the pressure gauges
are identified and calibrated. We send these out every twelve months – here is the
evidence of that”. The supervisor then turned to his computer screen and showed
the auditor calibration certificates for the pressure gauges.

“How do you know your process is effective?” the auditor asked.

“Well said the supervisor, “I have two objectives in this area. Turn-around time and
employee morale, we report on those every quarter”.

“How do you measure morale?” the auditor asked.

The supervisor to a notice board, which had on it graphs showing turn-around time.
“Do you see those smiley faces shown on various weeks, each day at the
management walk around, the MD asks the question how are you feeling, we have
various faces showing happy and sad and a mixture of in between, that’s how we
measure it. Our MD thinks this in important – a happy workforce is an effective
workforce.

Case Study – Widgets Engineering 22-10-2015

Page 12 of 17
Appendix 1
Appendix 2
Appendix 3

Please see the handout for Appendix 3.

Appendix 4
 Appendix 5

Case Study – Widgets Engineering 22-10-2015

Page 17 of 17