Clauses 9.2, 9.3 and 10.2
Internal audit to ISO 9001 that holds up under sampling, and a management review with minutes worth reading.
We run your internal audit programme under clause 9.2, chair or support the ISO 9001 management review under 9.3, and chase every corrective action under 10.2 until someone signs it closed. For organisations in Seattle and across Washington that already run a quality system and need the evaluation clauses to hold up at stage 2 or surveillance.
What the engagement is
Three clauses that most systems fail quietly
Clause 9.2 asks for an audit programme. Not an audit, a programme: frequency, methods, responsibilities, planning requirements and reporting, chosen with regard to the importance of each process, the changes that have hit it and what previous audits found. Most programmes we open are a spreadsheet with every process audited once a year in alphabetical order. That is a calendar. A certification body auditor will ask why purchasing, which produced four supplier escapes last year, got the same attention as the canteen.
Clause 9.3 asks top management to review the system at planned intervals against a fixed list of inputs, and to record decisions. The usual record is a slide deck with a sales forecast on it and no mention of audit results, supplier performance or the adequacy of resources. Nobody signed it. There are no outputs.
Clause 10.2 is where most nonconformities we find actually sit. The corrective action was opened in March and nobody closed it. Or it was closed the same afternoon with "operator retrained" as the root cause and no check that the retraining worked.
Most nonconformities we find sit in clause 10.2. The corrective action was opened in March and nobody closed it.
We fix the three as one loop, because that is what they are. The audit feeds findings into the corrective action log. The log feeds the management review. The review decides what the next audit cycle looks at.
What each clause gets from us
Written against ISO 9001:2015. The same clause numbers carry across 14001 and 45001 on the Annex SL frame; 13485 numbers its evaluation clauses differently and we map them on the first day.
-
9.2
The internal audit programme
We build a risk-weighted programme for twelve months. Processes with customer complaints, recent changes or open findings go in twice; stable support processes go in once. Every audit gets written criteria and a scope, and every auditor is kept away from their own work, which is the 9.2.2 c) requirement most small companies break by accident when the quality manager audits the quality department.
Then we audit. Process by process, on the floor, sampling records against the procedure the operator actually has in front of them. A typical single-site programme covers eight to twelve processes.
Audit programmeAudit plansChecklistsAudit reports -
9.3
Management review
We prepare the input pack against the 9.3.2 list: status of actions from the previous review, changes in internal and external issues, customer satisfaction, quality objectives, process performance, nonconformities and corrective actions, monitoring results, audit results, external provider performance, adequacy of resources, effectiveness of actions on risks and opportunities, and opportunities for improvement. Every item gets a number or a named document, not a sentence.
In the meeting we keep the minutes. The outputs under 9.3.3 are written as decisions with an owner and a date, so the next review can check them.
Input packMinutesAction register -
10.2
Corrective action closure
We go through the open log line by line with each owner. Containment first, then cause. We use five-whys or a fishbone where the problem earns one and nothing where it does not. "Human error" is not accepted as a root cause, because it tells the next auditor you stopped looking.
Closure means evidence the action worked: a follow-up sample, a trend over 30 or 60 days, an updated risk entry. Until that exists the line stays open, however old it is.
Corrective action logRoot cause recordEffectiveness check
Format example
Illustrative lines, not a client recordOne ledger line per finding
This is how an internal audit report from us reads. Clause, evidence seen, gap, owner, due. No adjectives. You can sort it, file it and hand it to the certification body's auditor as it stands.
| Clause | Evidence seen | Gap | Owner | Due | Rating |
|---|---|---|---|---|---|
| 9.2.2 c | Quality manager audited document control, which she administers | Auditor not independent of the process | QM | +30 days | Minor |
| 10.2.1 d | 7 of 11 corrective actions closed with no effectiveness check | Closure without evidence the action worked | Ops lead | +45 days | Major risk |
| 9.3.2 c | Last review minutes omit supplier performance and audit results | Required inputs missing | GM | Next review | Minor |
| 7.1.5.2 | Torque wrench at cell 3 tagged, calibration record 4 months overdue | Measuring equipment past due, in use | Maintenance | +7 days | Major risk |
| 7.5.3.2 | Operator follows rev C instruction, posted copy is rev B | Obsolete document at point of use | Doc control | +14 days | Observation |
After the cycle
What stays in your binder
- A twelve-month audit programme with the reasoning for each frequency written next to it.
- Audit plans and completed checklists for every process audited, signed by the auditor.
- The findings ledger above, filled in with your own lines.
- Management review input pack, minutes and an action register with owners and dates.
- A corrective action log in which every line is either closed with evidence or has a live due date.
How one audit cycle runs
Timings for a single site with around 50 people. More sites or shifts stretch the middle, not the ends.
- Week 0
Scoping call
Forty minutes. We ask for the process map, last year's audit reports and the corrective action log, and we quote the cycle.
- Week 1
Programme and plans
We weight each process by risk and history, set frequencies and send audit plans to process owners at least five working days before we arrive.
- Weeks 2 to 4
Audits on the floor
Opening meeting, process audits, a short closing meeting each day. Findings go into the ledger the same day so nobody is surprised by the report.
- Week 5
Report and corrective actions opened
Report issued. Each finding becomes a line in your corrective action log with an owner who agreed to it in the closing meeting.
- Week 6
Management review
We build the 9.3.2 input pack from real figures, sit in the meeting and write the minutes and output decisions.
- Days 30 and 60
Effectiveness checks
We come back, sample again and either close the line with evidence or write down why it stays open.
Before you ask
Questions buyers actually raise
If none of these is yours, write to us or call (206) 464-3067.
Can our own people audit instead of you?
Yes, and in the long run they should. Clause 9.2 does not ask for an external auditor. It asks for objectivity and impartiality. We can train two or three of your staff and audit alongside them for the first cycle, then step back to reviewing their reports.
Does this mean we pass the certification audit?
No. The certification body decides, and it would be dishonest of anyone outside it to promise a pass. We promise the programme, records and review meet 9.2 and 9.3 as written, and that open corrective actions are visible rather than hidden. For a mock stage 2 run the way a certification body runs it, see certification audit readiness.
Our management review is a slide deck. Is that wrong?
The format is fine. The content usually is not. If the deck covers every 9.3.2 input and records decisions with owners, keep it. If it is the monthly sales review with a quality slide at the end, it will not survive sampling.
Who is this not for?
A company with no system running yet. There is nothing to audit until procedures exist and records have been kept for a few months. Start with a gap assessment or ISO 9001 implementation. If your procedures are the problem, documented information is the right engagement.
What does a cycle cost?
It is priced per audit cycle and quoted in writing after the scoping call. The number moves with processes in scope, sites, shifts and whether we audit alone. The scope builder gives indicative days before you call.
Send us your corrective action log. We will tell you how many lines would survive sampling.
Request a scopeOther engagements: gap assessment · audit readiness · documented information · ISO 9001 implementation · compare all five.