This is an old revision of the document!


Rainbows, Unicorns... and Audit Reports?

Audit Reports are “supposed” to contain the results of an “audit”… which is defined as:

ISO 9000:2015, sec. 3.13.1
audit
systematic, independent and documented process for obtaining objective evidence (data supporting the existence or verity of something) and evaluating it objectively to determine the extent to which the audit criteria (set of policies, procedures or requirements used as a reference against which objective evidence is compared) are fulfilled.

So why does AS9101F, Form 5, “Audit Report” include a field, under the “Audit Conclusions” section, requiring auditors to include their “subjective opinions” regarding “Strengths and Good Practices”?

Is this actually required? Upon examining ISO 17021-1:2015 & AS9101F, the ONLY reference I could find was the requirement in AS9101F, sec. 4.2.3 to complete the “…Audit Report (Form 5)”.

I did find “best practices” mentioned in ISO 19011:2018, “Guidelines for auditing management systems”.

5.5.6 Managing audit programme results
The individual managing the audit programme should consider, where appropriate:
— communicating audit results and best practices to other areas of the organization, and
— the implications for other processes.

But, of course, ISO 19011 is only a guideline, that's not mandatory.

<note>The “should consider, where appropriate” cracks me up. I'm almost surprised they didn't add “and if it's not too much of an inconvenience… because we really wouldn't want it to be a bother. Seriously, think about it, and do whatever is easiest for you.” </note>

Even worse, some registrars require their auditors to complete a SWOT analysis for each audit! This is beyond ridiculous because auditors have extremely limited time to assess a management system… much less reasonably identify any meaningful “Strengths, Weaknesses, Opportunities and Threats” to the organization.

Conclusion

Ultimately, incorporating subjective “Strengths and Good Practices” OR a SWOT Analysis into an audit report contradicts the definition of the audit purpose of using “objective evidence” to “objectively” determine the extent to which the audit criteria are fulfilled.

On more than one instance, I've issued nonconformities against areas where previous AS9100 auditors had identified as “Strengths and Good Practices”. This is confusing to clients.

Requiring AS9100 auditors to provide subjective opinions regarding “Strengths and Good Practices” in audit reports is an example of a BAD practice being promoted by IAQG.

IAQG… please consider this an “opportunity for improvement”; and remove the “Strengths and Good Practices” from Form 5 in the next revision of AS9101.

For a variety of reasons, these add about as much value (perhaps even less) as placing a rainbow unicorn clipart graphic into the report.