1/31/13

Internal Auditor: Case Study: Auditor Interpretation of ISO Standards

QualityGurus.com Internal Auditor Forums Internal Auditor Forum Case Study: Auditor Interpretation of ISO Standards
Search forums Display replies in nested form

This forum has a limit to the number of forum postings you can make in a given time period - this is currently set at 2 posting(s) in 1 day Case Study: Auditor Interpretation of ISO Standards
by Patty Flores - Wednesday, June 22, 2011, 07:38 AM

My company is a medical device manufacturing company. We are a very small company so we haven't gone completely electronic. During our recent audit we received a minor non-conformance because our files/documents were not protected from fire or damage. We have been audited for almost 10 years and that requirement was never discussed. Our CAPA Plan included moving our critical documents to a fireproof filing cabinet. The only ISO standard I could find that somewhat related to this NCR was 4.2.4 Control of records which states "A documented procedure shall be established to define the controls needed for the identification, storage, protection, retrieval, retention time and disposition of records." Also, 4.2.4.3 states "Records should be stored safely, protected from unauthorized access, and protected from alteration." My question is do you think that the standards mentioned above require us to move our files to fireproof filing cabinets or do you think that that is just our auditor's interpretation? Aside from the fact that fireproof filing cabinets are VERY expensive, why couldn't we just have them in a filing cabinet with a lock? Do you think our auditor's own interpretation of "protection" was from "fire" or is that what the standard was really inferring? Thank you for any insight!
Reply

Count of Likes: 0

100% Free Accounting

WaveApps.com Perfect for Small Businesses. Get Wave Accounting Now!

Re: Case Study: Auditor Interpretation of ISO Standards

by Varun Bains - Tuesday, July 19, 2011, 04:48 AM

The clause 4.2.4 Control of records does not mention it to put the records in fireproof file cabinet.it don't have any clue why auditor said so as now a days all things are maintained on server so the records are there as long as you are maintaining.so this is very different interpretation from auditor and as per my knowledge 4.2.4 does not say that put your documents in fire proof cabinet
Show parent | Reply

Count of Likes: 0

Re: Case Study: Auditor Interpretation of ISO Standards

by ADETOLA OLA - Friday, October 14, 2011, 08:58 AM

I think that the reason why the auditor talked about the fireproof cabinet was because like the auditee said they are a small company and that they have not totally gone electronic with their documents. Since their documents are still in papers, the best way to safeguard the documents would be to keep them in a fireproof cabinet. However, I believe this decision is still subject to the discretion of the auditor.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Amjad Naeem - Monday, August 22, 2011, 01:54 AM

In my point of view, 4.2.4 clause of ISO 9001:2008 standard just require that record should be protected till defined retention period. If there is no other way in place of fireproof cabinet, then the auditor is right.
www.qualitygurus.com/courses/mod/forum/discuss.php?d=7829
Show parent | Reply 1/9

1/31/13

Internal Auditor: Case Study: Auditor Interpretation of ISO Standards

Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Tom Pollmiller - Tuesday, September 6, 2011, 09:43 AM

The short answer is no, you do not have to move the files into a fire proof cabinet. The auditor was simply identifying an area of concern. You have not protected the files/records from potential damage. Although moving the files to a fire proof cabinet would help to prevent damage, this will not prevent all possible damage. You mentioned that your company has not gone completly electronic, which implies you have some elctronic storage. Simply establish a plan to complete the conversion digital storage with offsite backup and you would be far better off than investing in fire proof storage.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Terina Fitzpatrick - Thursday, September 8, 2011, 12:48 PM

I agree completely with Tom. You can store all your documents electronically rather than hard copies in a fire proof cabinet. They just have to be secure and retrievable if or when required. Ensuring that there is back up off site.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by JOHN ADDO - Saturday, July 7, 2012, 06:23 AM

You have it there. Data Integrity, Retrieval and Storage is much better done electronically than the old method of keeping data in fireproof places. My advice is to make sure you do frequent data backup which must not be stored at the same office premise. Your backups could be stored at a different safer location with ease of accessibility.
Show parent | Reply

Count of Likes: 0

Re: Case Study: Auditor Interpretation of ISO Standards

by Nehal Hasan - Thursday, September 8, 2011, 04:40 AM

I think that this is just an auditor's interpretation, and just complete your electronic filing ,that would be good for business.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by DALJIT GUJRAL - Monday, January 9, 2012, 07:00 PM

I think it is foremost duty of the Auditor to keep all the records safe and secure. Whenever data is saved in computers , back-up copy should always be made in order for any lost data. Retrievability is the key to success for any organisation and it shows the good documentation skills.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Nehal Hasan - Thursday, September 8, 2011, 04:41 AM

I think that this is just an auditor's interpretation, and just complete your electronic filing ,that would be good for business.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Radheyshyam Sharma - Tuesday, September 13, 2011, 12:47 AM

You have to store your record in a safe place. there is no need to move the files in fireproof cabinet. It depends upon you, how to keep your record safe up to recommended time. You can also think on auditors advise to move the record in a fireproof cabinet, if you think it as a better option to keep your record safe. you can also use electronic media to keep your record safe.
Show parent | Reply

Count of Likes: 0
www.qualitygurus.com/courses/mod/forum/discuss.php?d=7829 2/9

1/31/13

Internal Auditor: Case Study: Auditor Interpretation of ISO Standards

Re: Case Study: Auditor Interpretation of ISO Standards

by Ong Theriza - Tuesday, September 13, 2011, 02:34 AM

Regarding to your minor NCR that was received is not neccessary and is only your particular auditor own definition of safety. As my passed experienced, an auditor is going to give us a minor NCR as well regarding to why my company only do sampling testing for every bateches and not a few for more accuracy result? My point is our limitation of equipment unit since is very expensive and we only have one unit and so many samples depends on this machine, that is why we did as our procedure. As long as we can show that with this procedure, we have no problem to our operation and customer is satisfied with our product, so the auditor at last cannot give us the minor NCR. How can the auditor asked us to buy more unit of machines since our company is not afford to do it? They cannot fause us to spend money. They are only audit our procedure and record. The most important things is we do what we write, and we write what we do. Yet, no problem with our procedure that were set.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Deebha Vasanthakumar - Saturday, October 29, 2011, 09:57 AM

Hi, As per ISO there is no need of fireproofing cabinet for controlled records. I think as per your company's environmental condition, your auditor has suggested the fireproofing cabinet for protecting the controlled records. Thanks & Regards, Deebha
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by cecilia baca - Monday, October 31, 2011, 05:16 PM

From the auditors perspective its important to take into account that the auditor is not just auditing the "system" but also how the system is being contained. I have found that many times enviornmental factors (building, location, risk factors-building up to code? next to restaruant? water lines? or other high risk structures? in addition to having no back up system(did not see it mentioned)would certainly raise concerns; is there a potential for files to be exposed to damaged? These are all consideration that will influence the findings. I was issued a NCR. The recommnedation was that we also consider fire proof file cabinets. Faced with the same dilemna we quickly figured out that the concern was the file room being located next to the boiler room. We did not purchase the file cabinets (could not afford them) but we reconfigured our space and moved the file room to a different location and installed a fire door in the boiler room. We gave a time frame for transfering all our hard files to e-files and this satisfied the auditors.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by elizabeth mnyandu - Saturday, November 12, 2011, 09:42 AM

Moving the records to a fireproofing site would be your added advantage, however the ISO standard does not specify that we should move to fire proof cabinets it just talks about keeping our documents and records protected. How protected they should be lies with a specific organisation as business and requirements vary
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Jennifer Gidley - Wednesday, January 18, 2012, 01:58 PM

I think the auditor was just making what he thought was the most practical suggestion for you to create a record protection procedure. Fireproof filing cabinets are not themselves a requirement for ISO standards. A documented procedure for record protection, however, is. If you can think of a more practical way of ensuring record protection, such as another set of copies of all records which are kept in a different secure location or electronic back-up copies of all records, then I believe that would be an acceptable way of adhering to the standards. I know you said you haven't gone completely electronic yet, but could you perhaps at least start the process of backing records up electronically?
Show parent | Reply

www.qualitygurus.com/courses/mod/forum/discuss.php?d=7829

3/9

1/31/13

Internal Auditor: Case Study: Auditor Interpretation of ISO Standards

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Jennifer Davies - Thursday, March 15, 2012, 06:27 AM

In my experience locked filing cabinets in , prefereably a locked room would be all that is required. The Care Quality Comission is currently happy for files to be protected in this way as long as only those people who have a 'need to know' have the access to files. I think the experience that you have had is the interputation of an over zelus individual.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Muhammad Hanan - Thursday, March 15, 2012, 10:10 AM

As per my opinion auditor has make right decision. His point of view should be according to the ISO Standard and as well as he might noted that your record are not save yet from fire. As you mentioned that fire proof cabinit are very expensive. I think its may be expensive but not more then document. Search alternative solution for that.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by NEIL ROZEE - Monday, March 19, 2012, 06:11 AM

I would have thought the fire proof cabinet is a little over the top..... A risk assessmnet should show the need such action( is the area at any significant risk of fire ie ignition sources) In normal circumstances I would have an locked filing room / cabinet for storing files which I would have backed up on computer files as a matter of some urgencey

Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by LOOTE AKUWOM ELIZABETH - Saturday, March 24, 2012, 07:04 AM

the mention on clause does not directly say that files should be put in a fireproof but what we have to be concern a bout is the safety of the records,and this can be one of the protecting strategies.thanks
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Hermichi Kosasi - Tuesday, April 10, 2012, 12:17 PM

This problem is not classified as minor because there is no NC ISO clause is breached clause 4.2.4 mainly because it does not explain specifically what should be protected from fire or storm. ISO only emphasize that the archive during the period of retention should remain clearly readable, ready to be identified, easily searchable, and retrievable. But of course if an organization purchased a fireproof filing cabinet as a precaution against unforeseen events then it's good. But not a must. Thank You.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by George Castillo - Thursday, April 12, 2012, 05:30 PM

Dear Patty, As a general practice records are not stored in a fire proof cabinet and certainly ISO does NOT require to do so, looks like you have a difficult auditor who is trying to impose his own interpretations.
www.qualitygurus.com/courses/mod/forum/discuss.php?d=7829 4/9

1/31/13

Internal Auditor: Case Study: Auditor Interpretation of ISO Standards

During the course of the audit you have the right to disagree with the finding, although this may make matters worse.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Shana Alt - Thursday, April 19, 2012, 07:26 PM

I agree, protecting the documents in a fireproof cabinet or off-site storage would be the next best thing after storing your files electronically. Larger companies are able to control the documents at corporate level, use the intranet for the facilities give give standardization throughout.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Dawn Parks - Wednesday, May 9, 2012, 12:55 PM

I work in a food processing plant as far as I know a fire proof cabinet is not a requirment......Our company stores documents in a controled area as far as a paper trail and also stored electronicly in a database for extra precaution in the food industry because of USDA Regulations and company procedures all documentation has to be stored for 2 years ,and the same requirement is with the auditor in any situation concerning raw and rte food products . Company wise they are found to be helpfull with customer complaints and overall food safety or a recall situation wheater be mock recall or the real deal. Dawn Parks
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Camilo Encarnacion - Monday, May 21, 2012, 12:53 PM

This is a case wherein we can detect the bias of an auditor. His or her personal interpretation of the ISO Clause 4.2.4.3. reflects previous work experience. Say, work engagement with HSE or fire fighting training. There are so many ways on how to store safely and protect documents. The worst disater the auditor thought about was fire (and maybe water), hence the fireproof filing cabinet requirement. Even electronic data files can not expressly guarantee full protection of files and documents due to the advent of virus and hackers. Therefore, the best protection is the backup system. In my opinion, for a company with limited resources, keeping the records/files/documents in locked burglar-free filing cabinet would be enough and in compliance to the ISO clause. But there should be one responsible and one accountable personnel to keep the keys.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Derdree Domee Palma Dumaquit - Thursday, May 24, 2012, 05:30 AM

Everyone is entitled on their own opinion. As per ISO 9001:2008 4.2.4 Control of Records in which states that a documented procedure shall be established to define the controls needed for the identification, storage, protection, retrieval, retention time and disposition of records. My understand is to have proper documentation in which the 6 variables are obtained and observe. For the protection variable, normal cabinet is accepted as long as the storage room is protected from unauthorized access. As a conclusion, there is no need to have a fire proofing cabinet for such case.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Walter Duarte - Monday, May 28, 2012, 12:31 PM

I was in a similar situation because we did not show evidence that our files specs were protected to avoid be steal or printed our without any Control Documentation.
www.qualitygurus.com/courses/mod/forum/discuss.php?d=7829 5/9

1/31/13

Internal Auditor: Case Study: Auditor Interpretation of ISO Standards

And the Company previews experience was that a competitor got a copy of the Confidential documentations for the product manufactured.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Olawale Ogunsola - Wednesday, May 30, 2012, 08:31 AM

The Standard did not require your company to move her files to fireproof filing cabinets but I'm in support of your auditor's recommendation because fireproof filing cabinet is the only way you can protect your files against fire since your company have not established electronic filing system. Thank you. Olawale Ogunsola
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by John Carroll - Thursday, May 31, 2012, 12:59 PM

My belief is that it was your auditors interpretation. Yes, you need to establish a procedure tocontrol documents, including records. Fireproof cabinets are well and good, but there are other solutions thatare just as effective. For example,having copies stored off premises are just as effective and provide forunauthorized access and protection from alteration.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by kinza usman - Tuesday, June 19, 2012, 07:09 AM

im my opinion yes the auditors were rite becz the security is an imp issue.because information is a very important tool fr an organisation.they are expensive but its really worth to spend money on something rather to bear the loss thats untoleratable.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by bamigbaye babatunde - Thursday, June 28, 2012, 07:24 AM

The work of an accountant, which auditor is inclusive, involved interpreatation of statement. In my opinion the interpreatation of the auditor was right given the circumstances of the said company. Never the less, it will be more economical for the company to invest more on digital storage and offline back up than acquiring more fire proof safe that occupied more space that could be put to more productive use.
Show parent | Reply

Count of Likes: 0

Re: Case Study: Auditor Interpretation of ISO Standards

by Sunkanmi Bello - Monday, July 2, 2012, 01:27 PM

To establish a document procedures as identified 4.2.4 control of records:records must be protected either electronically with good back up system or manually in safe and fire proof condition. I believe the auditor was right to raised a minor non conformance on record control in this scenario.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Monchito V. Adecer - Thursday, August 2, 2012, 05:00 AM

Firstly, I would like to assume that this is a QMS audit, not any other system? Secondly, if QMS audit, there is no specific requirement for fireproof storage of records, and documents. Therefore, you are correct, and you should challenge the auditor. May I share that I work in a multinational company, and I have been the Systems-certifications MR (QMS, EMS, FSMS/HACCP/GMP, SA, OHSAS, GlobalGAP, SEDEX, Organics), and we have lots and lots of records, and I am also in
www.qualitygurus.com/courses/mod/forum/discuss.php?d=7829 6/9

1/31/13

Internal Auditor: Case Study: Auditor Interpretation of ISO Standards

charge of our global/corporate RIM/Records & information management implementation in our division ( about at least 15,000 employees). If we will be required of a fireproof storage, I will never find one in the 2nd biggest island of the country. There is not even a third party storage company here. If I will propose to construct, my boss will doubt my sense of business, and being an engineer, I cannot reconcile anybody investing to this kind of facility. I propose, you revisit, and discuss with your certification body, lead auditor or your boss. If they will insist, if I am in your position, I will consider transferring to another CB that will add value t your organization. Regards!
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Atanu De - Friday, August 3, 2012, 12:56 AM

nowhere in the ISO it is written that you have to store all of your record in the fireproof filing cabinet. It was just the auditor's perception of storing the documents safely. It is better to implement electronically store the documents rather than the manual one.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by James Strickland - Monday, August 27, 2012, 06:02 PM

The best recommendation in this situation is to go electronic. It will be a cost savings as your company gains more files, you simply could not store enough safes.This was a subjective conclusion by the auditor.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Cindy John - Wednesday, September 12, 2012, 10:21 AM

We have been using the same auditor for several years, and have never been asked if our records are in fire-proof filing cabinets. Sometimes I think that auditors are searching for something to nail you on, and this is a reach. Although, every auditor will look at things differently, and bring up something that you never thought was an issue before. We keep our QA files in a locked room, in regular filing cabinets. But we also key the info into a database or scan to a electronic file. Maybe you could consider that. There are other people throughout the plant that retain their own records that they use for production, I just make sure that they give me the required information for retention and control. Cindy John
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by MOHAMMAD IQBAL - Wednesday, September 19, 2012, 09:15 AM

If you have already established control of records procedure in your organisation which also states that you have to protect all your documents from fire and damage,then auditor interpretation is right.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Samson Walota - Wednesday, November 14, 2012, 05:33 AM

The auditor was absolutely right.If as an auditee, you cannot prove that your documents are protected from fire, then there is a problem. It is quite a huge risk. Most organisations have moved away from this hussle by ensuring that all documents are converted into electronic versions. Where the documents need to be filled manually in ink, the documents are scanned and kept on the company server. It is not only fire risk, there are other areas which are prone to floods. The company needs to demonstrate that the records will still be protected. This is why most companies back up their records in a server quite far from their operational place. If you haven't had any serious fire or you have never seen fire reducing a facility to a rubble, you may look down upon such a finding.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Pam Tate - Thursday, December 6, 2012, 07:59 AM

I'm uncertain of the auditors interpretation but I too work for a small contract company and all of our files are not on a server.
www.qualitygurus.com/courses/mod/forum/discuss.php?d=7829 7/9

1/31/13

Internal Auditor: Case Study: Auditor Interpretation of ISO Standards

Most of the documents here are recorded on forms and filed in a fire proof cabinet. However, once those files are full the oldest files are moved to limited access area thats not fireproof.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by azza abd alrhman - Tuesday, January 8, 2013, 12:06 PM

Iam like you, i worked in company had lack records keeping system because we took some of our records that in hard copies to archive in locked containr with no any protection of fire and we start prerequeset program for ISO is that mean we should it required to move our files to fireproof filling container? also we have another proplem that is an aural ordars not writting one dose this affected our work adverslay. but in my point of wiew i think its better to go to electronic records than use papers saving but it take time to conver to electronic.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Jennifer Van Horn - Sunday, January 13, 2013, 09:01 PM

All auditors are different and we, the plants, are at their descretion. I think this one would fall under "the auditors interpretation". As long as you are following what your program states, there shouldn't be an issue. Hopefully, the list of non-conformances was minimal. Not sure if this helps, but we store our records in the top racks of our locked warehouse, which is made of fire proof materials (cinder blocks). But now I feel the need to investigate further!
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Mohammed Asif Ali - Wednesday, January 16, 2013, 04:49 AM

As Mentioned in your CAPA Plan states that moving your critical documents to a fireproof filing cabinet persuant to clause 4.2.4 specifically the term "Protection". Your company has delveloped the CAPA plan according to the ISO standards and established company's objectives for Control of Records. This should be followed by all the concern employess to achieve desired results. keeping the above in mind, I aggreed the Auditor's findings are correct.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by Kyaw Lin Htoo - Wednesday, January 23, 2013, 08:16 AM

Back ground- Minor NCR(Control of record) to medical device manufacturing company Observation- Files/documents were not protected from fire or damage. Classification- ISO 9001:2008 doesn't mention about the fireproof cabinet to be use but required to maintain during the contract or ISO period. I believed that the fireproof cabinet couldn't enough to keep all necessary documents. So you should create soft copy and hard copy for your company documents safety and keep it them properly.
Show parent | Reply

Count of Likes: 0 Re: Case Study: Auditor Interpretation of ISO Standards

by ADEKUNLE RAFIU-BABATUNDE - Saturday, January 26, 2013, 06:55 AM

on interpretation of ISO(INTERNATIONAL ORGANIZATION FOR STANDRDS) has various family of standards such as 1so 9000(quality management standard) iso 14000(enviromental management standards) and so on.all these standard was designed to help organizations to ensure that they meet the needs of their customers and other stake holders.as an auditor you must have an adequate knowledge to interprete and understand those families of ISO Standards for proper implementation during the cause of auditing.the iso standards is continually being revised by the standing technical team.good knowledge of interpretation of iso standard is the best.
www.qualitygurus.com/courses/mod/forum/discuss.php?d=7829 8/9

1/31/13

Internal Auditor: Case Study: Auditor Interpretation of ISO Standards

For instance as an auditor to audit an iso 9000(quality management standard) dont you think adequate knowledge of this standard will be your power for proper implementation. just it is the fact that foreign auditors should be acquitend with the culture and norms of the environment they are auditing.
Show parent | Reply

Count of Likes: 0

Meet IFRS Standards

icaew.com/finance-reporting-course

Apply financial reporting standards with ICAEW courses

Quality Handbook | Management Gurus |||| Terms of Use | Privacy Policy

www.qualitygurus.com/courses/mod/forum/discuss.php?d=7829

9/9