Contents
Short answer
A properly configured ERP changes how an ISO 9001 audit is prepared, because the evidence is produced by the activity itself instead of being gathered after the fact. The article details what the auditor looks for (consistency between what is described and what is done), upstream and downstream traceability, the full non-conformance loop through to effectiveness verification, authorisations and four management-review indicators.
The week before an ISO 9001 audit often looks like a search party: hunting for records in binders, rebuilding histories from memory, printing spreadsheets. A properly configured ERP changes the nature of the exercise, because the evidence is produced by the activity itself, instead of being gathered after the fact.
What the auditor is really looking for
Contrary to a widespread fear, an auditor does not check that you own procedures. They check that what you describe matches what you do, and that you can prove it. Three questions come up without fail:
- Show me the full history of this lot, from component to delivered customer.
- What did you do with this non-conformity, and what did the action yield?
- How do you know this person was qualified for this operation?
Upstream and downstream traceability
Two paths must be walkable. Downstream: from a received material lot, find all the finished products that contain it and all the customers delivered — this is the path of a recall. Upstream: from a product a customer has complained about, trace back to the component lots, the operators, the machines and the checks — this is the path of an investigation.
These two paths only exist if the lot-component / work-order link was recorded at the moment of consumption. No tool reconstructs after the fact information that was never captured.
Non-conformities, from finding to closure
A non-conformity raised but never closed is more damaging than one never raised: it proves the system is spinning in a vacuum. The circuit must be complete and timestamped:
- Finding, with the part, lot and operation concerned.
- Disposition decision: scrap, rework, concession, return to supplier.
- Root-cause analysis, when recurrence or severity warrants it.
- Corrective action, with an owner and a deadline.
- Effectiveness check, some time after implementation.
The last step is the one auditors most often find missing.
Qualifications and sensitive operations
For operations subject to qualification — welding, non-destructive testing, lot release — the ERP must refuse declaration by an unqualified operator, or at least flag it. A check that depends on a team leader's vigilance is not a check: it is an intention.
The management-review indicators
The standard requires a periodic review backed by data. Four indicators compute directly from a fed ERP, with no re-entry:
- Customer service rate: orders delivered complete on the promised date.
- Internal non-conformity rate, by product family and by cause.
- Supplier performance: conformity and on-time delivery at receipt.
- Average time to close corrective actions.
A welcome side effect
Companies that structure their quality this way almost all notice the same effect: the audit stops being a dreaded event, because it no longer calls for any special preparation. The data already exists, produced by daily work. See our approach on the AV Core Quality page.
