Passing an Audit With Few Findings Does Not Mean Your QMS Is Effective
I am seeing more organizations point to an external audit with very few nonconformances and several observations or opportunities for improvement as evidence that their quality management system is effective.
Management is relieved. Employees are congratulated. The audit report becomes evidence that the organization must be doing things right.
Then I start looking at the business.
On-time delivery has been below target for months, sometimes years. Customer scorecards remain red. Key performance indicators are flat or declining. Customer complaints are increasing. Internal corrective actions are surprisingly scarce. In some cases, when you look deeper, problems are being handled informally or are not being documented at all.
That raises a question leadership needs to be willing to ask:
If the QMS is performing so well, why isn't the business performance showing it?
An External Audit Cannot Tell You Everything
This is not an argument against external audits.
Certification and customer audits provide valuable independent evaluation of a management system. But an external auditor has a defined amount of time and cannot examine every transaction, record, employee, product, decision, and process output generated throughout the year.
Auditing necessarily involves examining objective evidence within an established scope and period of time.
That makes the audit valuable.
It does not make the audit report a substitute for the organization's own performance data.
One of the mistakes I see management make is assuming an external auditor has performed the same kind of continuous, detailed evaluation that management should be performing internally.
That is not what an external audit can reasonably provide.
What Happens When Passing Becomes the Objective
The problem becomes more serious when leadership tells employees before an audit that there must be no findings.
When leadership makes “no findings” the objective, they should not be surprised when employees begin managing what the auditor is allowed to see. I have watched organizations spend months scrubbing records, cleaning up problems that had been tolerated all year, steering auditors toward their strongest employees, and even making sure certain employees were unavailable in areas likely to be audited.
At that point, the organization is no longer preparing for an audit—it is managing the auditor’s view of the organization.
Then the audit ends, the pressure disappears, normal behavior returns, and leadership celebrates the favorable report.
If you have to temporarily change how your organization operates so an auditor will conclude that your QMS is effective, the audit result is not the accomplishment you think it is.
Your Internal Audit Program Should Be Telling You More
A strong internal audit process should give management a much deeper understanding of the health of the QMS.
Yet I frequently encounter internal audit programs built around an annual schedule and a checklist.
The process gets audited because the calendar says it is time. Questions are answered yes or no. Boxes are checked. Little objective evidence may be documented to demonstrate what the auditor actually examined.
Then that process waits another year before anyone audits it again.
That approach misses one of the greatest opportunities of internal auditing.
Audit frequency and depth should reflect what is happening in the organization. Process risk matters. Previous audit results matter. Performance matters. Recurring problems matter.
If an area has experienced nonconformances or continues to perform poorly, why would management automatically wait another year before examining it again?
The audit program should respond to what the business is telling management.
Few Corrective Actions Do Not Necessarily Mean Few Problems
I become particularly cautious when an organization with weak performance also has very few internally generated corrective actions.
Some organizations view a short corrective-action log as another sign that the system is performing well.
I don't automatically see it that way.
Sometimes it means people do not want to formally document problems because doing so creates additional work. A meaningful corrective action requires the organization to understand what happened, investigate the cause, take appropriate action, and determine whether that action actually worked.
It is easier to fix the immediate problem, close the issue informally, and move on.
But avoiding corrective action does not eliminate the underlying problem.
It can eliminate management's visibility into it.
A mature QMS should make it acceptable to identify problems. Leadership should want employees to bring forward weaknesses, improvement opportunities, and ideas that can make processes perform better.
I have seen stronger organizations recognize employees, including through financial compensation, for ideas that reduce waste, improve performance, and benefit the organization.
The message is fundamentally different.
Instead of telling employees, “Don't let anyone find a problem,” leadership is telling them, “Help us find where we can get better.”
The Auditor Does Not Own Your QMS
There is another pattern I encounter.
Some organizations have effectively built their QMS to satisfy the auditor.
A customer requires certification, so certification becomes the objective. An auditor suggests changing something, and the organization immediately changes it.
Then another auditor arrives with a different viewpoint, and the system changes again.
Over time, the QMS begins reflecting a collection of auditor preferences rather than the way management has determined the business should operate.
Organizations need to know the requirements that apply to them. They also need to know their own processes.
When an auditor believes something should be done differently, management should be willing to understand why.
What requirement is not being met?
What objective evidence supports the finding?
How does the issue relate to the applicable requirement?
Those are legitimate questions.
That does not mean becoming combative with an auditor. I encourage organizations to listen carefully and understand the auditor's viewpoint.
But if the organization has defined an effective process that meets the applicable requirements, management should be capable of explaining and defending that process.
And when there is a genuine disagreement, established appeal processes exist for a reason.
The QMS belongs to the organization—not to whichever auditor happens to be there that week.
Three Years of Good Audits Do Not Change the Evidence in Front of Me
When I identify an issue during an audit, I sometimes hear:
“The last three auditors never had a problem with this.”
I understand why organizations ask that question.
But I cannot know what objective evidence another auditor sampled. They may have examined different records, interviewed different people, followed a different process trail, or encountered different conditions.
I can only evaluate the objective evidence in front of me against the applicable requirements.
If that evidence demonstrates a problem, the fact that another auditor did not previously identify it does not make the evidence disappear.
That is another reason management should be careful about using previous audit results as proof that a problem cannot exist.
What Should Management Celebrate?
A favorable external audit result is worth acknowledging.
It just should not become the organization's primary measure of QMS effectiveness.
I would rather see leadership celebrate improvement that occurred before an external auditor ever walked through the door.
- Are key performance indicators improving?
- Are customer requirements being consistently met?
- Is delivery performance getting better?
- Are customer concerns being reduced?
- Are employees identifying problems and improvement opportunities?
- When corrective action is needed, is the organization doing the hard work of understanding cause and verifying effectiveness?
- Are internal audits changing in response to risk, previous findings, and process performance?
Those indicators tell management far more about the health of the system over time.
Which Evidence Are You Going to Believe?
A favorable audit report should never give management permission to ignore what the business is telling them.
The purpose of the QMS is not to pass an audit. It is to help the organization consistently meet customer requirements, improve its processes, and get better over time.
An external audit can provide valuable independent evidence about the management system.
But it is still evidence gathered during a limited period from a much larger system.
Management has something the external auditor does not: the performance of that system every day.
If the audit report says you're doing well but your performance says otherwise, which one are you going to believe?