![](media/image1.wmf){width="3.3631944444444444in"
height="0.7291666666666666in"}

**DIRECTIVE NO.** [GPG 9980.1G]{.underline} **APPROVED BY Signature:**
[*Original Signed by*]{.underline}

**EFFECTIVE DATE:** [August 28, 2000]{.underline} **NAME:** [A. V.
Diaz]{.underline}

**EXPIRATION DATE:** [August 28, 2005]{.underline} **TITLE:**
[Director]{.underline}

**Responsible Office: 300/Office of Systems Safety and Mission
Assurance**

#### Title: INTERNAL AUDIT SYSTEM

**\
**

# Preface

1.  PURPOSE

This procedure establishes the process for coordinating, scheduling,
planning, performing, documenting and closing out internal audits of the
GSFC Quality Management System (QMS).

2.  APPLICABILITY

This procedure applies to all policies, system level procedures,
Directorate procedures, work instructions, and related records that form
the GSFC QMS.

3.  AUTHORITY

NPD 8730.3, NASA Quality Management System Policy (ISO 9000)

4.  REFERENCES

```{=html}
<!-- -->
```
a.  ANSI/ASQC Q9001, Quality Systems -- Model for Quality Assurance in
    Design, Development, Production, Installation, and Servicing

b.  GPG 1710.1, Corrective and Preventive Action

c.  GPG 5340.2, Control of Nonconforming Product

P5. CANCELLATION

GPG 9980.1F, Internal Audit System

6.  RECORDS

  ---------------------------- --------------------- ---------------------
  **Quality Record Title**     **Record Custodian**  **Retention**

  Qualified Auditors and Lead  GSFC Audit            [NRRS 8/5-A2, Project
  Auditors training/experience Coordinator           Test Engineering, and
  records (reflecting audit                          Evaluation
  experience by copy of audit                        Files]{.underline}
  report as well as formal                           (Records may be
  training by copy of training                       retired to a Federal
  certification or class                             Records Center
  attendance roster)                                 \[FRC\] when 2 years
                                                     old. Destroy when 15
                                                     years old.)

  Audit Executive Summaries    GSFC Audit            [NRRS 8/5-A2, Project
  contained in the Audit       Coordinator           Test Engineering, and
  Database                                           Evaluation
                                                     Files]{.underline}
                                                     (Records may be
                                                     retired to an FRC
                                                     when 2 years old.
                                                     Destroy when 15 years
                                                     old.)

  Internal audit               Code 302              [NRRS
  Nonconformance Reports                             8/5-A1]{.underline}
  (NCRs) and associated                              (Permanent. Records
  Corrective Actions in the                          may be retired to an
  NCR/CA database                                    FRC when 2 years old.
                                                     Transfer to NARA 15
                                                     years after
                                                     completion of the
                                                     project or when 25
                                                     years old.)

  Audit Database Change        Audit Coordinator     [NRRS 8/5-A2, Project
  Request Dispositions                               Test Engineering, and
                                                     Evaluation
                                                     Files]{.underline}
                                                     (Records may be
                                                     retired to an FRC
                                                     when 2 years old.
                                                     Destroy when 15 years
                                                     old.)
  ---------------------------- --------------------- ---------------------

# Procedure

1\. DEFINITIONS

a.  Quality Audit - A systematic evaluation, conducted by an independent
    team, of an organization\'s compliance with the GSFC QMS.

b.  Audit Nonconformance - A failure to meet a specified requirement.

c.  Objective Evidence - Quantitative or qualitative information,
    records, or statements of fact pertaining to the quality of an item
    or service or to the existence and implementation of a quality
    system element. It is based on observation, measurement, or test
    that can be verified.

d.  Audit Contact -- The representative of the audited
    organization/function who is the primary point of contact with the
    Lead Auditor. The Audit Contact is typically responsible for
    managing and approving corrective actions resulting from the
    internal audit, but this responsibility may be delegated by the
    Audit Contact to another as a Nonconformance Lead (NCL) (see GPG
    5340.2).

e.  Escort - The representative of the audited area who accompanies the
    auditor during the investigation and analysis of the objective
    evidence. This individual will (a) provide access to data records
    and

physical areas, (b) offer interpretation of the audited organization's
documents, (c) interface with other audited organization personnel, and
(d) witness the discovery of nonconformances.

f.  NCR/CA Database -- An inter-active on-line database, accessed via
    the GSFC QMS web-site, used to document and track the status of
    identified nonconformance reports (NCRs) and associated corrective
    action (CA).

g.  Audit Database - An inter-active on-line database used to document
    and track the schedule, participants, results, follow-up, and status
    of internal and supplier audits.

h.  Quality Management System Representative (QMSR) - A GSFC manager, or
    a group of GSFC managers, designated by and reporting directly to
    the Center Director, who has responsibility and authority for the
    effective implementation of the QMS.

2\. IMPLEMENTATION

1.  The Director, Office of Systems Safety and Mission Assurance, shall
    designate an individual to be the GSFC Audit Coordinator.

2.  The Audit Coordinator maintains the listing of qualified auditors
    and lead auditors in the audit database from which internal audit
    teams will be formed. Qualifications are based upon the following:

```{=html}
<!-- -->
```
a.  Lead Auditor - The individual has successfully completed Lead
    Auditor training as evidenced by training certification or class
    attendance sheet, or has led an audit team on at least one previous
    audit of a quality system in their GSFC or non-GSFC career, or has
    been an auditor on at least three quality system audits (experience
    evidenced by audit report);

b.  Auditor - The individual has successfully completed auditor training
    as evidenced by training certification or class attendance sheet or
    has participated as an auditor in at least one audit of a quality
    system in their GSFC or non-GSFC career as evidenced by audit
    report.

2.3 Audit Scheduling

Based upon discussions with (prospective) Audit Contacts or as a result
of a request from an organization or its management the Audit
Coordinator shall schedule internal audits in the audit database. The
schedule shall be updated monthly to reflect audits to be performed in
the next three months. Audits may be based on an organizational and/or
QMS/ISO 9001 element(s). As each audit is scheduled the Coordinator
shall identify the Audit Contact in the audit database record and notify
him/her of the scheduled audit. Unless otherwise agreed to by the Audit
Contact, or directed by the QMSR, attempts should be made to schedule
audits at least 30 days prior to the anticipated audit date. Each
element of ISO 9001 applicable to GSFC shall be audited at least once
annually during at least one internal audit. Beyond this minimum audit
schedule requirement, the frequency and scope of internal audits will be
determined by the Audit Coordinator based upon results of previous
internal or external audits, trending data, observed conditions,
nonconformance reports, the relative importance/visibility of the
audited organization, availability of Lead Auditors/Team Members, or as
otherwise deemed appropriate.

> Note: Internal audits performed on an ISO element basis across
> multiple organizations (sometimes referred to as \"horizontal
> audits\") may not have an Audit Contact identified because of their
> nature. Consequently, it may also not be possible to conduct entrance
> and exit briefings addressed by this GPG.

2.4 Internal Audit Preparation (documented in audit database)

2.4.1 As each internal audit is scheduled, the Audit Coordinator will
select an available Lead Auditor from the qualified lead auditor pool in
the audit database. The individual selected shall be independent of
those having direct responsibility for the area/functions being audited.

2.4.2 The Lead Auditor shall:

a.  Confer with the Audit Contact to establish audit scope (including
    elements to be audited); escorts and facilities (e.g. meeting rooms,
    security clearances) required; exact internal audit date(s),
    including dates and times for entrance, daily, and exit briefings;
    the identification of any Nonconformance Leads different from the
    Audit Contact who are to be responsible for the management of any
    NCRs generated as a result of the audit;

b.  Based upon anticipated need as a result of 2.4.2(a), the Lead
    Auditor selects internal audit team members from the qualified
    auditor pool in the audit database. Individuals selected shall be
    independent of those having direct responsibility for the
    area/functions being audited.

The Lead Auditor is responsible for assigning audit element
responsibilities to team members;

c.  Document an Audit Plan reflecting the results of 2.4.2(a) and (b),
    and provide the Audit Plan to the Audit Contact and Audit
    Coordinator;

d.  Update the audit record in the audit database by completing the
    element responsibilities listing and attaching the Audit Plan in
    accordance with the on-line directions;

e.  In concert with any team members (1) review the audit schedule and
    team member assignments and responsibilities, (2) review the results
    of earlier related audits, (3) establish and review audit checklists
    (use of checklists is optional), and (4) identify and review, as
    necessary, related Quality Management System documentation. If
    prepared/tailored checklists which differ from the GSFC Audit
    Checklist in the audit database are used they shall be documented by
    the Lead Auditor as an attachment(s) in the applicable audit record
    in the audit database;

2.5 Conducting the Internal Audit

2.5.1 The Lead Auditor shall conduct an entrance briefing (route and
retain a meeting attendance sheet for the audit record). Attendees shall
include (as a minimum) the audit team members, the Audit Contact, and
escort personnel. The entrance briefing agenda should address the
following:

a.  Introduction of all attendees (route attendance sheet for audit
    record)

b.  Review purpose and scope of audit

c.  Identify audit team member element assignment responsibilities and
    determine escort personnel assignments

d.  Review audit terms and definitions (e.g., nonconformance, objective
    evidence)

e.  Confirm negotiated resources/facilities/clearances needed by the
    team are available

f.  Confirm time and date for the exit briefing and daily briefings

g.  Provide a short summary of audit methods and procedures to be used
    to conduct the audit

h.  Invite the Audit Contact to provide a brief overview of area
    operations/organization (Note: If the Lead Auditor desires this
    overview, it should be indicated in advance of the entrance
    briefing)

2.5.2 The auditor shall examine objective evidence collected through
interviews, and examination of documents, records and conditions in
audited areas. Each observed nonconformance shall be discussed with the
escort and noted by the auditor for presentation at daily team meetings
(see 2.5.3).

2.5.3 The Lead Auditor shall conduct daily meetings with the audit team
members to discuss progress and issues and revise the schedule and
assignments as necessary. The audit team members shall present proposed
NCRs (Nonconformance Reports) to the Lead Auditor for concurrence in
their validity.

2.5.4 The Lead Auditor shall conduct a daily briefing with the Audit
Contact and audit team members to report audit status, and to discuss
nonconformances and associated objective evidence. Daily briefings are
not required if the Audit Contact does not desire them.

2.6 Conducting the Exit Briefing

At the conclusion of the internal audit the Lead Auditor shall conduct
the exit briefing with the Audit Contact and audit team members (route
and retain a meeting attendance sheet for the audit record). The exit
briefing agenda shall address the following:

a.  A summary of the internal audit activities;

b.  Identification of proposed nonconformances;

c.  Discuss corrective action responsibilities, procedure, follow-up,
    and closure.

2.7 Internal Audit Results

As instructed by the Audit Coordinator, the Lead Auditor shall provide
documented audit NCRs to the Audit Coordinator for entry in the NCR/CA
database or the Lead Auditor shall directly enter the audit NCRs into
the database. Internal audit NCRs should be documented in the audit
database for automated notification to the auditee within three working
days of the exit briefing.

Following completion of the audit, the Lead Auditor shall prepare an
Executive Summary of the results of the audit, provide it to the Audit
Contact (with a copy to the Audit Coordinator), and electronically
attach it to the audit record in the audit database. The Executive
Summary shall address overall QMS compliance status of the organization
audited, emphasizing areas for improvement as well as areas of
commendable performance, and identify those elements of the audit that
resulted in NCRs (with a reference to their location in the audit
database). The audit record shall also contain attachments (separately
or as part of the Executive Summary) of entrance and exit briefing
attendance lists.

2.8 Corrective Action and Follow-up

1.  For each NCR resulting from the audit, the Audit Contact/NCL shall
    identify an expected corrective action completion date (within the
    NCR/CA system) and determine corrective action in accordance with
    GPG 1710.1.

2.8.2 The Lead Auditor shall monitor the adequacy of documented
corrective action responses, including the reasonableness of and
compliance with expected corrective action completion dates and notifies
the Audit Coordinator when the Audit Contact/NCL has entered expected
corrective action completion dates on all NCRs associated with the
audit. Inadequate or untimely corrective action responses shall be
brought to the Audit Contact\'s attention for resolution. If resolution
cannot be reached at the Lead Auditor/Audit Contact level, the Lead
Auditor shall request the Audit Coordinator\'s assistance in resolving
the problem or potentially escalating the problem to the QMSR.

2.8.3 After an internal audit\'s NCRs have been successfully closed by
the Audit Contact/NCL and, in the opinion of the Lead Auditor or Audit
Coordinator, any internal audit corrective action response warrants (see
Note) an independent follow-up by the Lead Auditor, the Lead Auditor or
Audit Coordinator shall indicate in the audit record in the audit
database that a follow-up audit is needed, at which point the Audit
Coordinator coordinates and schedules a follow-up audit. The Lead
Auditor may elect to follow-up on all or a portion of the original audit
as planned and documented in the follow-up Audit Plan. Follow-up audits
shall be planned, conducted and their results documented in the same way
as any other internal audit, except formal entrance and exit briefings
may be dispensed with as warranted by the scope of the follow-up audit.

Note: The need for an independent Lead Auditor follow-up audit is a
subjective one, but is generally warranted when the NCR\'s were the
result of major nonconformances (e.g., procedures/processes not defined
and documented) or a series of minor nonconformances associated with one
element.

2.9 Internal Audit Close-Out

An internal audit record is considered closed when the Audit Contact has
entered expected corrective action completion dates on all associated
NCRs. Closeout of internal audit NCRs shall be done in accordance with
GPG 5340.2 and GPG 1710.1. Audit records are archived when all
associated NCR\'s have been closed and a determination has been made and
documented in the audit record whether an independent follow-up audit is
necessary.

2.10 Audit Database Configuration Control

Users of the audit database may request changes to the on-line database
design or operation by completing the QMS Systems Configuration Change
Request (CCR) Form [(GSFC
4-35)](http://gdms.gsfc.nasa.gov/gdms/plsql/dmform.master_list) and
providing it to the Audit Coordinator identified in the audit database
help pages. The Audit Coordinator has disposition authority for all such
change requests.

![](media/image2.wmf)

**CHANGE HISTORY LOG**

+---------+---------+-------------------------------------------------+
| **Rev   | *       | **Description of Changes**                      |
| ision** | *Date** |                                                 |
+---------+---------+-------------------------------------------------+
| B       | 8/12/98 |                                                 |
| aseline |         |                                                 |
+---------+---------+-------------------------------------------------+
| A       | 10/6/98 | Header and footer format changes. 1(b) --       |
|         |         | Changed "process" to "requirement". 1(e) --     |
|         |         | reworded element (b). 2.2 -- Removed limitation |
|         |         | of one audit per year per organization.         |
|         |         | 2.3.1/2.3.2 -- Removed third criterion of "The  |
|         |         | individual is available". 2.3.3.(f) -- Added    |
|         |         | "approximately". 2.4.1 -- Changed "shall" to    |
|         |         | "should" in third sentence. 2.4.2 -- Removed    |
|         |         | requirement for audit activities to be          |
|         |         | performed in the presence of the escort.        |
|         |         | 2.5.1(b) -- Inserted "proposed" and removed     |
|         |         | second sentence "Limit conversation to          |
|         |         | clarifications and avoid lengthy discussions    |
|         |         | about the merits of the nonconformances or      |
|         |         | possible corrective actions". 2.5.1(d) --       |
|         |         | Changed "the Exit Briefing date" to "NCR entry  |
|         |         | into the NCR/CA database". 2.7.1 -- Inserted    |
|         |         | "proposed" in first sentence. 3. -- Identified  |
|         |         | quality records maintenance responsibilities.   |
+---------+---------+-------------------------------------------------+
| B       | 2/19/99 | Changed definition of \"audit nonconformance\". |
|         |         | In 2.2 added \"importance of the element to a   |
|         |         | product\". 2.3.3c - added \"exact\". Reworded   |
|         |         | 2.3.3e.6. 2.4.3 last word of second sentence    |
|         |         | changed from \"discussion\" to \"approval\".    |
|         |         | 2.5.1 - deleted requirement to present          |
|         |         | documented NCRs at exit briefing. 2.6 - added   |
|         |         | second paragraph.                               |
+---------+---------+-------------------------------------------------+
| C       | 5/7/99  | Expanded and moved records from section 3 to P6 |
|         |         | to comply with GPG 1410.1 and added retention   |
|         |         | times.                                          |
|         |         |                                                 |
|         |         | Revised 1(a), (d) and added (h).                |
|         |         |                                                 |
|         |         | 2.3 - Changed Audit Schedule from annual to     |
|         |         | three months (2^nd^ sentence revision), added   |
|         |         | 3^rd^ and 4^th^ sentences. Reworded sentence 5. |
|         |         |                                                 |
|         |         | Reworded and re-ordered contents of 2.4.2.      |
|         |         | Added 2.4.2(c) and (d)                          |
|         |         |                                                 |
|         |         | 2.7 - Added 2^nd^ sentence                      |
|         |         |                                                 |
|         |         | 2.8.1 - Reworded                                |
|         |         |                                                 |
|         |         | 2.8.2 and 2.8.3 - Expanded to require Lead      |
|         |         | Auditor monitoring of corrective actions;       |
|         |         | notifying Audit Coordinator of entered expected |
|         |         | corrective action completion dates. Added 2.8.3 |
|         |         | Note.                                           |
|         |         |                                                 |
|         |         | General revision of flowchart.                  |
+---------+---------+-------------------------------------------------+

**CHANGE HISTORY LOG (cont.)**

+---------+---------+-------------------------------------------------+
| **Rev   | *       | **Description of Changes**                      |
| ision** | *Date** |                                                 |
+---------+---------+-------------------------------------------------+
| D       | 8/16/99 | 2.3, fourth sentence, revised to make 30 day    |
|         |         | advance warning a goal rather than an auditable |
|         |         | requirement. Rewrite of first paragraph of 2.7  |
|         |         | to allow entry of NCRs by Lead Auditor or Audit |
|         |         | Coordinator. Three-day entry rule changed from  |
|         |         | \"shall\" to \"should\". Added parenthetical    |
|         |         | expression to first sentence of second          |
|         |         | paragraph of 2.7.                               |
+---------+---------+-------------------------------------------------+
| E       | 1       | P6 - Refined necessary auditor qualification    |
|         | 1/09/99 | records and custodian                           |
|         |         |                                                 |
|         |         | 2.2(a) and (b) - Added detail to required       |
|         |         | qualification records.                          |
|         |         |                                                 |
|         |         | 2.3 modified to clarify audit scheduling and    |
|         |         | tailoring of same and added the Note.           |
|         |         |                                                 |
|         |         | 2.10 added.                                     |
+---------+---------+-------------------------------------------------+
| F       | 0       | P4 - Deleted reference to GPG 5100.2            |
|         | 3/16/00 |                                                 |
|         |         | P6 - First record modified to reflect           |
|         |         | training/experience records rather than lists   |
|         |         | of auditors in auditor pool. Audit schedule     |
|         |         | deleted as a quality record. Third record       |
|         |         | retention period, deleted \"whichever is        |
|         |         | sooner\" at the end of the sentence.            |
+---------+---------+-------------------------------------------------+
| G       | 0       | 2.4.2e - Use of audit checklists is no longer   |
|         | 8/28/00 | mandatory.                                      |
|         |         |                                                 |
|         |         | 2.5.2 - Removed reference to audit checklists   |
|         |         | as recording medium.                            |
|         |         |                                                 |
|         |         | 2.9 - Added audit record archiving process.     |
+---------+---------+-------------------------------------------------+