![](media/image1.wmf){width="3.2in" height="2.6486111111111112in"}

**HEADQUARTERS COMMON PROCESS**

**MANAGEMENT SYSTEM INTERNAL AUDITS**

#### 

Approved by February 5, 2002

**\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_**
\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Frederick D. Gregory, Date

Deputy Administrator

DOCUMENT HISTORY LOG

+---------+-------+---------+-----------------------------------------+
| **S     | **    | **Effe  | **Description**                         |
| tatus** | Docum | ctive** |                                         |
|         | ent** |         |                                         |
| **(Base |       | *       |                                         |
| line/** | **    | *Date** |                                         |
|         | Revis |         |                                         |
| **Revi  | ion** |         |                                         |
| sion/** |       |         |                                         |
|         |       |         |                                         |
| **Canc  |       |         |                                         |
| eled)** |       |         |                                         |
+---------+-------+---------+-----------------------------------------+
| B       |       | January |                                         |
| aseline |       | 15,     |                                         |
|         |       | 1999    |                                         |
+---------+-------+---------+-----------------------------------------+
| R       | A     | April   | Revisions resulted from DNV             |
| evision |       | 28,     | Preregistration Audit nonconformances   |
|         |       | 1999    | and ISO Project Office comments to      |
|         |       |         | improve the clarity and readability of  |
|         |       |         | the document. The changes do not        |
|         |       |         | materially impact the intent or usage   |
|         |       |         | of this HCP. For details, please see    |
|         |       |         | "HPC 1280-3, Internal Quality Audits    |
|         |       |         | Comment Disposition, Robert D. Kovach   |
|         |       |         | -- 3/24/99".                            |
+---------+-------+---------+-----------------------------------------+
| Admin   | A     | March   | Administrative change. Changed          |
| Change  |       | 14,     | responsible office from Code R to Code  |
|         |       | 2000    | B due to the ISO Project Office being   |
|         |       |         | reassigned.                             |
+---------+-------+---------+-----------------------------------------+
| Admin   | A     | October | Administrative change. Changed          |
| Change  |       | 29,     | Responsible Office from Code B to Code  |
|         |       | 2000    | J due to the ISO Project Office being   |
|         |       |         | reassigned.                             |
+---------+-------+---------+-----------------------------------------+
| R       | B     | F       | Revisions were made to incorporate      |
| evision |       | ebruary | minor changes in the internal audit     |
|         |       | 5, 2002 | process identified while implementing   |
|         |       |         | the process and to comply with the ISO  |
|         |       |         | 9001:2000 Standard. Changes include     |
|         |       |         | deleting process steps to streamline    |
|         |       |         | the process, removing several           |
|         |       |         | appendices and making them electronic   |
|         |       |         | NASA HQ forms, adding the definitions   |
|         |       |         | for Audited Entity in Paragraph 3.3 and |
|         |       |         | Audited Entity Representative in        |
|         |       |         | Paragraph 3.5 and modifying the         |
|         |       |         | definition for Internal Audit in        |
|         |       |         | Paragraph 3.8, creating the Internal    |
|         |       |         | Quality Audit Critique Report in        |
|         |       |         | Paragraph 6.16, deleting the reference  |
|         |       |         | to NPG 1441.1 Records Retention         |
|         |       |         | Schedules in Paragraph 4.1 and deleting |
|         |       |         | the reference to HCP 1280-2, Corrective |
|         |       |         | and Preventive Action in Paragraph      |
|         |       |         | 6.17, and making flowchart changes to   |
|         |       |         | correctly depict the process flow and   |
|         |       |         | to comply with the Headquarters         |
|         |       |         | document and data control HCP.          |
+---------+-------+---------+-----------------------------------------+
| Admin   | B     | Se      | Revisions were made to incorporate      |
|         |       | ptember | minor changes including: change the     |
| Change  |       | 10,     | names of forms to correspond to         |
|         |       | 2003    | language in the new NPD 1280.1,         |
|         |       |         | Management Systems, add clarity to the  |
|         |       |         | request to the Administrator's          |
|         |       |         | Correspondence Office to create HATS    |
|         |       |         | actions to track nonconformances and    |
|         |       |         | observations and to forward disputed    |
|         |       |         | issues identified during nonconformance |
|         |       |         | or observation life cycles to the       |
|         |       |         | Headquarters ISO Executive Management   |
|         |       |         | Representative for resolution, and to   |
|         |       |         | incorporate the new Corrective Action   |
|         |       |         | Tracking System II (CATS II).           |
+---------+-------+---------+-----------------------------------------+
| Admin   | B     | May 1   | Administrative change made as a result  |
| Change  |       | 2007    | on an HQ external audit. As a result of |
|         |       |         | that I would like to request the        |
|         |       |         | following actions:                      |
|         |       |         |                                         |
|         |       |         | > Please remove HQOWI1150-AI003,        |
|         |       |         | > Management of Quality Council         |
|         |       |         | > Meetings.  PA&E now manages the OMC   |
|         |       |         | > meetings and this document is no      |
|         |       |         | > longer valid.                         |
|         |       |         | >                                       |
|         |       |         | > Replace "Quality Council" with        |
|         |       |         | > "Operations Management Council" in    |
|         |       |         | > HQPG 1280-3, Management System        |
|         |       |         | > Internal Audits, paragraphs 6.1 and   |
|         |       |         | > 6.19.                                 |
|         |       |         | >                                       |
|         |       |         | > Replace the Responsible Office for    |
|         |       |         | > HQPG 1280-3, Management System        |
|         |       |         | > Internal Audits from "JI/ISO 9001     |
|         |       |         | > Program Office" to "Office of         |
|         |       |         | > Internal Controls and Management      |
|         |       |         | > Systems" in the header.               |
|         |       |         | >                                       |
|         |       |         | > Replace "Director, NASA ISO 9001      |
|         |       |         | > Program Office" with "Assistant       |
|         |       |         | > Administrator, Office of Internal     |
|         |       |         | > Controls and Management Systems" in   |
|         |       |         | > HQPG 1280-3, Management System        |
|         |       |         | > Internal Audits, paragraph 6.16.      |
|         |       |         | >                                       |
|         |       |         | > Replace "Headquarters Quality         |
|         |       |         | > Council" with "Operations Management  |
|         |       |         | > Council" in NPD 1280-3, NASA          |
|         |       |         | > Management System Policy, paragraph   |
|         |       |         | > 5a.                                   |
|         |       |         | >                                       |
|         |       |         | > Replace "Institutional and Corporate  |
|         |       |         | > Management" with "Internal Controls   |
|         |       |         | > and Management Systems" in NPD        |
|         |       |         | > 1280-3, NASA Management System        |
|         |       |         | > Policy, paragraph 5c.                 |
+---------+-------+---------+-----------------------------------------+

##### 1. Purpose 

This document describes the process for organizing and conducting
Headquarters Management System internal audits. The purpose of these
audits is to verify whether management activities and related results
comply with the management system and to determine the system's
effectiveness.

**2. Scope And Applicability**

2.1 [Scope]{.underline} This document identifies the responsible
entities for staffing, planning, and conducting management system
internal audits. These audits encompass all processes and documents that
form the NASA Headquarters Quality Management System (QMS) as described
in the "Headquarters Quality Management System Manual, HQPD 1200-1".

The Headquarters Management System, including the management system
internal audit process, shall be audited once every three years
according to the process described in this document.

2.2 [Applicability]{.underline}

This document applies only to NASA Headquarters.

## 3. Definitions

3.1 [Audit Manager (AM)]{.underline}. The AM or his/her designated
alternate is responsible for and has the authority for implementing,
managing, maintaining, and reporting on the performance of the
management system internal audit process. The AM shall complete a Lead
Assessor course and be granted organizational authority to manage
Headquarters management system internal audits.

2.  [Audit Plan]{.underline}. Provides the audit scope, the audit time
    and date, the audited entity, the auditor's names and assignments,
    the Point of Contact (POC) name, and the Audited Entity
    Representative for each audit. The Audit Plan, NHQ Form 278, is
    available at: <ftp://ftp.hq.nasa.gov/forms/form/nhq278.itp>.

3.  [Audited Entity]{.underline}. The focus of an audit. Audited
    Entities may include, but are not limited to, processes and
    subprocesses, documents, and organizations.

3.4 [Audited Entity Management]{.underline}. The manager or designee who
shall sign the Internal Audit Summary Report (NHQ Form 274, URL
<ftp://ftp.hq.nasa.gov/forms/form/nhq274.itp>).

3.5 [Audited Entity Representative]{.underline}. The person representing
the Audited Entity for an audit.

3.6 [Auditor (AT)]{.underline}. An individual qualified through training
to perform a management system audit. The AT shall complete an Internal
Auditor course or Lead Assessor course. ATs may be NASA employees or
qualified contractors.

3.7 [Corrective Action Tracking System II (CATS II)]{.underline}. The
automated system used to support the life cycle management of
nonconformances and observations.

3.8 [Escort]{.underline}. An Audited Entity management representative
who may

> accompany the auditor during an audit. This individual provides access
> to physical areas and witnesses or is informed of potential
> nonconformances and observations.

3.9 [Headquarters Action Tracking System (HATS)]{.underline}. The
automated system used to track Headquarters actions including
nonconformances and observations.

3.10 [Internal Audit]{.underline}. A systematic and independent
examination performed by a qualified NASA Headquarters employee or
contractor to verify whether management activities and related results
comply with the management system and to determine the effectiveness of
the system.

3.11 [Lead Auditor (LA)]{.underline}. An individual qualified through
training to organize and oversee a management system internal audit and
report audit findings. The LA shall complete an Internal Auditor course
or Lead Assessor course. The LA may be a NASA employee or a qualified
contractor.

3.12 [Nonconformance]{.underline}. Nonfulfillment of a specified
management system requirement.

3.12.1 [Major Nonconformance]{.underline}. A systemic breakdown of the
management system that impacts its ability to produce a product or
service or impacts management system processes.

3.12.2 [Minor Nonconformance]{.underline}. A nonsystemic breakdown that
can have an indirect, lower order, adverse impact on a management system
product or service.

3.13 [Objective Evidence]{.underline}. Qualitative or quantitative
information, records, or

statements of fact pertaining to a process or product or to the
existence and implementation of a management system clause that is based
on observation, measurement, or test and can be verified.

3.14 [Observation]{.underline}. A finding that may lead to a
nonconformance. Based on an analysis by the AM, related Observations may
be elevated to a Nonconformance.

3.15 [Point of Contact]{.underline}. An Audited Entity's contact person.

> 3.16 [Abbreviations]{.underline}.

AM Audit Manager

AT Auditor

HQPD Headquarters Policy Directive

HQPG Headquarters Procedures and Guidelines

LA Lead Auditor

NCR Nonconformance Report

OWI Office Work Instruction

POC Point of Contact

QMS Quality Management System

**4. References**

Headquarters Quality Management System Manual, HQPD 1200-1

**5. Flowchart**

![](media/image2.wmf)

![](media/image3.wmf)

6\. Procedure

+------------+-------+------------------------------------------------+
| [Number]{. | ##### | [Action]{.underline}                           |
| underline} | # Act |                                                |
|            | ionee |                                                |
+------------+-------+------------------------------------------------+
| 6.1        | AM    | Draft an internal audit announcement memo for  |
|            |       | the Executive Management Representative to     |
|            |       | send to NASA Headquarters Officials-In-Charge. |
|            |       | The memo will identify audit scope, audit      |
|            |       | dates and the Auditors. Audits will be         |
|            |       | scheduled at least every six months. Audit     |
|            |       | focus will be based on the results of internal |
|            |       | and external management system audits and any  |
|            |       | Operations Management Council guidance.        |
|            |       |                                                |
|            |       | Forward the memo to the Executive Management   |
|            |       | Representative for distribution.               |
+------------+-------+------------------------------------------------+
| 6.2        | AM    | Select LAs to oversee audits. LAs shall be     |
|            |       | assigned to                                    |
|            |       |                                                |
|            |       | the audit for the duration of the audit and    |
|            |       | its related                                    |
|            |       |                                                |
|            |       | activities. LAs shall be assigned in           |
|            |       | sufficient time to prepare for the audit.      |
+------------+-------+------------------------------------------------+
| 6.3        | AM/LA | Verify audited entity POCs.                    |
+------------+-------+------------------------------------------------+
| 6.4        | LA    | Work with AM to select ATs who will conduct    |
|            |       | the audit. LA shall contact ATs to ensure that |
|            |       | they will be able to commit to the audit.      |
+------------+-------+------------------------------------------------+
| 6.5        | AM/LA | Prepare draft Audit Plan, (NHQ Form 278, URL   |
|            |       | <                                              |
|            |       | ftp://ftp.hq.nasa.gov/forms/form/nhq278.itp>). |
|            |       | The plan shall be flexible in order to permit  |
|            |       | changes in emphasis based on information       |
|            |       | gathered during the audit and to permit        |
|            |       | effective use of resources. The plan shall     |
|            |       | include the following:                         |
|            |       |                                                |
|            |       | -   The audit scope.                           |
|            |       |                                                |
|            |       | -   The audit time and date.                   |
|            |       |                                                |
|            |       | ```{=html}                                     |
|            |       | <!-- -->                                       |
|            |       | ```                                            |
|            |       | -   The audited entity(s).                     |
|            |       |                                                |
|            |       | ```{=html}                                     |
|            |       | <!-- -->                                       |
|            |       | ```                                            |
|            |       | -   The auditor(s) and assignments.            |
|            |       |                                                |
|            |       | ```{=html}                                     |
|            |       | <!-- -->                                       |
|            |       | ```                                            |
|            |       | -   The POCs name(s).                          |
|            |       |                                                |
|            |       | ```{=html}                                     |
|            |       | <!-- -->                                       |
|            |       | ```                                            |
|            |       | -   The Audited Entity Representative(s).      |
+------------+-------+------------------------------------------------+
| 6.6        | AM/LA | Discuss draft Audit Plan with ATs.             |
|            |       |                                                |
|            |       | -   Discuss the audit scope.                   |
|            |       |                                                |
|            |       | -   Review general audit techniques and        |
|            |       |     conduct.                                   |
|            |       |                                                |
|            |       | -   Review and discuss the documents to be     |
|            |       |     audited.                                   |
|            |       |                                                |
|            |       | -   Confirm audit assignments.                 |
|            |       |                                                |
|            |       | -   Distribute Internal Audit Checklist forms  |
|            |       |     (NHQ Form 275, URL                         |
|            |       |                                                |
|            |       | <ftp://ftp.hq.nasa.gov/forms/form/nhq275.itp>) |
|            |       |                                                |
|            |       | > to each team member to tailor for each       |
|            |       | > audit.                                       |
+------------+-------+------------------------------------------------+
| 6.7        | A     | Review Draft Audit Plan.                       |
|            | M/LA/ |                                                |
|            | POC   | -   LA and POCs review Draft Audit Plan,       |
|            |       |     modify as necessary and sign.              |
|            |       |                                                |
|            |       | -   LA sends Audit Plan to the AM to sign,     |
|            |       |     incorporates any AM changes, and           |
|            |       |     coordinates changes with applicable POCs.  |
+------------+-------+------------------------------------------------+
| 6.8        | AM/LA | Provide a copy of the signed Audit Plan to the |
|            |       | applicable POCs.                               |
+------------+-------+------------------------------------------------+

+------------+-------+------------------------------------------------+
| 6.9        | LA/AT | Prepare for Audit.                             |
|            |       |                                                |
|            |       | -   Review results of previous internal and    |
|            |       |     external management system audits.         |
|            |       |                                                |
|            |       | -   Review audited entity documentation        |
|            |       |     applicable to the audit.                   |
|            |       |                                                |
|            |       | -   Review and tailor Internal Audit           |
|            |       |     Checklists for each audit.                 |
|            |       |                                                |
|            |       | -   Finalize audited entity representative(s), |
|            |       |     scribe and escort with appropriate POC.    |
+------------+-------+------------------------------------------------+
| 6.10       | LA/AT | Conduct the Audit.                             |
+------------+-------+------------------------------------------------+
| 6.11       | LA/AT | During the audit, report any safety hazards to |
|            |       | the NASA Headquarters Safety Office.           |
+------------+-------+------------------------------------------------+
| 6.12       | LA/AT | Conduct daily end-of-day meeting(s) to discuss |
|            |       | audit activity and results.                    |
+------------+-------+------------------------------------------------+
| 6.13       | A     | Complete and sign Internal Audit Checklists.   |
|            | M/LA/ |                                                |
|            | AT    | Create draft nonconformances and observations  |
|            |       | in the Corrective Action Tracking System II    |
|            |       | (CATS II) Quality Management System (QMS)      |
|            |       | Module at                                      |
|            |       |                                                |
|            |       | <https://neptune.hq.nasa.gov/cats/>. The AM,   |
|            |       | with LA and AT recommendations, shall          |
|            |       | determine if the draft nonconformance is a     |
|            |       | Major or Minor Nonconformance.                 |
|            |       |                                                |
|            |       | Print draft NCRs and observations.             |
|            |       |                                                |
|            |       | Complete, print and LA signs the Internal      |
|            |       | Audit Summary Report (NHQ Form 274, URL        |
|            |       | <                                              |
|            |       | ftp://ftp.hq.nasa.gov/forms/form/nhq274.itp>). |
+------------+-------+------------------------------------------------+
| 6.14       | AM/LA | Conduct exit meeting with Audited Entity       |
|            |       | Management.                                    |
|            |       |                                                |
|            |       | -   Discuss audit results.                     |
|            |       |                                                |
|            |       | -   Provide the Internal Audit Summary Report  |
|            |       |     to Audited Entity Management to sign.      |
|            |       |                                                |
|            |       | -   Provide the NASA Headquarters Internal     |
|            |       |     Audit Critique form (NHQ Form 277, URL     |
|            |       |                                                |
|            |       | <ftp://ftp.hq.nasa.gov/forms/form/nhq277.itp>) |
|            |       |                                                |
|            |       | to the audited entity POC to complete/return   |
|            |       | to the AM.                                     |
|            |       |                                                |
|            |       | -   Record names of exit meeting attendees on  |
|            |       |     an attendee list and file list with the    |
|            |       |     Audit Report.                              |
+------------+-------+------------------------------------------------+

+------------+-------+------------------------------------------------+
| 6.15       | AM/LA | Prepare the Audit Report and forward to the AM |
|            |       | or his/her designee. The report shall contain  |
|            |       | the following items as applicable:             |
|            |       |                                                |
|            |       | -   Audit Plan(s)                              |
|            |       |                                                |
|            |       | -   The signed Internal Audit Summary          |
|            |       |     Report(s)                                  |
|            |       |                                                |
|            |       | -   The exit meeting attendee list             |
|            |       |                                                |
|            |       | -   Internal Audit Checklists                  |
|            |       |                                                |
|            |       | -   NASA Headquarters Internal Audit Critique  |
|            |       |     forms                                      |
|            |       |                                                |
|            |       | AM makes draft NCR(s) and Observation(s)       |
|            |       | "Official" in the CATS II QMS Module.          |
|            |       |                                                |
|            |       | AM requests the Administrator's Correspondence |
|            |       | Office to create Headquarters Action Tracking  |
|            |       | System (HATS) actions for each nonconformance  |
|            |       | or observation. The first HATS action monitors |
|            |       | the time until the root cause (nonconformances |
|            |       | only), corrective action/process improvement   |
|            |       | action plan (AP) and proposed AP               |
|            |       | implementation date are entered into the QMS   |
|            |       | module for each nonconformance or observation. |
|            |       | The second action, created after the LA        |
|            |       | approves the AP and proposed date, monitors    |
|            |       | the action implementation for each             |
|            |       | nonconformance or observation.                 |
+------------+-------+------------------------------------------------+
| 6.16       | AM    | Review NASA HQ Internal Audit Critique         |
|            |       | comments and recommendations. Prepare          |
|            |       | Management System Internal Audit Critique      |
|            |       | Report and forward to the Assistant            |
|            |       | Administrator, Office of Internal Controls and |
|            |       | Management Systems.                            |
+------------+-------+------------------------------------------------+
| 6.17       | AM/LA | Verify completed corrective and process        |
|            |       | improvement actions using the CATS II QMS      |
|            |       | module available at:                           |
|            |       | <https://neptune.hq.nasa.gov/cats/>.           |
+------------+-------+------------------------------------------------+
| 6.18       | AM    | Forward disputed issues identified during      |
|            |       | nonconformance or observation life cycles to   |
|            |       | the Headquarters ISO Executive Management      |
|            |       | Representative for resolution.                 |
+------------+-------+------------------------------------------------+
| 6.19       | AM    | Summarize audit findings for Executive         |
|            |       | Management Representative to present at next   |
|            |       | Operations Management Council Meeting.         |
+------------+-------+------------------------------------------------+

**7. Quality Records**

+---------------+-------+----------+----------+----------+-----------+
| RECORD        | ####  | LOCATION | MEDIA:   | SCHEDULE | R         |
| I             | ####  |          |          | NUMBER   | ETENTION/ |
| DENTIFICATION | OWNER |          | EL       | AND ITEM | DI        |
|               |       |          | ECTRONIC | NUMBER   | SPOSITION |
|               |       |          | OR       | (NPG     |           |
|               |       |          |          | 1441.1)  |           |
|               |       |          | HARD     |          |           |
|               |       |          | COPY     |          |           |
+---------------+-------+----------+----------+----------+-----------+
| Internal      | AM    | AM       | Hard     | Schedule | Close     |
| Audit         |       |          | Copy     | 5        | file at   |
| Announcement  |       |          |          |          | end of    |
| Memo          |       |          |          | Item 30, | survey/   |
|               |       |          |          | B.       | audit at  |
|               |       |          |          |          | end of    |
|               |       |          |          |          | fiscal    |
|               |       |          |          |          | year.     |
|               |       |          |          |          | Destroy   |
|               |       |          |          |          | when 9    |
|               |       |          |          |          | years     |
|               |       |          |          |          | old.      |
+---------------+-------+----------+----------+----------+-----------+
| Audit Plan    | AM    | AM       | Hard     | "        | "         |
| (NHQ 278)     |       |          | Copy     |          |           |
+---------------+-------+----------+----------+----------+-----------+
| Internal      | AM    | AM       | Hard     | "        | "         |
| Audit         |       |          | Copy     |          |           |
| Checklist(s)  |       |          |          |          |           |
| (NHQ 275)     |       |          |          |          |           |
+---------------+-------+----------+----------+----------+-----------+
| Official      | AM    | <http:/  | El       | "        | "         |
| No            |       | /hqiso90 | ectronic |          |           |
| nconformances |       | 00.hq.na |          |          |           |
|               |       | sa.gov/> |          |          |           |
| and           |       |          |          |          |           |
| Observations  |       |          |          |          |           |
+---------------+-------+----------+----------+----------+-----------+
| Internal      | AM    | AM       | Hard     | "        | "         |
| Audit Summary |       |          | Copy     |          |           |
| Report (NHQ   |       |          |          |          |           |
| 274)          |       |          |          |          |           |
+---------------+-------+----------+----------+----------+-----------+
| Exit Meeting  | AM    | AM       | Hard     | "        | "         |
| Attendee List |       |          | Copy     |          |           |
+---------------+-------+----------+----------+----------+-----------+
| NASA HQ       | AM    | AM       | Hard     | "        | "         |
| Internal      |       |          | Copy     |          |           |
| Audit         |       |          |          |          |           |
| Critique      |       |          |          |          |           |
| forms (NHQ    |       |          |          |          |           |
| 277)          |       |          |          |          |           |
+---------------+-------+----------+----------+----------+-----------+
| Internal      | AM    | AM       | Hard     | "        | "         |
| Audit         |       |          | Copy     |          |           |
| Critique      |       |          |          |          |           |
| Report        |       |          |          |          |           |
+---------------+-------+----------+----------+----------+-----------+