and we have not satisfied the NCR's of the last audit and the best part is.....Our QA Manager quit on us last month! After being with the company 15 years he leaves, giving us one weeks notice.

Here is our situation.

We are a small machine shop with less than 40 employees. We have been registered since 1998. We are due for surveillance audit and re-certification next month.

I received a call from the registrar's exec. commitee chairperson stating that our NCR's were not responded to appropriately from the last audit.
Our QA manager was the only one involved in the audits, basically he would just brief us afterward at the management meetings. I don't even know how to respond to her new request regarding the NCR's. She said something about a 5y form. Which I now believe is "5 Why's" after doing some research (that's how I stumbled on this website/forum.)

We need some immediate help to stop the bleeding.

If we were to ignore this and just allow our current registrar to pull their certification, could I simply hire a consultant and start the process with another registrar, basically starting from scratch, but this time getting more involved at the start?

Any input greatly appreciated.

I would ask the registrar for an extension of the due dates for the corrective action responses due to the management representative’s leaving the organization.

Then, generate a corrective action plan for each of the NCR’s, with input and buy-in from the management team, and submit them in advance of the upcoming audit. Then, the auditor can review the plans and monitor their implementation for effectiveness.

This would be much easier than going through recertification with a new registrar, IMO. Besides, a new registrar will still want to review the previous audit results and ensure any resulting corrective actions have been implemented and are effective.

It sounds as though your organization didn't get involved in the quality system and left it all to the quality manager.

Why bother with registration and the installation of the quality system if top management doesn't realize that they have to be intimately involved? The system can't be worth much and it won't hurt you any to be without it.

So ask yourself, "What am I getting out of this system? Why bother keeping it?" If the answer is "We need the Registration document in order to do business." Then go find a paper mill, buy a cert. and save all of the headaches.

So ask yourself, "What am I getting out of this system? Why bother keeping it?" If the answer is "We need the Registration document in order to do business." Then go find a paper mill, buy a cert. and save all of the headaches.

Any ideas on where I would find one.

Get your management involved in the generation of corrective action plans. That will be the best way to measure their commitment to the system.

Welcome to the Cove!:bigwave:

I'm sorry it has to be under such stressful circumstances.

I know this advice seems difficult to accept, but RELAX! This is important stuff, but not life and death. Most registrars will be more than willing to grant you a sufficient extension to get yourself up to speed. If not, contact me through a Private Message or email and I will help you negotiate with them.

By now, you've learned that there is a lot of nitty gritty stuff about formal registration to an international Standard like ISO9001:2000 which you trusted your former Quality Manager to insulate you from. I regret seeming to "pile on," but he erred in not keeping you involved from the beginning. There are important things you should look for in his replacement. Primary in that list of qualifications is a strong willingness and ability to act as a teacher and mentor to everyone in your organization to ensure EVERYONE is knowledgeable about the Quality Management System of your organization and the requirements of your customers.

As part of your research, you DO need to come to a decision about the importance of formal registration to a Standard. If this is customer-mandated, then you know you have to bite the bullet. If not a requirement of your current or projected customer base, then you should consider investing the fee for registrars into additional salary for a well-qualified Quality Manager, perhaps with the temporary assistance of a consultant who can act as your advocate rather than pay an arm's length auditor. The difference is simply that the consultant would help you work out viable solutions to your NCR's instead of expecting you to do it on your own.

A word of caution:
Some folks will look at you the same way a shark looks at a bleeding fish or other animal - FOOD! Others may be scornful that you allowed yourself to be caught in such a position. History doen't matter at this point. The important thing is how you handle yourself from here on. Do not allow yourself to be swindled by some sharpie who offers an instant fix. Do not waste time accepting punishment for past lapses in judgment. Be systematic in selecting help. Vow to stay personally involved in your Quality System. There is every chance this may turn out to be a blessing and you will emerge from this temporary situation a stronger and better organization than before.
The majority of the folks here at the Cove will be more than willing to help you. Don't let yourself be easily discouraged.

Danzio, (Welcome to the Cove)

I agree with Wes and Badgerman. Ask for an extension. In my last job I took over the QA system from a guy that had burnt his office down and then decided never to turn up to work again. He burnt all the records and the PC. I had some half charred noites to work with and had to basically rewrite the entire system from a disk that had outdated software and nothing could read. It took me 3 weeks just to get the office in order and find someone that had software that would read the magic disk. We had an audit pending and outstanding NCRs. We survived.

Recently, at my company noone would listen or partcipate in quality and I took the drastic step of ensuring that our Registrar would NCR us. It worked and now our management team are falling over themselves trying to please the auditor. The auditor and I go way back and always new we would be able to recover from a few NCRs. When the review comes around in a few weeks not all of the NCRs will be complete but we can show that they are being acted upon and things such as audits and training are again underway. You must remember that a QA system is fluid. It is never stable so there are always things changing. It will NEVER be perfect on the day but you need to able to show your willingness and actions to ensure that in the end everything will be in line with the standard and your business practices.

What are the NCRs that you have? (In broad terms). We may be able to help you with strategies to fix them.

Hi, Danzio. :bigwave:

You've received some great advice from Badgerman, Wes and Greg. Wes brought up an excellent point though in reminding you to relax. Yes...we know...easier said than done. While I doubt many of us have been exactly in your position, we can empathize...our experience has taught us to remember to breathe and, when in doubt, laugh.

Take a step back, look at the big picture and then start your game to address these NCRs.

Wise words were given to you to have your top management not just involved, but actively involved in developing the plans to address these NCRs. Not only does it demonstrate committment, but it certainly is nice when they understand what the heck is going on, right? :rolleyes:

I'm a little perplexed at the auditor's mention of a 5-Why form. Was that in relation to an NCR or an Opportunity for Improvement. There is not direct 'shall' requiring the use of such a tool (although it can come in handy).

As Greg offerred, please feel free to share these NCRs with us (unless there are some confidentiality rules that you perceive). While we may not necessarily develop direct solutions, we may be able to provide you with some options to approach your management with.

And lastly, the game plan for your system overall. It is a shame that the Quality Manager's departure was the first and only indication of an improper balance of responsibities within the Management System.

It might be beneficial (and score brownie points with the auditor) if you and the management committee were to develop a sort of "designate" program (i.e., who can complete the tasks when the normally scheduled individual is not there) and/or proper distribution of tasks of responsibilities. For example, I am the 'administrator' of our document control program...however, each department is responsible for their own documents (development, control, training, etc.).

Keep us updated! :)

I agree with other posts that the best course is to explain the problem and ask for an extension. You may also request they clarify the NCR if you have difficulty in understanding what the problem is.

As others said relax, it's not the mega-problem you think. I don't know what your registrar's procedure is in cases of NCs not being closed out at next visit. I recommend you ask.

I can tell you what happens with the Certification Body I work with (UK company). Assuming your NCR was classified as minor (should say on the NCR, get a copy from the registrar if you don't have it) then failure to correct it by the next visit would automatically result in the classification being elevated to a major. This would automatically mean that your registration/certification is suspended. NOT withdrawn. You then have more time to fix the problem. You could even get some help from the auditor during the visit. You may need to accept another visit just for the area of the NCR so the auditor can verify the corrective action and close out the NCR. Maybe it can be done by sending documentation. Depends on the nature of the NCR and your registrar. Again check with your registrar. The cost of the extra visit should not be excessive and certainly less than starting afresh.

So a worst case scenario (suspension) is not so bad and the suspension would be lifted as soon as you fix the problem and they can verify it. In your case since it is also a re-assessment visit the new certificate would be delayed but you are not deregistered.

If you check with your registrar what happens in these case you don't even have to let him know who your company is. Call as if you wanted information on their rules because you are deciding which registrar to choose.

And of course you may get help here if you gave details of the NCR so the problem could be fixed.

danzio, I'll add my 2 cents...and agree with the above advise. Talk with your registrar and be upfront with them about you circumstances. It was not of your doing, but you are now tasked with cleaning up the mess and moving on.
So don't panic, discuss it with them and the sooner the better. After all, the registrar wants you to stay registered too. They should be able to provide you with some appropriate guidence to overcome this roadblock.

As part of your research, you DO need to come to a decision about the importance of formal registration to a Standard. If this is customer-mandated, then you know you have to bite the bullet. If not a requirement of your current or projected customer base, then you should consider investing the fee for registrars into additional salary for a well-qualified Quality Manager, perhaps with the temporary assistance of a consultant who can act as your advocate rather than pay an arm's length auditor. The difference is simply that the consultant would help you work out viable solutions to your NCR's instead of expecting you to do it on your own.


Nice one Wes. Are you a consultant by any chance?

I'll go one step further. If you ditch the certification the NCR's go out of the window with the registrar. So you won't need a consultant to to help work out solutions to the NCRs either. You can then consider investing the consultant fee on a few beers to help you get over the headaches your problem has given you.

Throwing it out the window may not be an option. I don't know anyone prusuing TS16949 with out a customer mandate, and target date for completion. Whoops, sorry, thought it was TS, just realized it is ISO9001 :o

I have been in contact with the registrar. I felt I was in trouble when on my initial contact with them, I explained the situation with my QA Manager and her immediate response was, "Well just because you lose your ..... doesn't mean your whole system should fall apart!" I asked for an extension yesterday via email and the reply was: "I am not certain that we can extend this. As I have stated earlier, all recertifcation audits are required to go 2-3 months prior to expiration.
As of right now, the audit is set for 9/19-20, only 10 days before the certificate expires.

I am fairly certain that if the recert takes place after the certificate is expired that its required to go through full registration time.

I will check with my Program Manager and get right back to you."

I have not heard back yet this morning.

Anyway, yesterday I spent a couple hours looking for the ISO manual and I can't even find it. I think my guy may have run off with it.

I appreciate all the replies received and I am not yet giving up but I do believe I am not going to be able to recover from here without some outside help. How does one find a good man and avoid the "sharks" as Wes put it?

BTW, based on the statement from the registrar above, if all recertification audits are "required to go 2-3 months prior to expiration" haven't they violated their own policy by waiting until just 10 days prior to expiration to schedule the audit?



Denis9001,
I like your approach, you wouldn't be a brewmaster by any chance now would you?

As far as the NCR's they are all minor, two are in regards to violations on our website, one for using the ISO logo, another for claiming to have design services when in fact we claim exemption to element 7.3. Even though we do outsource some design work. I do not quite know how to get around that one. My former QA manager said if we had to be compliant to 7.3 it would open up a whole new set of problems so how do we handle that. An auditor will eventually stumble upon an order that has the word "design" in it and were busted. Is it better to just wait until that happens?

The other 2 NCR's are for not obtaining "objective evidence" for customer satisfaction and finally utilizing a non-approved supplier for outside services. There it is.

Thanks for listening, just being able to vent seems to help. Even if it's only therapeutic.

The comments fro your registrar don't seem to be providing customer service help. Is this someone in authority or an auditor? Not the kind of attitude expected for your efforts and forthright communications. if you don't need to be registered to ISO9001 by a customer consider dumping the process, and call your system ISO 9001 compliant. The minors you listed don't seem to be any big deal. There are several manuals posted here that you may be able to use for guides.

danzio

Don't sound like a big problem to me.

NCR1 - ISO logo. That's not really a ISO9001 NC but a breach of your registrars rules and regulations for certification. Solution simple. Remove the logo or make the website "under construction" when the auditor comes. You should fix this NCR though because they can follow up anytime. Not really a hard one to fix. Betcha you forgot to put the certificate number on the logo or used the ISO logo as opposed to your registrars certification mark.

NCR2 - This is a common problem. No way you can include design in your system. it's very complex clause. The trick here is to shift your design service to suppliers/subcontractors. Reword your website so you don't claim you do the design. You say "we offer" and not "we do". Now all your designers should be in your approved vendor/subcontractor list. Maybe you don't have time to do evaluation records for them. So raise your own internal NCN on this. Maybe not having supplier records will get you a minor but hey...this is a kwik fix. Strictly speaking if you have noticed a problem and it is under the control of your QMS (ie a internal NCR and corrective action request) the CB (certification body) shouldn't raise a NCR because it is already identified and is under control. You should also "sanitize" your other records so there is no paperwork to indicate the design work was done in-house. If your staff did the design it may be a smart move to add them to your subcontractor list and explain that they did it as freelancers and not as part of their job duties. Once you have shifted design to purchasing you are out of the tricky clause.

NCR3 - Using a non-approved supplier. easy-peasy. bang him on your AVL and create related supplier record.

NCR4/5 - Customer satisfaction is an awkward and difficult clause. No idea what they mean by "objective evidence". It's subjective. Anyhow. Not sure what your method is for measuring satisfaction. The popular method is survey...yawn...as if we don't have enough. the other way is to have indicators which would indicate the level of satisafaction. So you have a simple spreadsheet with indicators like... complaints received, late deliveries, average order turnaround, repeat orders etc. A lot of this shoudl be available and really you should do this as it is a good way to monitor your business.

I am mindful that the clock is ticking and you really need just a band aid to get through the assessment. If kwik fix wanted. Knock up a questionairre. Don't spend much time. Once you have it you cannot get a major but maybe a minor. Then do a telephone customer survey. Of course you dont have time. So just bung in customer names/phone numbers from your records and tick away the responses yourself. The auditor cannot phone your customer to verify. he is not allowed to. backdate the date of call and have the person who made the call sign off the form. I would not use paper but knock up a access database quickly. maybe you dont have the tech skill so paper is fine.

You were a bit vague on these satisfaction ncr's so cannot help too much.

This should scrape you through. As said if what you do looks poor. raise you own NCR and CAR to show that action is underway. You could even claim that records were stolen by the previous quality manager and raise a NCR about record safety.

The missing QM maybe a big pain. Get one of those fill-inthe-blanks ones from the net. You can call the old Quality manager. Not as the company but as you personally and plead with him to help you out of a jam, save your job and tell you where the manual and docs are.

OK that's my emergency solution. But I stress. You should get your system in order and do proper fixes for these problems. By the way, the website ncr's will disturb the auditors most because they are seen publicly and can rebound on the auditors/CB.

Good luck...

Registrars have to follow requirements as well. It is correct to plan the re-certification audit sometime in advance of the expiration of the validity of the certificate, so any issues arising from the re-certification audit can be resolved prior to the certificate “ceasing” to be valid.

I believe that being forthcoming and open with your registrar is definitely the right approach, but if the system is not implemented, one should not expect to be certified. From your comments, your system was based on 1 individual. What contravenes a basic premise of what a quality system should be.

My suggestion to you, at this time is: Call your registrar and ask for a voluntary suspension of the certificate. Tell them that you will call them, when you are ready to resume the certification program. Decide if you need external assistance or not to put a system in place. There are plenty of knowledgeable, professional people here in So-Cal. But since you are listed as the president of the company, you might want to build your system with your own internal resources. It is doable. It might take a little longer, but you will ensure that a true system exists.
Concerning the actual findings you listed, I did not see the ISO logo in your website. So, I assume that you already fixed that. But even if it was there, it should have not been written up. Auditors are supposed to identify misuse of the certification mark, not the ISO logo. Once again, using the ISO logo is prohibited by ISO. See http://www.iso.org/iso/en/iso9000-14000/certification/publicizing/index.html (http://www.iso.org/iso/en/iso9000-14000/certification/publicizing/index.html) but should not be written up as a finding during an ISO 9001 audit, imo.

The Design issue definitely must be resolved. It needs to be clarified in your manual as part of the Scope of your Management System. Either done in-house or outsourced, if you sell design services, you will definitely need to find ways to comply with ISO 9001 7.3. PS. Seems that the word excelled is misspelled in your website – exelled –

Good luck and, like Wes said, relax.

ralphsulser is spot on about your registrars attitude. What a snotty b***h. I'd like to see her training records and evidence of competency in ISO9001 and customer comminications.

Another option you can consider is changing to another registrar. Really it all boils down to cost and the number of audit man-days required. One thing you should be aware of is that if you change registrars it is considered as a "transfer" not an initial assessment so the man-days required should be less than if an initial. Maybe not an option for you and maybe you would need to bang in your application (or get quote) before your certificate expires. Worth a phone around maybe to compare prices.

Hey I'll certify you. My fees are peanuts (thailand rates) but you won't like the travel expenses. or I'll get our head office in UK to do it. Where are you? Miami, Vegas. I'll even buy the beer after the visit.

danzio,

Welcome to The Cove :bigwave:

As far as the missing manual, your registrar should have a copy of it as part of their past audit records. They have to have one from your original registration audit (desk audit). Granted any copy the registrar has is not the "controlled" document it would help you recognize what it looks like and where it could be at your organization.

Also, it is likely one of your customers asked for a copy of the quality manual in the past as they certified you as a supplier. You may be able to find a copy with one of your customers.

Jaime

My only comment is that first I agree with nearly all the advice given for this situation. Second, what a great group of folks to try and help out!

Way to go Covers!!!

Welcome Danzio :bigwave:
The bottom line here is that, your organization is the registrars client, and in being a client, you may want to remind the registrar's contact of this fact.
If you're inheriting a messed up system that, merely pays lip service to the intents of the ISO 9001 standard, I emmpathize :(
I certainly don't think you should panic, Sydney's points are very valid too, your registrar may be following a defined and contactual process.
Regarding time to get your house in order, I'm certain you may be able to gain permission of more time for organizing your system.
Rox gave great advice too, step back and look at your existing system and gain a big picture view of what you've actually got. You may indeed be in a position of deciding to re-boot your quality system, defrag and reframe.
Wallace.

To everyone: Thank you for all your ideas, thoughts and concerns. What a great bunch to put in the effort to help us out of this mess.

With regards to the missing manual, I have our Quality Manual, what I can not find is the ISO 9001:2000 manual.

I am still waiting to hear from our registrar regarding an extension. Remember she said "I will get right back to you" and that was 2 days ago.

With regards to the NCR's. I will attempt to respond to them and then wait for feedback to use as guidance for the follow-up. I don't suppose there would be any harm if they don't like my initial response would there? I am assuming it would only generate a rejection and I would have to try again.

Again, thanks to all.

With regards to the missing manual, I have our Quality Manual, what I can not find is the ISO 9001:2000 manual.



Your quality manual was most likely drafted copying the ISO standard, so I wouldn't really worry too much about that. In my experience, most are written that way but others will jump in and correct me if I'm off the mark.

Hi All,

I am a customer service rep for an international registrar and I hope (pray) that the problem (lack of response) you are having with your registrar's customer service rep.... isn't ours!
The advice given to you by everyone here is excellent and you do have several options.
By attempting to respond to the nonconformances, you are correct, if they are turned down, you can definitely try again. You have a little time to try to do this, since your renewal audit isn't scheduled until September, it might be worth a try. Our company's procedures say that we cannot accept a transfer client from a system with open nonconformances, it would have to be an original registration audit (with the additional manday requirements) not a transfer (where mandays would stay the same). Another good reason why trying to close the NCR's might be very worth it for you.
It also might be a good idea to simply ask for certificate suspension and post-pone your renewal audit, our company allows certificate suspension for 90 days, after 90 days we would require additional audit time be added to the audit (remember...registrars get audited too and we would have to justify why, in the face of serious problems or major changes with a management system that additional audit wasn't added), so that is why the 90 day limit is imposed. Good luck to you and know that you aren't the only company in this situation, it happens!

With regards to the missing manual, I have our Quality Manual, what I can not find is the ISO 9001:2000 manual.



danzio:

My experience here may be different than others, but are you sure that your Quality Manual is not your ISO 9001:2000 manual? Take a look to see if it doesn't cover the standard. Some Q Manuals will do this point by point, but others don't.

If you have an electronic copy, why not make a copy of it, delete any identifying information that would reveal your company, and post it here? We can tell you pretty quick if that is what you have. You may already be further ahead than you think.

I can't remember ever hearing anyone refer to an ISO 9001 manual as a seperate entity.

danzio:

My experience here may be different than others, but are you sure that your Quality Manual is not your ISO 9001:2000 manual? Take a look to see if it doesn't cover the standard. Some Q Manuals will do this point by point, but others don't.

If you have an electronic copy, why not make a copy of it, delete any identifying information that would reveal your company, and post it here? We can tell you pretty quick if that is what you have. You may already be further ahead than you think.

I can't remember ever hearing anyone refer to an ISO 9001 manual as a seperate entity.Way back in the "olden days" [1994 version of ISO9001] there were a lot of companies who thought they needed a separate "big honkin' manual" for ISO. We have several threads in the Cove which discuss how to make a document with very few pages and still meet the Standard. It's a real pity more folks don't read and follow the advice freely available here in the Cove on streamlining the Quality Manual and still remain compliant with the Standard.