Hi all,

We have several production facilities covered under one ISO 9000 certificate. The design for our products is done by our company's technology business unit which is a completely separate business unit within our company. For this reason we have always excluded 7.3 from our scope and our auditing company never questioned it.

I should mention that a branch of the 'technology group' resides at one of our sites and services all production sites by providing the product design and technical support.

This year our auditing company assigned us a new auditor, who after auditing some of our production sites (in other words, in the middle of the audit) is saying we cannot exclude 7.3 anymore because its being done right at one of our sites. AND he is adding extra time to our audit schedule in order audit 7.3 (to be done while auditing the site where the technology group also resides).

I can understand saying that we cannot exclude all of 7.3 anymore, though I believe that we should still be able to exclude activities handled by a separate business unit (or at least consider them as "outsourced"). The location of the design function in my opinion is irrelevant, they're just renting space locally.

The part I have a BIG BEEF with is the changing of the audit scope midstream. I believe we should have been told that NEXT time we need to be up to snuff regarding 7.3. Who's right (if anyone)?

I'd *love* to hear if anyone has thoughts on this??
Thanks!

First of all, if the activities of the design are included in the audit of the business technology center, then it should not be part of the local site audit. I would accept auditing the local stuff as part of the BTC since the auditor is there anyway, however....

It sounds like historically, your local sites were not part of 7.3. A change of scope would have to impact the contract between you and the registrar. I am confident that the auditor does not have the authority to change the contract. I would contact your registrar, asking what requirement has changed.

is probably how the auditor felt at the time. Whatever their protocol is will govern how it's handled on-site, but technically, the auditor did the correct thing. The engineering/design function, however it is 'managed' should be defined in the scope and/or other QMS documentation. As an 'ex-registrar' auditor, there's some empathy for the situation, since calling it an exclusion in the past (or under a 1994 ISO cert.) wasn't really correct. Also, the auditor feels 'trapped' because the previous visits didn't highlight it, I'm guessing.:confused:
So, perhaps, how it was handled is a genuine cause for your concern. A call to the operations management could have been made, with you there at the time, rather than an auditor's unilateral action, but who knows even if their HQ would know what to do? I know of one registrar whose management over rules the auditor all the time to 'save face' with the customer and keep the revenue flowing!!:eek:

I hope you can have the situation fixed appropriately to include those pesky engineers.......:lmao:

Andy

Hi all,

We have several production facilities covered under one ISO 9000 certificate. The design for our products is done by our company's technology business unit which is a completely separate business unit within our company. For this reason we have always excluded 7.3 from our scope and our auditing company never questioned it.

I should mention that a branch of the 'technology group' resides at one of our sites and services all production sites by providing the product design and technical support.

This year our auditing company assigned us a new auditor, who after auditing some of our production sites (in other words, in the middle of the audit) is saying we cannot exclude 7.3 anymore because its being done right at one of our sites. AND he is adding extra time to our audit schedule in order audit 7.3 (to be done while auditing the site where the technology group also resides).

I can understand saying that we cannot exclude all of 7.3 anymore, though I believe that we should still be able to exclude activities handled by a separate business unit (or at least consider them as "outsourced"). The location of the design function in my opinion is irrelevant, they're just renting space locally.

The part I have a BIG BEEF with is the changing of the audit scope midstream. I believe we should have been told that NEXT time we need to be up to snuff regarding 7.3. Who's right (if anyone)?

I'd *love* to hear if anyone has thoughts on this??
Thanks!


If an error was made in the past, the auditor is obligated to try to correct it during the audit where it is discovered. There is nothing written that allows us the discretion to "decide" we'll get it later.

The more difficult question is whether you can exclude at your site. I would say no, but I have to qualify my comment. It would have to be audited at the design center for sure, but generally we pick up the trail (linkage) at the local site, after auditing it at the technical center. If your organization is design responsible, you can't exclude it, only indicate which parts are not performed here at the local site.

I would side with the auditor at least 2/3 or 3/4's of the way. The new ISO does not allow Design to be arbitrarily excluded anymore.

Even if the design function is outsourced you are still responsible (see end of 4.1). You can exclude design if it is the customer's design or it a standard product (like mowing lawns).

I tend to agree with auditor although it should be handled by the registrar not the auditor.

7.3 deals with process and well as product. Process designs, including the development of your quality and environmental systems fall within the requirements of 7.3.

Good Luck

7.3 deals with process and well as product. Process designs, including the development of your quality and environmental systems fall within the requirements of 7.3.

Good Luck

I'm sorry but someone needs to see what you're smoking.......

7.3...in fact all of section 7 is limited to those activities identified as necessary to achieve customer satisfaction, that's why it is called "PRODUCT REALIZATION" and not company management. Using your line of thought the planning of the company Christmas party would fall under 7.3 because it is essentially a "designed" process. Next you'll say that an organization must put the supplier of toilet papaer on the approved supplier list....

I addition...the auditor cannot change the scope of the audit. The scope, criteria and objectives are the property of the client and the auditor can only recommend the scope be changed.

It's early, I have a cold and I haven't been sleeeping well so I'm cranky....

I did not understand your comment, that someone needs to see what I am smoking. If you can't reply to a post without bashing, then don't reply.

Maybe you need to do some research on 7.3, and not be so quick to add ridiculous things to the interpretations regarding Christmas parties and toilet paper.

Also, I didn't even comment on the auditor changing the scope. As I see it, the auditor was following a process audit format. Too bad you don't understand how a process audit trail can lead to things outside of the scope.

dmp

CQA, EMLA, CQE

c'mon guys. Enough with the bad blood:rolleyes:

The audit is a 9001:2000, so 'Process Design' isn't in - that's a TS requirement, dmp06.:read:

:applause: Hjilling said it well. Plus, it's really the responsibility of the MR to call management on these things, so as to avoid getting wacked during an audit. The 3rd party did what they should have, even if they did it kinda unilaterally. Don't forget the MR's job is to maintain compliance, so this issue probably should have come up a long time ago. Yeah, the registrars are culpable, but the accreditation authorities issued memoranda a long time ago about the practice of registering organizations to 9002 when they were design responsible (didn't make much impact, did it?:nope: )

Andy

dmp,

One thing to keep in mind when reading posts in threads is that we cannot always read the emotions, personalities, and intents of the poster (sometimes emoticons help). :yes: Randy does not "bash" people personally, and simply was adding "color" to his post to make a point. We really must have a bit thicker skin when it comes to the give and take of information and ideas in a forum such as this. I'm sure Randy doesn't take your "Too bad you don't understand how a process audit trail can lead to things outside of the scope" comment as a personal affront. Mostly we have fun here, feel strongly about some subjects, make light of others, but all in all, enjoy the interaction. :agree1:

There are perhaps many ways this 'subject situation' could have been handled. I would have finished the audit as planned, but wrote up in comments (for the closing meeting and for the registrar's review) the need to address this change in scope. Don't get too excited, Casana. Just work through it with your registrar and auditor and make sure you clearly communicate your contract and audit plans prior to the next audit. Have fun.

c'mon guys. Enough with the bad bloodYes... No need for it. Let's leave it at that, and get back to the topic at hand.

the accreditation authorities issued memoranda a long time ago about the practice of registering organizations to 9002 when they were design responsible (didn't make much impact, did it?:nope: )Not really, no. There were lots of 9002 registrations that were definitely borderline or worse in that respect.

/Claes

Thanks for all the replies!:thanx:

I agree that we need to review where 7.3 fits in our scope and revise as needed both our scope and our quality system.

However, I don't want to RUSH the creation of a documented design process in a few days just to satisfy the auditor. Adding 7.3 to the audit scope last minute puts me in the position of potentially having some very nasty findings and I guess that's the part that really upsets me.

I do feel that there were other ways to deal with this issue, thanks for validating that.

I think my biggest issue is that I don't know what to do next. So I've decided not to do much other than to warn potential auditees about the issue. I think it would be unrealistic and deceiving if I suddenly scramble to create all necessary documents & procedures (not to mention that I do like to sleep once in a while, LOL)

Rob, I will try and not get too excited about it and will definitely work with the registrar. Don't know how much fun I'll have with it, though...

I did not understand your comment, that someone needs to see what I am smoking. If you can't reply to a post without bashing, then don't reply.

dmp

CQA, EMLA, CQE


Bashing? Who's bashing? That's a pretty standard comment I use when we need to have a reality check. (As can be attested to by many folks here that have actually met me in the flesh)

As for bad blood....haven't had any since my last maleria attack about 20 years ago....

I deal with dozens of folks that tell me "the auditor said this, and the auditor said that, blah, blah, blah." Most auditors need to shut their yaps, keep their "opinions" to themselves, and provide the service to the client that was agreed to and paid for (btw...I teach that way, just ask around..) and not make things up onthe fly which may or may not be part of your issue here.

Thanks for the nice words Rob:o I wonder what the reaction would have been if I had suggested choking the krap out of the auditor when opted to change the scope?

I wonder what the reaction would have been if I had suggested choking the krap out of the auditor when opted to change the scope?
Could always do what db suggests here:
http://elsmar.com/Forums/showpost.php?p=71972&postcount=12
:lol:

I have had a few instances where a new auditor has identified a "major" shortcoming of previous external audits.

I think a lot has to do with the commercial nature of the whole business, not wanting to make waves and loose a client to a more "lenient" certifying body.

I had one client who was certified to 9001:1994 when it should have been 9002. We didn't want to change "down" because it seemed negative at the time.

9001 is better because you have to think more about the processes rather than which part of the standard this is.

what did the auditor(s) look at for heavens sake?:mg: What was the design evidence???:eek: Someone was smokin' something really bad!!:nope:

Andy

Well, in case anyone was curious about how it all worked out...

We are able to make the auditor understand that our design group is a completely separate group from the manufacturing group. All he audited was the interface between the two groups (handled by the QA group). So it all ended up ok and he had no findings of any kind on this topic other than to ask that we change our audit scope wording to include the word 'design'.

Of course we had other issues with the auditor but that would be another posting altogether...

Thanks for all the advice!

Well, in case anyone was curious about how it all worked out...
We always are.:agree:

Add the word "design" to your scope?:confused:

We always are.:agree:

Add the word "design" to your scope?:confused:Yes, it's an outsourced process that requires control.

what did the auditor(s) look at for heavens sake?:mg: What was the design evidence???:eek: Someone was smokin' something really bad!!:nope:

Andy

When we first started consulting back in the dim, dark 1990's there were quite a few organisations getting 9002 instead of 9001 because:

Government tenders always said 9002 (even if design was required),

9001 was too hard (even the assessors were saying this). We had a row with one assessor because the client didn't have a drawing office.

We went the opposite with our clients. If they did design then we did 9001. It's not that hard really.

This client bought in, or had manufactured, temperature probes. The design part was which fasteners their customers would use to attach them.

Add the word "design" to your scope?:confused:

Yep. Actually when we looked deeper, the only design aspect that is 'outsourced' is the product design. The packaging and engineering impact aspects are handled by people covered by certificate's scope and needed to be addressed. Lucky for us (this time!) the auditor zeroed in only on the product design and barely touched the rest of the design process. Probably because the guy in charge of packaging is very good at speaking confusingly while sounding coherent (should have been a politician) so the auditor was to bewildered to dig deeper. No guarantees that the same thing will happen next audit though!

Unfortunately this packaging person is being very hardheaded about documenting specifications for the packaging materials, which has caused MANY problems at our manufacturing sites. I'm secretly hoping that including him in the scope will help tame his ways but we'll see...:whip:

So I guess the auditor was right after all about needing to include design...though he was IMHO going down teh wrong trail... I'll steer him to the right one for the next audit, LOL!

Casana,
At least you didn't get an N/C for "nothing at all in design and development". I'm glad that everything worked out and that you are on a track to add some controls where you previously had none. It might be instructive to ask yourself 5 Why's after the "Organization did not include Design" finding and see if you are missing anything else. (Lack of big picture review of the QMS, maybe?) I received a finding at my last audit (after 3 audits that included 3 different auditors, and 18 months of QMS work) that my Internal Laboratory Scope was not documented. I wouldn't mind writing down "I missed it because I'm a numbskull". It would make my life easier. The honest truth is that I have a hard time getting anyone that's not soaking in ISO to compare the standard to our process and ask stupid (read this as uninformed) questions and make me answer them.

It might be instructive to ask yourself 5 Why's after the "Organization did not include Design" finding and see if you are missing anything else.

Oh, I know EXACTLY why it wasn't included - there was no management interest in including DESIGN as part of our scope. "It wasn't there before, why add it if the registrar hasn't asked?" type of attitude. The PRODUCT DESIGN part was definitely out of scope, but the rest of the design process did need to be included. I've already sounded the alarms and providing a list of things to act on.

The one thing in my favor is that we had a bunch of findings (some deserved, some not but that's another story) which rattled upper management enough to start talking about compliance. We'll see how it goes from her on...

...Unfortunately this packaging person is being very hardheaded about documenting specifications for the packaging materials, which has caused MANY problems at our manufacturing sites. I'm secretly hoping that including him in the scope will help tame his ways...


...exactly the reason why not excluding it is the right thing. Too many sins were missed in this area.

Of course, some of the sins were caused by the customers...

Well, in case anyone was curious about how it all worked out...

We are able to make the auditor understand that our design group is a completely separate group from the manufacturing group. All he audited was the interface between the two groups (handled by the QA group). So it all ended up ok and he had no findings of any kind on this topic other than to ask that we change our audit scope wording to include the word 'design'.

Of course we had other issues with the auditor but that would be another posting altogether...

Thanks for all the advice!


Hate to rain on this parade, but if design is in the scope, and design is performed at another location, that design function must be audited at that remote location BEFORE your audit, and approved, before your audit is valid. Just auditing the interface is not enough. (See Rules for more info).

Not sure if this changes anything, but better to deal with it ASAP, before the 90 day window runs out.

Hate to rain on this parade, but if design is in the scope, and design is performed at another location, that design function must be audited at that remote location BEFORE your audit, and approved, before your audit is valid. Just auditing the interface is not enough. (See Rules for more info).
Not sure if this changes anything, but better to deal with it ASAP, before the 90 day window runs out.All of that applies IF this was a TS certification. I don't think it is the case here.

All of that applies IF this was a TS certification. I don't think it is the case here.


Oops, you're right, the original post was indeed ISO. I thought this was a TS case.