Control of Outsourced Processes (not properly described in the quality manual)

[Edugar]

Hello all,

We received the following minor non conformity in our last 13485 audit from our notified body: “the outsourced processes and their control are not properly described in the quality manual”.

In order to address this feedback, we are looking at different options to make our current approach of managing the outsourced processes more transparent to all involved parties. One simple approach would be to do a procedure.

- Do you think that it is the best way to show that organization controls the outsourced processes?
- Do you have any example of “control of outsourced processes” procedure to share?

Appreciate your input.

[SteveK]

Hi Edugar,

We have some secondary processes (e.g. anodizing) which are controlled by a Sub-Contracting procedure as part of the QMS. Very specific to our systems (but short) - just shows how it links in to purchasing/production.

Steve

[Marcelo Antunes]

What is need is to describe the outsource processes (hence the "not properly described in the quality manual" NC) and show how it interacts with your internal processes, and also show that it does not introduce any risks to your processes and final product.

For this, you need to set requirements for these outsourced processes, including risk management activities which need to be taken by your provider.

[qusys]

In Reply to Parent Post by Edugar

Hello all,

We received the following minor non conformity in our last 13485 audit from our notified body: “the outsourced processes and their control are not properly described in the quality manual”.

In order to address this feedback, we are looking at different options to make our current approach of managing the outsourced processes more transparent to all involved parties. One simple approach would be to do a procedure.

- Do you think that it is the best way to show that organization controls the outsourced processes?
- Do you have any example of “control of outsourced processes” procedure to share?

Appreciate your input.

You shall define the criteria with which your company controls outsourced processes, establishing measureables, target, management of non conformities and so on.
This could be agreed in the contract that you sign with your supplier.
Here , you could also establish the communication channel with them ( example meeting on time basis, reports and so on), as well as second part audit from your side as well.
To better explain and manage the overall process of control of outsourced processes, you could think to a mapping of your process to manage this one .
Hope this helps

[cclee]

Not sure what was the objective evidence provided to support the deductive nonconformance statement but I assumed it is related to one of these:

-contract manufacturer for the manufacture of devices, subassemblies, etc.
-contract sterilization for the sterilization of finished products.
-contract laboratories for the analysis of sterilization, environmental monitoring, biocompatibility etc.

I'm sure you already have procedures in place to maintain and control the above processes and elements of the QMS through CAPA, internal/supplier audits, quality objectives, management reviews, etc. So, without having to create a separate procedure for Outsourced Processes you could state in your manual all your outsourced processes and indicate that the policy to control these processes is identified in section 8.5.1(Improvement- General) of your manual (assuming your manual is aligned with ISO clause). Also, at the end of the manual you could reference the sections to the appropriate procedures or create a map to "link" everything together so the auditor will have a better understanding of the control of outsourced processes.

Hope this helps.

[jkuil]

Please read the 2 ISO guidance documents applicable to the outsourced processes

[db]

In Reply to Parent Post by Edugar

We received the following minor non conformity in our last 13485 audit from our notified body: “the outsourced processes and their control are not properly described in the quality manual”.

Quote to me, from the standard where this is a requirement? I do not see that in my copy of ISO 13485. I don't think this is a valid nonconformity.

[Edugar]

In Reply to Parent Post by db

Quote to me, from the standard where this is a requirement? I do not see that in my copy of ISO 13485. I don't think this is a valid nonconformity.

Yes, you are right. It would be a NC if the Outsourced processes were not properly controlled. In this situation I guess the auditor wanted a clearer description.