Sanity Check on ISO 9001 Pre-Assessment Findings

[cereo]

I work for a Fortune 500 company that has chosen to self-certify to their own "ISO 9000-compliant" system standard. It is basically ISO 9001 with some add-ons. The company's Lead Auditor just finished his pre-assessment audit of our Warehouse/Distribution Center. I would like a sanity check on his findings, please. Are ANY of these valid?? (Findings are in bold, my comments are italicized)

1. Your procedure for Customer Related Processes does not state what record or proof you will keep for contract review. Reviews are being done and are recorded (confirmation e-mails) by a single authority (Logistics Manager)

2. All controlled documents must be stamped in RED as controlled on each page. Our procedure states first page, next to signatures.

3. All employees must understand your document control process. Such as how to recognize changes to documents per your procedure. 100% of employees interviewed told the auditor that a controlled doc is the “official” version, that they may not copy, write on, change, deface, or remove controlled documents. Our procedure requires that retraining be performed and recorded for all affected employees every time a document is revised. The auditor’s “evidence” for this finding was that none of the employees could verbalize that the “A” next to the document name would change to a “B”

4. All forms should have form numbers. Even ones that are not related to product or service quality or provision? Yup

5. Need to develop a record of customer propertyso any such product that is lost, damaged or is otherwise unsuitable for use shall be recorded and reported to the customer. Our procedures state that, because of the nature of our business, every product is customer property and so all “product” nonconformities (damage caused by us or during shipment) must be reported to the customer. Our nonconforming product procedures specify recording and reporting to the customer, and yes, we have a log.

6. Continuous Improvement Process needs to be addressed in your procedure.

7. Need to develop and maintain a CAR log to track the progress of open corrective actions and for review for trends.

8. CAR’s must have follow-up before close out. Once RCA and solution implementation is done, the CAR initiator is consulted and their signature, where appropriate, is obtained acknowledging that the actions taken were appropriate and expected to be effective. We require post-closure follow up which may continue for a year or more.

Thank you for your time and feedback.

[Randy]

Here's a quick answer and I'm gonna call for most of this

What do you require within you own procedures because most of this isn't required by 9001?

Like #4, there is no 9001 requirement for form numbers, but if your document control number says all form will have numbers you're S-O-L

#7, not required by 9001

#2 not required by 9001...so on and so forth

So go back, look at you stuff, and detemine what's what.

[cereo]

Thank you, Randy and Marc.
These are all written to the ISO requirements, none of these were the add-ons and none involved violations of our own documents. My peeve is that this auditor denied us certification until these were corrected.
We have something that functions as a CAR Log, it's just not what he is used to seeing elsewhere in the company, so he wants a "Log"
Our procedure is clear, "closed" does not mean "done." This auditor requires closure within 30 days or "it's not timely" so we "close" and continue to follow up.
If we didn't have procedures that were working and records to show they are working (for each and every one of these findings), I would have to agree with you, Marc.

#6 though...? We are doing everything required in 8.5.1...is it a requirement that we regurgitate the standard in a "document?"

[Marc]

1. Update your procedure.
2. He has a point. If you have a 5 page procedure which is uncontrolled and you use stamps, I would expect each page to be stamped. Only stamping one page isn't "effective" if someone (for example) copies a page out of the procedure.
3. Well, I have to side with the auditor. If employees don't understand revision levels on documents, there's a problem.
4. They have to be identified somehow. Number, title, what ever. Essentially forms are controlled documents until they are used and then they become records. Now - If they are are not related to product or service quality or provision, you may have a point. None the less, usually companies have some control method. Some companies even control telephone message forms which are "store bought". I would expect differing opinions on this one.
5. Check the definition of customer property - Typically it is materials and/or assemblies and/or parts which they provide to you to use in your processes. In your case, since you do not produce anything, you're probably right. Everything you have is "customer property".
6 and 7 - Yup.
8. The failure is "...expected to be effective...". Technically a corrective action can not be closed until it's effectiveness is verified.

[Big Jim]

In Reply to Parent Post by cereo

I work for a Fortune 500 company that has chosen to self-certify to their own "ISO 9000-compliant" system standard. It is basically ISO 9001 with some add-ons. The company's Lead Auditor just finished his pre-assessment audit of our Warehouse/Distribution Center. I would like a sanity check on his findings, please. Are ANY of these valid?? (Findings are in bold, my comments are italicized)

Since your company is not seeking certification, they can pretty much make up their own rules and you have no recourse as an employee of that company. And make up their own rules they certainly did as Randy pointed out so colorfully.

1. Your procedure for Customer Related Processes does not state what record or proof you will keep for contract review. Reviews are being done and are recorded (confirmation e-mails) by a single authority (Logistics Manager)

ISO 9001:2008 does not have a requirement for a written procedure for contract review, and thus no requirement for such a written procedure to specify how to keep those records. Element 4.2.4 does require a written procedure for control of records, and records of the results of contract review are required. Read both 4.2.4 and 8.2.2 and I think that your auditor is being overly prescriptive.

2. All controlled documents must be stamped in RED as controlled on each page. Our procedure states first page, next to signatures.

Documents do need to be controlled. Refer to 4.2.3. Your auditor is being way overly prescriptive in saying how it has to be done.


3. All employees must understand your document control process. Such as how to recognize changes to documents per your procedure. 100% of employees interviewed told the auditor that a controlled doc is the “official” version, that they may not copy, write on, change, deface, or remove controlled documents. Our procedure requires that retraining be performed and recorded for all affected employees every time a document is revised. The auditor’s “evidence” for this finding was that none of the employees could verbalize that the “A” next to the document name would change to a “B”

It sounds like your auditor doesn't know how to ask questions that your employees understand. Auditor's have a primary responsibility to make themselves clearly understood, not try to find a way to trap the auditee.

4. All forms should have form numbers. Even ones that are not related to product or service quality or provision? Yup

Forms that are necessary for the control or operation of your quality management system need to be controlled. There is more than one way to control them. If you didn't control all of them, you need to. If you have some other way to control them other than with a form number printed on them, you can. An example of this would be a purchased pre-printed red tag from a stationary store that you have no reasonable way to add a form number to, so you list it with your forms with a note to see exhibit and provide a copy with that list as an exhibit.

5. Need to develop a record of customer propertyso any such product that is lost, damaged or is otherwise unsuitable for use shall be recorded and reported to the customer. Our procedures state that, because of the nature of our business, every product is customer property and so all “product” nonconformities (damage caused by us or during shipment) must be reported to the customer. Our nonconforming product procedures specify recording and reporting to the customer, and yes, we have a log.

I don't see enough here to comment much about. Was the auditor aware of the log?

6. Continuous Improvement Process needs to be addressed in your procedure.

ISO 9001:2008 does not require a written procedure for continuous improvement. The closest it comes is corrective and preventive actions need to be included in your written procedures.

7. Need to develop and maintain a CAR log to track the progress of open corrective actions and for review for trends.

This may be a good idea, but not a requirement of ISO 9001:2008.

8. CAR’s must have follow-up before close out. Once RCA and solution implementation is done, the CAR initiator is consulted and their signature, where appropriate, is obtained acknowledging that the actions taken were appropriate and expected to be effective. We require post-closure follow up which may continue for a year or more.

Like you, I'm beginning to wonder if your auditor read the same standard. Take a look at 8.5.2 and you will see that your auditor is being overly prescriptive. Nowhere does the standard require the initiator to sign off a corrective action, and although it may often be wise to consult the initiator when signing one off, it isn't always in the best interest of the quality management system for him to do so. He may have been the one that recognized the problem, but that doesn't mean he is always the best qualified to determine it was effectively closed.

Thank you for your time and feedback.

I haven't laughed so hard in a long time.

[Randy]

Denied certification from a Pre-Assessment? DOUBLE

1st, an auditor cannot grant or deny diddly-poo

2nd, certification don't come from a Pre-Assessment, I know because I've done a few this year already

3rd, the auditor can't tell you to do squat beyond whatever the standard requires and/or your contract dictates.

[Sidney Vianna]

I think this thread helps driving the point that self declaration programs can be as dysfunctional and ineffective as the traditional external audit process, with the aggravation that auditees don't have an avenue for appeal.

[Marc]

In Reply to Parent Post by Randy

<snip> 3rd, the auditor can't tell you to do squat beyond whatever the standard requires and/or your contract dictates.

And what your internal procedures require.