Corrective and Preventive Actions - ISO 9001 Clauses 8.5.2 & 8.5.3

[glenn0004]

We have just had an independent GAP review of a revised QMS that we are about to implement.

We had used a well known manual as a benchmark template and, implemented 8.5.2 and 8.5.3 (corrective and preventative actions) via the internal audit procedure and QMS review - the GAP review has stated that we must have independent processes for implementing corrective and preventative actions - who's right or wrong.

[Brunetta]

In Reply to Parent Post by glenn0004

We have just had an independent GAP review of a revised QMS that we are about to implement.

We had used a well known manual as a benchmark template and, implemented 8.5.2 and 8.5.3 (corrective and preventative actions) via the internal audit procedure and QMS review - the GAP review has stated that we must have independent processes for implementing corrective and preventative actions - who's right or wrong.

I tend to agree with the GAP review. Think of it this way...

As described preventive and corrective actions will only be initiated from internal audits and QMS review...

What if an employee sees an opportunity to remove a risk in a process on their own?
How does your Nonconforming Product process interact with corrective actions? Do you analyze trends from this process to determine if a corrective action is needed to prevent recurrence of the nonconformity identified in a trend?

Hope this gives you food for thought.

~Brunetta

[Jason PCSwitches]

As far as I can see, the standard states "A documented procedure shall be established to define requirements". It does not say a 'separate' documented procedure, just a documented procedure. As long as the procedure includes all the required information, and adequately defines the process, I don't see a problem, technically. IMHO, it would probably be more effective to have a separate procedure, combining the two elements in that (1) procedure.

[ChrissieO]

In Reply to Parent Post by Brunetta

I tend to agree with the GAP review. Think of it this way...

As described preventive and corrective actions will only be initiated from internal audits and QMS review...

What if an employee sees an opportunity to remove a risk in a process on their own?
How does your Nonconforming Product process interact with corrective actions? Do you analyze trends from this process to determine if a corrective action is needed to prevent recurrence of the nonconformity identified in a trend?

Hope this gives you food for thought.

~Brunetta

Agree with you and the gap analysis on this. So many times I have seen the CA & PA procedure as virtually the same process where there is clearly a difference and should be handled seperately.

Think of it from a safety point of view.

Corrective action is what you put in place to stop the reoccurrence of an incident.

Preventive action is stoping the incident happening in the first place.

Are you using risk based analysis for decision making, FMEA's, how robust is your MOC process etc. These are just some of the things that will identify where preventive actions should be implemented.

On the other hand, there is nothing to say that the two seperate procedures can't be held within the same document, they just need to by defined differently.

Cxx

[Stijloor]

In Reply to Parent Post by Jason PCSwitches

As far as I can see, the standard states "A documented procedure shall be established to define requirements". It does not say a 'separate' documented procedure, just a documented procedure. As long as the procedure includes all the required information, and adequately defines the process, I don't see a problem, technically. IMHO, it would probably be more effective to have a separate procedure, combining the two elements in that (1) procedure.

Personally, I am a BIG proponent of separating the two processes.
However, a note in ISO 9001:2008 states:

NOTE 1 Where the term “documented procedure” appears within this International Standard, this means that the procedure is established, documented, implemented and maintained. A single document may address the requirements for one or more procedures. A requirement for a documented procedure may be covered by more than one document.

Emphasis mine.

Stijloor.

[Jason PCSwitches]

In Reply to Parent Post by ChrissieO

Agree with you and the gap analysis on this. So many times I have seen the CA & PA procedure as virtually the same process where there is clearly a difference and should be handled seperately.

Think of it from a safety point of view.

Corrective action is what you put in place to stop the reoccurrence of an incident.

Preventive action is stoping the incident happening in the first place.

Are you using risk based analysis for decision making, FMEA's, how robust is your MOC process etc. These are just some of the things that will identify where preventive actions should be implemented.

On the other hand, there is nothing to say that the two seperate procedures can't be held within the same document, they just need to by defined differently.

Cxx

I'm with you guys on the theory behind this, especially if you are implementing a system, you should do it in the most practical and clear manner. It is wise to have these as separate documents as to prevent confusion. However, to stick with the OP's question, who's to say you cannot include the processes in (1) document? If the processes IS defined, and can demonstrate effectiveness, then you really have no discrepancy from the requirements of the standard. Everything else, is an opinion and/or preference. Good post by the way :>

[Jim Wynne]

In Reply to Parent Post by glenn0004

We have just had an independent GAP review of a revised QMS that we are about to implement.

We had used a well known manual as a benchmark template and, implemented 8.5.2 and 8.5.3 (corrective and preventative actions) via the internal audit procedure and QMS review - the GAP review has stated that we must have independent processes for implementing corrective and preventative actions - who's right or wrong.

It's not clear what you're referring to as "independent processes." As others have noted, it's permissible to combine the documentation of CA and PA in a single documented procedure. Nonetheless, the standard makes a distinction between CA and PA, so the "processes" used in implementing them will be different by definition.

[dknox4]

In Reply to Parent Post by Jason PCSwitches

I'm with you guys on the theory behind this, especially if you are implementing a system, you should do it in the most practical and clear manner. It is wise to have these as separate documents as to prevent confusion. However, to stick with the OP's question, who's to say you cannot include the processes in (1) document? If the processes IS defined, and can demonstrate effectiveness, then you really have no discrepancy from the requirements of the standard. Everything else, is an opinion and/or preference. Good post by the way :>

This sums it up nicely. I am amazed that whoever performed the gap analysis could not explain this. Did this person get paid?