3rd Party Audit Finding Not Clear - 4.1 Outsourced Processes

[AndyN]

The company sends quality requirements as an addendum (boilerplate type) that describe a multitude of requirements including the notification and handling of NCM; CAPA program; SPC; Key Characteristics. These are listed as they believe to be able to respond to if the supplier’s processes go south.

So the obvious questions is, did the auditor ask for and review these, or did anyone think to offer them up to the auditor? Or was it a lack of discussion from the auditor and no-one knew what they were looking for, to be able to reply with an example of this boilerplate?

 

[azsportsfan]

The guides during the audit told me that the auditor expected to see a list of processes in the manual which does not sound correct to me. I'm thinking that something has to be disconnected to the purchasing process. The other thing is the wording of 9101D (4.1 line 11 "List outsourced processes") but that's the auditors list for OE correct?

 

[Big Jim]

Can you provide the actual write up about the outsourced processes metrics?

 

[azsportsfan]

Requirement / Clause No.(s): 4.1: Where an organization chooses to outsource any process that affects product conformity to requirements, the organization shall ensure control over such processes. The type and extent of control to be applied to these outsourced processes shall be defined within the quality management system.

Statement of Nonconformity: FINDING: The QM does not identify the processes that are outsourced.

 

[azsportsfan]

For Purchasing:
7.4.2g
FINDING: The purchase order information does not include but is not limited to: Disposition of NCM, Change of processes, change of facilities, change of suppliers.
Also cited Risk Management
There is no evidence of risk management for suppliers as required by 7.4.1f

 

[azsportsfan]

5.4 was cited for only having a scrap metric being tracked for the last year.

 

[AndyN]

Requirement / Clause No.(s): 4.1: Where an organization chooses to outsource any process that affects product conformity to requirements, the organization shall ensure control over such processes. The type and extent of control to be applied to these outsourced processes shall be defined within the quality management system.

Statement of Nonconformity: FINDING: The QM does not identify the processes that are outsourced.

This is ambiguous enough that a technical review may not pick up that QM doesn't equal Quality Management System.

It's OK, during the audit to both have findings reviewed - before the closing meeting - and to take time to ensure your people fully understand what's being reported.

 

[Big Jim]

The guides during the audit told me that the auditor expected to see a list of processes in the manual which does not sound correct to me. I'm thinking that something has to be disconnected to the purchasing process. The other thing is the wording of 9101D (4.1 line 11 "List outsourced processes") but that's the auditors list for OE correct?

4.2.2 requires that the quality manual include a description of the interaction of the processes. This is often done in chart form (most frequently a flow chart). Auditors need this information to set up an audit plan and in AS9100C to determine which processes are product realization related and require him to create a PEAR (AS9101D Process Effectiveness Assessment Report).

Auditors are trained to look to the interaction of processes to see what you have determined your processes are. This description is expected to include outsourcing in some fashion. Often it is an activity or sub-process of purchasing.

In the 9101D OER (Objective Evidence Report, aka "checklist") the auditor is expected to list the outsourced processes as you have indicated. So it would be a good idea to include a list of outsourced processes in the interaction of processes description, although I can't see it being a firm requirement. I would expect the auditor to ask what they are so he can complete the form, not that he has to find it in the interaction chart (or however you handle it if not in a chart).

 

[Big Jim]

For Purchasing:
7.4.2g
FINDING: The purchase order information does not include but is not limited to: Disposition of NCM, Change of processes, change of facilities, change of suppliers.
Also cited Risk Management
There is no evidence of risk management for suppliers as required by 7.4.1f

I'm guessing that the auditor was not show the boiler plated purchase requirements. Perhaps he did not look past the purchase orders (if so shame on him).

I'm beginning to think the biggest mistake on this audit was not making sure you had sufficiently knowledgeable guides.

 

[AndyN]

Back in post #5, I asked if this was a Stage 1... Jim brings up some good points, however, shouldn't this have been resolved at the stage 1 (if this audit isn't it)?