Could I issue major finding for Inadequate Procedures

I performed a supplier audit for ISO 9001 requirements. The supplier has established a QMS compliant to ISO 9001 but is not certified. Whilst, the procedures are in place, they are deficient and do not "fully" meet the ISO 9001 requirements. For example, the internal audit procedure does not state requirements for internal auditors, does not state that the auditors can not audit their own work etc. Then in the Management Review procedure, the review inputs and review outputs are not defined.

Under these circumstances, as the supplier is not ISO 9001 certified, would these be considered as minor findings ?

Please advise.

Re: Could I issue major finding ?

Good day SGquality,

Do you require your suppliers to be ISO 9001 registered in order to be approved?

When I audit as a 3rd party, my issuance of majors is based on a complete absence of controls and conformity within a particular element group. Partial gaps result in minors unless they are judged likely to imminently allow bad product going to customer (you).

Certainly internal auditor qualifications are worth attention. Did their lack of education/skill result in ineffective audits? What is the basis of your perspective?

Are the management reviews including all the required parts, despite the procedure not defining this requirement?

I would like to understand these things before commenting further.

Re: Could I issue major finding ?

Being certified or not the severity of nc are the same.
On the other hand,it seems that this system is full of non conformities,depending on the quantity of ncs you may decide to stop the audit not wasting time on that, informing that the system does not meet the main requirements of the ISO.
Hope this helps

Re: Could I issue major finding ?

Thanks for your responses.

Jen Kirley said:

Do you require your suppliers to be ISO 9001 registered in order to be approved?

Certainly internal auditor qualifications are worth attention. Did their lack of education/skill result in ineffective audits? What is the basis of your perspective?

Are the management reviews including all the required parts, despite the procedure not defining this requirement?

Click to expand...

No, our organization does not require this supplier to be ISO 9001 certified.

Internal audits are performed by competent personnel however the procedure does not mandate any requirements. Likewise, the management review procedure does not state the review inputs and review outputs and hence not discussed. Most of the management review meetings are towards addressing production related issues.

QAMTY said:

Being certified or not the severity of nc are the same. On the other hand,it seems that this system is full of non conformities,depending on the quantity of ncs you may decide to stop the audit not wasting time on that, informing that the system does not meet the main requirements of the ISO. Hope this helps

Click to expand...

This supplier is not required to be ISO 9001 certified by my organization. The supplier is a small machining shop, and the President said that they want to have QMS elements in place without going through the cost of certification which is not mandated by most of their customers. The supplier was very receptive to all my findings and showed full commitment ton address all my findings.

Re: Could I issue major finding ?

Why did you hold the audit in the first place? Were you having issues with that supplier? Is it a long standing supplier? What is their track record?

Re: Could I issue major finding ?

Well,it depends on you to continue the relationship with this supplier, if you determine that the iso compliment is not your requirement and /or the product you receive is in full control,then you perform a normal audit and send the report of nonconformities waiting from him a compromise to solve the ncs found.
Many companies work in this way, I mean work with non certified companies until there this is a requirement , it may be possible that you may be requested that your suppliers must be ISO certified,then at that moment you evaluate the action to be taken.
Regards

Since it is a supplier audit ditch the ISO requirements and audit to what your company thinks is important. Don't worry about major/minor. Focus on what really needs attention to meet your needs. It's a small shop. Do you really think that stating auditor requirements on a piece of paper will matter? Or do you really thimk top management, the president, is detached so that he isn't doing effective reviews of inputs/outputs?

SGquality said:

I performed a supplier audit for ISO 9001 requirements. The supplier has established a QMS compliant to ISO 9001 but is not certified. Whilst, the procedures are in place, they are deficient and do not "fully" meet the ISO 9001 requirements. For example, the internal audit procedure does not state requirements for internal auditors, does not state that the auditors can not audit their own work etc. Then in the Management Review procedure, the review inputs and review outputs are not defined.

Under these circumstances, as the supplier is not ISO 9001 certified, would these be considered as minor findings ?

Please advise.

Click to expand...

As I read your post, three things immediately jump to my mind:

1) I don't see anything in your post that requires them to conform with ISO 9001 requirements at all. You say that they don't need to be certified, but you don't say what QMS requirements your company contractually (PO, supplier agreements, etc.) have imposed. Without a requirement there is NO nonconformity. You said you were auditing them to ISO 9001, but unless it's required in some way, you're just there consulting.

2) ISO 9001 does not require the internal audit procedure to state requirements for internal auditors. To conform to ISO 9001 they do need to be determined somewhere in the system, but not necessarily in the procedure. Same with the management review inputs and outputs. They're not required to be defined in a procedure. As long as they are included in the review (as evidenced in records) they meet ISO 9001 requirements.

3) "Major" and "minor" classifications have no meaning unless their significance is defined. For supplier audits "major" sounds scary, but what does it mean in your system? Does the supplier need to react differently to a major NC vs. a minor NC? Have you told the supplier what it means?

In order to really understand the situation with your supplier, we need to know what your organization requires of your supplier. Without the requirements defined, we don't know what they were supposed to do. Show us some shalls, and we can probably help.

The answer fully depends on the agreed to audit criteria.

1) What is required to be done?

2) Is it being done?

Everything else is bull. Either agreed to "requirements" (criteria) are being accomplished or they aren't. It's that simple

SGquality said:

I performed a supplier audit for ISO 9001 requirements. The supplier has established a QMS compliant to ISO 9001 but is not certified. Whilst, the procedures are in place, they are deficient and do not "fully" meet the ISO 9001 requirements. For example, the internal audit procedure does not state requirements for internal auditors, does not state that the auditors can not audit their own work etc. Then in the Management Review procedure, the review inputs and review outputs are not defined.

Under these circumstances, as the supplier is not ISO 9001 certified, would these be considered as minor findings ?

Please advise.

Click to expand...

I think you may be making more of your "interpretations" of the ISO 9001 requirements than being objective. You cannot issue a "major" on subjectivity like this. You mention they are deficient, but where does it say IN THE STANDARD that these have to be in their documents?