API Spec Q1 7.5.2 & 7.5.2.1 - Audit Nonconformance Help

H

HRMaribeth

Hello Everyone:

Working on a nonconformity from our most recent API Audit. Struggling...:frust:.

To get you on board, I am copying and pasting the entire conversations between us (the company) and API to try and clear this up. As many of you may know, API will not consult you to help you get the answers/evidence they really want from you (which makes it difficult), it's like playing a game between them and us and a lot of going back and forth to get to the right answer.
Enough of that. I can't figure out what we need to get from our vendors/suppliers to show conformity to this one. If anyone has had experience with this one and could help me out... I would so appreciate it! :cfingers:.

Here is all the info related to this NCR. It starts from the oldest and ends with the most recent response.

[FONT=&quot]AAR Number 9:[/FONT][FONT=&quot] 7.5.2.1 -- The org shall validate those processes identified by the applicable product specification as requiring validation. If these processes are not identified, or there is no product specification involved, the processes requiring validation shall include, as a minimum, non-destructive examination, welding and heat treating, if applicable to the product. [/FONT]
[FONT=&quot]Definition: Validation[/FONT]
[FONT=&quot]NCR ? No record of qualification requirements for personnel performing an outsourced carburizing was found. [/FONT]
[FONT=&quot]Correction: [/FONT][FONT=&quot]Retrieve qualification records from vendors we outsource our processes with[/FONT][FONT=&quot].[/FONT]
[FONT=&quot]Root Cause: [/FONT][FONT=&quot]Misinterpretation of the standard.[/FONT]
[FONT=&quot]Corrective Action: [/FONT][FONT=&quot]Retrieved personnel required qualifications from Vendors and is now documented in vendor files[/FONT][FONT=&quot].[/FONT]
[FONT=&quot]Response from API:[/FONT]
[FONT=&quot]1. [/FONT][FONT=&quot]Submit evidence of the ?carburizing? validation performed by your supplier in accordance with Spec Q1, 7.4.1.3.[/FONT]
[FONT=&quot]2. [/FONT][FONT=&quot]Did you review any other suppliers providing processes that require validation? What was the result of the review? [/FONT]
[FONT=&quot]3. [/FONT][FONT=&quot]Your root cause requires further clarification. Provide a ?detailed? explanation of the cause of the nonconformity. Why was the standard misinterpreted?[/FONT]
[FONT=&quot]4. [/FONT][FONT=&quot]Your corrective action is not accepted. What actions have you implemented to minimize the likelihood of recurrence?[/FONT]
[FONT=&quot]Our Responses:[/FONT]
[FONT=&quot]1. [/FONT][FONT=&quot]Submit evidence ? [/FONT]
[FONT=&quot]2. [/FONT][FONT=&quot]Yes. No other suppliers require validation. [/FONT]
[FONT=&quot]3. [/FONT][FONT=&quot]We thought qualifications of vendors was checked during final inspection and we thought this process to be sufficient to validate the product conformance.[/FONT]
[FONT=&quot]4. [/FONT][FONT=&quot]We have added API criteria to our part numbers within our business system which will trigger required validation on all API materials received back from vendor.[/FONT]
[FONT=&quot]Response from API:[/FONT]
[FONT=&quot]1. [/FONT][FONT=&quot]I couldn?t find the evidence demonstrating compliance with API Spec Q1, Clause 7.5.2 and 7.4.1.3. Please submit all the requested information.[/FONT] [FONT=&quot]Per 7.5.2; We have the in-house capability to validate the subsequent monitoring and measurement of suppliers to validate their process. See example (carburizing in-house validation) of our validation of outsourced carburizing process.[/FONT]
[FONT=&quot]Ivan E. Pinto (9/20/2013 10:30:41 AM)[/FONT][FONT=&quot]:

Notice that a hardness inspection performed at your location cannot ensure the process was adequate to maintain a homogeneous grain structure and proper chemical and mechanical properties. Your supplier must validate the carburization process in accordance with API Spec Q1, 7.4.1.3. The validation should include:

- defined criteria for review and approval of the processes,
- approval of equipment and qualification of personnel,
- use of specific methods and procedures,
- requirements for records, and
- revalidation.

1. Your customers must be notified about the lack of a validated process. Submit evidence.
2. Provide detailed corrective actions to minimize the likelihood of recurrence.[/FONT]


[FONT=&quot]Our Response:[/FONT]
[FONT=&quot]After careful review, we understand this NCR to be related to our internal process for Supplier Qualification; QSP 7.40 (attached) This procedure has been in place since 2008 and revised 10/30/09 to comply with API requirements. This is our process for validating our outsourced processes up to and including personnel qualifications. [/FONT]
[FONT=&quot]For your review, please find QSP 7.40, Form F-008; Supplier Evaluation, and also a vendor Certificate of Registration to ISO 9001-2008 attached.[/FONT]

API Respone:

Ivan E. Pinto (10/14/2013 9:49:04 AM):
Your evidence is related to ?supplier qualification?. Notice that your organization is required to ?validate processes? by API Spec Q1, 7.4.1.3 & 7.5.2.
- defined criteria for review and approval of the processes,
- approval of equipment and qualification of personnel,
- use of specific methods and procedures,
- requirements for records, and
- revalidation.

1. Your customers must be notified about the lack of a validated process. Submit evidence.
2. Provide detailed corrective actions to minimize the likelihood of recurrence.
 

Sidney Vianna

Post Responsibly
Leader
Admin
There is a lot to be dealt with in this nonconformity, but the major issue that you are not (apparently) grasping is the fact that you have outsourced a special process <Wikipedia reference-linkcarburizing> which is a type of heat treatment, and such process needs to be validated, which typically includes destructive testing of samples. The surface hardness tests only are NOT sufficient to determine if metallurgical and physical properties are adequate or not. Part of your correction, according to API, is to notify your customer that the part has been processed without a validated special process.

But that does not constitute corrective action, since, in itself does not prevent recurrence of the problem.
 

Big Jim

Admin
I understand your frustration. For what it is worth, this is the case with any of the ISO 9001 related standards although some auditors seem to be harder to communicate with than others.

From what I see, your issues are really related to sloppy responses, not to API being difficult.

You would probably find it useful to go to the ANAB website and look up their "Heads Up 137" for some good advice on responding to NCRs. Be aware that the audience is different, in that this is guidance for certification bodies (API in your case) on how to respond to NCRs that ANAB writes against them.

A basic pair of definitions from ISO 9000 is needed first.

Correction - action needed to overcome a nonconformance.

Corrective action - action needed to overcome the CAUSE of a nonconformance (emphasis added).

Correction then is what you immediately do to stop the flow of blood. It includes whatever you do to contain the problem, and sometimes the word containment is used interchangeably. An example could be that you discover you made a bad part. Correction could include making a good part to fill the order. It could also include investigating to determine the extent of the problem and apply appropriate containment.

Next you determine why this happened. To get to the true root cause, you may go through some some contributing causes along the way. As long as you can still reasonably ask why, you have not drilled all the way down to the root cause. This appears to be what the auditor is complaining about. To be appropriate, it must be what failed in your system. Superficial responses are not acceptable. You cannot determine an appropriate corrective action until you have done this.

Sage advice I received from a wise quality management system practitioner is that root cause can always be reduced to either a documentation issue or a competency issue. Sometimes a combination of both. Be careful how you word it though, as anything that sounds like "human error" is not appreciated. "Human error" does not show where the system broke down.

Once you know the true root cause (often the hardest part), determining the corrective action is usually pretty easy, as it is what you do to overcome the root cause. For example, what documents are needed to be improved or what training is needed.

Good luck with resolving this.

Once you really understand the corrective action process, it should be much easier in the future. Let us know how you do.
 

Big Jim

Admin
There is a lot to be dealt with in this nonconformity, but the major issue that you are not (apparently) grasping is the fact that you have outsourced a special process <Wikipedia reference-linkcarburizing> which is a type of heat treatment, and such process needs to be validated, which typically includes destructive testing of samples. The surface hardness tests only are NOT sufficient to determine if metallurgical and physical properties are adequate or not. Part of your correction, according to API, is to notify your customer that the part has been processed without a validated special process.

But that does not constitute corrective action, since, in itself does not prevent recurrence of the problem.

It appears that the OP does not grasp 7.5.2, validation of special processes.

Validation of heat treating often does not include destructive testing. I likely does include evidence of process controls to meet the spec, for which the heat treat supplier provides certifications and often include oven charts as evidence as well as rockwell hardness testing.

A special process is a process that cannot be verified by ordinary inspection. When it cannot be simply inspected, a validation scheme is needed. You heat treat supplier is probably aware of what is needed.

You cannot ignore special processes simply because they are outsourced. You still need to show that validation has taken place, hence the need for certs. You need to specify the heat treat specs and ask for certifications. The certs need to be kept as validation records. Part of this may include an audit or site visit of the heat treat supplier to ensure they have the ability to meet your specifications and that they keep adequate validation records (usually records of process controls).
 
H

HRMaribeth

Thanks for all the information Big Jim. I also found a thread in which you were a part of, kind of related to my issue.

You are correct with your last statement re: OP, I get that part.

This has been quite the learning experience for us. Dealing with API is a far cry different that working with our ISO Registrar Auditor. (Night & Day).

I appreciate your information on responding to Auditors too. I will check it out. If you noticed, we did start out with few words but it ended up exploding into what you see there. We were given 13 NC's and managed to close all but 2, this being one of the 2.

I pretty much know what we need to do now. Someone sent me their phone number and walked me through. But again :thanks:!!:agree:

Maribeth
 
Last edited by a moderator:

Sidney Vianna

Post Responsibly
Leader
Admin
Validation of heat treating often does not include destructive testing.
My experience is quite the opposite. The validation of most heat treatment processes that I am familiar with would require destructive testing of samples to ascertain that metallurgical and physical properties of the metal are adequate.
 

Big Jim

Admin
My experience is quite the opposite. The validation of most heat treatment processes that I am familiar with would require destructive testing of samples to ascertain that metallurgical and physical properties of the metal are adequate.

In your earlier post you mentioned "typically". I would guess that the "typically" is more common for aerospace. I have not seen it in API. I have seen it occasionally in ISO 9001 or AS9100 companies.

I'm sure it is mostly a difference in the cross section of companies I work with rather than any significant difference is application.

So I'll add YMMV.
 

Sidney Vianna

Post Responsibly
Leader
Admin
I would guess that the "typically" is more common for aerospace. I have not seen it in API.
Actually, most of my experience with heat treatment comes from my involvement in the Oil & Gas Industry. As the Oil majors continue to develop fields in deeper and deeper waters offshore, risk management is critical. From the API RECOMMENDED PRACTICE 6HT document, we can read:

Improper heat treatment of critical components is one of the primary factors that have contributed to field failures. One of the problems associated with field failures is the fact that the test coupon used to certify the properties of the components may be processed at different times than the part(s) it qualifies. This recommended practice was developed to provide optional heat treating and testing procedures exceeding those currently provided in the API Specification 6A Equipment Specifications.

A more serious problem associated with field failures is the fact that the small QTC?s allowed by API Spec 6A will not represent the actual mechanical properties of the part that has a larger ER than the QTC.
 

Big Jim

Admin
Actually, most of my experience with heat treatment comes from my involvement in the Oil & Gas Industry. As the Oil majors continue to develop fields in deeper and deeper waters offshore, risk management is critical. From the API RECOMMENDED PRACTICE 6HT document, we can read:

Thank you for posting this. Please note that this is a "recommended" procedure. I have no idea how much this is actually practiced.

I do know that using coupons for heat treat validation is not actually required by ISO 9001, AS9100, or API Q1.

I don't question that it is a good idea, and perhaps even a best practice for many applications.
 

Sidney Vianna

Post Responsibly
Leader
Admin
The point being in the Oil & Gas Industry, there are many critical pieces of equipment that depend on adequate mechanical, metallurgical, chemical and physical properties in order to operate properly and reliably.

ISO 9001, AS9100, API Q1, etc are QMS standards and don't delve into product performance requirements for obvious reasons
The quality management system requirements specified in this International Standard are complementary to requirements for products.

The point of linking the API document was to clarify that, even from API's perspective, proper heat treatment of critical products is paramount and many failures have been attributed to that issue.

A QMS that does not address product requirements in a robust manner is obviously a QMS that does not add value. We have to go beyond the general requirements of QMS standards in order to assure product integrity and fitness for use.
 
Top Bottom