Determining what are, and are not, Outsourced Processes

[Helmut Jilling]

Re: Determining what are and are not Outsourced Process

There is no requirement to list your outsourced processes.

What the standard says is:

"Where an organization chooses to outsource any process that affects product conformity to requirements, the organization shall ensure control over such processes. The type and extent of control to be applied to those processes shall be defined within the quality management system."

I don't see list in there anywhere.

You should appeal that nonconformance. The auditor appears to have fallen into "requirement creep".

I would view buying labels as simply making a purchase, not outsourcing.

The Auditing Practices Group has published guidelines on outsourcing that you may find useful. Google TC-176 and look on their site for Auditing Practices Group and look for information on outsourcing. TC-176 is the technical committee within ISO that is responsible for ISO 9001:2008.

I agree the standard does not say you SHALL list them...but it would be kind of difficult to define what controls are in place if you don't identify what the processes are in the first place.

I describe it more as follows...

The standard, in cl 4.1, requires you to define all sorts of details about your processes...When it comes to outsourced processes, the standard still requires you to define them as a process related to your QMS, but allows you to do much less documenting of the details...just the necessary controls you have applied. I believe that is because the standard recognizes that most of the controls are provided by the suppliers. You just need to define any additional controls you bring to the party.

Also, it should be noted, all outsourced processes and purchases shall be controlled - some are controlled under the "Outsourced Processes" (cl 4.1) category, and the rest under Purchasing cl 7.4. So, if it is not one, it will fall under the other.

 

[Big Jim]

Re: Determining what are and are not Outsourced Process

I agree the standard does not say you SHALL list them...but it would be kind of difficult to define what controls are in place if you don't identify what the processes are in the first place.

I describe it more as follows...

The standard, in cl 4.1, requires you to define all sorts of details about your processes...When it comes to outsourced processes, the standard still requires you to define them as a process related to your QMS, but allows you to do much less documenting of the details...just the necessary controls you have applied. I believe that is because the standard recognizes that most of the controls are provided by the suppliers. You just need to define any additional controls you bring to the party.

Also, it should be noted, all outsourced processes and purchases shall be controlled - some are controlled under the "Outsourced Processes" (cl 4.1) category, and the rest under Purchasing cl 7.4. So, if it is not one, it will fall under the other.

That's pretty much how I do it when writing an ISO 9001 or AS9100 manual. I do list them, but I don't try to make it an all inclusive list. Things change, so I usually say "outsourced processes include . . .", and try to list the main ones. Then I show that outsourcing is controlled by the purchasing process. Purchase orders or other purchasing documents clearly show what is being purchased and when completed the work and any accompanying certifications are compared against the purchasing documents to confirm outsurcing was properly controlled (or words to that effect).

The organization gets to define the controls. And by the way, the standard says define, not document or record.

I still think the OP's auditor was into mission creep.

 

[treesei]

Re: Determining what are and are not Outsourced Process

That's pretty much how I do it when writing an ISO 9001 or AS9100 manual. I do list them, but I don't try to make it an all inclusive list. Things change, so I usually say "outsourced processes include . . .", and try to list the main ones. Then I show that outsourcing is controlled by the purchasing process. Purchase orders or other purchasing documents clearly show what is being purchased and when completed the work and any accompanying certifications are compared against the purchasing documents to confirm outsurcing was properly controlled (or words to that effect).

The organization gets to define the controls. And by the way, the standard says define, not document or record.

I still think the OP's auditor was into mission creep.

I agree with this approach. Personally or internally, one needs to know what processes are outsourced. However, it would be unwise to try to produce an inclusive list within the documentation/record system. Putting too many details unnecessarily in the QMS often is a trouble maker, at least not cost effective.

 

[JuneFoo]

Thanks for all your help! (Love this place!)

The examples from the link Harry provided helped: "However, some outsourced processes are often overlooked, including hiring and training, internal auditing, calibration, lab testing, customer surveys, call centers, purchasing, field service, equipment preventive maintenance, installation, and records archiving."

I'm pretty new to this so the links and all your responses will give me something to work with. Appreciate it much!

I never thought of "training & calibration" shall consider as an outsourced process, in such, what kinds of control we shall implement?

 

[treesei]

I never thought of "training & calibration" shall consider as an outsourced process, in such, what kinds of control we shall implement?

Training and calibration are often outsourced. To start, when selecting a provider, you check its credibility. You set up criteria for providers. You send them questionnaires as part of periodical reviews etc. For calibration labs, you usually want to see its ISO cert. There are many controls you may implement but they must fit your need.

 

[Big Jim]

It's pretty much like any other purchase. You describe what you want on the PO or other purchasing documents (such as a contract) and you confirm you got what you asked for on or after delivery.

Don't forget that outsourcing controls need to be defined within you quality management system, and be aware the defined doesn't have to mean documented. If you have a purchasing procedure, it is common to define outsourcing controls there.

 

[Alatriste]

Re: Determining what are and are not Outsourced Process

I need your help. I need to help a small facility (4 people) to get ISO 9001 certification by the end of the year. As it is a small coupling facility, I am thinking to added as a another, already ISO-certified facility instead as either remote facility or an outsource facility.
My question is what is the difference between remote facility and outsourced facility, and what is the easier way to do it? As long as this small facility is included in any ISO certificate mentioned, it is ok.

Thanks in advance for your help.

 

[Jim Wynne]

Re: Determining what are and are not Outsourced Process

I need your help. I need to help a small facility (4 people) to get ISO 9001 certification by the end of the year. As it is a small coupling facility, I am thinking to added as a another, already ISO-certified facility instead as either remote facility or an outsource facility.
My question is what is the difference between remote facility and outsourced facility, and what is the easier way to do it? As long as this small facility is included in any ISO certificate mentioned, it is ok.

Thanks in advance for your help.

Welcome to the Cove.

I'm not sure what you mean by "coupling facility," or what you hope to accomplish by adding another facility. If the one you want to be certified is a subsidiary of another, it's possible for one of them to be considered a support site. I'm not sure how outsourcing (contracting with another company to operate a process) would play into any of this.

If you could clarify your intentions it would help.

 

[Alatriste]

Re: Determining what are and are not Outsourced Process

The small facility currently provides coupling services to a sister, bigger, hose facility. The hose facility can do the coupling by themselves but they decided to use the small sister facility for commercial reasons. Now, there are only 4 people in the small facility and they do not have any Quality documentation at all, so I think is better if we look for the small facility to be added (and mentioned in ISO certificate) instead of trying to get a single ISO certification for small facility from scratch (and so little resources).

Thank you in advance for your support.