Do We Have to Comply with Our Own Procedures?

[Quality_Steve]

IMO...If you are not following the process/procedure as written then you should ask yourself, is the process/procedure necessary? If it's not a necessary process, as in it has no influence on the finished product and not required by ISO, get rid of it! If it is necessary, is the process written to align with best practices? If the actual process achieves the same or better results than the written process, it time to re-write the process.

The problem I run into is we write great processes and people will choose not to follow the process through carelessness or impatience.

If it takes a little longer to do it right the first time, it is still quicker than doing it twice.

But I digress, I was handed a QMS three months before certification. I had little knowledge of ISO or quality in general. I had to quickly polish up what was already written, find the holes, and make it work. Now that we are certified, I have had the time to really look at things and see if they make sense. I have found that we have over-documented everything. We have process flows for filling out forms.

The Cove has been a very helpful resource!

 

[John Broomfield]

Re: We no longer have to comply with our own procedures - OFFICIAL !!

A 10 year old thread resurrected....:mg:

4.1 of ISO 9001 talks about determining methods (procedures, work instructions, command media, etc.) related to the QMS processes. Further, it requires organizations to implement actions to ensure processes are deployed.

If we agree that we develop documentation to define how processes should operate, a requirement for implementing actions reads, IMO, as: follow the procedures. You can not truly implement processes if one deviates from the documentation that describes how the process is supposed to be carried out.

Sidney,

I resurrected this discussion because it had not been concluded with what ISO 9001 actually specifies when comparing the 1994 and 2000 versions.

And yet we still see auditors reporting employees for failing to conform to procedures as a nonconformity to ISO 9001:2008. Now they no longer have the old 4.9c clause they even have to imagine the requirement to do so!

Implement means use the organizational management system to put it into effect including its many provisions for managing change. Implement does not mean conform to procedures that may not work.

Sure, management may require conformity. But ISO 9001 no longer specifies that employees shall conform to the plans, procedures or instructions.

May I suggest the acid test is the 7.5.2 for validated processes? The specific methods have to be used but the requirement to conform to the specific methods is left to management.

John

 

[John Broomfield]

IMO...If you are not following the process/procedure as written then you should ask yourself, is the process/procedure necessary? If it's not a necessary process, as in it has no influence on the finished product and not required by ISO, get rid of it! If it is necessary, is the process written to align with best practices? If the actual process achieves the same or better results than the written process, it time to re-write the process.

The problem I run into is we write great processes and people will choose not to follow the process through carelessness or impatience.

If it takes a little longer to do it right the first time, it is still quicker than doing it twice.

But I digress, I was handed a QMS three months before certification. I had little knowledge of ISO or quality in general. I had to quickly polish up what was already written, find the holes, and make it work. Now that we are certified, I have had the time to really look at things and see if they make sense. I have found that we have over-documented everything. We have process flows for filling out forms.

The Cove has been a very helpful resource!

Quality Steve,

Three questions:

1. Who requires employee conformity to procedures?
2. How do they make this clear to the employees?
3. Do they cite an ISO requirement to conform or is it their own?

Managers may also say "use it or improve it".

By the way, well done!

John

 

[Quality_Steve]

Quality Steve,

Three questions:

1. Who requires employee conformity to procedures?
2. How do they make this clear to the employees?
3. Do they cite an ISO requirement to conform or is it their own?

Managers may also say "use it or improve it".

By the way, well done!

John

Very good questions! I believe these views have been pasted down from different parts of the organization that have been ISO certified since 1994. I would have to say it more management requiring conformity than anything. Many of the requirements we impose upon the production floor are stated in their quality log instructions.

I've always heard the old saying, "Say what you do and do what you say."

Now you make me question the very foundation in which I stand on

 

[Sidney Vianna]

Re: We no longer have to comply with our own procedures - OFFICIAL !!

Implement means use the organizational management system to put it into effect including its many provisions for managing change. Implement does not mean conform to procedures that may not work.

Sure, management may require conformity. But ISO 9001 no longer specifies that employees shall conform to the plans, procedures or instructions.

John, we have had this discussion in many threads, post 2001. For example, in the Not following the Procedures is a Nonconformance? Sales department thread. I stick to my comment that I wrote:

4.1. Failure to follow established procedures signify failure to implement PROCESSES, as devised. ISO 9001 is about process control & improvement. Documented procedures exist to describe how the process is supposed to work. Thus, and obviously, if you are not following a documented procedure, chances are, you are deviating from the intended way the process is supposed to be executed. Unless it is one of those instances where the documented procedure has not been revised to catch up with the intended process.

 

[John Broomfield]

Very good questions! I believe these views have been pasted down from different parts of the organization that have been ISO certified since 1994. I would have to say it more management requiring conformity than anything. Many of the requirements we impose upon the production floor are stated in their quality log instructions.

I've always heard the old saying, "Say what you do and do what you say."

Now you make me question the very foundation in which I stand on

Quality Steve,

No worries as long as the requirement for employees to conform to policy, plans, procedures and instructions comes from your management as and when required.

John

 

[John Broomfield]

Re: We no longer have to comply with our own procedures - OFFICIAL !!

John, we have had this discussion in many threads, post 2001. For example, in the Not following the Procedures is a Nonconformance? Sales department thread. I stick to my comment that I wrote:

Sidney,

You stated:

"4.1. Failure to follow established procedures signify failure to implement PROCESSES, as devised. ISO 9001 is about process control & improvement. Documented procedures exist to describe how the process is supposed to work. Thus, and obviously, if you are not following a documented procedure, chances are, you are deviating from the intended way the process is supposed to be executed. Unless it is one of those instances where the documented procedure has not been revised to catch up with the intended process."

In 4.1 is see no requirement specified to "implement processes as devised".

I agree that the process and procedure are meant to match, except when:

1. The documented procedure has been countermanded by someone in authority.
2. The documented procedures does not work.
3. The documented procedures is not be up to date.
4. The documented procedure is undergoing active corrective action (to demonstrate effectiveness before updating the document)

The 1994 requirement to comply in all cases was corrected in 2000.

It is now up to management to say when conformity to procedures is required.

Auditors increasingly investigate the effectiveness of process monitoring per 8.2.3 instead of reporting employees for not following procedures.

John

 

[Sidney Vianna]

Re: We no longer have to comply with our own procedures - OFFICIAL !!

In 4.1 is see no requirement specified to "implement processes as devised".

I don't see how

determine criteria and methods needed to ensure that both the operation and control of these processes are effective,

could be interpreted in a different manner.

 

[John Broomfield]

Re: We no longer have to comply with our own procedures - OFFICIAL !!

I don't see how could be interpreted in a different manner.

Sidney,

I agree. This requires effectiveness not conformity:

"Determine criteria and methods needed to ensure that both the operation and control of these processes are effective".

But conformity and effectiveness only coincide when the procedure is exactly right.

How often is the procedure exactly right? Most procedures are in need of improvement and auditors want to see auditees doing this for themselves.

I am sure we agree that auditors clamping down on ineffective procedures does no one any good. It leads to no changes unless the auditor says so.

Such dependency undermines the independence of audit.

Hence the need to audit process monitoring per 8.2.3 rather than employee conformity per no clause at all.

John

 

[Paul Simpson]

Firstly I agree with Sidney that raking over the coals is non value adding when there is so much else of more worth to talk about.

But there is a general point worth making. When ISO went away from the 20 clause structure for the 2000 edition this meant a change of approach for both standard writers and users. So if you want to write in a requirement to manage a process and to ensure that employees follow any documented procedures intended to control the process then it is likely that this single requirement is incorporated in a couple (or more) requirements in the text.

I try to explain it as drawing threads through the standard to establish a requirement and, as has been mentioned, clause 4.1 describes processes and their control, 4.2 covers documenting processes, 7.1 covers planning, 7.5 control of operations (I still can't bring myself to use 'Product Realization' ) and (finally my particular answer to the question) 5.5.2 a for responsibility for ensuring these process controls and procedures are implemented.

a) ensuring that processes needed for the quality management system are established, implemented and maintained,

Hope this helps.