Documents of external origin not identified? ISO9001 Clause ISO 9001:2000 5.4.1

[AndyN]

I can see why AB's have clamped down on the use of 'observations', in place of non-conformities. In many cases, the auditor was simply lazy and just reported the symptom, not taking time to investigate further.

There is a mechanism to report an 'outlier' - the summary report from the audit. It's good 'CYA' for the auditor and it's there for the client to note, ignore or action, as they see fit.

Of course, although I'm not trying to hi-jack the thread, the idea of making a non-conformity of external documentation controls seems a bit lame, since the company either had one, when they got registered or they didn't. If there's a couple of documents not in the system, if the system exists, then that's hardly a non-conformity. It should have been pointed out to the client, when found, recorded in the summary and they should be given the opportunity to address it.

 

[Helmut Jilling]

I can see why AB's have clamped down on the use of 'observations', in place of non-conformities. In many cases, the auditor was simply lazy and just reported the symptom, not taking time to investigate further.

There is a mechanism to report an 'outlier' - the summary report from the audit. It's good 'CYA' for the auditor and it's there for the client to note, ignore or action, as they see fit.

Of course, although I'm not trying to hi-jack the thread, the idea of making a non-conformity of external documentation controls seems a bit lame, since the company either had one, when they got registered or they didn't. If there's a couple of documents not in the system, if the system exists, then that's hardly a non-conformity. It should have been pointed out to the client, when found, recorded in the summary and they should be given the opportunity to address it.

Andy, your answers are not quite what I said.

If it is a nonconformity it has to been written as such. And, we have discussed the external docs topic enough. If there are docs which must be controlled, then certainly they must be. I have written that NC many times.

However, Jim's point, that there are occasional grey issues which don't clearly make an NC because the standard is not clear. They can't be written as an NC, unless there is clear evidence the situation is not effective. There are grey areas. Usually, we don't wrute those. But, it is risky to list things in an audit report like that. Some witness auditor will take it as his duty to determine whether it should have been an NC and issue findings. It is risky for 3rd party auditors to do that.

I either write an NC, or a clear-cut OFI, or the rest is verbal and left to the client to address. Not my preferred way to do it, but apparently what the AB's want.

 

[AndyN]

I understand Helmut. My comments were based on my experience as a third party auditor and related to the procedures the CB had for dealing with 'observations' - they tried not to present them on forms which 'looked like' an NC, but were a 'heads up' that there may be something brewing, as it were........

I took a look at the OP and it seems a stretch to be listing OE manuals etc as required documents of external origin and then making that kind of thing a non-conformity. My belief is that an auditor could investigate the situation to determine if there has been an issue which leads to downtime, extended periods of equipment non-availability as a result of not having such documents. Without that evidence of ineffectiveness (or similar) then it's thin ice we're treading on.

In some of the examples given in this thread, I believe Sidney is totally correct in his assertion that people would end up controlling yellow pages etc. You don't have to have the OE workshop manual to perform maintenance on your car, especially if you already are qualified to work on automobiles, for example.

It certainly is a difficult call for an external auditor to determine the effect of not having a system to identify and control such external documents, given the time constraints of their type of audit. IMHO, I wouldn't have spent much time on it at all, since a document control issue such as this isn't going to be on management's radar screen (even if we can all agree it's necessary) as something affecting business performance, customers' satisfaction. There are bigger fish to fry, in most cases.

 

[Jim Wynne]

I took a look at the OP and it seems a stretch to be listing OE manuals etc as required documents of external origin and then making that kind of thing a non-conformity. My belief is that an auditor could investigate the situation to determine if there has been an issue which leads to downtime, extended periods of equipment non-availability as a result of not having such documents. Without that evidence of ineffectiveness (or similar) then it's thin ice we're treading on.

I think that we need to consider how documents are used. If there is a library of maintenance manuals and no one ever looks at them, but maintenance is being conscientiously performed, then there's no issue. On the other hand, if as I said earlier, there is a requirement to use the manufacturer's maintenance instructions, and the manuals are referred to for that purpose, then it's a different story. Somehow the authority of the maintenance manuals has to be made unambiguously normative.

The suggestion that auditors look for evidence that contradicts an auditee's contentions is a good one, I think. I've always thought that when an auditee contends that everything is in control, and provides evidence to support the contention, that the burden of proof to the contrary is on the auditor.

A point of clarification regarding an earlier statement I made which might have been misunderstood: there are times when a clear nonconformance exists (i.e., there is some condition which is unambiguously not in accordance with the standard), but there is no evidence that the NC is systemic. In such cases, I was suggesting a different category of finding, one related to, but different from, an NC requiring corrective action. There is nothing to be gained by requiring corrective action for an outlier, but in the current paradigm auditors are required to document such instances and require CA. If unsure, auditors should always err on the side of caution, imo, but there are cases where auditors will find issues that really don't require formal CA.

 

[Sidney Vianna]

What's missing is the idea of a third-party audit being a sort of collaboration with the auditee, rather than a police action.

Jim, some CB's promote a "partnership approach" with their clients, where both organizations understand that the system has to work for the certified company, while providing assurance to the registrant's customers about the system's ability in delivering customer satisfaction.

A conflict exists as the primary users of an organization ISO 9001 certificate are, as mentioned above, not the organization itself, but their customers. Nevertheless, it is up to the organization to select their own CB. Many times, the criteria for CB selection is very dysfunctional. Many people deliberately avoid selecting a CB that will make them "work for the cert". The "path of least resistance" is attractive to many.

 

[CliffK]

I wish I had found this thread sooner. I've been having some thoughts about control of external documents myself.

It seems the original question had to do with the need to list, or otherwise control, equipment manuals.

Let's just stipulate, for a moment, that equipment manuals can be critically important. I know some may not think so, but bear with me. Let's also admit that they can go missing or be damaged.

Will a list of manuals prevent their loss? No. Will a documented control procedure prevent loss? No. A documented procedure may help, if it contains the right words and if manual users are trained on the procedure and if they take it to heart.

That seems like a lot of ifs to me. Wouldn't you be better off spending your time motivating people to care for the manuals properly?

I guess my point is that you do not have an infinite amount of time. Why spend it futzing around with control procedures that don't amount to a bucket of spit? (Okay, I got carried away. They DO amount to a bucket of spit. Joke, joke.)

It's the people that will take care of the manuals, and that's where you need to be working.

Cliff Kachinske