How Can We Show Control Over Outsourced Processes?

[JaneB]

I´ll pass on SGS´s definition of an outsourced process : An outsourced process is one that even if the organization has the condition/capacity to do internally, the organization decides to do it outside of the organization.

Really? I disagree and would dispute this - they're making up their own definition.

I'll stay with what's clearly stated in ISO 9001:2008 (cl 4.1):

NOTE 2 An “outsourced process” is a process that the organization needs for its quality management system and which the organization chooses to have performed by an external party.

Why, oh why, use something else ???

 

[Ted Schmitt]

Really? I disagree and would dispute this - they're making up their own definition.

I'll stay with what's clearly stated in ISO 9001:2008 (cl 4.1):

NOTE 2 An “outsourced process” is a process that the organization needs for its quality management system and which the organization chooses to have performed by an external party.

Why, oh why, use something else ???

The lead auditor put it in the stage 1 audit report. I did not dispute it or find anything wrong with it as all my outsourced processes are being monitored by many different ways...

 

[JaneB]

The lead auditor put it in the stage 1 audit report.

Ah, that's a different thing. I assume the lead auditor wrote something like 'even though the organisation has the capacity to do this, it has chosen to outsource XYZ process' whereas I understood you to mean they were creating their own unique definition & using that. Sorry if I confused.

 

[Ted Schmitt]

Ah, that's a different thing. I assume the lead auditor wrote something like 'even though the organisation has the capacity to do this, it has chosen to outsource XYZ process' whereas I understood you to mean they were creating their own unique definition & using that. Sorry if I confused.

I think you understood it correctly the first time. The exact wording (after my translation) :

Outsourced processes in our understanding are those which even having the conditions/capacity to do it internally, the organization chooses to do it outside of the organization. Please check if this situation occurs.

Like I mentioned in a previous post, I did not think much of it since our outsourced processes are being sufficiently monitored and under control.

 

[Roland Cooke]

Just recently transferring from TUV to SGS, I´ll pass on SGS´s definition of an outsourced process : An outsourced process is one that even if the organization has the condition/capacity to do internally, the organization decides to do it outside of the organization.

That's news to me, certainly not how I would define outsourcing.

It's also simply wrong. For example, there aren't that many companies that decide (for whatever reason) to not use their own onsite irradiation facility and instead outsource that key manufacturing process step (gamma sterilization). They outsource because they can't do it themselves.

Certainly companies can also outsource processes for the reason you suggest.

 

[Ted Schmitt]

Thanks for the input Roland.

Since you work for SGS could you maybe check what´s up here in Brazil with this "interpretation"?

I don´t wish to make this a big issue or anything, but now it´s making me curious...

 

[Roland Cooke]

I wouldn't lose any sleep over it, but if you PM me all the info, I'd be interested, and may be able to find out more (no promises).

What I always say in these situations (I usually work with manufacturing organizations) is that it helps to create a moderately-detailed process flowmap.

Where one of the steps in the flow takes place at a different company, typically that's an outsourced process. You may well need more involvement in establishing the initial arrangements.

The reason that identifying outsourced processes early is important to CBs is that we might conclude that we need to audit there if the process is significant.
You need to establish why you are satisfied that the company is competent to provide you with the products/services you need (or at the very least explain what preventive measures you have put in if they can't be judged to be reliable).

 

[red08]

My confusion lies more with regards to our current documented system procedures and work instructions that were developed for these, previously internal departments. I agree that yes they are still working under my roof however, I can not ignore that they are separate companies and will begin manage their resources in accordance with what makes since to their business. So, with that being said, do I develop a Supplier Quality Manual that provides our specifications and requirements for deliverable s? Will this allow me to remove the Design and Development system procedure, and relative instructions for my documented system? I do not develop and/or control the procedures that my other critical suppliers use. In accordance with the Purchasing element of the standard, we evaluate, audit, and place proper controls to ensure we receive conforming product. So, I'm asking our community to help me develop a plan for how I will treat and manage this situation in the future. Thank you

 

[Helmut Jilling]

My confusion lies more with regards to our current documented system procedures and work instructions that were developed for these, previously internal departments. I agree that yes they are still working under my roof however, I can not ignore that they are separate companies and will begin manage their resources in accordance with what makes since to their business. So, with that being said, do I develop a Supplier Quality Manual that provides our specifications and requirements for deliverable s? Will this allow me to remove the Design and Development system procedure, and relative instructions for my documented system? I do not develop and/or control the procedures that my other critical suppliers use. In accordance with the Purchasing element of the standard, we evaluate, audit, and place proper controls to ensure we receive conforming product. So, I'm asking our community to help me develop a plan for how I will treat and manage this situation in the future. Thank you

The standard does not require you to over control your outsourced supplier companies. It merely states you have to document whatever controls you have defined (if any are needed), and that has to be documented.

Remember, the cl 4.1 discusses identifying your processes, and inputs/outputs, criteria, metrics, planning it all out. Then it says if you have outsourced processes, you have to define those as well. You don't have to do all the 4.1 things,they can do it, but you do at a minimum have to define whatever controls you do have.

Examples can include requiring ISO certification, receiving inspection, adherence to specs, whatever is appropriate. Don't overdo it.

 

[vanputten]

"An outsourced process is one that even if the organization has the condition/capacity to do internally, the organization decides to do it outside of the organization."

I get the impression that some of us are interpreting the SGS defiention of Outsource differently.

The SGS definition does not state that it is ONLY outsourcing if the organization has the capacity to do the process internally. It says that DESPITE having or not having the capability internally, if the organiztion chooses to have the process done externally, then it is outsourcing. The SGS definition says that independent of having the capability internally, when an organizaiton chooses to do the process externally, then it is outsourcing.

To me, Note 2 in section 4.1 of ISO 9001:2008 and the SGS definition mean the same thing to me. It is about choosing. If you choose to do it internally, then make sure you have the capacity or get the capcacity if you don't have it. If you choose to do it externally, even if you have the capacity inrternally (or not), then it is outsourcing.