IATF 16949 - How to demonstrate/prove effective action has been taken

[DariusPlumdon]

We have 4 minor NCs in a recent audit, 3 of which I would like advice on as to how to prove the 'effectiveness' of the corrective action (S7 in the CARA system)

NC1: Solder fault on boards

- We have inspected all boards & re-worked the few with a fault to 'contain' the issue - All good

- We have done 5Y to find the root cause & put a measure in place for future production, an enhanced guideline plus an extra check - All good

- Our issue is we predominantly deal with Software, producing Hardware is something we do 2 or 3 times a year at most.

So how can we demonstrate 'effectiveness' when since the audit we have not have another production batch of boards, and will not do a production batch within the next 90+ days?



NCs 2&3: Something is implemented, but not ‘documented’

The auditor was clear he had no issue with what we doing, but has raised two separate NCs (one on Marketing & the other Distribution) as in both cases he insists we must document what we do. The finding is raised on the documentation being incomplete, nothing else

- Again we have done a root cause & have the newly updated documents as roof of implementation - All good

But how can we show/prove the effectiveness of the document updates, as what staff do is unchanged, they still do a good job?

I am sure there must be a simple pragmatic solution in both cases, but I do not know them & can find no good guidance online

 

[Dianne]

I can't help with the boards part of your question, however I had a similar issue in our ISO9001 audit a few years ago and the auditor gave a really useful explanation that enabled me to close down our finding.

The implementation is the update to the template

The effectiveness is shown by the updated template being used and correctly completed (all required fields) as intended

The other really useful tip the auditor gave us was to that in addressing the finding you are not required or expected to move everything to the new template at once, unless you want to. He said transfer to the new template for the example named in the audit finding evidence. Then roll out the template for every new usage (a new patient for us). He said we could also move to the new template when we next needed to update a patient record, but this was up to us and not mandatory requirement of the standard.

What we did need to do was let him know what rules we were setting ourselves for using the updated template; so in our case we said all new patients use the new template, all existing patients would only be moved to the new template when we next had need to update the their record.

We had over 700 cases of the template being used, we were concerned he would want all of these transferred, thankfully he said there was no requirement for this, only do this if it benefits us.

He closed the finding based on this. Hope this help you.

 

[qusys]

We have 4 minor NCs in a recent audit, 3 of which I would like advice on as to how to prove the 'effectiveness' of the corrective action (S7 in the CARA system)

NC1: Solder fault on boards

- We have inspected all boards & re-worked the few with a fault to 'contain' the issue - All good

- We have done 5Y to find the root cause & put a measure in place for future production, an enhanced guideline plus an extra check - All good

- Our issue is we predominantly deal with Software, producing Hardware is something we do 2 or 3 times a year at most.

So how can we demonstrate 'effectiveness' when since the audit we have not have another production batch of boards, and will not do a production batch within the next 90+ days?



NCs 2&3: Something is implemented, but not ‘documented’

The auditor was clear he had no issue with what we doing, but has raised two separate NCs (one on Marketing & the other Distribution) as in both cases he insists we must document what we do. The finding is raised on the documentation being incomplete, nothing else

- Again we have done a root cause & have the newly updated documents as roof of implementation - All good

But how can we show/prove the effectiveness of the document updates, as what staff do is unchanged, they still do a good job?

I am sure there must be a simple pragmatic solution in both cases, but I do not know them & can find no good guidance online

Hi Darius,
For the first ncn, which were the evidences that carried the auditor to raise the ncn?
Is the violated clause the Control of the repaired product 8.7.1.5 or control of the reworked product 8.7.1.4? I think there is a difference.
In this case , for the solder fault on board, is there a risk to deliver a nonconforming product?
Do you have customer return for that failure?
Have you reported that potential risk on your product/process fmea? do you have reaction mechanism in place? Is the root cause found applicable to other similar process in preventive action?


for ncn 2 and 3 , to provide effectiveness you can do an interl audit on that issue, with the purpose to verify effectieness. For example, check if the personnel has been retrained on the revised procedure, if there is record for the certification.
In prevention, could the found root cause be applied for similar processes too?

I dont kow if it can help.
Please give us additinal details juest in case

 

[Enghabashy]

* the stock & the customers are in the risk area ; all delivered products should be traced " in warehouses ; market & could be recall accordingly ; you should submit evidences & proof that you hold /prevent or inspect above cases & they are found ok;

**actual filed failure study with service / sales & marketing crew could be extended accordingly " if applicable for any doubt"
*** additional process & product audits should be applied as a requirement
**** control plan & FMEA should be reviewed accordingly " as the statement of the requirement also "
**** the root causes & actions taken should prove the prevention of the re occurrences;
***** preventive actions could be taken in similar production lines “ if applicable “

****** the effectiveness & follow up should be still open till finalizing the 2nd batch ; it could be opened over the 90 days / till 2nd customers feedback /---etc-- as appropriate decision for validating & evaluating the actions taken

 

[DariusPlumdon]

* the stock & the customers are in the risk area ; all delivered products should be traced " in warehouses ; market & could be recall accordingly ; you should submit evidences & proof that you hold /prevent or inspect above cases & they are found ok;

**actual filed failure study with service / sales & marketing crew could be extended accordingly " if applicable for any doubt"
*** additional process & product audits should be applied as a requirement
**** control plan & FMEA should be reviewed accordingly " as the statement of the requirement also "
**** the root causes & actions taken should prove the prevention of the re occurrences;
***** preventive actions could be taken in similar production lines “ if applicable “

****** the effectiveness & follow up should be still open till finalizing the 2nd batch ; it could be opened over the 90 days / till 2nd customers feedback /---etc-- as appropriate decision for validating & evaluating the actions taken

Hi Darius,
For the first ncn, which were the evidences that carried the auditor to raise the ncn?
Is the violated clause the Control of the repaired product 8.7.1.5 or control of the reworked product 8.7.1.4? I think there is a difference.
In this case , for the solder fault on board, is there a risk to deliver a nonconforming product?
Do you have customer return for that failure?
Have you reported that potential risk on your product/process fmea? do you have reaction mechanism in place? Is the root cause found applicable to other similar process in preventive action?


for ncn 2 and 3 , to provide effectiveness you can do an interl audit on that issue, with the purpose to verify effectieness. For example, check if the personnel has been retrained on the revised procedure, if there is record for the certification.
In prevention, could the found root cause be applied for similar processes too?

I dont kow if it can help.
Please give us additinal details juest in case

Hi,

For NC1 he raised under 8.3.4! His rationale was insufficient review; not the clause I expected, but his fundamental finding was good & we have improved from it.
Nothing was sent to the customer, we were still in the process of checking the boards ourself. Yes we do have a NCN, Recall & the other processes you alude to.
My point is in theory we are convinced the enhanced guideline roll out & additional review will avoid such an issue in the future, but until we produce another batch of ANY board to will not know for sure ... and that will be way over 90 days from the audit closing meeting, probably 120 - 150 days. So how can we honestly show effectiveness within the 90 days??


For NCs 2 & 3 yes we could do an internal audit; seems a bit of overkill, but if I get no better suggestion this is exactly what we will do, thanks.

 

[DariusPlumdon]

* the stock & the customers are in the risk area ; all delivered products should be traced " in warehouses ; market & could be recall accordingly ; you should submit evidences & proof that you hold /prevent or inspect above cases & they are found ok;

**actual filed failure study with service / sales & marketing crew could be extended accordingly " if applicable for any doubt"
*** additional process & product audits should be applied as a requirement
**** control plan & FMEA should be reviewed accordingly " as the statement of the requirement also "
**** the root causes & actions taken should prove the prevention of the re occurrences;
***** preventive actions could be taken in similar production lines “ if applicable “

****** the effectiveness & follow up should be still open till finalizing the 2nd batch ; it could be opened over the 90 days / till 2nd customers feedback /---etc-- as appropriate decision for validating & evaluating the actions taken

Hi, thanks for replying. I agree with your replies '*' to '*****' and this we have completed.

My issue is that there is no production of a further batch of this or other boards for around 150 day (as I wrote we mainly do SW). When we do produce the HW we will off course do as you suggest and check it.

My point is that this finding was from an IATF external audit, and the rules (to my understanding) state you have 60 days (which can be extended to 90 days maximum) to show the effectiveness; with no production batch how can we do this and not have our accreditation removed??

 

[Enghabashy]

1 All evidences of above actions taken ;covering the documentations changes should be submitted accordingly; the Design Mgr. /responsible should be member of the team ,

2 they are indicating the effectiveness ; the control plan changed to reflect the reaction plan , the FMEA changes( covering DFMEA & PFMEA"-- design manager should participate in both team for closing out 8.3.4 controls processes ; the new score of the severity /occurrences /detection ; it could be changed as the score /SOD or RPN -- any changes of instructions , the ISKIKAWA /root causes analysis ; --etc.,

3-the 8.3.4.4 Product approval process should be under the focusing ; any relevant of design changes for the verification & validation –; specially in the upcoming batch , therefore the Design member could be one of core team

4- the closing out of all opened points in which documented by the IATF Assessor / lead auditor in CAPA reports should be done internally/ closed out ; with the relevant evidences the senior Q Mgr./ management representative ;it could be done within the 90 days; it’s ok within this period ; the recommendations & the actions should cover the estimated new batch after the 120/-- days as well

https://en.wikipedia.org/wiki/Ishikawa_diagram​

 

[DariusPlumdon]

1 All evidences of above actions taken ;covering the documentations changes should be submitted accordingly; the Design Mgr. /responsible should be member of the team ,

2 they are indicating the effectiveness ; the control plan changed to reflect the reaction plan , the FMEA changes( covering DFMEA & PFMEA"-- design manager should participate in both team for closing out 8.3.4 controls processes ; the new score of the severity /occurrences /detection ; it could be changed as the score /SOD or RPN -- any changes of instructions , the ISKIKAWA /root causes analysis ; --etc.,

3-the 8.3.4.4 Product approval process should be under the focusing ; any relevant of design changes for the verification & validation –; specially in the upcoming batch , therefore the Design member could be one of core team

4- the closing out of all opened points in which documented by the IATF Assessor / lead auditor in CAPA reports should be done internally/ closed out ; with the relevant evidences the senior Q Mgr./ management representative ;it could be done within the 90 days; it’s ok within this period ; the recommendations & the actions should cover the estimated new batch after the 120/-- days as well

Ishikawa diagram - Wikipedia​

View attachment 29658

View attachment 29657

Thank again for your further reply. Again I agree with what you have written & we have pretty much done this (all companies have slightly different templates etc.) AND we will of course implement this on the next batch of boards. Your answer is the best I have received about providing evidence of effectiveness within the 90 day limit, so I will propose this through CARA to the auditor ... I can only hope he accepts this!

 

[Golfman25]

For 1, you really cannot prove effectiveness until you run again. So you have two options as I see it. Run a prototype batch to prove out the change. Or figure out some giberish to close the NC and actual effectiveness will be confirmed at the next audit.

As for 2&3, it will depend why it wasn’t documented in the first place.

 

[DariusPlumdon]

We had official sign-off in mid July, so I can now update & thank you all.

Dianne: Your idea on evidence worked. The auditor initially rejected this, but we stuck to our guns & on the penultimate day he suddenly accepted this

Everyone who commented on the board issue: This was more tricky* We went down the route of 'Golfman25' in that we created 'some giberish to close the NC and actual effectiveness will be confirmed at the next audit'. We really did not like doing this 'giberish' approach, but we were forced down this route and ultimately the important thing is that improvements we have implemented we have a real benefit moving forwards

*In hindsight we should have formally identified this earlier (rather than just verbally), which would then have allowed the action to be done beyond 90 days & for then to be a special audit (which is acceptable under IATF rules)