If we do not have Preventive Action, is it an ISO 9001 Nonconformance?

[SpongeMouse]

Re: If we do not have Preventive Action, is it a nonconformance?

i agree with the guys, as i understand the "preventive" word, it is part of the continuous improvement process, of which it is a requirement.

my 2 cents

 

[samsung]

Re: If we do not have Preventive Action, is it a nonconformance?

Both Howste and Sorin have provided reasonable amount of explanation and rational before coming to a concluding remark. I do agree with the reasoning they provided in support of their statements.

However, the auditors' observations/NC's are generally contextual and it's also possible that, while going through the Internal Audit reports, he might have come across such issues which could have been easily prevented before those were detected by the auditors.

 

[jkuil]

Re: If we do not have Preventive Action, is it a nonconformance?

I understand the principle, but I mostly disagree. The auditor shouldn't be deciding where the organization "should have taken" preventive actions. The organization should be the ones prioritizing

We do not dissagree on the definition of "should have take", thanks for adding the clarification.

while going through the Internal Audit reports, he might have come across such issues which could have been easily prevented before those were detected by the auditors.

Considering the above: better wording would even be "didn't execute the (CA)PA process where the organisation should have. Because the outcome of the PA process may be a justifyable not to implement any PA. If the risks associated with a non-conformity are low, but the costs to prevent them are excesively high a PA may not be required. But if the absense of the PA is not justified by a documented risk assessment, this still is a non-conformity. Again, the criteria for the risk assessment must be specified by the compagny and should be used by the auditor as audit criteria.

 

[samsung]

Re: If we do not have Preventive Action, is it a nonconformance?

hi
in our last audit,IMQ auditor issues a NCR coz our organization do not have any preventive actions.is it correct? i said to him it is not correct but i can not prove it . please help me to prove it to this company(IMQ I mean)
let you know that our records is for 3 months.

If you want a straightforward answer to your query, look at this pretty clear explanation.

 

[Big Jim]

Re: If we do not have Preventive Action, is it a nonconformance?

If the auditor is/was able to show you a POTENTIAL NC and you were not able to produce a PA, then I may conclude that the auditor was right.

BUT, if the auditor wrote you up ONLY because you did not have any PA, then he/she is full of ****.

The clause quoted in this topic:

ISO 9001:2008 clause 8.5.3
The organization shall determine action to eliminate the causes of potential nonconformities in order to prevent their occurrence.

So...we have 2 key words here: potential and determine. It is up to the organization to identify the POTENTIAL NC and DETERMINE the necessary action (aka PA) in order to eliminate the cause of POTENTIAL NC.


Can you provide the exact text of the NC? - the one from the auditor?

I should add that whenever I write a nonconformance for no preventive actions, I always establish with the auditee that they had some that they did not bother to record. They are ALWAYS so prevelant that it is not hard to do.

 

[Richard Pike]

Re: If we do not have Preventive Action, is it a nonconformance?

If you want a straightforward answer to your query, look at this pretty clear explanation.

Yes that indeed is pretty clear.

As is often the case, we may not have all the information surrounding the NC so I wouldn't be to quick to criticize the auditor in question.

Being a little sadistic when it comes to incompetant auditors (and as i said I am not implying this auditor was incompetent) it would be interesting to receive the NC and then present the Auditor with the official interpretation.

Any predictions to what his/her response may have been or could have been?

 

[howste]

Re: If we do not have Preventive Action, is it a nonconformance?

If you want a straightforward answer to your query, look at this pretty clear explanation.

This interpretation is specific to 8.5.3a, not to the whole preventive action clause. If you read it in isolation, it sounds like preventive actions are optional. They're not.

 

[Sorin]

Re: If we do not have Preventive Action, is it a nonconformance?

This interpretation is specific to 8.5.3a, not to the whole preventive action clause. If you read it in isolation, it sounds like preventive actions are optional. They're not.

It sounds like your auditor is correct. If you have not been taking preventive actions, it's a nonconformity.

I wrote a nonconformance for exactly that last week. The company had been registered for a year, and not one preventive action had been written. It is not optional.

Yes, it is required and the auditor is right. You can refer this guidance document from ISO which details the 8.5.3 section on auditing of PA.

I think that we are dealing with a wrong interpretation of the standard.
The way I see it, I (as an audited company) may be written up IF I have no tools in place to foresee potential NCs (analyzing trends, etc.)

However, IF the tools are in place, IF the trends are being discussed and IF there is evidence that the company DETERMINED there is no need for a CA, I would really like to be written up for not having PAs.

So….the PAs ARE optional. What is important is:

1.Tools in place to foresee potential NCs.

2. Analyzing the trends as revealed at no 1.

3. Take action aka PA (IF determined as necessary by the COMPANY).

 

[howste]

Re: If we do not have Preventive Action, is it a nonconformance?

The certification body can't grant registration to the standard until there is evidence of effective implementation of all the requirements of the standard. If there are no records of preventive actions taken, how can they do that?

 

[Sorin]

Re: If we do not have Preventive Action, is it a nonconformance?

The certification body can't grant registration to the standard until there is evidence of effective implementation of all the requirements of the standard. If there are no records of preventive actions taken, how can they do that?

The essence of clause 8.5.3 is not the existence of documented PAs but the steps taken to foresee and analyze the possibility of potential NC and the steps taken (if necessary) to prevent the apparition of those potential NCs.

IMO implied...