Interesting audit request - Full reaudit when separating R&D from division

[Adam Scrase]

Hello,
Hopefully the right forum:

Right set the scene, we're a 9001:2000 certified software company with offices in the Europe, Americas, and Asia-Pacific. We've decided to split our development house into product lines (or business units) the net result being we're going to move the R&D of one of our product lines to another office.

My certification body has insisted that they need a thorough audit before they can change the scope of certifiation on our certificate, ie, add development in for the other office. Is the a reasonable request? To me it's little more than an address change and it is going to be hugely expensive flying an auditor out for a day or less in auditing time.

A bit more detail, hopefully to answer some of your initial questions: The move is to an existing office, ie, already within the scope of the certification. Existing IT infrastructure. It's software so there's no awkward export, copyright, supplier or manufacting type problems we don't already address. The new operation will continue to use the existing (audited) processes, we will initially transfer exisiting some staff to the other office. The numner of staff will be around 5 (five). Apart from a new address very little will have changed. What is the value of this audit?

Thanks in advance

 

[Randy]

To me it sounds like something that can be looked at during a scheduled visit. Basically the biggest changes appear to be people shuffling and re-alignment of resources, otherwise known as "improvement". This is an issue that should be workable with very little heartburn.

 

[Adam Scrase]

Randy, Jim,
Thanks for the replies.

Yes I agree with your points, its more important to me that any development is process driven, and scope change or certification is secondary. My initial response was to suggest it wait until the next scheduled visit, around 18 months.

However certbod stated that while my scope states "The Quality Management System is applicable to ... development of software applications ..." we need to make the distinction between those applications produced by a certified system and those that aren't. I can't get my head round whether he's linking certification to a product (or product line) or not. Either way I feel that they are being very officious and awkward. That seems the way of most UK based certbods at the moment.

Adam

 

[JodiB]

Adam,

Yes, certification is tied to a product line. You are talking about the design, etc. of a specific thing. Very important that the certification not be misleading to a cient that a company is certified for everything when it is only one or two production lines / products that have been verifed.

 

[M Greenaway]

Lucinda

Would it perhaps be more 'correct' to say that the certification is tied to business processes ? ISO9001 approval is not approval of a product, hence the reason why you can not (should not) put your ISO9001 logo's on your products, packaging or product literature.

With regard to the question it does seem wrong to require a full audit just for relocation of an office, if as you say the process is already covered in your existing ISO9001 certificate.

Splitting ISO9001 certification by business units is, in my opinion, against the intent of ISO9001 where processes that affect quality cannot be scoped out of your certification. In the old days of ISO9001, 9002 and 9003 a company could go for ISO9002 certification even though it conducted design, and would 'scope out' the design process from its certificate. ISO9001:2000 was supposed to disallow this, however if you can gain seperate certificates for seperate business units in an organisation then this sort of scoping out could be done.

 

[David Mullins]

Provided all sites are covered by the same certificate, there shouldn't be a problem. What does the accreditation body require with regard to policy/procedure on this - they can arbitrate the matter for you (that's one of the things they get paid for).

I wonder if it's the world's biggest auditor - BSI?

 

[JodiB]

Martin,

You're of course correct that certification is of process not product. But not all processes are shared (or audited ) by all product lines. This is why scopes must be specific and relate to the design, manufacture of XX widget. A company can (and they do) operate QMS over one product line and not others. When they choose to bring another product line or manufacturing activity ( like a paint line ) into the scope of certification, the handling of those products within the QMS must be audited.

Back to this real life case.....If the design is being transferred from one location to another (and David brings up a good point regarding whether the other location has previously been covered by the certification) then the processes supporting design in that location need to be audited.

If I were the registrar's account mgr. for you, I would just leave your certificate alone until we audited the change of activity at the new location - and would perform that audit on the next regular scheduled surveillance visit. That is assuming that the next visit would occur within 6 months. I'm afraid that if it were longer than that then a special visit would have to take place. But being the smartie that I am, I would then just tack on some of the regular surveillance activities onto it and reduce the next visit by that time. In the meantime, I might ask for a letter describing your plan for the transfer of activities and place this in the technical file. Have to CYA for the accreditation bodies. It would also be good info to send to the assessor so that s/he is kept in the loop.