Is a Records List Required for ISO9001?

[Crusader]

Good advice. But in the future, you should use the debriefing and exit meetings as your opportunity to clarify these issues, BEFORE the auditor leaves your premises. It is much better to discuss this with the auditor while s/he is at the site, rather than correspond later via email, or appeal for a NC to be voided.

Typically, I dispute the finding right at that moment during the audit! The auditor does not always understand what was presented because the auditees present the facts unclearly to the auditor. But if it gets in the report, then I do what I stated in the previous post.

 

[Momazona]

Thanks for all the speedy replies!

It is my first audit, and like I said, I didn't really get the idea that I could dispute the findings until I started reading the posts here at the Cove. (I'm still not sure I'll get it past "Top Management" who may not want to rock the boat.) But I am of the opinion that it has to work for us, not an auditor. Besides, I'll end up being the one who has to keep up with a master list of records!

And I'll never count on an auditor answering my emails again, I've yet to get a reply from him!

Ah well, I've learned a bunch!


Rene'

 

[Crusader]

Having a master list of records is really not all that bad. I have one. I had a choice to eliminate it when we transferred from QS-9000 to ISO 9001:2000. I access it on occasion or when it needs updating. But when I have needed to refer to it, it has been helpful.

 

[RSantos]

First: your signature meant only that you received the NRs from the auditor - not that you agree with them.
In the future, after the auditor has stated his findings in the closing meeting, thank him for performing his audit in a professional manner, and say something like the NRs have brought several things to light that we need to consider. Though we do not agree at this time that all the NRs are correct, we will review our procedures and the standards carefully and provide a written response for each nonconformance written.... After he goes away, sit down and put on your "auditor hat" to look at each thing he wrote and determine if it is correct - if it is, fix it promptly and send him the objective evidence. If he was wrong, document why it was wrong. If he mistook what he was seeing, state that this in not a nonconformity because... and quote chapter and verse. You may need to include a statement about your failure to show the auditor your procedure that covers the requirments. But be politic in your response -- you may get the same guy next year. I have submitted such responses to several certification auditors under ISO 9001, ISO 13485, and ISO 17025 and never had a problem.

 

[RSantos]

About records: you'll need a matrix showing the minimum training requirements for employees/job description. The matrix is a controlled document and that may have been what your auditor was looking for. You also need records showing that the training has been performed. And evidence that you review the matrix on a periodic basis to verify it remains complete and applicable. And evidence that the training for each employee is reviewed on a periodic basis (annual performance review?), and especially when there is a change in job function.
You must have a controlled list of all quality system (SOPs) and product-related procedures/drawings etc. that shows the current revision and where controlled copies have been sent. The list of product-related documents is called the Valid Documents List (VDL) and should be posted where all can verify the document they have in their hand is the correct version.
Even better, but not always appropriate is an online VDL, and make only make current documents available on-line.
Don't be afraid of controlling documents and records. My rule on controlled documents/records: If you might have to show this document to someone in the future, slap a document number & revision indicator on it and file it. The VDL & filing cabinet has saved me more than once!
We assign project-specific numbers followed by a sequential number, database the doc title and number, and print a VDL to keep by the file cabinet so things can be found quickly. (Our quality-system project number is 00000) Setting up such a system takes an investment in time, but inproves efficiency ($$$) in the long run.
If you have the money, buy commercially available document control software. (We wrote our own, but unless you have super software folks that understand quality systems, don't try)

 

[Ajit Basrur]

Typically, I dispute the finding right at that moment during the audit! The auditor does not always understand what was presented because the auditees present the facts unclearly to the auditor. But if it gets in the report, then I do what I stated in the previous post.

Just on a lighter note ......

We had a Customer audit last week. This audit team consisted of 2 teams who were auditing their checklist requirements.

One auditor during the closing meeting gave us a NC which was totally baseless. It so happened that the similar point in a slightly different manner was reviewed by another set of auditors.

We were providinf clarifications that its not a NC but this guy was not at all agreeing. Even we had a show where the auditors were internally arguing among themselves.

Finally we gave up and said its ok we take it as a NC as we didnot want to have bitter experiences.

 

[CarolX]

About records: you'll need a matrix showing the minimum training requirements for employees/job description.

You must have a controlled list of all quality system (SOPs) and product-related procedures/drawings etc. )

Sorry RSantos - but where is the shall for this.

Training matrices and lists of controlled documents are not a requirement of the standard.

 

[Jim Wynne]

Don't be afraid of controlling documents and records. My rule on controlled documents/records: If you might have to show this document to someone in the future, slap a document number & revision indicator on it and file it. The VDL & filing cabinet has saved me more than once!

Controlling documents that don't need to be controlled is wasteful. The test you propose--"If you might have to show this document to someone"--could potentially apply to every piece of paper in the building, because if you don't think anyone will ever have to see it, there's no point in even keeping it, let alone controlling it. Formal control procedures should be reserved for documents that can be expected to change (in order to maintain history, and insure that only the most recent versions are used).

Filing systems for records should be designed such that retrieval is simple, in the event that someone does need to see them. No list is required.

 

[RSantos]

Sorry RSantos - but where is the shall for this.

Training matrices and lists of controlled documents are not a requirement of the standard.

List of controlled documents: Not a “direct” Shall. But objective evidence is needed to show compliance with the organization’s procedure that was written to comply with ¶ 4.2.3 (Control of documents)

Also most, not all, companies use documents (drawings, work instructions, etc.) in production and service. If such documents are used, then they will need to be current.

I don’t know of a way to demonstrate compliance without a list of what has been controlled.


Training matrices: True, there is not a “direct” Shall. But objective evidence is needed to show that:
The organization has determined the necessary competence for personnel performing work affecting product quality and has provided training or taken other actions to provide these needs. ¶ 6.2.2 a, b

When the organization has established a matrix of what each job function/description needs for training, then it’s up to the auditor to prove the matrix is incorrect.

Example: Machinists - Most auditors expect each employee who handles product to know how to initiate product Nonconformance Reports. But, if Inspection Personnel initiate all NRs and handle the routing, approval, correction, and verification processes, the machinist won’t need training on those processes.

 

[Jim Wynne]

List of controlled documents: Not a “direct” Shall. But objective evidence is needed to show compliance with the organization’s procedure that was written to comply with ¶ 4.2.3 (Control of documents)

Also most, not all, companies use documents (drawings, work instructions, etc.) in production and service. If such documents are used, then they will need to be current.

I don’t know of a way to demonstrate compliance without a list of what has been controlled.

Note that the subject was records and not controlled documents, per se. There may be times when a list of controlled documents might be useful, but it's not a requirement, and there isn't a good reason that I can think of to control records (the forms used for completing records perhaps, but not the records themselves).

Training matrices: True, there is not a “direct” Shall. But objective evidence is needed to show that:
The organization has determined the necessary competence for personnel performing work affecting product quality and has provided training or taken other actions to provide these needs. ¶ 6.2.2 a, b

Again, a matrix might be helpful, but it's not required, and even if a matrix is used, there's probably no need for control.

Example: Machinists - Most auditors expect each employee who handles product to know how to initiate product Nonconformance Reports. But, if Inspection Personnel initiate all NRs and handle the routing, approval, correction, and verification processes, the machinist won’t need training on those processes.

This sort of thing can be included in job descriptions, without having to keep and maintain a matrix.