Is hiring a CB for certification and periodic audits an outsourced activity?

[Jim Wynne]

There are some processes which an organization can not carry out on it's own (or not allowed to do) and therefore these processes have to be outsourced. One such activity/ process is Certification Audit which fits into the definition of 'Outsourcing' as stated in 9001.



Are there organizations which treat 'hiring the CB for certification and periodic audits' as an outsourced process?

Your opinion please.

Thanks.

No! It has nothing to do with your processing of product to meet customer requirements, like machining, painting, plating, welding or something similar.

Correct. Just like getting your medical device product approved by the FDA is not an outsourced process.

We might be going off in different directions here, because it's not clear what Samsung meant by "periodic audits." I don't think there's any sensible way to consider registrar activities as outsourced processes because there's no way for "the organization" to carry out the activity on its own. Companies may decide to outsource product-related processes such as the ones cited by Andy, and they might do it because they either lack the capability to do it in-house (and don't want to initiate such processes) or because of overflow (they have in-house capability but there are volume issues).

The standard requires control of those things when they're outsourced. It's too much of a stretch (imo) to add things where (a) the relationship to the product is at best indirect, and (b) there's no option to keep the process in-house.

 

[Randy]

Ok, but how is that anything to do with outsourced process, as applicable to the implementation of an ISO 9001 based system?

Krap if I know, but it sounded good at the time

 

[Jim Wynne]

No! It has nothing to do with your processing of product to meet customer requirements, like machining, painting, plating, welding or something similar.

In addition to my earlier comments, it should be pointed out that 4.1 (ISO 9001-2008) says,
"Where an organization chooses to outsource any process..." and in Note 2 it says that an outsourced process is one which "...the organization chooses to have performed by an external party." (My emphasis in both quotes.)

Registrars' services are not processes that an organization chooses to be performed by an external party. They must be performed by an external party.

Now--if the external party is performing the organization's internal audits, such outsourcing is a choice, and in that regard falls under the requirements of 4.1. I say "in that regard," because whether or not internal auditing qualifies as being directly product-related is a matter that reasonable people might disagree about. I say not.

 

[Big Jim]

In addition to my earlier comments, it should be pointed out that 4.1 (ISO 9001-2008) says,
"Where an organization chooses to outsource any process..." and in Note 2 it says that an outsourced process is one which "...the organization chooses to have performed by an external party." (My emphasis in both quotes.)

Registrars' services are not processes that an organization chooses to be performed by an external party. They must be performed by an external party.

Now--if the external party is performing the organization's internal audits, such outsourcing is a choice, and in that regard falls under the requirements of 4.1. I say "in that regard," because whether or not internal auditing qualifies as being directly product-related is a matter that reasonable people might disagree about. I say not.

It may not be germane to the subject, but organizations DO choose their certification body. They also DO choose to be certified.

 

[samsung]

We might be going off in different directions here, because it's not clear what Samsung meant by "periodic audits."

By periodic audits, I mean 'Surveillance' audits.

 

[samsung]

Correct. Just like getting your medical device product approved by the FDA is not an outsourced process.

I suppose FDA is a regulatory agency and the nature of this activity, i.e; inspection is different from certification services or surveillance audits. Here the requirement of inspection is imposed on the organization and it has no option but to get the products inspected by the FDA whereas in case of certification, it can be a voluntary decision also.

What confuses me is the definition "An “outsourced process” is a process that the organization needs for its quality management system" (emphasis mine) and also the statement "Where an organization chooses to outsource any process that affects product conformity to requirements, the organization shall ensure control over such processes."

This is the purpose of asking this question since certification directly relates to or affects the QMS in some way.

Thanks for all the valuable responses so far given by the experts. I hope to have more comments on this topic.

 

[AndyN]

What confuses me is the definition "An “outsourced process” is a process that the organization needs for its quality management system" (emphasis mine) and also the statement "Where an organization chooses to outsource any process that affects product conformity to requirements, the organization shall ensure control over such processes."

Certification of the system is an option - it's not needed, per se. Don't forget that certification isn't actually anything to do with ISO 9001. The original intent of the use of the standard was between a customer and a supplier, as the basis of agreement on (product) quality. Certainly, there's been recognition of the CB role - 'interested parties', but the actual certification isn't mentioned and, as we know, has little impact on product conformity.

 

[somashekar]

This is the purpose of asking this question since certification directly relates to or affects the QMS in some way.

The certification relates to the QMS directly as it tags the details of the organization as well as the scope in the certificate.

The certification should in no way affect the QMS.
QMS is implemented and maintained (certainly continualy improved) with the quality policy as the guidance and the scope and other details as stated in the quality manual. The certification just tags it to an internationally accepted standard and this tag is processed and delivered through various registrars who in turn have accredition to bodies that monitor certification process aligned to the international standards.
So one certainly does not need a certification to the QMS. So a certificate or no certificate should not effect product confirmity to requirement. Hence it is not an outsourced process and certainly there is no need of control to be exercised.
Want a tag to the QMS ? evaluate and select a registrar who can provide.
Don't want a tag ? be happy to implement and maintain the QMS

 

[Jim Wynne]

It may not be germane to the subject, but organizations DO choose their certification body. They also DO choose to be certified.

How many registrations would there be if registration were truly an act of independent volition? For many registered companies, the choice was get registered or go out of business.

 

[Big Jim]

How many registrations would there be if registration were truly an act of independent volition? For many registered company, the choice was get registered or go out of business.

True enough, but it is still a choice.