Is possession of the ISO 9001 Standard Required?

[Jim Wynne]

If you were to write a nonconformity against not having a copy of the standard, what requirement(s) would it reference?

ISO 9001:2008 4.2.3.f)

Sorry but that won't work. Here's the bit you cite:

A documented procedure shall be established to define the controls needed
f) to ensure that documents of external origin determined by the organization to be necessary for the planning and operation of the quality management system are identified and their distribution controlled...

What about the "...determined by the organization..." part of it? It doesn't say "...determined by the auditor..."

 

[Boingo-boingo]

What about the "...determined by the organization..." part of it? It doesn't say "...determined by the auditor..."

As in the numerous times where the standard refers to as applicable, as appropriate, etc., the expectation is that the organization will make a reasonable, sensible, determination.

If the only rationale for an organization not to have a copy of a QMS standard they want to comply with (and attain certification to) is because someone in a key position to think they don't need to have a copy of the standard because they have it memorized, or "know it all", it is a bad rationale, in my estimation.

And (third-party) auditors have to assess the adequacy of those determinations, for certification purposes.

 

[Jim Wynne]

Third-party auditors have to audit against the explicit requirements and not make up their own. The rationale for not having a copy is irrelevant. The clause you cite assumes that the organization has determined the relevant documents of external origin that must be controlled; not the documents of external origin that must be present. You can't be expected to control something that doesn't exist.

 

[Boingo-boingo]

The rationale for not having a copy is irrelevant.

I disagree, emphatically. If a third-party auditor will not assess the adequacy of the organization's determinations, then audits and certifications will be (even more) meaningless.

Example: An organization determines that they will perform internal audits every 10 years and management reviews every 20 years, they would not be violating any explicit ISO 9001 requirement, but, and obviously, clearly circumventing the intent and effectiveness of those two processes. If you don't think that a third party auditor should assess the adequacy of the decisions of registrants, for certification purposes, we will have to disagree on this.

 

[Jim Wynne]

The proof is in the pudding, not in the mind of a CB auditor. Whether an auditor can provide actual evidence of the inadeqacy of something is different from an arbitrary decision that something is inadequate without provision of supporting evidence. No evidence, no NC.

Again, the cited requirement assumes that a determination has been made and only addresses the control of documents that have already been determined to be needed. It does not address the requirement to have documents other than the documented procedure itself.

 

[Crusader]

Sheesh. Thanks to all for the input and discussion.
To assume one is cutting corners to shortcut implementation... is not fair.
I do not see any value-added benefit in purchasing the document especially when from past experience I know what I must do to achieve the goal of registration...and, and, and there will be a new revision replacing it (eventually). I'll wait and buy the new rev when it is released.

I left a company (16 years running ISO 9001). I had the hardcopy standard there. I'm in a new company and I am implementing ISO 9001.
New company does not have the standard. I know what the standard says. I know what I must do. I have 16 years of being audited by a CB under my belt.

Since the standard is not required to have as part of the registration process, then I choose not to buy it. Simple as that.

Thanks for the clarification. I tried searching but found nothing. Obviously, I did not use the correct criteria.

 

[Crusader]

omg. I sound arrogant in the post above. my bad.

It's just that I cannot see buying a document that is not required if I do not need it. I just wanted to make sure there wasn't some hidden requirement somewhere - to have that document.

You know what I'm saying?

 

[insect warfare]

I know what you're saying.

On a related note, you could also use a ISO 9001:2008 gap analysis template to assess against ISO requirements (if push came to shove), as those documents tend to contain most of the verbiage of the standard anyway.

Brian

 

[Crusader]

Yeah, kinda using it but not officially. I'm going straight to writing, implementing, and now auditing. As I do that, I am training all at the same time. I'm only 1 person doing all the implementation and I have a readiness audit next month.

Now where is that sweating raindrops smiley when ya need one?

 

[insect warfare]

Wow, that's a huge undertaking....I hope your upper management is actively committed enough to the cause enough to lend you a hand or two. Good luck to you and let us know how it turns out.

Brian