ISO 14001 Clause 4.4.2 - When do I need a procedure?

[Al the Elf]

Do I need a procedure ?

I'm looking for some guidance.

I'm rebuilding our Management System from the ashes of a "Certificate on the Wall" ISO900x:1994 approach, and we are now also addressing ISO14001 and OHSAS18001 in an integrated management system. One of the releases to my management team has been the removal (in ISO9K:2K) of the formal requirement to have "a written procedure for...", and with gusto they are comfortably defining auditable "processes".

My problem is this - ISO14001 for example in Clause 4.4.2 says "It shall establish and maintain procedures to make its employees or members at each relevant function and level aware of .....", but in keeping with 9K-2K I have no procedure, but I do have a bunch of processes.

I'm interested then in how auditors are interpreting this (and all other places where 14001 and 18001 still refer to procedures when 9K-2K requires a process) with regard to accreditation.

Simply - if I have an auditable "process", but don't have a "procedure" will I be unsuccessful in registration to 14001 and 18001 ?

Cheers, Al.

 

[Randy]

There are only a few written procedures required by the standard. If the standard doesn't require a wriitten procedure then it is the organizations right to determine its approach. To me in the absence of a written procedure, if everyone knows what to do and when to do it and how to do it, you're covered. Process and procedure are at times synonymous. IMHO

 

[goose]

Following up to what Randy said if "it's not documented you might expect an auditor to interview several participants in the process to determine that the process/procedure is consistently beig followed".

In absence of a documented procedure you may want to have good records of training on the methodology used.

 

[Al Dyer]

The voice of gloom returns.

Although a procedure is not required by a standard does that mean you should not have a procedure?

Procedures need to be written and enforced based upon the dynamics of the organization, including work force knowledge.

Who uses level II procedures?

The Management Representative to cover the companies ass.

Who uses level III instructions and forms?

The entire company from the president down to the lowest level of employee. These are the most impotant aspects of a working management system. Instructions give people to knowledge (on top of training) to perform their jobs in the correct manner.

Take it from the lowest to highest personnel in an organization. Even the President or G.M. needs an instruction as to what needs to be accomplished to cover manufacturing/quality requirements during management review.

And believe me, the worst cases of not following procedure/instruction are from upper management that should know better.

Working people want to do the job the correct way, if management does not give them the tools and training, all is for nought.

To all Quality Proffesionals out there I ask you to respond to the following question:

When was the last time your corrective action said "operator error"?

Sorry, my typing fingers (left fore and right middle) are getting tired. I really would like some response!

 

[Jim Biz]

Saddly (I hate to admit) -- the last time was this morning...
ARRRGH ...

How long do you suppose it will take to get everyone on board ?.... Operators don't make "errors" - they are management controlable issues and can be avoided.

Regards
Jim

 

[Al the Elf]

Thanks for the feedback folks -

The feeling I'm getting is that at Level 2, I can probably appeal to the auditor that I have a clearly defined process (flowchart, training, etc), and they aren't going to hold me to the letter of the (14K, 18K) standards to force me into having a written procedure. Provided, of course, I can demonstrate in the field that people know what they are supposed to be doing, and are then compliant with it. Has anyone experienced auditors who take the hard line view ?

I agree with Al on Level 3 documentation, and it's criticality. We're getting quite comfortable on "Operator error", although it's frequently the easy cop out from really understanding a root cause. With a customer interested in short term cost constraint, it's often the most appropriate answer.

Cheers, Al.

 

[Randy]

I tell you Al the only way I can hold an Auditee to have a written procedure is either:
1) It is required by the standard
2) They have a document that states they will have a written procedure for whatever
3) The absence of one could lead to deviations from policy and the objectives & targets (4.4.6).

I think (me, Randy, a unit of one) if folks do the job they way they say they will and it can be verified, they don't need don't kill trees to just get a warm fuzzy. Flow charts, if accurate, are worth a thousand words, so are level 2 docs. IMO

 

[Marc]

Originally posted by Al Dyer

Who uses level II procedures?

The Management Representative to cover the companies ***.

I have never worked with a company where only the Management Rep used level IIs, nor can I imagine such a company unless it is very, very small.

 

[Marc]

Originally posted by Al the Elf

1. The feeling I'm getting is that at Level 2, I can probably appeal to the auditor that I have a clearly defined process (flowchart, training, etc), and they aren't going to hold me to the letter of the (14K, 18K) standards to force me into having a written procedure.

2. Has anyone experienced auditors who take the hard line view?

1. If the standard specifically requires a documented level 2 you do not have a choice.

2. Every auditor I have 'experienced' has required a documented level II where the standard specifically required one.

Level II procedures are typically needed and useful. In fact, often through a level II you can eliminate the need for one or more level IIIs.

I find this thread problematic as it appears more "...we really don't need this..." knee-jerk than rational. I don't promote excess documentation. Anyone who had read through the threads here over the years knows one of my regular rants is Minimal Documentation. But that does not mean one documents nothing. You have to look at each company and it's processes to determine documentation needs. If your company injection molds toy soldiers for Cracker Jacks boxes, it will need far, far less documentation than if it manufactures semiconductors. If your company is a multi-national corporation there will be a greater need for procedures than if you're in a 10 person 'Mom and Pop' shop.

> I can probably appeal to the auditor that I have a clearly
> defined process (flowchart, training, etc), and they
> aren't going to hold me to the letter of the (14K, 18K)
> standards to force me into having a written procedure.

Do so at your at your own risk. And do not confuse issues. A flow chart is a valid procedure (and obviously it's documented) whilst training is not a documented procedure per se. Thus a flow chart will satisfy a requirement for a documented procedure - training on an undocumented procedure will not. I expect an auditor to "...hold me to the letter of the standard...". I agree with Randy's comments just above.

Again, I want to point out I am not in favour of layers and layers of documentation. To wit (from http://elsmar.com/level2/accolades.html ):

--> You're advice was extremely important. Especially important,
--> at least in my opinion, was your help in determining where we did
--> not need to document every last thing (by using training, etc.). I
--> think that without this input, we would have spent a lot more time
--> writing things that we did not need and wasted a lot of peoples'
--> time. We were able to get the audit done in a year while we are
--> achieving record sales and profits. Who can argue with that?

That said, it is true that where you have undocumented procedures, do expect the auditor to 'sample' the people who are responsible for following (using) that 'undocumented procedure' to ensure all will repeat the same thing (as proof that the undocumented procedure is consistently understood and used).

 

[Al the Elf]

An example ?

Marc & Randy - thanks for your clarification. I was heading into the sunset, happy I would be OK without procedures, and am now reassessing...

Maybe an example could help :

Clause 4.4.3 a) of 14K requires that I "establish and maintain procedures" for internal communication.

Clause 5.5.3 of 9K:2K requires "appropriate communication processes" for internal communication.

For us, currently, effective formal internal communication (on all subjects including Safety and Environmental) is the job role of a person in HR, who decides for themselves how it's done. They have a clear line in their job description requiring them to "effectively communicate" on certain subject matter, but this doesn't feel like something I could present to an auditor as a 'procedure'. The performance of the HR guy is even assessed as a part of an appraisal process, by his boss (who is a member of the Top Management team).

Putting in place a procedure for the HR guy, just so they can show it to an auditor on the 14K front seems barking !

I'm curious how this would now be treated, by an auditor doing an integrated audit.

Marc - I too am in favour of minimising documentation, although I prefer the phrase "appropriate documentation", to force the decision about what is needed back onto the people actually managing any process. In that sense I'm in favour of deciding what processes are necessary to deliver customer requirements, then implementing these, rather than having a procedure 'cos the standard says I must have one. The latter route, IMO just begs for non-compliance.

Cheers, Al.