ISO 9001:2008 4.2.3(f) - Controlling Documents of External Origin

[cgaro]

All:

My company recently had an external customer audit done, I received the audit findings report yesterday and was surprised to find that we received a nonconformance for "not having a process control and maintenance of External Standards used in the QMS to assure acceptable quality. IPC, ISO, ANSI etc."

The portion of ISO 9001:2008 that this finding is against is 4.2.3(f), "to ensure that documents of external origin determined by the organization to be necessary for the planning and operation of the quality management system are identified and their distribution controlled".

My understanding of this requirement is if we claim compliance to a given standard then we should have a copy of the latest specification on hand which we do. While we do use the IPC workmanships standards for the inspection of cable/wire/harness and soldered assemblies I don't see that we use them to plan or operate our QMS, we use ISO 9001:2008 for that. Which we do have the current revision of.

So - my question is - Am I misunderstanding the requirement of ISO 9001:2008, section 4.2.3(f)? All comments and replies are most welcome!!

~Cgaro

 

[John Broomfield]

Cgaro,

All sorts of documents of external origin have an impact on your QMS especially when they change.

You would therefore expect to see these documents identified somewhere in your QMS and for these external documents to be monitored for changes.

You would expect to see evidence of changes being made to your QMS in response to those changes as they are relevant to your fulfillment of requirements.

This does not necessarily mean that you must maintain a hardcopy library of such documents. But you would expect to see specific people responsible for monitoring the relevant sources or websites and ensuring the relevant people are made aware and that the QMS responds to such changes.

In your case that would probably include IPC Workmanship Standards especially if your customer's contracts referred to such standards.

John

 

[planB]

"Operation of the quality system" includes having control over the quality of your products, components and your manufacturing processes. When you refer to standards to ensure the quality of your products /manufacturing processes, you have to make sure to control your standard documents in a similar way you would control documents of internal origin, i.e. make sure everybody who needs the standard for fulfilling the activity has controlled access to the standard in the revision defined by you, which implies controlled removal of obsoleted standards and standard revisions. This should be part of your doc-control procedure.

Most of the time, this will be the latest standard revision you may refer to, but not necessarily, e.g. you might want to use the prior revision of the standard during a transition period when the standard revision is not (yet) harmonised (EU) or a recognized consensus standard (US) or even refer to obsoleted standards with a documented rationale.

HTH,

Gerhard

 

[Big Jim]

I also don't see how you could exclude the IPC manuals. They are absolutely critical to producing good parts. It clearly fits into the "operation and control" of your QMS, particularly the "control" part.

Control of external documents is really very easy though. Just list them and show where they are kept.

 

[cgaro]

I see where you're all coming from - thanks so much your input has been very helpful. Suffice to say, we do state in our Inspection Processes Procedure the applicable workmanship standards that we are IAW, I guess what I didn't quite understand was having to control or monitor the revision changes of these standards.

**Updating the Doc Control Procedure accordingly Thanks again!

 

[normzone]

This may just be a case of semantics, but generally it does not speak well to the audit process that " had an external customer audit done, I received the audit findings report yesterday and was surprised to find that we received a nonconformance ".

Audit findings should be clearly communicated as they develop and before the auditor flees the premises. ;-)

 

[Big Jim]

Sure, in an ideal world, that is how it would work. My experience has been that the customer audits are the least organized. Who are you going to complain to? Your customer?

I would be MUCH more concerned if a CB audtor had done this.

 

[Freddyfred]

The best to do is to contact the auditor and have her/him define their criteria. Without solid communication of the finding its hard to determine what the auditors definition is.

 

[kgott]

I agree with john R Broomfield.

Its about having a process that works that identifies, controls and distributes docs from outside the business that impact on product quality and all those things in the get-the-work-do-the-work-get-paid chain and the processes that support them.

 

[Marc]

That includes customer documents, applicable standards and many more (depending upon the company and the specifics of the contract, print call-outs, etc.). Key Words: "Documents of External Origin". Often times a contract will call out something like an old Mil-Spec. You have to have a copy of it and it must be controlled.