ISO 9001 - Reseller Exclusions

qualitygal

Registered
Hi there. My company is a reseller of COTS Information Technology equipment and software. We take orders from enterprise and government, then purchase and resell from OEMs and authorized distributors. All product is drop shipped from OEM/distributor to customer. I have a few questions:
1) Can we exclude clauses 7.1.5, 8.3, 8.5.1?
2) Does anyone have a sample quality manual for this type of company (I'm struggling with 8.5.1)

Thanks so much!
 

John C. Abnet

Teacher, sensei, kennari
Leader
Super Moderator
Hi there. My company is a reseller of COTS Information Technology equipment and software. We take orders from enterprise and government, then purchase and resell from OEMs and authorized distributors. All product is drop shipped from OEM/distributor to customer. I have a few questions:
1) Can we exclude clauses 7.1.5, 8.3, 8.5.1?
2) Does anyone have a sample quality manual for this type of company (I'm struggling with 8.5.1)

Thanks so much!


Good day @qualitygal ;
1- ISO 9001 allows for "exclusions" (the term is now applicability) to any part of the standard, which...
A.5 Applicability
This International Standard does not refer to “exclusions” in relation to the applicability of its
requirements to the organization’s quality management system. However, an organization can review
the applicability of requirements due to the size or complexity of the organization, the management
model it adopts, the range of the organization’s activities and the nature of the risks and opportunities
it encounters.
The requirements for applicability are addressed in 4.3, which defines conditions under which an
organization can decide that a requirement cannot be applied to any of the processes within the scope
of its quality management system. The organization can only decide that a requirement is not applicable

if its decision will not result in failure to achieve conformity of products and services.

2- I would caution about being biased (potentially) by "someone else's...". Keep in mind, there is no need/requirement by ISO 9001 for a "quality manual". In fact, ISO 9002:2015 (current) version, does not even require "procedures" as did previous versions.

Summary:
Do what is best for YOUR organization. ISO 9001 prescribes very little in regards to HOW the standard is met. Take a look at what your organization already does, and then reverse engineer that towards what the standard requires. Most established/sustaining organizations "meet" most of the ISO 9001requirements. The goal is to simply identify any gaps and correct them, and "capture"/articulate how your organization meets the applicable aspects of the standard. While it is not possible for me/"us" to know exactly which aspects of the standard may not be appicable to the scope of your organization, it does seem (based on what you describe), that 7.1.5 and 8.3 may not apply. However, 8.5.1 encompasses operational control. I can not see how all aspects of clause 8.5 would not apply. This section requires your organization to consider how it controls what it DOES do...(regardless of what that is).

Hope this helps.

Be well.
 

Tagin

Trusted Information Resource
Hi there. My company is a reseller of COTS Information Technology equipment and software. We take orders from enterprise and government, then purchase and resell from OEMs and authorized distributors. All product is drop shipped from OEM/distributor to customer. I have a few questions:
1) Can we exclude clauses 7.1.5, 8.3, 8.5.1?

7.1.5 and 8.3 - almost certainly you can exclude them.

8.5.1 - I would say definitively NOT. You have to do almost all of a-e in order to successfully operate your business.

For 8.5.1, you have a process to provide a product to your customer. It's just that most of the physical aspects of that process are outsourced to your supplier. So, your 'controlled conditions' fall mainly into two categories:
  • Informational (e.g., infrastructure, procedures, training, controls, and monitoring are involved in taking orders, transmitting to suppliers, monitoring supplier shipping updates and tracking numbers, info, etc.)
  • Control of outsourced services (your suppliers)
If you approach 8.5.1a-e step by step, and consider these two categories, I think you will find it pretty straightforward.
 

qualitygal

Registered
Hi There - I have another question, this time related to clause 8.6 "release of products". As mentioned earlier, we don't touch product. Instead, we purchase product from suppliers and they drop ship to our customers. I'm wondering how we can comply with the record requirement "retain documented info on release of products, including a. evidence of conformity with acceptance criteria and b) traceability to person authorizing the release." Would an invoice along with tracking number from the supplier work? As far as "conformity with acceptance criteria" - we are selling COTS only, warrantee is in sealed box that is drop shipped to customer. Not sure what we should "retain" at our site as evidence of conformity. Your feedback is so greatly appreciated!
 

Tagin

Trusted Information Resource
In your case, the release occurs when your organization issues the signal to your supplier to dropship the product.

So, who in your company is allowed to issue such signals? Maybe the 'signal' is a PO? If so, who can issue a PO? What approval steps do they need, or is it written into their job role that they are authorized?

How do you know when such a signal has been sent? Maybe the PO changes to another stage in your system?

How do you know who issued that signal? Maybe your ERP system records who changed the PO status, or maybe you keep copies of all PO's sent as records as an audit trail?
 

qualitygal

Registered
In your case, the release occurs when your organization issues the signal to your supplier to dropship the product.

So, who in your company is allowed to issue such signals? Maybe the 'signal' is a PO? If so, who can issue a PO? What approval steps do they need, or is it written into their job role that they are authorized?

How do you know when such a signal has been sent? Maybe the PO changes to another stage in your system?

How do you know who issued that signal? Maybe your ERP system records who changed the PO status, or maybe you keep copies of all PO's sent as records as an audit trail?
Thank you! Very helpful. So, just to confirm, we don't need to keep record of release of shipment from supplier (as part of supplier control)?
 

Tagin

Trusted Information Resource
Thank you! Very helpful. So, just to confirm, we don't need to keep record of release of shipment from supplier (as part of supplier control)?

That is up to your organization and its processes. Presumably, you receive back some kind of response from the supplier that they 1) received your signal and 2) confirm that they are actually going to ship it. What you do with those responses (attach them to the PO, save them in a folder, just read them and delete them, etc.) is up to what your org has defined.

What the supplier does internally for their release controls is a separate matter. If you wanted to make sure their process was good, that would fall under supplier approval/monitoring.
 

qualitygal

Registered
That is up to your organization and its processes. Presumably, you receive back some kind of response from the supplier that they 1) received your signal and 2) confirm that they are actually going to ship it. What you do with those responses (attach them to the PO, save them in a folder, just read them and delete them, etc.) is up to what your org has defined.

What the supplier does internally for their release controls is a separate matter. If you wanted to make sure their process was good, that would fall under supplier approval/monitoring.
Got it! Thanks very much for your assistance!
 
Top Bottom