Management Review "planned interval" define please

[Marc]

I worked with a small company a while back. It had been registered for a few years. An auditor came for a surveillance audit and freaked out because their "schedule" for management review was once a year and it was just marked on a wall calendar. She couldn't write it up because they had several years of management review records proving they did management review yearly, but she *really* didn't like the wall calendar idea. Thing is, for that company (something like 12 employees) it worked well for them - Simplicity.

This is not a recommendation, just something to think about.

 

[normzone]

Yeah, the new team I'm coaching for is very small, and policy of taking the simplest possible approach that achieves the desired effect often ends up producing events like the instance you describe.

My external auditor gets all soggy and hard to light about it but I think if it meets the requirements of the standard and works for the organization then you have a defensible place to stand and argue from with the external auditor.

In my case I'd schedule the "once a year" meeting via email calendar, but it's the same challenge with auditors who expect to see a controlled document detailing the date and time of each internal audit and the Management Review meeting.

 

[Marc]

The bottom line is records for something like this to work. In this case it meets the "planned interval" requirement because it is "planned" on a simple wall calendar. The yearly records of each meeting prove it is done and meets their procedure cling for a yearly meeting.

They do it because it's required. The company is small enough that communication is easy. They all know each other. Everyone knows what's happening and all that stuff. It's a family place.

Originally the request by a customer was TS 16949 certification (well, back then it was QS-9000 I think - it was around 1997 or 1998 that I did their ISO 9001 implementation). I got them to talk to the customer and agree on ISO 9001 since they weren't tier 1 and the customer agreed.

 

[RoxaneB]

I'm a firm believer in conducting strategic management reviews at "planned" intervals, as opposed to "periodic" intervals - there's a reason why it says "planned" in standards. "Periodic" to me smacks of "let's set it and forget it". But if you can define (and preferably document) a sound methodology for holding management reviews closer together when there are more actions and decisions to follow up on, and holding that pattern until you start to see a relaxed state, then (in my book) you've reached the promised land. And it would be prudent to establish min/max frequency thresholds anyway, if only as a safeguard, to 1) avoid excessive gaps between reviews and 2) manage the natural accumulation of changing business circumstances.

"Periodic", to me (and based on previous experience), means 'Hey, we'll do it if we remember to do it...and when we have spare time.' "Planned" is defined intervals/frequency and with expected discussion points to be addressed.

I think handling management reviews this way can demonstrate effective use of the risk-based assessment model, which I suspect lots of ISO 9001:2015 users will gradually realize as they traverse into the realm of (visible) risk management.

Not only can these reviews support a risk-based approach, I find that they're also a good way to summarize the "state of the business." Let's face it...every team has meetings. There are meetings that support meetings that support meetings. The output from one meeting can become the input to another meeting, as the information meanders (and hopefully climbs) the communication chain of an organization.

By the time things hit senior management, the review should consist of confirming the state (and resolution) of smaller stuff with the bigger, strategic items left for the top dogs to address.

For example, does senior management honestly want to hear all the details regarding a department's 3 internal audit findings on out-of-date documentation? Probably not. They simply want to know that things have been adequately resolved and closed.

What senior management may be more interested in is that various departments demonstrated an inability to control hard copies of procedures and due to business/orgranizational growth, it may be time to consider an electronic document control system.

It's the whole concept of looking at individual trees versus the entire forest.