Minor non-conformance for not controlling local regulation laws?

[qualprod]

Hello everyone.
An external auditor auditing compliance with 9001 2015, raised me a minor nc for not referencing anywhere into my qms other standards apart from Iso 9001.
The point is, in my policy I state " complying with legal and statutory reglamentation " just to say that if I'm requested to comply some requirements of my client, I Will do it, currently I produce paper bags, and nobody askd me to comply with some additional regulations.
Into my qms, I only have the iso 9001 as an external document, my business is clean and secure.
So you think does this nc apply?
She says that even if a manage only products, I must have other local standard controlled as external documents, such as those for environment and accounting.

Thanks for your inputs

 

[Marc]

Document control has always required control of "documents of external origin" such as the ones you cite.

When you have "legal, statutory and/or regulatory" requirements, you have to have a copy of them and they must be controlled and monitored.

In some cases you may not have to have a physical copy (such as if the regulation or other requirement is available to the public on the internet) but you must still have a "control" so that you know if and when a regulatory or other document is changed.

It is not sufficient to state that as a "policy" that your company (for example) "complies with all legal, statutory and regulatory documents". Somewhere in your business system (not necessarily your "quality" system) you must specifically define what they are. If you think about it, this makes sense. Someone, in what may be one department, or in various departments, must keep abreast of such requirements.

 

[John Broomfield]

qualprod,

Your trade association is probably engaged with any upcoming legislation or regulations that will affect its members.

Here is an example:

Paper Bags

So, include your trade association as an interested party and make sure your organization working as a system responds.

It may respond when strategic planning, marketing, selling, designing your services or products and when reviewing quotes, proposals and contracts.

That response may be in the form of risk assessment, system development, tweaking a process or updating a procedure.

But only mentioning it in your policy is inviting the auditor to ask “what happens if the law changes to require a minimum recycled content?”. Other questions may also reveal weaknesses in your quality management system.

John

 

[qualprod]

Thanks Marc

But the efforts to comply with legal requirements shouldnt be more focused to products and services, According to 9001?
Thanks

 

[Marc]

ISO 9001 requires document control, which includes (and always has) documents of external origin.

What you are failing to appreciate is ISO 9001 is not limited to products and/or services alone. It addresses the company's business systems as a whole. For example, document control is not necessarily a quality function. In the 1980's, for example, places I worked in DoD companies the document control departments were not typically part of the quality department/system other than that in many cases some or all product and service related documents were controlled by the document control department.

And it gets more complex in that some companies have centralized document control as a defined department which most, if not all, departments have to use. In other companies control of documents is a departmental function (there is no centralized document control functional group). A company can set up their document control system(s) any way they want, but the "essence" of document control requirements (e.g.: a review and approval aspect) has to exist.

Documents which are applicable to legal aspects/requirements of the company are not exempt from document control even if they are controlled by the company's legal department (assuming one exists in the company), just as in many companies customer prints are controlled by the engineering department.

If it is a document, it has to be controlled, even if it is a policy on keeping the bathrooms clean. If the company has a website, its content has to be controlled with a revision history just like all other "documents".

I welcome feedback by others on what I am posting. There are probably others here who can better explain.

 

[John Broomfield]

And, ultimately, everything the company should be doing is for Quality.

...if not for its products then for its services to its existing and future customers and other stakeholders.

 

[qualprod]

Marc,

Retaking this point (see below), regarding regulations to comply with.
regarding your comment, is ok, if we have to comply with them, we need to have somewhere as you said, controlled documents "not necessarily your "quality" system"

If regulations/laws will be controlled out of a QMS, why could this be a NC into a QMS?

Thanks

It is not sufficient to state that as a "policy" that your company (for example) "complies with all legal, statutory and regulatory documents". Somewhere in your business system (not necessarily your "quality" system) you must specifically define what they are. If you think about it, this makes sense. Someone, in what may be one department, or in various departments, must keep abreast of such requirements.

 

[Ninja]

Howdy all,

It seems like the age old case of mixing up the noun and the adjective:

Quality Management System isn't the Management of the quality system.
It is the Quality of the Management System.

There are boundaries (regulations) set by an external party that your management system must capture...it is not reasonable that you would capture and control them outside of the Management System...they must be an inherent part of the management system...

...and it's easier to control it there anyway...

 

[Sidney Vianna]

It seems like the age old case of mixing up the noun and the adjective:

Quality Management System isn't the Management of the quality system.
It is the Quality of the Management System.

Says who? This kind of platitude just confuses users, in my opinion. The Quality Management System is the management of the quality system. What is a quality system? The parts, bits and pieces of the company operations that have an impact on product quality and customer satisfaction.

As an example, if there is a local regulation controlling storm water run-off in to the local sewer system, that is an environmental regulation that has ZERO impact on product quality. So, obviously, from a quality system perspective, this regulatory requirement is non-existent. From an organization's perspective, their EMS (environmental management system) has to identify, monitor and comply with that regulation.

 

[Marc]

<snip> If regulations/laws will be controlled out of a QMS, why could this be a NC into a QMS? <snip>

Document control in a company is not necessarily "controlled by the quality department", if that is what you're saying. Often it is completely independent of the quality department in a company.

Document Control is a company-wide "system" - A Business System. It is required by ISO 9001 and always has been, and it isn't, and never has been, only applicable to (for example) a specific subset of departments (or other company defined "sections").