Re: Missing Contract Review Records on big contracts
I audited a company's contract review (CR) function to ISO9001 and AS. I could not find records of CR on big contracts with Boeing or USAir. I expected to find a one-page Contract Review form signed by affected Departments Managers.
I was told that they received the bid request and they send the proposal back. If Boeing sends a contract back to the company with no changes and if the president of this company signs the contract, it is evidence of records of contract review. It is because the company President would not sign anything without having his staff check it out.
I asked if there were evidence that the affect departments reviewed the contract. The answer was- there is no requirement in the std to show that.
I asked if this method of satisfying the CR record requirement is documented? The answer was- There is no requirement to document it. They are showing evidence of CR by the signature of the President.
This is how I look at it. 7.2.2 requires records of contract review. If the company decides to use the signature of the President on the final contract as the record, it needs to be documented somewhere. Otherwise, using the signature alone as record of CR does not meet the intent of the standard.
What do you think?
It's an interesting question. For the sake of clarity and for those who might not have immediate access to the standard, here is 7.2.2, in part:
The organization shall review the requirements related to the product. This review shall be conducted prior to the organizations' commitment to supply a product to the customer (e.g. submission of tenders, acceptance of contracts or orders, acceptance of changes to contracts or orders) and shall ensure that
(a) product requirements are defined,
(b) contract or order requirements differing from those previously expressed are resolved and
(c) the organization has the ability to meet the defined requirements.
Records of the review and actions arising from the review shall be maintained (see 4.2.4).
The question at hand is, "Can a management person's signature on a contract satisfy the "shall" with regard to maintaining records of contract review?"
Maybe. If there is system documentation that states explicitly that the signature is applied only
after the requirements in 7.2.2 have been met, and there have been no changes to the contract as originally tendered for which records were kept, then the signature might suffice. I'm not sure at all though, whether implied consent is a valid answer to a "shall." If it were, all kinds of doors would be open to allow weaseling out of requirements. I would be particularly suspicious if I could find no records at all of any sort of contract amendments or questioning of "the organization's" ability to meet the requirements.
If this strategy meets the letter of the standard, I don't think it meets the intent, by any stretch, especially given that top managers are, in my experience, likely to accept work first and then try to figure out how to get it done. As far as an audit NC is concerned, I would want to review the records (if there are any) more closely before determining whether 7.2.2 has been met or not.