Non-Conformance vs OFI -- your best descriptions

[John Broomfield]

I agree. Only failures to fulfill requirements should be reported as nonconformities.

But I’ve yet to hear of any registrar selling the value of their well-crafted nonconformity statements.

 

[Randy]

I agree. Only failures to fulfill requirements should be reported as nonconformities.

But I’ve yet to hear of any registrar selling the value of their well-crafted nonconformity statements.

I prefer not to write the things, but of course I do because that's what's required and expected, and recently some of the let's say, really serious nature popped up.

When you have good solid requirements and good solid objective evidence that they have not been fulfilled, non-conformity is present and soft balling to the OFI route isn't the correct answer because it diminishes the auditor and cheapens the audit.

 

[Tagin]

Tagin,

Is a conforming system not meant to invoke preventive action without any help from its auditors?

John

I was speaking with respect to the topic at hand: the OP's internal audits. So I could have worded it more specifically as:

But it seems more relevant for your org's internal audit process to define the two (OFI & NC), not necessarily how others define it.​

 

[Randy]

I was speaking with respect to the topic at hand: the OP's internal audits. So I could have worded it more specifically as:

But it seems more relevant for your org's internal audit process to define the two (OFI & NC), not necessarily how others define it.​

Other's? Which other's? Within the framework of ISO based MS's these things are defined for one reason (nonconformity)...to avoid confusion, create consistency and allow for effective conformity..... You can define anything you wish, but you'd better be consistent in meeting those definitions and if they don't match up with the basic document requirements itself (whatever ISO MS standard you wish), there can be problems and they'd more often than not, be self inflicted.

 

[Tagin]

Other's? Which other's? Within the framework of ISO based MS's these things are defined for one reason (nonconformity)...to avoid confusion, create consistency and allow for effective conformity..... You can define anything you wish, but you'd better be consistent in meeting those definitions and if they don't match up with the basic document requirements itself (whatever ISO MS standard you wish), there can be problems and they'd more often than not, be self inflicted.

Do you know of an ISO canonical definition of OFI? I thought there was not one.

 

[Randy]

Do you know of an ISO canonical definition of OFI? I thought there was not one.

There isn't really, you have to dig and the average auditor can't point you to this....and it still requires some thinking (I don't write OFI's myself, those things are a minefield I stay out of)

From ISO 17021 (hopefully no copywrite infringement)
9.1.9.6.2 Opportunities for improvement may be identified and recorded, unless prohibited by the requirements of a management system certification scheme. Audit findings, however, which are nonconformities in accordance with 9.1.15 b) and c) shall not be recorded as opportunities for improvement.

9.1.15 Actions prior to making a decision
b) it has reviewed, accepted and verified the effectiveness of correction and corrective actions, for all nonconformities that represent
1) failure to fulfill one or more requirements of the management system standard, or
2) a situation that raises significant doubt about the ability of the client's management system to achieve
its intended outputs;

c) it has reviewed and accepted the client's planned correction and corrective action for any other nonconformities.

 

[Mike S.]

I fully understand a 3rd party auditor avoiding writing OFI's. But the OP was discussing internal audits, and I think internal auditors issuing OFI's is perfectly fine.

I also agree that a nonconformity should not be reduced to an OFI in any audit - they are different. But I will sometimes not document a nonconformity if it is minor and isolated and immediately fixed. Or, if I document it, I won't issue a CAR if it is immediately fixed.

 

[ISO_Man]

Do not bother with OFIs.

Report every system weaknesses as a nonconformity.

...including the systems that rely on auditors to initiate improvements.

I'm leaning this way, as the default question that I get for every OFI is "so I don't HAVE to do this, right...?"

 

[ISO_Man]

The documented requirements can come from the standard or from the organization's documented requirements. In my own view, there is no sense in doing internal audits against the standard, because the internal requirements should include the requirements of the standard. If you think it's a good idea to call something a nonconformity that doesn't violate a requirement, you're looking for trouble.

The external auditor kicked my ass for not having references to the actual standard in my audit forms.

 

[Jim Wynne]

The external auditor kicked my ass for not having references to the actual standard in my audit forms.

There's no requirement, although it might be convenient to do so. You just need to be able to show that the requirements of the standard are reflected in your internal requirements.