Re: Outsourced Processes - Type and Extent of Control to be Applied - ISO 9001:2008 D
Karen,
Ultimately, it does not matter whether you buy in a thing, a service or a process - you are buying in something that you either don't have the inhouse capacity to do/make/produce, or something that you don't choose to do (eg, you can't/happens only rarely/cheaper to have someone else to do it, etc).
Suggest instead of worrying over much about whether it's a 'process' or not, an 'activity' etc. that you focus your attention more on:
1. what do we
send out of our premises to be done?
2. what do we
buy in?
(And that when asking either question, you understand 'what' to mean 'what = that is important/essential/critical to the quality of
our product or service' - eg, this would screen out the largely trivial "paperclips-we-use-in-office" stuff)
You see, whether you send something out to be anodised, painted, plated, machined or whatever, the key point is: what arrangements do you make in order to maintain reasonable control over that? (I'm assuming you don't just send it out, cross your fingers, and accept whatever comes back!)
I think the extra info in the 2008 version was intended to overcome some blind spots that many organisations had - I've heard them say often things something like:
Oh, that's not included because XYZ company does that, and we don't control them.
ISO 9001's point of view is: it is
you who has made an agreement to supply
your customers, and that includes the responsibility of having reasonable arrangements to 'control' whatever you choose to outsource so that, ultimately, your customer gets what you agreed to supply to them. (All very reasonable and good business sense IMO)
Thus, as clause 7.4 requires, you need to make sure that you adequately convey to your supplier what your requirements are, and then ensure that you got what you specified, etc. You don't necessarily have to worry about how it is controlled internally at your supplier's - that is usually their job and definitely sounds so in this case. But it's also a reason why ISO requires you to pay attention to how you select and monitor your suppliers, as well as check whatever stuff you have 'done externally' rather than simply hand it straight across to your customer & disclaim all responsibility.
I'm not suggesting it's not an interesting question to debate (a process or not? an activity?) but you may get a range of opinions even among experts, and just end up confused.
Ultimately, I see very little distinction between:
what is a purchase of a service or product versus what is a subcontracted or outsourced process.
All those additional Notes and info are just clarifying - or trying to!
