Process Changes, but Work Instructions/Process Maps are not updated

[azuker]

If during an employee interview, an internal auditor finds that a process has changed, but work instructions and process maps have not been updated to reflect that change, how should that finding be reported/classified?

 

[Stijloor]

That's a nonconformity. Look at similar processes to ensure that this is not a systemic issue. You provide the objective evidence, write a CAR and submit to the Process Owner.

 

[azuker]

Thank you for that confirmation. In this instance, a workflow was changed to make an improvement. The change was communicated to staff via email and implemented, but the work instruction and process map that support the procedure had not been updated at the time of audit.

 

[Stijloor]

Thank you for that confirmation. In this instance, a workflow was changed to make an improvement. The change was communicated to staff via email and implemented, but the work instruction and process map that support the procedure had not been updated at the time of audit.

Still a nonconformity. Obvious weakness in the change management process. When I was auditing, one of the most recurring issues: poor change control - any change. Employees not aware and/or documents not updated.

 

[insect warfare]

Thank you for that confirmation. In this instance, a workflow was changed to make an improvement. The change was communicated to staff via email and implemented, but the work instruction and process map that support the procedure had not been updated at the time of audit.

IMO, you should write an NCR against the document control and/or change control processes and assign CA to those process owners - there's a disconnect there, and that audit trail should be followed to determine just how bad the disconnect really is.

Brian

 

[AndyN]

If during an employee interview, an internal auditor finds that a process has changed, but work instructions and process maps have not been updated to reflect that change, how should that finding be reported/classified?

For a start, you don't report it based on what someone says has happened. It may be inaccurate and you might suspect them (if you know them) of less than good motives. Hence, you should obtain objective evidence, first hand, if you can, PLUS the results of following this different process. If you go around reporting what someone tells you without validation, people will, eventually, stop talking to you! You'll have to start your audit with "You have the right to remain silent..."

So, did you check and validate what they said happens? Did you see what the impact was on the result? I'd suggest it's NOT a document control issue - that's just a symptom and management don't get interested in documents. The REASON for documents not being changed is where you need to discover the issue. Is it planning or process change control etc. as Jan suggests. Reporting documentation issues is a cop out.

 

[azuker]

Hi! The auditor has evidence of email communication from the process owner to staff members that outlines the change in the process, so there is more evidence to go by than just word of mouth. The result of the change is an improvement in the flow of work.

Should the auditor interview the process owner to investigate the reason behind why the work instructions and process maps have not been updated to reflect the changes?

Your input is appreciated, thanks!

 

[AndyN]

Hi! The auditor has evidence of email communication from the process owner to staff members that outlines the change in the process, so there is more evidence to go by than just word of mouth. The result of the change is an improvement in the flow of work.

Should the auditor interview the process owner to investigate the reason behind why the work instructions and process maps have not been updated to reflect the changes?

Your input is appreciated, thanks!

Good info! Yes, indeed! It now seems to me that the Process Owner doesn't understand the use of the QMS to achieve control over changes. Of course, the auditor should verify what provisions are made for the change process before hand, so that they can compare the story of the process owner to what SHOULD happen. Maybe the process is flawed and the Process Owner was doing the best they *thought* they could do (I'm wondering also what the MR is doing if the process is already broken so that management wouldn't know to use it, change it, improve it, too, of course)

See why dismissing this as "document control" is misleading?

 

[John Broomfield]

azuker,

Your nonconformity statement perhaps:

Requirement: Documented procedures shall be reviewed and revised as necessary - 4.2.3b
Evidence: List the examples of process v procedure differences perhaps in a table and cite the emailed changes.
Nature: Failure to update the documented procedure(s) to specify the way the process is actually carried out.

You may need to refer to ISO 9000, the normative standard's definition of procedure.

John

 

[AndyN]

azuker,

Your nonconformity statement perhaps:

Requirement: Documented procedures shall be reviewed and revised as necessary (to reflect the actual undocumented procedure - 4.2.3b)
Evidence: List the examples of process v procedure differences perhaps in a table and cite the emailed changes.
Nature: Failure to update the documented procedure(s) to specify the way the process is actually carried out.

You may need to refer to ISO 9000, the normative standard's definition of procedure.

John

But John - you have put YOUR words into a requirement and called it an ISO requirement! Where does it say, in 4.2.3b "to reflect the actual undocumented procedure"?

If you presented that to me, I'd be asking where you learned to write an NC statement!

As I pointed out earlier, there's a bigger fish to fry than a simple document control issue...If the auditor chooses to bring value to management from their efforts. No wonder many organizations rarely see anything of interest from their audits!