Quality Objectives - Acceptable Levels and Functions

[misu183]

misu183б you are correct with regards to prevalent practice.
But I know several large ISO9001 certified companies with complex multi-level organization structure where quality objectives are defined ONLY for top level (for whole organization) and are not cascaded to middle and low relevant levels and functions!! And I am not sure that this is right! From my point of view, taking into consideration the meaning of word WITHIN, organization CAN (or CAN NOT) establish the quality objectives for top level (not mandatory to have top level objectives). But INSIDE (i.e. WITHIN) the organization quality objectives MUST be established on RELEVANT levels and functions, depending of business, product, processes, organization structure and so on.
Any opinions, please!

The way I understood:
5.4.1 - ISO 9001:2008 stipulates that objectives are established for relevant functions and relevant levels within organization. "Relevant" is for any responsible which is conducting processes that affects the quality of the product. That's why there are management processes, main processes, support processes and measure-analyses-improvement processes which need to be measured and analyzed on the regular basis. Analysis cannot be done without targets established through objectives for any type of process.

 

[misu183]

Interesting and practical question: can 3rd party auditor issue NCR for multi-level organization in case of documented top level objectives are exist but neither of low levels and functions do not have specific documented objectives?

I would add it as a remark in the audit report and on next follow-up to the initiated corrective/preventive actions, if not solved, I would issue it as a non-conformity.

 

[Big Jim]

Interesting and practical question: can 3rd party auditor issue NCR for multi-level organization in case of documented top level objectives are exist but neither of low levels and functions do not have specific documented objectives?

For the most part the organization, not the auditor, get to determine what is relevant.

Unless the program the organization is using is obviously inadequate in meeting the intent of the standard I would not find a nonconformance here. That said, I would be looking to see that they have met the intent of 5.4, 4.1, 6.2.2, 8.2.3, and 8.4 and that they have discussed the results in management review (5.6, two of the listed topics on 5.6.1 are specific to discussion on what are likely to be quality objectives/KPI).

 

[MVladimir]

Excellent discussion! Thanks, friends! Hope it will be useful in our QMS and audit practice.

 

[Mallya]

I think to start with every department is recommended but make sure that all core company business processes are covered, and thereafter you can continue to broaden to other areas.

Benny

 

[High Fidelity]

I have been thinking about the same questions here. We got two minor nonconformities, 5.4.1 and 5.6.2. There were no evidence that there were set quality objectives for all processes and that in management review there were no evidence that every relevant section of the standard weren't accounted.

Should I just report that we are going to set the objectives and edit the management review sheet so that the relevant things are accounted for?

I think it's a bit odd that different CB:s have a bit different view of the issue. I mean don't you have clear guidelines how things are? You just give your opinions. No hating, just wondering.

 

[Big Jim]

I have been thinking about the same questions here. We got two minor nonconformities, 5.4.1 and 5.6.2. There were no evidence that there were set quality objectives for all processes and that in management review there were no evidence that every relevant section of the standard weren't accounted.

Should I just report that we are going to set the objectives and edit the management review sheet so that the relevant things are accounted for?

I think it's a bit odd that different CB:s have a bit different view of the issue. I mean don't you have clear guidelines how things are? You just give your opinions. No hating, just wondering.

Some auditors (or their trainers) tend to read more into a requirement than is really there.

That is why it is critically important for organizations to have someone on board that understands the standard extremely well, so that these points can be defended at the time.

Your auditor may be reading more into the standard than is there. At least that is how it looks with what little has been provided. You get to determine what the relevant levels and functions are. I would tend to agree with him if you have some generic objectives and have made little or no effort to line them up to your core business processes to meet the requirements for 8.2.3.

 

[JaneB]

The standard does not say that you have to set quality objectives for ALL processes! 5.4.1 most definitely does not say this! IF your auditor is insisting this is the case, appeal it, because it's not true.

You do have to set some objectives, you do have to use them and review them (ie, progress against them) - because if you don't have any plan for what you aim to accomplish, how do you know if you did anything right/wrong etc?

I don't quite understand the second issue when you say

... in management review there were no evidence that every relevant section of the standard weren't accounted.

If it means 'we couldn't show the auditor reasonable evidence in total that management does review all items listed in 5.6.2b ' then you need to think about that. I'm not a great fan of 'just list it on the MR sheet' because that encourages a tickbox mentality, rather than making it something integral to your business, which I think is how it should be.

 

[High Fidelity]

It's actually just the way you mentioned it. Of course we should have a document stating that every section the standard requires has been dealt with but the analyzing and use of the data collected from the review must be used much more systematically. We don't arrange the management reviews just for fun do we? The check box ticking method - in my opinion, it's a good way to ensure that everything has been dealt with.

 

[Big Jim]

It's actually just the way you mentioned it. Of course we should have a document stating that every section the standard requires has been dealt with but the analyzing and use of the data collected from the review must be used much more systematically. We don't arrange the management reviews just for fun do we? The check box ticking method - in my opinion, it's a good way to ensure that everything has been dealt with.

One of the biggest failures of using a checklist based on the elements of the standard for auditing is that it forces focus on the minutia with the resulting loss of the bigger picture. The analogy is that you become focused on individual leaves on a tree to the extent that you forget that the leaves belong to a tree and that the tree belongs to a forest.

This also tended to create a focus more on the more easily understood parts of the standard. Things not as well understood tended to be neglected or at least treated lightly.

One of the topics not well understood and thus not dealt with well in audits is the process approach. The definition of something with "inputs and outputs" is totally inadequate for dealing with 4.1 and 8.2.3 with a simplistic checklist.

Until the term "process" is better defined, everything about the "process approach" will remain adrift.

It is a great mistake to believe that an organization needs to provide documented evidence of how they meet each "shall" in the standard. It is not required, and trying to make it so tends to create a lazy auditor, one that doesn't know that when there is no requirement for documents or records and their are none, it is the auditor's obligation to audit by interview and observation to determine what the actual practice really is.