Questions pertaining to our last audit - Fix or Minimum Document Retention time?

[MBraun76]

Hello Everyone,

I have two questions of my own that arose during an audit we just had last week.
The first question concerns document retention times. In our documented list of retained records, where it lists the length of time they are retained, the previous QA Manager had put "Minimum Retention Time" at the top of the column. We received a nonconformance for using the word "minimum" here. Apparently our auditor knows someone on the ISO review board and they told him that documents should no longer be categorized by "minimum times", only actual. However, in reading up on the requirement in one of my reference books (the "ISO 9000 Quality Systems Handbook" by David Hoyle) it states that the retention time does not mean you have to dispose of them at that time, only that you can. So isn't that the same as having a "minimum" retention time? The whole thing strikes me as an odd thing to hit on.

The second question is about internal audits. In most of my audits I always ask about inputs, outputs and measureable results, although in a fairly informal, roundabout manner. In my last audit, however, I glanced over measureable results. It was an audit of a manufacturing line and I was more concerned with questions about quality and procedures than whether or not they know how many are supposed to be made on a certain day and if they made their goal or not. Did I make a mistake by not touching on results in one audit? Our auditor told me that I should actually categorize and identify my questions based on inputs, outputs and measureable results. He was very firm on this. Does he have a solid point or is he voicing an opinion here?

I thank you for your time and input,
Michael

 

[Jim Wynne]

Re: Questions pertaining to our last audit

Hello Everyone,

I have two questions of my own that arose during an audit we just had last week.
The first question concerns document retention times. In our documented list of retained records, where it lists the length of time they are retained, the previous QA Manager had put "Minimum Retention Time" at the top of the column. We received a nonconformance for using the word "minimum" here. Apparently our auditor knows someone on the ISO review board and they told him that documents should no longer be categorized by "minimum times", only actual. However, in reading up on the requirement in one of my reference books (the "ISO 9000 Quality Systems Handbook" by David Hoyle) it states that the retention time does not mean you have to dispose of them at that time, only that you can. So isn't that the same as having a "minimum" retention time? The whole thing strikes me as an odd thing to hit on.

Here's the pertinent part of 4.2.4 (ISO 9001:2008):
The organization shall establish a documented procedure to define the controls needed for the identification, storage, protection, retrieval, retention and disposition of records.
If you've determined that the control needed for retention is a minimum amount of time, you've satisfied the standard, and your auditor is way off base.

The second question is about internal audits. In most of my audits I always ask about inputs, outputs and measureable results, although in a fairly informal, roundabout manner. In my last audit, however, I glanced over measureable results. It was an audit of a manufacturing line and I was more concerned with questions about quality and procedures than whether or not they know how many are supposed to be made on a certain day and if they made their goal or not. Did I make a mistake by not touching on results in one audit? Our auditor told me that I should actually categorize and identify my questions based on inputs, outputs and measureable results. He was very firm on this. Does he have a solid point or is he voicing an opinion here?

8.2.2 says (in part): The audit criteria, scope, frequency and methods shall be defined.

Whether or not the audit in question represents a nonconformity depends on how you defined the the criteria, scope and methods. If you documented the audit requirements one way and then performed the audit another way, the NC could be legitimate.

 

[Al Dyer]

MBraun76,

Good input.

Over the years many of us have learned that people, organizations, manufacturers are too zealous in defining specifics in meeting the various requirements and box ourselves into corners. When we read it and learn of it we discover that the requirements can be very lax. The entities that issue the requirements do realize that each company is different and needs to be given the leeway of operating their organizations.

The first QS audit I went through as an MR opened my eyes considerably. He came in, reviewed the policy and procedures then told me they said what they should, that the words were right. Then he said he was here to review if we were doing what we said we were doing, that's all. During the audit he asked me many times why we were making this so hard on ourselves by writing instructions and requirements on ourselves that were clearly unobtainable in the long run and would only lead to future N/Cs. His final comments upon leaving us with a failed audit was KEEP IT SIMPLE.

I am rambling but this gentleman really opened my eyes as to how the process works.

Al...

 

[Randy]

Knowing that I will upset the applecart I'll go ahead and say that your auditor is more full of doo-doo than straight poop. I checked the APG guidance and ANAB requirements and there isn't diddly about document retention times. As for "the ISO Review Board", I've never heard of that entity so it's probably a case of your auditor mis-speaking oneself.

On the audit thingy, you can do it by day of week according to temperature divided by humidity if you want. The only real wrong way is the way that doesn't give you the results that you need and have to have...

 

[Big Jim]

Hello Everyone,

I have two questions of my own that arose during an audit we just had last week.
The first question concerns document retention times. In our documented list of retained records, where it lists the length of time they are retained, the previous QA Manager had put "Minimum Retention Time" at the top of the column. We received a nonconformance for using the word "minimum" here. Apparently our auditor knows someone on the ISO review board and they told him that documents should no longer be categorized by "minimum times", only actual. However, in reading up on the requirement in one of my reference books (the "ISO 9000 Quality Systems Handbook" by David Hoyle) it states that the retention time does not mean you have to dispose of them at that time, only that you can. So isn't that the same as having a "minimum" retention time? The whole thing strikes me as an odd thing to hit on.

The second question is about internal audits. In most of my audits I always ask about inputs, outputs and measureable results, although in a fairly informal, roundabout manner. In my last audit, however, I glanced over measureable results. It was an audit of a manufacturing line and I was more concerned with questions about quality and procedures than whether or not they know how many are supposed to be made on a certain day and if they made their goal or not. Did I make a mistake by not touching on results in one audit? Our auditor told me that I should actually categorize and identify my questions based on inputs, outputs and measureable results. He was very firm on this. Does he have a solid point or is he voicing an opinion here?

I thank you for your time and input,
Michael

You should have a talk with your registrar. This auditor's ignorance is overwhelming. I can't even conceive of how he came up with that idea. On the opposite, I have had auditors write a nonconformance because records were retained longer than the retention time shown in the auditee's written procedure for control of records. Both extremes are just silly.

You should have no trouble appealing this.

 

[AndyN]

Michael:

Good advice here. Your auditor should know better than to pull a stunt like either of these. If TC 176 had wanted a specific wording or intention it'd be in there! Maybe he knows one person from one TAG from one country who doesn't like the word minimum, but that's hardly a reason is it?

On the audit side, not all audits need to be focused on results, so he's off base here. As Jim correctly states it's about the scope, objective and so on. Maybe you could make this a little clearer in your audit docs.

I'd be very clear to your CB you don't want this person back...

 

[MBraun76]

Thank you very much everyone. I feel better about my understanding of ISO. My personal thoughts were very close to what a lot of you said, I simply didn't quesion it as thoroughly as I should have due to my lack of experience. I will have to remember to be more assertive when I question an auditor in the future. Especially when I have these NCRs removed.

Again, thank you very much for everyone's response. As always this forum has been a great help.

 

[jkuil]

The first question concerns document retention times. In our documented list of retained records, where it lists the length of time they are retained, the previous QA Manager had put "Minimum Retention Time" at the top of the column. We received a nonconformance for using the word "minimum" here. Apparently our auditor knows someone on the ISO review board and they told him that documents should no longer be categorized by "minimum times", only actual. However, in reading up on the requirement in one of my reference books (the "ISO 9000 Quality Systems Handbook" by David Hoyle) it states that the retention time does not mean you have to dispose of them at that time, only that you can. So isn't that the same as having a "minimum" retention time? The whole thing strikes me as an odd thing to hit on.

It depends on the documents you retain. National privacy regulations may prevent you from retaining records endlessly.
Secondly, you have to ensure the availability, including legibility, during the specified retention period. Are you archive environmental conditions suitable for endless retention? What you do want to say that you only assure document quality for the minimal retention period. So I would recommend refrasing.

The second question is about internal audits. In most of my audits I always ask about inputs, outputs and measureable results, although in a fairly informal, roundabout manner. In my last audit, however, I glanced over measureable results. It was an audit of a manufacturing line and I was more concerned with questions about quality and procedures than whether or not they know how many are supposed to be made on a certain day and if they made their goal or not. Did I make a mistake by not touching on results in one audit? Our auditor told me that I should actually categorize and identify my questions based on inputs, outputs and measureable results. He was very firm on this. Does he have a solid point or is he voicing an opinion here?

In my opinion this is an opinion, unless your quality system defines that you must assess the input, output and measurable results. Both yield and product quality can be identified as measurable results. Therefore, the auditors concern may be with the systematic approach that your audit procedures require?

 

[The Specialist]

Re: Questions pertaining to our last audit

Here's the pertinent part of 4.2.4 (ISO 9001:2008):
The organization shall establish a documented procedure to define the controls needed for the identification, storage, protection, retrieval, retention and disposition of records.
If you've determined that the control needed for retention is a minimum amount of time, you've satisfied the standard, and your auditor is way off base.

I couldn't agree more.

The standard stipulates a period that you MUST retain certain documents. The retention 'minimum' period will be different depending on industry and document/data type (e.g. batch records or validation records etc..)

As an organisation, you may wish to retain documents on-site whilst within this period to be available for audit. After retention time has elapsed, you may not wish to destroy these records but may 'archive' them for future reference (or many other reasons). These documents are therefore being retained beyond the 'minimum' retention time.

You are perfectly entitled to refer to 'minimum' retention time...

What I would say, however, is that you must identify what the 'minimum' retention time is for each record type...

E.g. you must identify within your procedure what the required/minimum retention time for record type 'X' and record type 'Y' is.
You may then refer to the 'minimum' retention time as stipulated within the procedure (or referenced procedure/standard).