Terms & Conditions done by Outsourcing Company

[Chance]

Hi,

We are about to be audited by CB for ISO 9001 certification and I have some concerns already that the auditor might call as a finding.
We outsource some of our processes but we don't mention it anywhere in our QMS. The outsourcing company designed a contract agreement to us. Is there a need to have a control for this? The only thing we do is run a test for comparison of results.
But this process outsourced is not mentioned in our QMS. What if the auditor will ask a question about outsourcing?

Please help.

Thanks.

 

[SteelMaiden]

The standard says:
Where an organization chooses to outsource any process that affects product conformity to requirements, the organization shall ensure control over such processes. The type and extent of control to be applied to these outsourced processes shall be defined within the quality management system. (4.1 General Requirements)

So, yes, you have a nonconformance. Is this your initial registration audit? My suggestion to you would be to document this within your corrective action system and get to work defining how you control these outsourced processes. Good luck.

 

[Chance]

The standard says:
Where an organization chooses to outsource any process that affects product conformity to requirements, the organization shall ensure control over such processes. The type and extent of control to be applied to these outsourced processes shall be defined within the quality management system. (4.1 General Requirements)

So, yes, you have a nonconformance. Is this your initial registration audit? My suggestion to you would be to document this within your corrective action system and get to work defining how you control these outsourced processes. Good luck.

SteelMaiden,

Thanks for your help.
Yes I totally agree with you that it should be identified in our QMS.
We already passed Stage 1 and we are scheduled for Stage 2. Yes I will input a CAR in our internal corrective action system. So if I do that, they wont be able to write this down as a finding anymore. Correct? If we passed stage 1, do you think they might bring up this issue on stage 2?

Thank you.

 

[SteelMaiden]

SteelMaiden,

Thanks for your help.
Yes I totally agree with you that it should be identified in our QMS.
We already passed Stage 1 and we are scheduled for Stage 2. Yes I will input a CAR in our internal corrective action system. So if I do that, they wont be able to write this down as a finding anymore. Correct? If we passed stage 1, do you think they might bring up this issue on stage 2?

Thank you.

Never say never, but my registrar does not issue a nonconformance if I have already identified it and am makeing an honest effort of correcting it. I'm sure they would if they thought I was just sandbagging, tho. Hopefully, adding the documentation you need won't take long.

 

[Chance]

Never say never, but my registrar does not issue a nonconformance if I have already identified it and am makeing an honest effort of correcting it. I'm sure they would if they thought I was just sandbagging, tho. Hopefully, adding the documentation you need won't take long.

SteelMaiden,

I am willing to issue a CPAR but my boss insisted that no need to make our own requirements since we are asking the outsource company to follow existing state and federal regualations and that labs are certified to provide the test service. End of the day, we don't satisfy 4.1. How can I defend this to my boss.

 

[David Hartman]

SteelMaiden,

I am willing to issue a CPAR but my boss insisted that no need to make our own requirements since we are asking the outsource company to follow existing state and federal regualations and that labs are certified to provide the test service. End of the day, we don't satisfy 4.1. How can I defend this to my boss.

I don't believe that you need to define any special "requirements", but document the process for outsourcing that you just defined here (that you will require compliance with existing state and federal regulations and that labs are to be certified to provide the test service). You should require receipt of a copy of the labs applicable cert, and/or a certificate of conformance/compliance (C of C) as records that the lab meets your defined control requirements (if applicable a site survey report could be maintained as a record of compliance). :2cents

 

[Chance]

I don't believe that you need to define any special "requirements", but document the process for outsourcing that you just defined here (that you will require compliance with existing state and federal regulations and that labs are to be certified to provide the test service). You should require receipt of a copy of the labs applicable cert, and/or a certificate of conformance/compliance (C of C) as records that the lab meets your defined control requirements (if applicable a site survey report could be maintained as a record of compliance). :2cents

Thank you for your input. yes I will definitely do this.

 

[SteelMaiden]

I don't believe that you need to define any special "requirements", but document the process for outsourcing that you just defined here (that you will require compliance with existing state and federal regulations and that labs are to be certified to provide the test service). You should require receipt of a copy of the labs applicable cert, and/or a certificate of conformance/compliance (C of C) as records that the lab meets your defined control requirements (if applicable a site survey report could be maintained as a record of compliance). :2cents

Exactly. Don't reinvent requirements for the sake of requirements. Remember that the standard says you must define the type and extent of control to be applied to these outsourced processes.

 

[LindsayJNichols]

I like to show outsourced processes on the diagram of process interactions, which clues the CB auditor in right from the get go that outsourcing is an aspect of your business. Specs and requirements for the outsourced activities should exist either drawn up by you or the vendor. It certainly goes in your favor that you verify their results. I don't believe issuing a corrective action will satisfy a CB for a certification audit, they are expecting that you are meeting all applicable requirements verified by your internal audit process prior to scheduling the certification audit. I'd hurry up and get this addressed if you can.

 

[Helmut Jilling]

SteelMaiden,

Thanks for your help.
Yes I totally agree with you that it should be identified in our QMS.
We already passed Stage 1 and we are scheduled for Stage 2. Yes I will input a CAR in our internal corrective action system. So if I do that, they wont be able to write this down as a finding anymore. Correct? If we passed stage 1, do you think they might bring up this issue on stage 2?

Thank you.

That is a little too simplistic. Some little limited things may get a pass if you have initiated corrective action, on a case by case basis. Maybe a training record is incomplete and you flagged it internally, I might make a note to verify later. But, a fundamental part of the system like defining processes (including outsourced)? Not likely an auditor would accept that. That could lead to a system being incomplete but papered over with a lot of internal CARs. No, the system needs to be implemented to pass a certification audit.

It is not hard to implement this. On your main process sheet or map, identify what the outsourced process are. Then, for each process, somewhere docuemnt what controls you are already applying. You don't need to create a lot of documents or a lot of controls. Just what is necessary to ensure you will be happy with the resulting product.