Maybe 6 procedures are required <snip>
Note I specifically addressed required *documented* procedures/systems. There will be required records as well, and records specific to a company's way of 'doing things', if not required by the standard, then by the company's system.
You may feel a list is the best way to track something but that's your opinion. As a consultant you can advise a company on their systems/processes. It is not the function of an auditor to do that. In fact, technically it is a conflict of interest for an auditor to cross the line and tell a company how to do something, even though we know it happens in every audit to some degree. I did it myself "in a round about way" from time to time.
I stand by my point that there is no requirement for a list. This is about being written up and given a non-conformance for not having a list, not whether it is a good idea or not.
<snip> More importantly, I am concerned about something I often see in audits. I will ask where do we document the outsourced processes. They show me various unconnected documents, po's, control plans. I ask, ok, tell me, what are the outsourced processes? Typically, they tell me 2, 3 or 4 processes. Then later we find a few more.<snip>
That is a situation where the company was not prepared for the audit and/or could not describe and explain their system in way which makes an auditor feel comfortable that the people really understand their processes/systems and how they fit together.
This is something I worked very hard on with clients. In part it was typically knowing who to ask. I never had a client that had that problem during an audit because I know how important it is and made sure everyone was prepared. I larger companies I even made sure each auditor had an escort so that when they asked about a specific system the escort could/would ensure the proper person was being asked questions about the specific system(s)/process(es). Often an auditor would ask someone in manufacturing (for example) how their design system worked (as an example). The escort would stop the audit and get the right person there to answer questions. I am not citing that, necessarily, of a problem with auditors. An auditor comes in for the first time and won't necessarily know who s/he should be asking.
The important part is that each person know what their duties and responsibilities are, what documentation affects them and how, things like that.
While it does not say a list is required, in the absence of some kind of list or similar, how do you document what the specific outsourced processes?
As long as they have a system that meets the requirements, it doesn't matter if the auditor can only think of one way (in this case a list). As long as the company can describe and show how they do it, it is not up to the auditor to tell them they need a list.
