Category: ISO 9001 – Quality Management Systems

Risk Based Thinking in ISO 9001:2015

Reporting, best practices, non-compliance reporting, analysis

Question

In 0.3.3 clause of the standard – it is said that “A positive deviation of the risk can provide an opportunity, but not all positive effects of risk result in opportunities.”  Can you please clarify this statement?

Answer

Thanks for contacting ASQ’s Ask the Experts program.  Good question! As mentioned, ISO FDIS 9001:2015, Clause 0.3.3, which states, “A positive deviation of the risk can provide an opportunity, but not all positive effects of risk result in opportunities”.

In my opinion, this highlights an important point.  That is, not every positive deviation or change of a risk will include opportunity.  Consider the recent changes that have occurred in the Oil and Gas industry.  When the demand for crude oil was high, the availability of various materials and services providers was low, and prices were high.  This situation (availability of materials, services providers and costs) may have been identified as a supply chain risk.

However, the oversupply of crude oil drove prices down.  Crude oil production has dropped to stabilize pricing at the pumps.  This positive deviation of risk has provided an opportunity to crude oil producers, which includes the improved availability of materials, greater selection of services providers as well as more competitive pricing.  So dependent upon where you sit, this deviation of risk may be considered a negative that has decreased product demand and lowered pricing or a positive that has lowered consumer pricing and increased availability.

Consider companies that are providers of upstream services to crude oil producers.  Their risk based thinking may have identified the supply of qualified personnel to perform upstream servicing as a risk.  The decrease in demand for upstream services has increased the pool of qualified personnel.  However, this positive deviation of risk does not represent an opportunity.  The scenarios mentioned above are basic and intended to highlight the point of ISO FDIS 9001:2015, Clause 0.3.3.  There are far more dynamics that should be considered when assessing the deviation of risk versus opportunity.

I hope this helps.

Best regards,

Bill

Bill Aston, Managing Director
Aston Technical Consulting Services, LLC
Kingwood, TX 77339
Office: (281) 359-ATCS (2827) or Toll Free: (888) 968-9891
Website: www.astontechconsult.com

For more on this topic, please visit ASQ’s website.

Internal Audits

Employees, Training, Working, Learning, Duties, Tasks, DFSS, Innovation, Audit, Auditing

Question

Can the Management Representative be part of the internal auditor team?

Answer

Thank you for contacting ASQ’s Ask the Experts program.  Concerning your question, ISO 9001:2008, clause 8.2.2, only prohibits persons from auditing their own work.  So provided that the Management representative is assigned to audit processes that are outside his/her work responsibilities, there is no other restriction in with regard.   ISO 19011:2011,clause 4.0, “Principals of auditing” as well as clause 6.3.3, “Assigning work to the audit team”, should be reviewed for additional insight and understanding.

I hope this helps.

Best regards,

Bill

Bill Aston, Managing Director
Aston Technical Consulting Services, LLC
Kingwood, TX 77339
Office: (281) 359-ATCS (2827) or Toll Free: (888) 968-9891
Website: www.astontechconsult.com

For more on this topic, please visit ASQ’s website.

Approved Supplier List

Mr. Pareto Head and Supply Chain comic strip

Question

I would like to know how supplier status in the Approved Supplier List (ASL) should be managed so that there is complete traceabilty.  For instance, a vendor status is changed from approved to not approved in the ASL for reasons other than substandard performance which is documented in an audit report, how should QA document such change to ensure that these changes are tracked. Could QA make changes in the ASL without notifying the Purchasing Department and without any documentation?

Answer

Thanks for contacting ASQ’s Ask the Experts program.  Concerning your questions, about supplier status traceability, and ASL management, the following response is provided.

Dependent on the number of suppliers involved and the availability resources, an organization may choose to utilize a single or combination of methods to monitor supplier performance and supplier status.  These methods may range from using an MS Word or Excel spreadsheet, Access database to a multi-user database.

As you are aware, ISO 9001:2008, Clause 7.4.1, requires the organization to establish criteria for selection, evaluation and re-evaluation of suppliers.  This clause also requires records of results of evaluations to be maintained.  This includes any necessary actions taken as a consequence of the evaluations conducted, such as the removal of a supplier from the ASL or changed approval status.

ISO 9001:2008 does not limit a company’s ability to remove a supplier from the ASL.  This is an internal decision based on the company’s established criteria.  So there could be various reasons for removing a supplier from the ASL.  Likewise, with changing a supplier’s status from pending, approved to not approved.  As mentioned, ISO 9001:2008, Clause 7.4.1, requires records of supplier evaluations to be maintained, and any actions taken as a result of the evaluation to be retained.

The a primary purpose of the ASL is to ensure the placement of purchase orders or contracts are limited to those suppliers that meet the company’s established criteria for supplier selection, evaluation, and re-evaluation.  For this reason, Purchasing must be included in any changes made that may affect their use of the ASL.

Generally speaking, Purchasing is responsible for maintaining and updating the ASL, which includes ensuring the current status of suppliers of products and services are identified.   The company’s internal audit process is typically used to assess Purchasing’s conformance with established criteria for supply chain management.

In summary, I would not recommend that changes be made to any QMS process without the involvement of the QMS process owner and management as applicable.  ISO 9001:2008, Clause 5.4.2, sub b., requires top management to ensure that the integrity of the QMS is maintained when changes are planned and implemented.  If changes are made to the ASL, Purchasing should certainly be involved.

I hope this helps.

Best regards,

Bill

Bill Aston, Managing Director
Aston Technical Consulting Services, LLC
Kingwood, TX 77339
Office: (281) 359-ATCS (2827) or Toll Free: (888) 968-9891
Website: www.astontechconsult.com

For more on this topic, please visit ASQ’s website.

TS 16949, ISO 9001

Automotive inspection, TS 16949, IATF 16949

Question

Our company designs and manufactures commercial and automotive semiconductor products. We used to maintain dual certification (ISO 9001 and TS 16949) for all of our manufacturing and assembly locations, but recently dropped the ISO9001 certification.  My questions are as follows:

1) If we manufacture automotive and non automotive products in the same location “site”, without dedicated separation, does the TS certification eligibility apply to the entire site?

2) Can we include the non automotive design RSLs in the TS 16949 certificate scope, or would we need a separate ISO 9001 certificate to cover those activities?

Answer

Thank you for your question.   Yes, TS 16949 requirements would apply to all of your “automotive” processes whether they produce/support only automotive products or not.   This is actually the way you’d want to do it:  it would be more complicated to try to have two systems for automotive and non-automotive products.    If you have only one certification, the scope of your audits would have to be your whole product line, and not just your automotive products.

The answer to your second question is again related to the scope of your registration.   If you are not design-responsible for the automotive side of your business there is a risk that your TS 16949 audits (internal and external) do not include your design function.    If you want your design activity in scope, work with your registrar to roll it into your scope of registration.  Understand that if you do it that way, your non-automotive design would be subject to all of the additional 7.3 controls listed in TS 16949.  Although you should be able to cover it under one registration, It will be up to them if they want you to split it out into a separate ISO 9001 registration.  The impact of that difference should be minimal.

Please let us know if you have any follow-up questions related to this answer.

Denis

Denis J. Devos, P.Eng
A Fellow of the American Society for Quality
Devos Associates Inc.
(519) 476-8951
www.DevosAssociates.com

For more on this topic, please visit ASQ’s website.

ISO 9001 Internal Audit and TQM

Audit, audit by exception

Question

In ISO 9001 internal audit process, can we include the TQM function? If so, then which clause of ISO 9001 refers to it?

Answer

With regard to the ISO 9001:2008 internal audit process and its relationship to total quality management (TQM), it should be noted that TQM was a concept used by many companies worldwide prior to the existence of ISO 9000 quality management systems.

A few of the commonalities that are shared between TQM and ISO 9001:2008 include their focus on:

  • Reducing costs
  • Increasing profits
  • Leadership’s involvement
  • Ensuring customer satisfaction
  • Ensuring employee competency and involvement
  • Resource management
  • Quality system planning
  • Development of mutually beneficial supplier relationships
  • Accomplishment of objectives that support the organization’s mission (i.e., quality policy)

The primary difference that sets ISO 9001:2008 apart from TQM is that ISO 9001 has defined requirements for the establishment of documented procedures and records to provide evidence of conformance.  The concepts of TQM permeate quality systems that are based upon ISO 9001:2008 requirements.  In my opinion, if your internal audit criteria is ISO 9001, you’re also verifying that TQM concepts are being utilized within the quality system.  More information regarding TQM is provided in Juran’s Quality Handbook, 5th Edition.  Also consider reviewing the eight (8) quality management principles provided in ISO 9000:2005, Introduction, subclause 0.2.  These principles are applicable to all ISO 9000 family of quality management system standards.

Bill Aston, Managing Director
Aston Technical Consulting Services, LLC
800 Rockmead, Suite 170, Kingwood, TX 77339
Office: (281) 359-ATCS (2827)
Website: www.astontechconsult.com

For more information on this topic, please visit ASQ’s website.

Lead Auditor Qualification

Audit, audit by exception

Question

My manager and I have a question about internal lead auditor and auditor qualification. As stated in section 8.2.2 of ISO 9001:2008, “the organization shall conduct internal audits at planned intervals to determine whether the quality management system…”

Our question is do internal lead auditors and auditors have to be certified by an organization or trained by a certified lead auditor? May a person read ISO 19011:2011 and with his/her experiences in his/her field then perform audit tasks as stated in section 8.2.2 of ISO 9001:2008? If yes, would an ISO registrar consider it to be a non-conformance finding?

Thank you in advance for taking time to answer our question.

Response

Thanks for contacting ASQ’s Ask the Experts program.  With regard to your question, it is important to know that ISO 9001:2008 does not prescribe any specific requirements for the qualifications of persons conducting QMS audits.  ISO 19011:2011, provides guidance not mandatory requirements for determining Auditor qualifications.  As you are aware, an internal audit is one of the most valuable tools that an organization has to determine the effectiveness of its quality management system as well as to identify opportunities for improvement.

For this reason, it is essential that the personnel or consultants used to conduct audit activities, have the qualifications and experienced needed to provide these services.  As a minimum, I would suggest that your internal audit personnel  attend Auditor classroom training accredited by ASQ, RABQSA or IRCA.  This training should be supported by arranging for their participation in future audits as an audit team member.  This audit should preferably be conducted by an individual who has a current certification as an ASQ CQA or an RABQSA or IRCA Lead Auditor.

Another consideration is to ensure that the Lead Auditor can provide an audit log as evidence of his/her past audit experience.  The Lead Auditor should also provide evidence of their continued training to maintain their competency as an Auditor.  Another key point, is to ensure that the Lead Auditor has a working knowledge of your organization’s product line, processes or services.  The importance of using trained and experienced Auditors can’t be overstated.

I hope this helps.

Best regards,
Bill Aston
ASQ Senior Member
Managing Director of Aston Technical Consulting Services
Kingwood, TX
www.astontechconsult.com

For more about this topic, please visit ASQ’s website.

ISO 9001:2008 Quality Manager Titles

Workplace safety, OHSAS 18001, work environments

Question:

Is it a requirement that a person in an ISO 9001 registered organization who is responsible for fulfilling the duties and requirements of the management representative hold the title of Management Representative, i.e., is it a noncompliance that such person holds a different title, e.g., specifically, Quality Representative?

Response:

I have seen this question come up at other times.  Basically, I refer to how we need to understand the word “shall”.  “Shall”, when used in the ISO standards,  indicates a requirement.

Therefore, when clause 5.5.2 in ISO 9001:2008 says, “Top management shall appoint a member of the organization’s management . . . .”, then it is a requirement. There are good reasons for this. For one, the Management Representative must have the authority to perform those duties necessary for the successful implementation and continuation of a quality management system. Generally, a person in management knows the company’s business and has a working relationship with all the departments.
It is sometimes a practice to give a person a management title but limit their authority to that which is related to the QMS.

I hope this is helpful to you and thank you for sending your question.

Bud Salsbury
ASQ Senior Member, CQT, CQI

Follow Up Question:

Hello,

I appreciate and fully understand your answer, however, I probably did not pose my question adequately. The responsibilities of the MR is clearly assigned to a member of management, and, in fact is the QM, but does not use the title “Management Representative”, but instead uses “Quality Representative”.  So, in affect, there is no “MR” in the company.  Is this an issue?

Thanks.

Response:

If you wanted to add verbiage to your Quality Manual or one of your documented procedures (i.e. Management Responsibility) which clarifies this you could. However, you do not have to.

The standard says your MR shall be a member of management. The standard does not direct you to make this an official “title”.  It just needs to be clear that someone from management fulfills all the responsibilities of the MR. Those responsibilities can be in addition to that individual’s primary function.

It sounds like you are doing OK.

Bud Salsbury
ASQ Senior Member, CQT, CQI

For more on this topic, please visit ASQ’s website.

ISO 9001:2008 Evidence of Conformity

Checklist, Conformity, Go/No Go

Question
ISO 9001:2008 states in 8.2.4 Monitoring and measurement of product:  “Evidence of conformity with the acceptance criteria shall be maintained.”

When our plan identifies periodic inspections, variable or attribute, are performed, how can we show evidence without recording the specific results obtained during the inspection?

Answer
Thanks for contacting ASQ’s Ask the Experts Program.  With regard to your question, please note that the primary intent of ISO 9001:2008, clause 8.2.4 is to ensure that the organization has established acceptance criteria and that a record is maintained to verify that product requirements have been met.  This verification can be performed by documenting the results of actual measurements taken onto a spreadsheet, shop router, traveler, quality plan or other suitable means.

Another approach could be the use of a “Go” “No Go” gauge and a checklist to record inspection measurement results as pass or fail.  There are many different ways of maintaining a record of inspection results.  However, regardless of how measurements are taken, their results must be documented to provide evidence of conformance.  Unless a record is maintained, there is no evidence that the inspection ever happened or that the product meets defined requirements.

I hope this helps.

Bill Aston
ASQ Senior Member
Managing Director of Aston Technical Consulting Services
Kingwood, TX
www.astontechconsult.com

ISO 9001 Training Requirements

Reviewing confidential files, training records, human resources files

Question:
Are there specific training requirements for professionals (i.e. university graduates) in respect to ISO 9001: 2008?  Are there any specific records that need to be kept on these individuals?

Response:

Good Morning,

This is an interesting question as it can be perceived as simple and that a short answer would be sufficient.  However, in the interest of ensuring a ‘full’ answer, I will mention a few things about:

  • Qualifications
  • Records

Let’s begin with qualifications. You asked if there are specific training requirements in respect to ISO 9001: 2008. I will give you a yes/no answer. To be more specific, YES; everyone in an organization pursuing ISO compliance needs to be trained regarding their individual responsibilities. (See 6.2.2 Competence, training and awareness)  This includes ensuring they are “aware of the relevance and importance of their activities and how they contribute to the achievement of the quality objectives” (6.2.2d).  6.2.2e follows by saying you must “maintain appropriate records of education, training, skills and experience.”
I recommend that you read that entire clause and take note of the fact that it begins with “The organization shall”.

As for the Records, keep in mind that these are relatively normal Human Resources records. For example; if you have a machinist on your team, you would have records showing what schooling and/or training he/she has had to qualify for that position. That would also show what they can do in helping the team toward compliance.

Note it says in 6.2.2b that you are to provide training where necessary. For example; Someone completely new to the ISO standards would need to be made familiar with them and with their responsibilities. You would, of course, have records of such training.

Now, about the word “professionals” in your question.  I am guessing that you are referring to your Quality Assurance (QA) or Quality Control (QC) personnel as well as the Management Representative (MR).

Section 5.5.2 of ISO 9001:2008 make it more than clear what the responsibilities of the MR. There is a lot there. However, the single requirement stated there is that your MR ‘shall’ be a member of the organization’s management. That is because this person must be able to make decisions, apply resources, and generate necessary changes in the company with reference to the QMS. They must also be in a position to let Top Management know where the company stands in quality and what, if anything, needs to be revised.

I personally would recommend that any/all individuals you have in a position of Inspector be required to complete the study and training necessary to pass the exam for ASQ Certified Quality Inspector. It would be beneficial for your MR to acquire certification via ASQ as a Certified Quality Technician. These are not ISO requirements. However, the study and/or training for such would help them to be better prepared and qualified to lead your team to successful ISO 9001:2008 compliance.

Thank you for contacting ASQ with your questions.

Bud Salsbury
ASQ Senior Member, CQT, CQI

For more on this topic, please visit ASQ’s website.

ISO/TS Exclusions

Manufacturing, inspection, exclusions

Question:

I have a question regarding exclusions from the ISO/TS standards.

The majority of our business is the design and manufacture of enclosure hardware.  Recently though, a small portion of our business has become the sole North American Distributor for an Italian company. Their product lines are similar to ours. However, we procure their products and simply resell/distribute to their customers stateside, to Canada and Mexico. We do not have Design or Process Control for these items; they are pass-through product.

Therefore, my question is related to permissible exclusions from the ISO standard. Should we seek exclusions regarding certain clauses of Clause 7 of the standard, for this certain “supplier”, and/or for certain product groups that are sold on their behalf?

Response (Answered by Bud Salsbury):

At first, your question seemed relatively uncomplicated and I am inclined to say that you can simply sell or provide the products in question with a disclaimer or something identifying the fact that your company is not the designer/manufacturer of the product.  My company occasionally has purchased parts inserted into or added to the products made. Like bushings or threaded inserts, etc. We don’t have to add anything to our QMS for those as long as those items meet regulatory and statutory requirements.

However, I should mention, the standards make it clear that exclusions are permissible if “such exclusions do not affect the organization’s ability or responsibility to consistently provide product that meets customer and applicable statutory and regulatory requirements.”

Therefore, stepping away from the initial ‘simple’ answer, I would say that such exclusions would not be permissible. This is due to the fact that your organization is ultimately responsible for meeting customer requirements. Although you do not design or manufacture that specific product, you provide, and are responsible for what the customer requests.

You are also responsible for seeing to it that the OEM is meeting customer as well as any statutory or regulatory requirements. This would be of particular importance if these are electrical enclosures or intended for hazardous services, such as NEMA 7 (explosion proof enclosures).

Since you already design and manufacture your own products and have the Clause 7 included in your QMS, it would be counterproductive to add more documentation to exclude what you have mentioned. It would be wise to notify customers up-front, in the sales/purchase order process, that the product you are distributing is from a separate company.

Thanks much for this good question.

Bud Salsbury
ASQ Senior Member, CQT, CQI

Follow Up Questions:

• IF there were permissible exclusions allowed, WHO would need to ‘approve’ these or ‘allow’ them to be exclusions?  Would that be the registrar or someone else?

• IF there were permissible exclusions, would it be stated/depicted on the actual Certificate as such or only noted in the quality manual, for example?

• IF there were permissible exclusions, would it be an exclusion of the ISO CLAUSE?  And/or PRODUCT?  And/or  SUPPLIER?

• Currently we list “the design and manufacture…” in our scope.  Would we need to revise the scope to include ‘distribution’?

Response (Answered by Denis Devos):

Thank you very much for your question and your follow up.

In further response to your original question – if you are in the automotive industry, you will still be obligated to provide a Level 3 PPAP (as a default) to your customer for the product you are purchasing and reselling; whether you are design and process responsible or not.

Permissible exclusions are only granted for Clause 7.3 Product Design.  Per TS 16949, you cannot be excluded from the requirements of Clause 6.3 related to process design.    You can declare this exclusion yourself in your Quality Manual and your registrar will validate your claim during your registration audit.   The exclusion will appear on your registration certificate.  You can only be excluded from Clause 7.3 Product Design, (not process design).

Under TS 16949, you cannot exclude products from your registration if they are being sold to the automotive industry.   Sometimes, a registrar will permit only a portion of your business to be registered and that would be reflected in the scope on your certificate:  Check with your registrar.   You cannot be exempted from any requirements related to supplier management, such as Clause 7.4.

Yes, you will likely have to include “distribution” in the scope of your registration; check with your registrar.

I hope this sufficiently answers your follow-up questions and you find this advice helpful.  If you need anything further, please don’t hesitate to contact us.

Best Regards,

Denis J. Devos, P.Eng
ASQ Fellow
Devos Associates Inc.
London Ontario
www.DevosAssociates.com

For more on this topic, please visit ASQ’s website.