1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice
You must be a registered member in order to post messages and view/download attached files in this forum.
Click here to register.

NC-CA Procedure

Discussion in 'ISO 9001:2015 - Quality Management Systems' started by jamescrockford, Oct 31, 2018.

  1. jamescrockford

    jamescrockford Active Member

    Joined:
    Aug 1, 2017
    Messages:
    69
    Likes Received:
    18
    Trophy Points:
    7
    Hi all,

    I'm in the process of writing a procedure to cover a nonconformity and corrective action process for my new company.

    I'm trying to keep things simple but struggling to get my head round/overthinking the process.

    Below is what is in my mind currently;

    Option 1
    1) NC identified
    2) Raise NCR Form
    3) Record NCR in NC-CA Log
    4) Assign NCR Form to Process Owner with deadline (based on risk) for completion of root cause investigation and corrective action implementation.
    5) Once complete, review effectiveness of action taken (short term and long term as required).
    6) If satisfied, close out NCR.

    Does this sound okay?

    Of course, there will be more detail than this in the procedure.

    The bit I am struggling to get my head round is item 3. Some companies may set a deadline for the process owner to investigate and propose a corrective action plan, then another deadline set for the proposed corrective action to be implemented.

    I'm wandering how other people handle this?

    Any help would or advice would be much appreciated!

    Thank you!
     
  2. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Firstly, I'd keep them separated - by a long distance, too!

    If you closely link non-conformance control, you'll drive CA for any and all non-conformities and will end up overwhelming the organization. It's inappropriate and unnecessary. Deal with non-conformities and then use the inputs of that to analysis of data to then drive CA.
     
    judegu likes this.
  3. Golfman25

    Golfman25 Well-Known Member

    Joined:
    Nov 6, 2015
    Messages:
    816
    Likes Received:
    402
    Trophy Points:
    62
    Yep, what Andy said. Find a non-conformance -- dispose of it as appropriate. If it is worth of a formal 8D type corrective action, then have at it. Many issues are not. As for set timelines, I don't necessarily like them. I would develop a time line for status updates and reviews, rather than specific 8D milestones. Good luck.
     
    Andy Nichols likes this.
  4. jamescrockford

    jamescrockford Active Member

    Joined:
    Aug 1, 2017
    Messages:
    69
    Likes Received:
    18
    Trophy Points:
    7
    Many thanks for your feedback guys, I completely agree with what you are saying with regards to not initiating corrective action for all identified nonconformities but not sure how to set the system up in that manner?

    What forms/logs would I need?
     
  5. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Well... It sorta depends on what volume/type/mix of product(s) you have...

    One thing I believe you should have (for highish volume production) is a simple defect tracking log - think scatter diagram or similar - for quickly recording what the defect type/qty/location is. To have people filling complex non-conformance or reject forms all the time is something which gets in the way of accuracy.
     
  6. jamescrockford

    jamescrockford Active Member

    Joined:
    Aug 1, 2017
    Messages:
    69
    Likes Received:
    18
    Trophy Points:
    7
    Hi, we certainly are not high volume. We are not a manufacturer rather an IT company that provide a computer system (ERP essentially) for inventory management amongst other applications. We have a support desk who resolve support calls from customers which can turn into problems which need investigating and resolving (all recorded). I expect trends from this data to be an input into the NC & CA process. That aside we have the usual audit findings, customer complaints, management review actions, supplier issues and internally identified NC's.

    I'm from a manufacturing background so understand what you are saying, just trying to work out the best way forward for here.
     
  7. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Good stuff. In that case, I'd be monitoring the types of help desk tickets (why were they started) and then looking at the SLA to see what responsiveness criteria are used and how off that the service actually is. That type of thing. You can chart those too, or even dashboard them
     
  8. jamescrockford

    jamescrockford Active Member

    Joined:
    Aug 1, 2017
    Messages:
    69
    Likes Received:
    18
    Trophy Points:
    7
    Those types of issues are well documented in our system and dashboards are part of the software we used to record support tickets. I will make sure that reports out of this form an input into the NC/CA procedure but its the next step I'm struggling with.

    The above will be one input to the system and relates to our product, but there will be other inputs such as customer complaints, audit findings, supplier issues and management review action items. How should all of these be reported and recorded (previously for me its been on a NCR or CAR to myself to record then assign to appropriate people for action) but the bits I am getting my knickers in a twist about are;

    1) Do all reported NC's go into the log
    2) How do we decide/who decides if CA is required?
    3) Who determines deadlines for CA if required?
    4) What forms are used? Who does what?
     
    Andy Nichols likes this.
  9. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    1) Audit
    2) Look at trends which indicate objectives aren't met/customers aren't happy
    3) Process owner(s)
    4) I'm not sure it's about "forms", rather it's about data and derived information which management use. Management need to work who does what out.

    It sounds like you need a problem statement to know what to fix...
     
  10. jamescrockford

    jamescrockford Active Member

    Joined:
    Aug 1, 2017
    Messages:
    69
    Likes Received:
    18
    Trophy Points:
    7
    1) Audit? Not sure how you mean? When a possible NC gets reported, review it and decide if it should go into the log?
    2) Understood - Also initiate CAPA based on magnitude of issue/risk
    3) Great, thought so.
    4) How should we document details of NC's and CA? Previously I've done this on a NCR form and register. Agree that Management need to establish roles and responsibilities.

    Is there a good way for issues/NCs to be reported into me? Again, previously this has been done on a form that I then assign a number from a master spreadsheet and then forward it onto the assigned person.

    Also, going back to that decision of what to record and whether CA is required...lets say I did an audit of the sales process and raised 5 NCs and 3 OFI's. Usually I would raise forms for each findings, log in the master spreadsheet, issue to the assignee etc. This is adding all of my findings to the CA process though which isn't necessarily required?
     
  11. tony s

    tony s Well-Known Member

    Joined:
    Sep 10, 2015
    Messages:
    1,350
    Likes Received:
    1,054
    Trophy Points:
    112
    Location:
    Laguna Philippines
    IMHO nonconformities inherent with the products/services can be considered as defects (see 3.6.10 of ISO 9000:2015). I deal with this kind of nonconformity as per 8.7 of ISO 9001:2015. I don't automatically trigger CA for this. I use this kind of form (see below).

    upload_2018-11-2_11-8-47.png

    The person who will decide to initiate CA should base his/her decision on the criteria defined by the organization. If the decision is to proceed with the CA process, then another form will be used. Usually, the CA form is used for various sources of nonconformities (e.g. audit finding, complaints, problems with suppliers, regulatory noncompliance, etc.). I have now to deal with this issue as per 10.2 of ISO 9001:2015.
     
  12. jamescrockford

    jamescrockford Active Member

    Joined:
    Aug 1, 2017
    Messages:
    69
    Likes Received:
    18
    Trophy Points:
    7
    Okay so in my situation we could look at our support system as the product NC collector and major or common themes from that system can feed into the CA system along with our internal audit/external audit findings and true customer complaints plus perhaps major or common supplier issues and other areas such as information.security incidents?

    This way we have deemed when CA is required and not for every single NC. I understand this from a product defect perspective but still not sure on say audit findings and internally reported NC’s i.e so they all require CA?
     
  13. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Let's differentiate the QMS internal audit process and that of the external audit process (which has different objectives etc - but is often used as the model for auditor training). A key feature of the 2 types of audit i.e. internal vs external is that external audits are a time limited sample, done by someone who has different objectives, doesn't know the business, who audits relatively infrequently (annually) etc and has limited access to your performance data, customer feedback etc. As a result, they tend to view all audit findings like an iceberg (hence the picture on the front of my book) - they found something, so there's a LOT more under the surface. As a result, it's appropriate to issue Corrective Action requests, since it MUST be a systemic issue (right? If you believe the theory) Internal auditors have the luxury of having waaaaaay more information to hand, so should/could determine how pervasive the issue is. If they write non-conformities, trends and analysis will help to determine when an issue has become systemic in nature (of course, this will also require a robust approach to audit management and not doing one or two audits a year) - and hence management will detect the need for CA.
     
  14. jamescrockford

    jamescrockford Active Member

    Joined:
    Aug 1, 2017
    Messages:
    69
    Likes Received:
    18
    Trophy Points:
    7
    I appreciate that we need to define the trigger(s) for CA. Once the trigger is set, we will raise a Corrective Action Form and record in a log and follow the usual process.

    It is still the bit before that I am struggling with i.e. how we record and deal with nonconformities before the CA process is started, if at all.
     
  15. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    A simple answer is on a non-conformity report. However, that might seem too trite. Depending on a couple of factors - usually risk dependent - you can elect to record "defects" and then decide a threshold to meet, before a non-conformance report is issued. the NCR may not yet trigger a CAR, but would still lead to correction of a situation (potentially, resetting the threshold, for example). Unrelated industry, but by way of illustration:

    A multi-cavity plastic molding line might allow for a threshold of defective parts/hour or /shift. These defective are noted on a scatter chart. At the end of the shift, analysis shows where the defect trends lie and might trigger correction - parts being burned might cause the mold temp to be reduced, for example. The total quantity of parts might be simply scrapped off and replaced. No biggie. At the end of the week of running a report might include all the 5 shifts' data for management to decide on whether a CAR is needed (affecting set up or maintenance, for example.) This was in a relatively low cost part, recycleable part in high(ish) volumes.

    Your criteria will be different
     
  16. jamescrockford

    jamescrockford Active Member

    Joined:
    Aug 1, 2017
    Messages:
    69
    Likes Received:
    18
    Trophy Points:
    7
    I'm thinking that for product issues which our support desk deal with, I request data from them on a regular basis and any major issues/trends get added to our issues list/CA log along with audit findings, customer complaints, information security incidents etc. All will require action but not all will require full root cause investigation and corrective action. This will depend on the nature of the issue and the severity/risk. We could use a major/minor system where majors require RC and CA but minors only an investigation and correction.

    The penny may be starting to drop!
     
    Andy Nichols likes this.
  17. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    A key point, and one which is often overlooked, is your leadership's attitude towards how these situations are handled. Under NO circumstances should they even have the thought of holding anyone "accountable" for identifying issues and recording/reporting them. It should be part of understanding that processes are not perfect and such issues help them to work on a strategy for systemmatically removing the reasons - as process owners - for everyone's benefit.
     
  18. jamescrockford

    jamescrockford Active Member

    Joined:
    Aug 1, 2017
    Messages:
    69
    Likes Received:
    18
    Trophy Points:
    7
    Completely agree and everyone in the business can identify issues and report them. Senior Management will decide the trigger for CA I.e. what warrants it.

    I will be the focal point in terms of people reporting issues into me, assigning issue out to process owners for action or investigation and corrective action where appropriate and then keeping an eye on agreed target dates plus following up the action taken to ensure effective before closing out.

    Issues/trends will be reported at regular management meetings.
     
    Andy Nichols likes this.