1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice
You must be a registered member in order to post messages and view/download attached files in this forum.
Click here to register.

Change Control Process

Discussion in 'ISO 9001:2015 - Quality Management Systems' started by jamescrockford, Nov 30, 2018.

  1. jamescrockford

    jamescrockford Active Member

    Joined:
    Aug 1, 2017
    Messages:
    69
    Likes Received:
    18
    Trophy Points:
    7
    Hi guys,

    A recent customer audit (on us) highlighted that whilst we have a change control process in relation to the product and development, we do not have one for changes to e.g. key personnel, buildings, systems, equipment and processes.

    In reality, the high level changes that they are talking about would be handled by the board and I may never know anything about them until they are announced. The changes would of course be controlled and risks/impacts addressed during the process.

    Our customer is looking for us to produce a procedure which typically would have associated forms such as a change request note and change request log but I am not convinced that a change to say the MD or a move to another premises would ever realistically go through this process.

    Lower level changes to say procedures could go through such a process however we use our non conformance/observation/ofi system to handle these.

    What I don't want to do, is bring in a system that is not going to be used as is not appropriate.

    Your thoughts as always would be much appreciated.

    Thanks in advance!
     
  2. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    What role does the customer auditor play in contractual obligations? Frequently, customer QA people have grand ideas but zero "clout" with Purchasing, for example...

    Clearly, if you have an ISO 9001 compliant QMS, you have to have a change control process which has a focus on "Operations". It's taking a leaf out of the FDA/Automotive/Aerospace world where, having established robust and capable process controls, you should LEAVE THEM ALONE unless you have a formal change process. To suggest it applies to all the things listed is bizarre and frankly, silly - for the reasons you cite.

    If the auditor has no "clout", tell them to pack sand...
     
  3. jamescrockford

    jamescrockford Active Member

    Joined:
    Aug 1, 2017
    Messages:
    69
    Likes Received:
    18
    Trophy Points:
    7
    Understood Andy, I will find out.

    As per my original message, we have a change control system in place for changes to the product requested by customers/employees but this does not cover the areas such as key personnel, buildings etc. Our customer is in the FDA industry (albeit the UK/EU equivalent) and so will have tighter requirements around change control as you mention. We are not in that industry (yet) although may be down the line.
     
    Andy Nichols likes this.
  4. jamescrockford

    jamescrockford Active Member

    Joined:
    Aug 1, 2017
    Messages:
    69
    Likes Received:
    18
    Trophy Points:
    7
    Going back to this one Andy. We have a system with procedure in place for changes to our product/its development which includes a change request note and log. Would you say this is sufficient and to bring those higher level type business changes into the same type of system would be impractical.
     
  5. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Totally. One is strategic in nature, the other (very) tactical.
     
  6. jamescrockford

    jamescrockford Active Member

    Joined:
    Aug 1, 2017
    Messages:
    69
    Likes Received:
    18
    Trophy Points:
    7
    Okay, so change control for those types of changes should be managed in the board room and not on a change request note?!

    Perhaps within the change control procedure I could add a comment to make this clear along with a phrase that "risks and impacts will be considered".
     
    Andy Nichols likes this.
  7. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Indeed! Management review is the place to consider the impact of changes which are going to affect the QMS (and what doesn't?), so you could then update your "internal and external issues" etc and also deploy the changes arising from strategic planning into deployable tactical (process) planning, through a change plan & notification
     
  8. John C. Abnet

    John C. Abnet Well-Known Member

    Joined:
    May 23, 2017
    Messages:
    709
    Likes Received:
    510
    Trophy Points:
    92
    Location:
    Upper Midwest- USA
    You're getting very good council @jamescrockford .

    I would add, however, be sure your organization (not just YOU), asks themselves the question, "what do WE need in order to control change?" Are the items currently "excluded" within your organization's change control system controlled in the manner needed? If not, THEN you can consider if/how to improve that process. Remember, let the standard and the organization's needs be the guide, not the auditor.
     
  9. Neo113016

    Neo113016 Member

    Joined:
    Jul 9, 2018
    Messages:
    42
    Likes Received:
    6
    Trophy Points:
    7

    If your current processes are able to manage the changes to your key personnel, buildings, systems, equipment and other process then that is enough and you have a documented transition plan and minutes of the meeting with the affected managers then much better.