8.4.2.3 Supplier quality management system developement

As far as I know, nowadays ISO 9001 certification has become a must instead of a plus during the supplier selection process. However for the IATF 16949 certified small-scale company, in order to bring down the cost, it may choose some suppliers without ISO 9001 certification. (I think it is possible.)
As an IATF 16949 certified company, no matter how small its size is, if its supplier is not certified to ISO 9001, according to the subclause 8.4.2.3， it should be "authorized by the customer (e.g., item a) below)”, and item a）"is compliance to ISO 9001 through second-party audits;”

My question is the second-party is referred to as the customer or the company? If it is indeed refered to as the customer, is it possible the customer will do this second-party audit for the company in the real life? Or this small-scale company`s only choice is to find a ISO 9001 certified alternative？

 

Basically what that is saying is that you, the middle man, needs to audit the supplier for ISO compliance and get your customer to approve that supplier. Going to be a real headache for some of us who use mom & pop suppliers for 20+ years without incident.

 

20+ year-old suppliers! That is impressive!

 

In ISO 19011:2011 (Guidelines for auditing management systems), there's a table that clearly defines "second party audit". See the Table below:

 

@tony s
According to the content from ISO 19011:2011, as you mentioned above,
the customer is the company`s second party, and the company is the supplier`s second party. Right?
What`s more, if I am correct, the supplier is the customer`s tier-two supplier (subcontractor).
So the Second-Party here is refered to as the customer or the company?
My first idea is that if the subject is the company, the second-party is the customer;
if the subject is the supplier, then the second-party is the company.

 

I believe you're over thinking. Clause 8.4.2.3, which is titled "Supplier quality management system development", intends to make the organization's external provider of auto products/services to be compliant to ISO 9001 and, eventually, certified to IATF 16949. For 8.4.2.3a, second party audit here means that an organization must perform audit of their external provider's system against the requirements of ISO 9001:2015.

The term "organization" refers to the entity to which IATF 16949, even ISO 9001, applies. This was already established since the 2000 version of ISO 9001. The supply chain is described as: SUPPLIER -----> ORGANIZATION -----> CUSTOMER. The 2015 version of 9001 equates "supplier" to "external provider".

 

Small comment - organization shall audit own external providers or there is option to outsource auditing process to other site of same corporation or certification body who can perform third party audit on behalf of organization. Latest option was already "proposed" from a long time in case of "receiving inspection" - see now 8.6.4 c)

Additionally, one anecdote I've heard from my colleague.
One IATF 16949 certified organization purchased 3d measuring machine from its manufacturer.
Then they were looking for calibration service supplier for this equipment.
They've selected 3d measuring machine manufacturer.
Manufacturer was not 17025 accredited so organization told him: "Ask us for approving you as calibration service provider for this equipment".
Manufacturer submitted to organization official letter and was approved.
Organization's rationale - purchaser of 3d measuring machine from its manufacturer is naturally customer.
This is how "customer" in 7.1.5.3.2 can be misunderstood.

 

@Serious Man

Hi, Sir. the sub cl. 8.6.4 said that "The organization shall have a process to ensure the quality of externally provided processes, products, and services utilizing one or more of the following methods;". So auditing own external providers or outsourcing it may be one of the option of controlling the suppilers, right?

And regarding the anecdote you mentioned, the way the organization thinking of the term of "customer" seems to be wrong. So what is the proper way to do the calibration it if it is hard to find a 17025 certified organization to do that? I think the machine manufacturer is the natual candidate without further approval, am I right?

 

The "purchaser" here, in the context of the standard, is the "organization" and not the "customer".

 

What about suppliers that produce a product that does not go into the part only assist in making the part

 

Let's subject your product to the following questions?

1. Is your product intended for incorporation to your customer's product? (8.4.1a)
2. Does your product/service being provided directly to your customer's customer on your customer's behalf? (8.4.1b)
3. Is your product/service a "process" or part of a "process" your customer opted to outsource from your organization? (8.4.1c)
4. Does your product/service affect your customer's customer requirements such as subassembly, sorting, calibration? (8.4.1.1)

Any YES answer to the above questions will compel your customer to apply 8.4.2.3 to your organization.

 

Hi Tony, I need to consult about IATF 8.4.2.3 Supplier QMS Development.

We are tier 2 supplier for automotive OEM. We use chemical materials (raw materials) to make interlayer film product. We sell the film product to the tier 1 suppliers and they use our film product to make laminated safety glasses (the windshield) and sell it to car manufacturers. We have a situation that we purchase a couple of raw chemical materials through a distributor (or we can called it supplier) but this distributor is not registered to ISO 9001 as they are not the manufacturer of the chemical material. The real manufacturer of the raw chemical materials has the ISO 9001 certificate. This distributor does not repack the material, but they are still responsible for the material quality as we purchase it from them. In this kind of situation, can we still use that distributor (no ISO 9001 certification)? You information is deeply appreciated.

 

Hi Andy, thank you for your information. Of course, we can ask our distributor to see if they plan to register for ISO 9001. We plan to do IATF certification audit next year, and not sure if auditor will be ok with 1 distributor is not registered to ISO 9001. I heard one company has a similar situation like us and they got a minor NC because 1 distributor (or call supplier) which they purchase several raw materials from does not has ISO 9001 certification.

 

While he may have no business sense, he is being directed by the IATF standard. IATF requires all suppliers to be ISO 9001 certified unless approved by the customer. https://www.iatfglobaloversight.org/wp/wp-content/uploads/2019/10/IATF-16949-SIs_Oct2019-1.pdf
So if Susan wants to "pass" her IATF audit she needs to get customer approval for the distributor as a supplier.

 

That's fine and you'll be hit with a non-conformance and doing a corrective action. My advice is to just get customer approval.