ISO 9001: 2008 auditing issues

I conducted ISO 9001: 2008 internal audit for my company previously and there is a finding on retention period issue for a quality record. The document owner (from IT dept) refused to include the retention period of the record as the task is done annually once. When the task is carried out, a record will be added in the form. There are 15+ lines in the form which means that it can last for the next 10 over years (1 year 1 record). In this matter, it is quite difficult for the owner to indicate a figure for the retention period, can I have your advice on this matter? Thanks!

 

It is for one of our system validation procedure. This system is an important system used to store all our production data. Once IT guys done the yearly validation, they need to sign off the validation form (one year one record).

 

Just to clarify, is the retention period intended for the form that is designed to last for more than 10 years or the records that are logged into the form?

Although ISO 9001:2008 mentioned retention, this doesn't necessarily mean that there must be a definite time limit that must be set for all records. Retention of records will depend on the need of the process owner or the organization concerning their records. They may opt to declare a retention period of "n/a", "as long as the company exists", "as long as the worker is employed", etc.

 

This may no longer valid, eventually, since the 2015 version in clause 7.5.3.2 specifies:
"For the control of documented information, the organization shall address the following activities, as applicable:
a) distribution, access, retrieval and use;
b) storage and preservation, including preservation of legibility;
c) control of changes (e.g. version control);
d) retention and disposition."

 

The Auditor might find it "applicable" for a certain information though.

 

Since the ISO 9001 standard is littered with subjective phrases such as "where applicable", "as applicable", "as necessary", and "as appropriate", it's left to the organization to determine and decide "applicability", "necessity" and "appropriateness" and NOT by the auditor.

Before clause 7.5.3.2 it is clearly stated in 7.5.1 that:

The organization’s quality management system shall include:
a) documented information required by this International Standard;
b) documented information determined by the organization as being necessary for the effectiveness of the quality management system.​

An auditor would find him/herself "out of line" if he/she determines for the organization what is applicable or not.

 

An Auditor is duty-bound to verify the Client Organization's ability to judge the "applicability" factor, I thought. That's what he's paid for at least.

 

Since auditors need to evaluate objectively, they cannot just impose to any organization what the auditor's consider "applicable or not applicable" to the organization. If an auditor find him/herself in a situation where an organization's claim of "non-applicability" is difficult to accept based on his/her knowledge and experience, the auditor should ask first him/herself: “Would the absence of the “as necessary, as applicable or as appropriate” put the organization at risk of not meeting the organization's customer or applicable statutory and regulatory requirements?”
A “YES” answer supported with objective evidence will establish the “applicability”, “necessity” and “appropriateness”.

 

Am in complete agreement there. That's perhaps one reason why I used "might" in my earlier statement. Just a possibility.