Process approach documentation for ISO9001

4.1 a) requires the organization to "Determine the processes needed for the quality management system...". In a recent third party audit I was faced with an auditor who insisted that 4.1 a) meant that my quality policy manual must have a process flow chart similar to the one in the introduction (Section 0.2). Without such a flowchart with my processes identified and cross-referenced to ISO clauses, there was no evidence that we had identified processes. We ended up having a minor non-conformance for this, and she considered if it should be a major non-conformance.

Explanations that the quality policy manual listed the processes that are the basis for the QMS fell on deaf ears. My organization has had ISO9001 registration for 20 years, and has never been asked for such a chart. Has anyone else had a similar experience?

 

It never ceases to amaze me how idiotic some auditors can be. A flowchart would be used as a way of identifying sequence and interaction of the processes. But, even still, a flowchart is not a mandatory requirement. Please review step 5.1.4 of the Guidance on the Concept and Use of the Process Approach for management systems document which reads

I am in agreement that this is a bogus NC as long as you can demonstrate how you comply with 4.1. b) of ISO 9001:2008.

I can almost guarantee this auditor is very early in her maturity journey of this profession. Worthless NC. Push back to the CB is a must.

 

Good luck. I am dealing with a similar NC. We even have separate documents for each process linking them to the clauses, people, metrics, procedures, etc. We can lay them out on a table to create a "virtual process map." That was no good. Appealed to the CB and got absolutely nowhere. Bottom line, while they will deny it, in their eyes you need a "process map" (they even ask for it pre audit) which includes the process as they define them, not us. Suffice it to say this is my last audit with that CB.

 

It is UNBELIEVABLE that we seem cursed to have discussions about process approach and what is required/admissible for the rest of eternity. Sometimes I feel like screaming so we STOP THE INSANITY of PAOCD (Process Approach Obsessive Compulsive Disorder).

Many operational processes might affect product conformity and customer satisfaction. Identify those and the activities within those processes that might lead to non conforming products and customer complaints. Make sure these processes are properly managed from THIS perspective and, voila', you have understood the process approach.

Why ISO fails to develop actionable and pragmatic guidance document on this is beyond me....

 

I am dealing with this one as well. My CB told me that the IATF had a finding against them and thus linearity, bias and stability studies are required.

 

I understand the agony & having been on both sides of the table, understand the problem too well. I have been a QMS auditor with a major CB who took pains to "calibrate" their auditors to ensure consistent interpretation of the clause requirements & didn't get into avoidable arguments with clients. In order to determine the process for developing a Quality Management System, all of the following is considered acceptable
1. Swim-lane diagram that give a visual depiction of the process steps and interaction - This is by far the most complete way where interaction between functions is brought out very well. We can also show what documents are needed & what records are produced at what stage in the process, who needs them & for what. The greatest advantage of a swimlane diagram (also known as functional deployment mapping) is that improvement opportunities become visible. a very useful tool to satisfy the clause requirement on continual improvement!

2. Block diagrams

3. Step by step process description - too much text and process is not "visible"

4. A process interaction matrix: This lesser known of all tools & also the least used. Nevertheless, the matrix can show how processes interact but needs a lot of text to explain the process

Now on the NC...
1. If there is no description of the process, it is an NC against a clause requirement.
2. If description of the process exists, & if the auditor has a view different from that of the client auditee, it can only be an observation. NC can be raised only against a clause requirement and never against good practices.

Hope this helps

 

In my experience, the IATF has "secretly" changed the TS 16949 standard and process maps are now in fact required. It is part of the expectation to provide said process map as part of pre-audit planning. They actually use the term "process map" as a required submission in in the answer to question 31 on page 13.

http://www.iatfglobaloversight.org/docs/Rules 4th Edition_FAQ_June_2015.pdf

I'm not saying, I'm just saying.

 

Looking back at the original post, this looks typical of the issues around evidencing that you have met the requirements of the standard within your implementation and the size and nature of your organisation against satisfying the expectations of the auditor. I have come across an auditor requesting to see how the QMS management processes are implemented and form the management system (i.e the process life cycle within section 0.2), this is something we had; as we maintain a suite of policies that implement the requirements of 9001 and 14001 across the business and thee interation of these policies is documented as a life cycle. However if for the planning of product realisation, process mapping at level 0,1,2 and 3 to either a locally defined standard or recognised standard is not accepted then it's time to rethink your CB or the value of 9001 accreditation.

 

And who sells the core manuals ? Funny how that works.

 

IMHO clauses 4.1a of ISO 9001:2008 doesn't mean anything but to require organizations to determine the processes employed within its QMS while 4.1b is asking to determine their sequence and interaction. The requirement to include a description of the interaction between the processes of the QMS is on clause 4.2.2c. So, the requirement is about "describing the interaction" and not "describing the processes". Note1 of clause 4.1 mentions at least 4 groups of processes where we can describe the interaction. ISO/TS 16949 mentions at least two groups of processes in clause 5.1.1 (i.e. product realization and support). Other interpretations, which I subscribe to, suggest at least three groups such as core, support and management processes. My approach in satisfying clause 4.2.2c is to depict a high-level process map to describe the interactions.