I recently conducted an ISO 9001:2008 audit on Management Responsibility, and raised a major NC for section 5.6 Management Review. Currently there is no objective evidence of management reviews being conducted, therefore no records being kept either. We are a British company, with an office in Canada to support DND. Management believes these reviews are not necessary as we don’t have a stand-alone certificate here in Canada. We do have our own Canadian procedures and our own QMS.
My supervisor is the QA appointed representative, and I maintain the QMS under his watch. We have a monthly QIWT (Quality Integrated Work Team) report that we must submit to our QA representative in the UK on a monthly basis. I write the report, my supervisor reviews it (not documented) and it is then emailed to the UK. This report includes:
- Current year’s objectives (status)
- Documents up-issued within the period
- Audits conducted within the period
- Any open/delinquent nonconformance’s
- Audits planned for the next 3 months
- Any open/delinquent product nonconformance’s
Top management believes this should not have been raised as an NC, and that this report covers off the requirements listed in the standard for management reviews. Any feedback would be greatly appreciated.
You are correct. The report as you describe it does not constitute evidence of management review. It would count as management review input, but a meeting needs to be held, and conclusions drawn, decisions taken and a record of that meeting retained. Having an independent certificate is irrelevant – the auditor is coming, likely because you have a corporate certificate, and are one of the sites identified on that certificate.
The good news is that you found this now. The bad news is that you found this well ahead of the audit, with lots of time to correct the issue. If your audit had been closer to that of the registrar, your audit would have been sufficient identification of an issue that was being managed internally. In this case, you have sufficient time to address the issue.
Not having access to your management review procedure is a problem – depending on how it is written, this could be either a major or minor issue. If each location is expected to conduct an independent management review, then you are correct, in that it will be a major non-conformity. If the procedure specifies one management review for the entire corporation / registered entity, then the report may be sufficient input to the management review process. If the procedure is vague, then the non-conformity will likely be a minor.
Have a really close look at your management review procedure. At the very least, this should open up a constructive discussion regarding the extent and boundaries of the management review process. Well done!
- Ted Uffen, BRC Quality Consultant