When writing non-conformances, you are meant to identify and record the evidence that you saw to justify the non-conformity. While this is correct, it does have a tendency to drive the wrong behavior in that the evidence that you record is all that gets fixed.
For example, you review a sample of documents and find that two were not reviewed and approved by the correct person. You write this up as a non-conformity stating the two documents you saw. What does the organization do? In many cases, they will correctly approve the two documents that you identified as not being correct and close the non-conformity.
What does the organization do?
In many cases, they will correctly approve the two documents that you identified as not being correct and close the non-conformity.
What should they actually do?
They should investigate the issue to see how big it is; identify why the documents were approved by the wrong person; find out if there are any other documents incorrectly approved; and then put a plan in place to fix the approval process for good.
Auditing a business with multiple locations
Another example, you audit a business that has 9 branch locations. Using the square root rule, you audit the main office, plus three of the branches; you find the same non-conformity at two of the branches but not the third. At the closing meeting where all of the 9 branch managers attend, you issue them with the non-conformance stating the two branches as evidence. When you ask the branch managers what do they intend to do to investigate the issue, the 6 managers from the branches that you didn’t visit state collectively, “It wasn’t at my branch so I don’t have to do anything”.
What they should do of course is go back to their branch to see if the issue is happening there too – and there is a very good chance that it is.
“It wasn’t at my branch so I don’t have to do anything”.
Auditing a manufacturing business
Another instance, you audit a business that manufactures parts, and you find that the ITP (Inspection and Test Plan) has not been completed correctly for one of the parts. You raise a non-conformance, stating the part as evidence. The business explains that they will quarantine those parts and investigate how this could have happened, and then correct or discard any incorrect parts. You ask about the other products they make, and they explain to you that you only identified an issue with that part, so there is no need for them to check any of the others.
However, what they should do, is take a sample of their other parts and see if the problem is there too. It most probably is.
…take a sample of their other parts and see if the problem is there too. It most probably is.
What has ISO done about this? Well, it must be an issue with many organizations because in clause 10.2 Nonconformity and corrective action in both ISO 9001:2015 and ISO 14001:2015 it now includes,
“Evaluate the need for action to eliminate the causes of the nonconformity, in order that it does not recur or occur elsewhere…”
It requires the business to identify the root cause of the non-conformity and fix it permanently. To avoid further non-conformances, the business should properly investigate the process and find out what doesn’t actually work.
Can you think of any more examples? Let me know via the contact form.