iso 9001 outsourced processes

7/29/2019 ISO 9001 Outsourced Processes

http://slidepdf.com/reader/full/iso-9001-outsourced-processes 1/3

ISO 9001 Outsourced Processes

Everything You Need To Know About Meeting ISO 9001 Requirement

For Outsourced Processes

What is the ISO 9001:2000 requirement for outsourced processes?

This article provides guidance on the intent of ISO 9001:2008 clause 4.1 on thecontrol of outsourced processes. ISO 9001:2008 clause 4.1 states:

Where an organization chooses to outsource any process that

affects product conformity to requirements, the organizationshall ensure control over such processes. The type and extentof control to be applied to these outsourced processes shall bedefined within the quality management system.

NOTE 2: An “outsourced process” is a process that theorganization needs for its quality management system and

which the organization chooses to have performed by anexternal party.

NOTE 3: Ensuring control over outsourced processes does notabsolve the organization of the responsibility of conformity toall customer’, statutory and regulatory requirements. The type

and extent of control to be applied to the outsourced processcan be influenced by factors such as:

a) the potential impact of the outsourced process on theorganization's capability to provide product that conforms torequirements,

b) the degree to which the control for the process is shared,

c) the capability of achieving the necessary control through theapplication of 7.4.

What is the definition of an outsourced process?

An “outsourced process” is a process that the organization has identified as being needed for its

operations and quality management system (QMS), but one which it has chosen to be carried out by anexternal party outside the managerial control of your facility and may not be subject to the same QMS asyour organization.

An outsourced process may be performed by a supplier that is totally independent from the organization,

or which is owned by the same parent organization (e.g., a separate department or division not subject tothe same QMS). It may be provided on-site within the physical premises or work environment of theorganization or off-site at an independent site.



Examples of such processes include: - strategic planning done at head office; purchasing or design done athead office or another location; heat treating; painting; welding, calibration; testing; sort; human

resources; information technology; etc., peformed by an outside organization. A manufacturing companymay outsource welding, heat treatment or painting of product. A software company may outsourcesoftware development. A bank may outsource check clearing services.

How should outsourced processes be controlled? The intent of Clause 4.1 is to emphasize that when an organization chooses to outsource (permanently or temporarily) a process that affects product conformity with requirements, it cannot simply ignore this

process or exclude it from the QMS. The organization has to demonstrate it exercises sufficient control toensure the process is performed according to the relevant ISO 9001:2000 requirements, as well as, the

requirements of the organizations QMS.

The nature of control will depend on the importance of the outsourced process, the risk involved, and the

competence of the supplier. Also, the outsourced process will interact with other processes (either carriedout by the organization or outsourced). These interactions must be managed as required by ISO

9001:2000 clauses 4.1.a and 4.1.b.

The outsourcing of a needed process will normally be subject to the requirements of both ISO 9001:2008clause 7.4 (Purchasing) and clause 4.1 (General Requirements). In some situations, the organization might

not actually “purchase” the outsourced process. It might receive the service from head office or fromanother division, without a monetary transaction taking place. Regardless of these circumstances, ISO9001:2008 Clauses 7.4 and 4.1 are still applicable.

An organization will typically face two situations that frequently must be considered when deciding the

appropriate level of control of an outsourced process:

1. Where an organization has the competence and ability to carry out a process, but chooses to outsourcethat process (for commercial or other reasons), the process control criteria should already have beendefined and can be transposed into requirements for the supplier to comply with, if

necessary. Evidence of compliance to such defined requirements should be obtained from the

organization providing the outsourced activity.

2. Where the organization does not have the competence to carry out the process itself, and chooses tooutsource it, the organization has to ensure the controls proposed by the supplier of the outsourced

process are clearly defined and are adequate. In some cases, it may be necessary to involve externalspecialists in making this evaluation. Evidence of compliance to such defined requirements should be

obtained from the organization providing the outsourced activity.

It may be convenient, or even necessary, to define some or all of the methods to be used for control of theoutsourced processes in a contract between the organization and the supplier. Care should be taken,

however, not to inhibit the supplier from proposing innovations to the outsourced process.

In some situations, it might not be possible to verify the output from the outsourced process bysubsequent monitoring or measurement. In these cases, the organization needs to ensure that the controlover the outsourced process includes process validation in accordance with ISO 9001:2000 clause 7.5.2.

Important tips

1.Make sure you include all outsourced processes affecting product quality, in the scope of your QMS.You must be able to identify, define and demonstrate evidence of sufficient controls over outsourced

processes to ensure that such processes are performed according to the relevant requirements of ISO9001:2008. The nature and scope of such control will depend on the nature of the outsourced or



subcontracted process and the risk involved.

2.Outsourced processesmay be controlled in any number of ways, e.g., providing the outsourcer with product specifications; your supplier quality manual that they must meet; asking for inspection and test

results or certificates of compliance; validation of outsourced process; conducting product and QMSaudits of your outsourcer; providing drawings, checklists and forms, etc. The expectation here is that you

flow down to your supplier, the relevant ISO 9001requirements that you would have to implement had the process been performed in your own facility under your QMS control.

Where can I get further help?

This article is an excerpt from my eBook, “Understanding ISO 9001:2008”. This book provides acomplete and in-depth coverage of all ISO clause requirements and well as key quality management

principles and concepts. It is an excellent guide for QMS development, maintenance or improvement.

Need Training or Consultancy help?

Ask Art Solutions has significant expertise in all of the implementation steps and can help you fast track your way to an effective and profitable QMS. If you need help in developing or implementing your ISO 9001:2000 QMS, please call us at 905-593-8867 for a no obligation review of your needs.

Your Feedback is valuable

If this article was informative or if you would like to provide feedback, do send us an email with your comments.

If you feel this FAQ could help your supplier, customer or other business associate,feel free to refer our website to them or other business associate, feel free to referour website to them.

iso 9001 outsourced processes

Documents