Tom Taormina Historically, outsourcing is one of the most misunderstood concepts in QMS implementation and operation. Prior to ISO 9001:2015, the requirement for outsourced processes was limited to a few sentences in 4.1 (find more information in the article How to control outsourced processes using ISO 9001). Using a case study, I will present my experience on how understanding outsourcing according to ISO 9001 is of key importance for a company.
Some history first for better understanding
ISO 9001:2008 clause 4.1 was so vague that a guidance document was needed. It was the subject of so many interpretations that Technical Committee 176 of ISO published guidance document ISO TC/176 SC 2/N 630R2, Guidance on ‘Outsourced Processes’.
The most impactful guidance from that publication was the definition that an outsourced process is one that the organization may conduct internally, but has chosen to subcontract the work to an outside organization. It goes on to provide verbiage that the company must exhibit the same level of control over outsourced processes as they would within their own QMS.
Fortunately, ISO 9001:2015 has relocated this requirement to 8.4 (Control of Externally Provided Processes, Products and Services), where it more logically belongs in the standard. Unfortunately, it again stops short of clarifying a key element that an outsourced process must be controlled to the same degree that the process is controlled within your organization.
The story of BIG and Naïve
The following case study will dramatize the importance of control of outsourced products and provide a practical basis for understanding its application and consequences.
A large international company developed a philosophy of outsourcing some of their manufacturing to smaller machine shops. Their noble plan was to help local businesses grow their capabilities and expand their client base. We will call this company BIG.
They identified a company that had machining capability for an entirely different market segment. We will call them Naïve.
The purchasing agent from BIG was eager to meet his target for qualifying new machine parts providers when he approached Naïve. In his initial interview, Mr. Big was impressed by the craftsmanship he saw and the quality of work they produced with modest machining equipment.
It all began with large order
Mr. BIG enticed Naïve with an initial order for a large quantity of machined parts. He implied that they would need to purchase a larger CNC work center to handle the quantities and delivery needs. He also stated that Naïve would have to become certified to ISO 9001:2008 and undergo an audit by BIG’s quality department. Mr. Big offered Naïve a quality manual template and instructed them to just copy the content and change the context to their organization.
Having no quality management experience, the principals at Naïve created a quality manual and attempted to implement the process controls required by the Standard. The BIG quality representative performed an initial audit, created a list of major and minor nonconformities and gave Naïve tentative approval for the first production run.
Naïve was overwhelmed with the audit report and found a QMS consultant who informed them that they were nowhere near compliant with the Standard. The QMS consultant rewrote the quality manual and trained the principals on the resources they would need. Naïve purchased the CNC work center and produced hundreds of parts.
The problem came when BIG refused to pay
The incoming inspector at BIG, who was following their documented procedures, rejected all the parts. The raw material BIG provided to Naïve had not been tested and was not to specification. BIG had a set of special gauges to inspect the parts that were not provided to Naïve. The entire lot was determined to be scrap.
BIG refused to pay Naïve for the order. The situation rapidly deteriorated and lawyers were retained. An expert report was written on behalf of Naïve. The requirements of ISO 9001:2008 4.1 were cited along with an expert opinion that Big did not follow their own supplier approval requirements. BIG was found to have circumvented their own documented procedures within their ISO 9001:2008 QMS regarding outsourcing.
The lesson from this case for outsourcing is that the organization must virtually duplicate their QMS requirements, operational procedures, inspection and testing procedures, and go/no go criteria at the supplier’s facility. They must ensure that the subcontractor has the same competencies as those who perform those processes in house.
The other critical lesson is that BIG’s QMS was even more grossly out of control by allowing a purchasing agent to circumvent their own supplier approval procedures, a major nonconformity.
Call to Action
Clause 8.4 in ISO 9001:2015 is critical to the success of your QMS and your company. As you implement and audit the requirements, pay particular attention to how you structure the approval and monitoring of the various types of suppliers that you use. When buying off-the-shelf part numbers, the responsibility is on your organization to ensure that they are fit for use and that the suppliers continually deliver conforming commodities. When outsourcing services, your supplier must mirror the process controls that you have in-house. You have the obligation for ensuring that their operators are competent and that their processes are continually producing acceptable products or services.
If your organization does contract services for other companies, it is your obligation to ensure that your QMS meets all of the requirements of the organization you are providing services to. As you fulfill the requirements of 8.2 (Requirements for Products and Services), it is your duty to ensure that all controls are in place before accepting an order for contract services.
The bottom line is this: if there is controversy over the product or service, the company that outsources services cannot abdicate their responsibility for conformance to a subcontractor.
Learn more about ISO 9001 implementation in this free ISO 9001:2015 Implementation diagram.
