Heat Treatment Without a Current Certificate
A precision machining company outsources heat treatment to Supplier H. The purchase order states 'heat treat to 58-62 HRC per customer drawing' but does not identify the drawing revision. Supplier H's ISO 9001 certificate expired three months ago and no re-certification evidence is on file. Incoming inspection is visual only; hardness testing is performed by Supplier H and reported on its certificate. Two customer complaints in six months relate to parts below the hardness specification, and one field failure occurred. The purchasing manager says Supplier H has been good for 10 years and the certificate is 'just paperwork.' Supplier H was approved in 2017 and has not been re-evaluated. There are no supplier performance monitoring records and no supplier audit reports.
1. Identify the likely nonconformities and the relevant ISO 9001 requirements.
Read the worked answer
Likely nonconformities: (1) 8.4.1 - the organization has not controlled the externally provided heat-treatment process. Supplier H's approval has not been reviewed since 2017, its ISO 9001 certificate expired three months ago, and there is no performance monitoring. (2) 8.4.3 - verification of purchased product is not sufficient: incoming inspection is visual only, while hardness is a special characteristic verified solely by the supplier. (3) 8.4.2 - purchasing information may not be adequate if the order does not identify the drawing revision and hardness specification clearly.
The expired certificate is not automatically a nonconformity unless certification was a condition of approval, but it triggers re-evaluation. The two complaints and field failure are evidence that the control is ineffective.
2. Evaluate whether supplier approval and verification are adequate. What evidence should the auditor sample?
Read the worked answer
Supplier approval is not adequate. The organization has no records of supplier performance, no re-evaluation, no audit, and no independent hardness verification data. The auditor should sample: approved supplier list and approval criteria; purchase orders and drawing revisions; supplier certificates and test reports; incoming inspection records; complaint and field-failure investigation; supplier corrective actions; and any customer-specific requirements for special processes. The auditor should also check whether Supplier H subcontracts heat treatment.
The key question is whether the organization can demonstrate that supplied parts meet hardness requirements before release, not whether the supplier is long-standing or likable.
3. Classify the findings and recommend actions. What is the audit conclusion?
Read the worked answer
Classification: major. The failure is systemic in the control of a special process, and there is evidence of field failure and repeated complaints. It is not a single paperwork lapse.
NC statement: 'The organization has not effectively controlled the outsourced heat-treatment process. Supplier H was last approved in 2017, its ISO 9001 certificate expired three months ago, no supplier performance monitoring or re-evaluation was performed, and incoming verification is limited to visual inspection although hardness is a customer-critical characteristic. Two complaints and one field failure related to low hardness have occurred.'
Corrective action: re-approve Supplier H with objective evidence, update purchasing information with drawing revision and hardness requirements, add hardness verification or validated supplier test reports, monitor supplier performance, and audit the supplier. Certification should not be recommended until containment and corrective action are verified.