Northbridge Precision: a risk register nobody uses
Northbridge Precision (240 staff) machines components to customer drawings. In the opening meeting the site manager says risk-based thinking is "fully embedded". The auditor finds a risk register with 18 entries, owned and updated quarterly by the quality manager alone; no production supervisor has seen it. Departmental KPIs (scrap %, on-time dispatch) are reported monthly, but no measure spans the sales-to-planning handoff. A late-delivery complaint traced to that handoff: sales confirms a due date without checking capacity, planning finds the conflict two weeks later, and no one owns the interface. Process maps exist for 12 processes but were produced by a consultant in 2021 and not revised after the 2023 layout change. One internal audit in the last 12 months covered planning.
1. The site manager claims risk-based thinking is embedded. Evaluate that claim against clauses 6.1 and 4.4.1. What do you conclude, and what evidence might still change your conclusion?
Read the worked answer
What the standard requires. Clause 6.1 requires the organization to plan actions addressing risks and opportunities and to integrate and implement them into its QMS processes (6.1.2), then evaluate their effectiveness. A register is one possible output, not the requirement.
Applying it. The register is held by one person, unseen by process owners, and no process appears to have changed as a result. That is a strong indicator actions are not integrated - but it is an indicator, not yet a nonconformity.
Verify before concluding:
- Do process owners describe risks and their operational mitigations (capacity buffers, dual suppliers, escalation rules)?
- Are risks reflected in quality objectives (6.2) and management review inputs (9.3.2 e)?
- Can any register entry be traced to a documented process change or resource decision?
Conclusion. If all three come back empty across sampled processes, raise a nonconformity against 6.1.2 - minor if no product or customer impact is shown, since the system's ability to achieve intended results is weakened rather than demonstrably failed. If risks are managed informally but demonstrably, an opportunity for improvement is the defensible output. Never issue solely because a register looks unused.
2. The auditee calls the handoff problem "a personnel issue - sales should check with planning". How does the process approach change your investigation?
Read the worked answer
Reframe from person to interface. Under 4.4.1 the organization must determine process inputs and outputs, sequence and interaction, criteria and methods, resources, responsibilities and authority, and the risks. Here the sales–planning interface has no assigned owner, no criterion for accepting a due date, and no measure - KPIs stop at departmental boundaries.
Investigate the interface, not the individual: sample 4–5 recent orders and trace the date-commitment step. Ask who is authorized to confirm a date, against what capacity data, and what happens when capacity is unavailable. Look for a documented criterion and evidence it is followed.
Likely finding. If the interface is undefined and 4.4.1 c) (criteria and methods) and e) (responsibilities and authority) are not met, the finding is against 4.4.1. The behaviour is a symptom; the absence of process design is the condition. This also gives top management a systemic corrective action rather than a disciplinary one.
3. Would you raise a nonconformity for the 2021 process maps? Justify your decision against 4.4.1 and 7.5.2.
Read the worked answer
Ask what the maps are for. 7.5.2 requires documented information necessary for the effectiveness of the QMS.
If obsolete maps drive work - staff route jobs by them, or they are the only description of sequence and interaction - then the 2023 layout change made them wrong and they produce incorrect operation: nonconformity against 4.4.1 with 7.5.2 as supporting evidence.
If actual control runs through ERP routing, work instructions and training, and the maps are an unused consultant artifact, the nonconformity is weak. The question becomes whether the information is necessary at all; updating or withdrawing it is an opportunity for improvement.
Three checks decide it: are the maps referenced anywhere (induction, customer contracts, internal audits); does any route described differ materially from the current layout; has any employee used them in the last year. Impact, not age, determines the finding.