Design excluded on paper, performed in practice
Tarnfield Conveyors designs and installs conveyor systems for food factories. Its ISO 9001:2015 certificate scope reads: manufacture and installation of conveyor systems; design excluded, customer designs used.
During the audit of a project for a dairy, the auditor finds:
- Rev C of the customer's layout drawing, and Rev D issued by Tarnfield, showing a changed drive position, a new incline angle and a different gearbox. The change was decided at a site survey by Tarnfield's technical manager and accepted by the customer's project engineer by email.
- Tarnfield's own title block and drawing number appear on Rev D. There is no design input review, no verification calculation and no design review record.
- Heat treatment of drive shafts is subcontracted. The approved supplier list has one entry, marked used since 2015. No purchase order specifies hardness; no certificate of conformity is on file for the last four lots; incoming inspection checks shaft diameter only.
- A customer-owned jig worth about GBP 8,000 is stored outside under a tarpaulin and is visibly rusted. There is no record of its receipt and no report of damage.
1. Is the exclusion of clause 8.3 justified? What exactly would you report, and what are the client's options?
Read the worked answer
Requirement. Clause 4.3 requires the scope to state the products and services, with any exclusion justified and not affecting the organization's ability to ensure conformity. Clause 8.3 requires design inputs, controls, outputs and changes to be managed.
Analysis. Tarnfield did not simply build to a customer drawing. Its technical manager decided the drive position, incline angle and gearbox at a site survey; its own title block and drawing number appear on Rev D; the customer accepted by email. Those are design and development activities: inputs (8.3.2), controls and reviews (8.3.3), outputs (8.3.5) and changes (8.3.6). The exclusion is unjustified because the organization does perform design and customers rely on it, and it affects conformity because the changed incline angle and gearbox are exactly the characteristics that fail in service.
Report. Nonconformity against 4.3 (unsupported exclusion) with 8.3 as the undelivered requirement. Do not accept a correction that merely rewrites the scope while the activity continues.
Options. Either extend the scope and implement 8.3 - design inputs, review, verification, validation, change control, competent designers - or genuinely stop designing and route all changes back to the customer's engineer. Either route changes the scope, which the certification body handles as a scope extension or reduction with its own audit activity. Base the report on this project's evidence, not on general opinion about the industry.
2. Evaluate the control of the subcontracted heat treatment. Which clause applies, what evidence would you collect, and how would you grade it?
Read the worked answer
Requirement. Clause 8.4 covers externally provided processes, products and services. The organization must determine the controls (8.4.1), apply criteria for selection, evaluation and re-evaluation and monitor provider performance, and communicate requirements adequately (8.4.3). Where the output of an outsourced process cannot be verified by later monitoring - heat treatment is a classic special process - supplier verification plus validation under 8.5.1 f) are the only controls available.
Analysis. One approved supplier, no criteria, no re-evaluation since 2015, no purchase order specifying hardness or case depth, no certificates for the last four lots, and goods-in inspection that measures diameter only. Diameter tells you nothing about mechanical properties. Four lots of drive shafts are in service with no evidence they meet design intent.
Judgement. Major nonconformity against 8.4 and 8.5.1 f). The organization cannot demonstrate conformity, so it must evaluate released product under 8.6 - review design requirements, obtain retrospective certificates or test samples, and consider customer notification. Correction: quarantine stock, obtain evidence from the supplier, and establish a specification and certificate regime.
What would reduce it. If the supplier routinely issues certificates that are simply not filed, and hardness is independently verified at goods-in by another route, the finding narrows to a minor control weakness. Check before concluding - the grade should rest on whether conformity evidence exists, not on whether paperwork exists.
3. How would you treat the rusted customer-owned jig? State the requirement, the likely grade, and the question that settles whether the reporting process works.
Read the worked answer
Requirement. Clause 8.5.3: the organization must exercise care with customer property while it is under the organization's control or being used, must identify, verify, protect and safeguard it, and if it is lost, damaged or found unsuitable for use must report it to the customer and retain documented information about what occurred.
Analysis. The jig is customer property, stored outside under a tarpaulin and visibly rusted. There is no receipt record, so it was never identified or verified, and no report has been made to the customer. Both the safeguarding duty and the reporting duty are unmet, and the customer may be planning to use a jig that is no longer fit for purpose.
Judgement. Nonconformity against 8.5.3. Minor if a single item is still usable and the correction is immediate; major if the rust makes it inaccurate, a project has slipped, or other customer items are treated the same way.
Correction and test. Notify the customer in writing, quarantine and assess the jig, agree repair or replacement. Then test the system: is there a customer property register, is receipt inspection performed, and does any other customer-owned equipment sit on site? One question settles the reporting requirement - ask the customer whether they were told. A yes closes the reporting half of the finding; a no confirms that the process exists only on paper.