Contractor Control and Competence in a Food Processing Plant
A food manufacturer has operated an ISO 55001-aligned AMS for eight months at a single site with three production lines, 14 critical pumps, and an outsourced maintenance provider that performs 60% of preventive maintenance. During an internal audit, the AMS coordinator finds that the contractor's technicians replaced seals on two critical pumps last month without a work instruction, without isolating and tagging according to the site's lockout/tagout procedure, and without recording the work in the CMMS. The contractor's supervisor says the job was urgent and 'everyone knows how to do it'. Training records show that two of the contractor's four technicians have no evidence of competence assessment for pump maintenance. The site's management of change procedure requires contractor procedure changes to be approved, but no change request exists. Production was not affected, but the AMS coordinator is concerned about the next job.
1. Identify the nonconformities against ISO 55001 and classify their severity. Justify your classification.
Read the worked answer
Likely nonconformities:
- Clause 8.1 operational planning and control: outsourced maintenance on critical pumps was performed without approved work instructions, isolation and tagging, or CMMS recording. The organization has not controlled the outsourced process.
- Clause 7.2 competence: two of four contractor technicians lack evidence of competence assessment for pump maintenance.
- Clause 8.2 management of change: no change request for a contractor procedure change, contrary to the site's MOC procedure.
- Clause 7.5 documented information: no work record for the seal replacement.
I would classify the operational control and competence findings as major. They are systemic - affecting half the contractor workforce and critical assets - repeatable, and they create safety and asset failure risk. The missing record is part of the same control failure. A minor classification would be defensible only if this were a single isolated lapse with immediate correction and strong evidence of control elsewhere. 'The job was urgent' does not mitigate the risk; it suggests a culture of bypass. The audit should state the evidence, the requirement, and the risk, not just name the clause.
2. Recommend immediate containment and corrective actions, distinguishing between correction, root cause analysis, and corrective action.
Read the worked answer
Containment: suspend contractor work on the 14 critical pumps until a toolbox talk and permit check are complete. Inspect the two replaced seals, verify isolation integrity, and enter the work into the CMMS. Assess whether any temporary controls are needed for production risk.
Correction: record the work, update asset history, and verify no damage or unsafe condition remains.
Root cause analysis: ask why an urgent job bypassed the procedure. Possible causes include no approved on-call procedure, a contract that does not specify competence requirements, weak permit enforcement, supervisor pressure, or unclear accountability for contractor work. 'Technician error' is not a root cause.
Corrective actions: amend the maintenance contract to require competence evidence and work instructions; create an approved critical-pump procedure; add a contractor competence matrix; enforce MOC for contractor procedure changes; audit contractor jobs; and track a KPI for permit compliance and CMMS recording. Verify effectiveness after three months and update the risk register. This follows ISO 55001 clause 10.2: react, evaluate the need to eliminate causes, implement, review, and update risks.
3. How should the organization verify that the contractor's competence process is effective over time?
Read the worked answer
Define competence requirements per critical task, including contractor roles, and verify them through valid certificates or assessments, witnessed work, practical assessments, and supervisor sign-off. Do not rely on a one-off training certificate.
Monitor leading indicators: permit compliance, CMMS record completeness, rework rate, near misses, and contractor audit results. Audit the contractor quarterly and spot-check jobs against work orders and procedures. Include contractor competence in the organization's training needs analysis and in management review. If the contractor changes staff, require re-assessment before critical work.
Effectiveness is demonstrated by consistent compliant work over time, not by the existence of a file. The organization should also test whether the contractor stops work when a procedure is missing - that behaviour is the real control. Findings should feed corrective action and contract performance reviews.