Outsourced maintenance and a management review stuck in 2017
A food manufacturer runs three plants with 8,600 assets and has held ISO 55001 certification since 2017. Seventy per cent of maintenance is outsourced to a single provider on a five-year contract. The provider reports mean time between failures and preventive maintenance compliance monthly; the manufacturer reviews the figures but has never assessed whether asset management performance is achieving the asset management objectives, which are last year's actual results copied forward. Management review has used the same agenda since 2017: safety incidents, maintenance budget, output. It has no standing item on changes in context, asset-related risk, opportunities or the effectiveness of the asset management system. Internal audit of the asset management system is subcontracted to a consultancy owned by the maintenance provider's parent company. The contract specifies response times but says nothing about data ownership, reporting standards or audit rights.
1. Why are MTBF and preventive maintenance compliance insufficient under 9.1, and what exactly is missing?
Read the worked answer
9.1 requires monitoring, measurement, analysis and evaluation of what matters: the performance of asset management and the effectiveness of the asset management system, not only activity delivered by a supplier. MTBF and PM compliance are provider outputs. They do not tell the manufacturer whether its asset management objectives are met, whether performance is trending toward the corporate objectives, or whether the system produces the intended outcomes. Objectives copied from last year's results are not meaningfully measurable and are not consistent with current organizational objectives, so even a good measurement set would have nothing to evaluate against. Missing elements: performance measures traced to the objectives; evaluation criteria such as targets, thresholds and trend rules; documented analysis and evaluation; and reporting into management review. Because the evaluation step does not exist, the organization cannot know whether the outsourced arrangement delivers value - the substantive gap the revision highlights. Note also that the indicator set is provider-defined, so performance evaluation has effectively been outsourced along with the maintenance.
2. Management review has had the same three-item agenda since 2017. Assess this against 9.3.
Read the worked answer
9.3 requires the review to consider, at minimum, the status of actions from previous reviews; changes in external and internal issues relevant to the system; changes in the needs and expectations of interested parties; the extent to which asset management objectives have been met; performance and effectiveness of the system; nonconformities and corrective actions; results of monitoring, measurement, analysis and evaluation; audit results; adequacy of resources; and opportunities for improvement. The three-item agenda covers part of performance and nothing else. Record the facts: agenda unchanged since 2017, no standing items on context, risk, opportunities or effectiveness. The consequence is functional, not clerical - the review cannot steer the system, so decisions on the outsourcing contract, resourcing and objectives are taken without the required inputs. This is a nonconformity against 9.3, and because it has recurred at every cycle it is a system-level failure. At a transition audit expect a major classification, since the auditor will specifically ask how the review was adapted to the 2024 inputs.
3. The contract with the maintenance provider and the choice of internal auditor both raise issues. Identify the requirements and classify.
Read the worked answer
8.1 requires control of externally provided processes, products and services: the organization must specify what is required, apply criteria for selection, monitoring and evaluation of the provider, and retain responsibility for conformity. The contract sets response times only - no data ownership, reporting standards or audit rights - so the manufacturer cannot verify provider performance and does not control the asset information on which its own decisions depend. That is a nonconformity against 8.1, and it undermines the Clause 7 data and information requirements as well. Separately, 9.2 requires audits to be conducted objectively and impartially; using a consultancy owned by the provider's parent company to audit the processes the provider operates is a conflict of interest, and the auditor's own work falls within the audit scope. That is a nonconformity against 9.2 and normally a major one, because the audit programme cannot provide the assurance it exists to provide. Raise both separately: the outsourcing gap is the more consequential because it affects day-to-day control of the assets.