Responsibility and authority

So much can so wrong with this requirement.  The interpretations or should I say misinterpretations have caused so much grief for the uninitiated.  So let’s cut through the bunk with this paste;
5.5.1 Responsibility and authority
Top management ensures that responsibilities and authorities are defined and communicated within the company.

And that is it.  Nothing more.  How can you do this?  Before you go developing stuff, look at the complexity, expectations, risk exposures and communications of your company.  Is there something you already do that meets this one little sentence?  Does ‘definition’ mean ?documentation.  The short answer is no, but the level of understanding once communicated may require ‘ensure-ance’ via something that is documented.
Policies, responsibilities sections in procedures, published delegated authority lists, job descriptions, training records all could be used either singularly or in combination with each other.

And to what extent?  Here is a real life situation from our very own certified QMS.  We have an organisation chart, job descriptions, procedure sections and training.  Whilst we only have 7 documented procedures, we do have 18 policies (normally only a paragraph, of which others might define as business rules) that map out exactly who is who in the wonderful zoo at quality.com.au.

Classification of findings

Each certification service provider is required by JAS-ANZ to classify their findings.  How and by what name is largely up to the provider.  But before I get onto this, “What is a finding?”  A finding (or issue, matter, discrepancy, etc) is any situation that requires consideration or remediation with regard the quality management system.  For example, during an audit it was discovered that there is no documented procedure for internal quality audits.  And we will refer to this during the remainder of the blog.

Make sure you know how a provider classifies a finding and what are the required remedial actions for each before you finalise your decision on a provider.  Whilst most operate within similar constraints, some have some very quirky ‘rules’ and reporting requirements.  And how do you do that?  Ask for their published guidelines / criteria.

So the three broad categories of findings are; 1)nonconformance (or nonconformity, major corrective action, non compliance, etc); 2) corrective action (or improvement request, area of concern , minor corrective action, etc); 3) observation (consideration, opportunity for improvement, comment, etc).

What they represent; 1) nonconformance – lack of mandatory requirement (such as our example above) or an aggregation of findings within the one clause.  2) corrective action, something is in breach of the standard or your own procedures / processes.  Fix them.  3) observation, you may get some benefit from considering an alternate means of managing a situation.

And here is the consequence of each; 1) nonconformance – you will not receive initial certification, you will need to show cause (planned corrective actions) and remedial actions within 3 months to retain certification.  2) corrective action, certification will be granted / continued but you will need to close any remedial action before the next visit (6~12 months).  3) observation, you will need to demonstrate that you have considered the finding and declared an outcome.

Easy.  The best way to combat findings and their classifications is not to get any.  Good luck with that one!  But if your certification is part of a continuous improvement strategy, then rejoice in the findings found, so that you can make your quality management system better.