Managing Non-Conformities
An essential part of the effective operation of your management system is the corrective action and improvement process. During your third party audits by NQA, we may find situations where your system, process or practices are non-compliant with the standard being audited. When this occurs your auditor will raise a non-conformity against your organization. The nonconformity will detail which requirement of the standard/regulation has not been met and what evidence the assessor found in order to justify the non-conformity.
Major, minor or opportunities for improvement
The auditor will determine whether the non-conformity is to be graded a major or a minor. Majors are issued when there is a failure to fulfil one of the requirements of the standard or a situation arises where there is doubts that your management system can deliver its intended outputs. Minors are given where this is not the case or where a single lapse in a system or process is found. The auditor may also issue opportunities for improvement (OFIs) which are suggestions as to how to improve your system.
At a Stage 1 audit the auditor will raise Areas of Concern (AoC) which identify where your system is not yet compliant to the requirements and would result a non-conformity being raised at a Stage 2 audit. The auditor may require you to respond to an AoC from the Stage 1 and, the extent to which AoCs are identified at your Stage 1 audit may influence whether the auditor will recommend progression to the Stage 2 audit.
You will have an opportunity to discuss the non-conformity at the time it is raised and also at the closing meeting. The auditor will advise you as to the grading of the non-conformity and what action is required. In certain circumstances NQA may need to revisit your organization to ensure that non-conformities have been addressed.
Non-conformities which are raised by your auditor will be detailed on your audit report. Your response to the raised non-conformities should be detailed on the NQA Audit Non Conformance and Corrective Action Submission Form within the audit report. This form provides areas to detail how your organization has dealt with the non-conformity.
Unless otherwise stated, you are required to submit responses to minor and major non-conformities within 30 days and additional objective evidence to major non-conformities within 90 days of your audit completion. This applies to Stage 2, Surveillance, Recertification and Special Visits. Failure to do so may put your certification at risk of suspension. You do not have to provide responses to opportunities for improvement (OFIs).
Please note that certification will not be issued, reissued or revised unless all outstanding non-conformance responses have been submitted and in the case of a major non-conformity the evidence of correction has been provided and accepted by NQA.
Non-conformance responses should be emailed to NCR@nqa-usa.com.
The NQA Audit Non Conformance and Corrective Action Submission Form will be provided to you by your auditor. If you require a copy of the form please email NCR@nqa-usa.com.
You have the right to formally appeal against a non-conformity which will result in an independent review. More information on appeal can be found here.
Completing the NQA audit non conformance and corrective action submission form
The purpose of the NQA Audit Non-conformance and Corrective Action Submission Form is to demonstrate that your organization has an effective management system and is able to immediately address non-conformities, understand why they have occurred and put in place actions to ensure that the non-conformities do not repeat themselves.
The completion of the Corrective Action Submission Form should be an output of your own corrective action process (for example required by clause 10.2 in ISO 9001:2015). This requires you to fix the immediate issue identified (containment), understand why it happened (root cause) and make appropriate changes to make sure it is not repeated (corrective action). The NQA Audit Non-conformance and Corrective Action Submission Form asks you to detail how you have undertaken these steps and provide evidence.
The responses on this form should be succinct but provide enough information for NQA to establish whether you have effectively addressed the non-conformity using the steps identified above.
The completed Corrective Action Submission Form should be emailed to NCR@nqa-usa.com within the defined timescales. You should also attach any supporting documentation which provides evidence that the steps detailed in the submission forms have been undertaken.
Principals of non-conformity
Resolving a non-conformity raised at a third party assessment follows the same principals as non-conformities raised at internal audits. It should follow a logical process to understand the issue raised and ensure it is put right.
Containment Action
In this section you should detail what was done to immediately rectify the non-conformity. It should also detail any temporary measures taken to stop any further non-conformities from reoccurring. It should also include looking in other areas that might have that same nonconforming situation. You should clearly detail what action you have undertaken.
Illustrative example 1: A blocked emergency exit on an OHSAS audit will result in a non-conformity. A possible Containment Action may be to unblock the emergency exit and review the entire facility to see if all exits are clear.
Illustrative example 2: The auditor found that no internal audit had been conducted in the last 12 months and it there was no internal audit was scheduled. The immediate corrective action could be to update the internal audit schedule and conduct an internal audit.
Root Cause Analysis
Root cause should not be a restatement or further explanation of the non-conformance.
You should be able to demonstrate how you have effectively determined the underlying cause of the problem. Key questions to ask might be: Was the process clearly defined? Were individuals trained on the process?
There are a number of useful techniques available to help support this process. These include Fishbone (Ishikawa), 5Y or 8D.
The objective of the root cause is to achieve a logical progression from the issue. Starting from the non-conformity back through the various causes and effects to the underlying cause.
Illustrative example: Someone did not follow a process would be direct cause; determining why someone did not follow a process would lead to the true root cause.
Corrective Action
Corrective action details what action you have taken to ensure that the non-conformity does not reoccur. The Corrective action should directly address the root cause of the problem. You should be ready to provide evidence of what actions have been undertaken to support your claim that your Long Term Corrective action has effectively prevented the possibility that the non-conformity can reoccur.
The auditor will always verify your non-conformance responses at your next audit, in particular auditing whether your Long Term Corrective Action has been effective in preventing reoccurrences. Non-conformances will be raised against your corrective action process if your actions have found to be ineffective. This is one of the most common requirements in which major non-conformities are raised by assessors.
Multisite non-conformities
Where your business operates a multi-site certification you will receive a program of audits throughout each year. This program will select sub-locations/sites to audits and will be completed by your Client Support Representative.
When non-conformities are identified at a sub-location/site, the auditor will document this on the audit report and raise the non-conformity against the location. Depending on the nature of the non-conformity the auditor may raise this against the sub-location/site or against the organization’s overall system.
Where common issues have been found across multiple sub-locations/sites the auditor will raise a non-conformity against the overall management system. This is important because it will determine the expectations as to the corrective action and improvement activities put in place by the organization. For example, if a single incident of non-conformity is found at a sub-location/site the root cause analysis may identify it is a one off occurrence due to an individual breakdown at that location.
Conversely, if common findings are occurring across the organization this would be indicative of a systemic failing across the system and would require a root cause analysis and corrective action at an organization-wide level. Whilst the auditor will attempt to make a judgment as to the extent of the non-conformity across your organization, an effective root cause analysis process will determine this for you and allow you to take action accordingly.
You are required to respond to NQA non-conformities raised at audits within 30 days for a and provide objective evidence for a major non-conformity within 90 days from the end of the audit, unless otherwise instructed by your auditor.
At the final audit of your yearly audit program, the findings and non-conformities from the sub-location/sites will be collated and presented during the closing meeting. Those which have not been verified and closed will require to be closed out within the required time frame. Clients with administration days can use those days to review open findings with your lead auditor, they can also verify corrective actions taken.
This will happen at your Head Office audit and at sub-locations/sites based on where it is practical to verify corrective action implementation.