Last week I talked about how to distinguish Minor Nonconformities from Opportunities for Improvement. Now I'll review the difference between Minor Nonconformities and Major Nonconformities.
The difference to the organization is that Majors get a lot more attention and typically require a lot more work to close. If the auditor from your registrar raises a Major in an external audit, it can block your certification or recertification. Depending on the finding and the contract with your registrar, you may have to pay for a re-audit within a specified time frame (far sooner than you were planning for!) to prove that the nonconformity has been corrected and permanently prevented. Because the consequences for external Majors are so significant, organizations frequently define heavy procedures to handle internal Majors — so that they get immediate and sustained management attention, to make sure they have been resolved before the external audit.
In short, Minors can be comparatively innocuous but Majors are The Scary Ones. But what is the real difference? When do you write a Major?
The definition can be found in ISO 17021:2015, and it relates to the idea of a Quality Management System (QMS). Briefly, if the failure is a system failure, it's a Major; if not, it's a Minor. More exactly, according to definition 3.12 a major nonconformity is a:
nonconformity that affects the capability of the management system to achieve the intended results.
In the same way, definition 3.13 tells us that a minor nonconformity is a:
nonconformity that does not affect the capability of the management system to achieve the intended results.
But what are "the intended results"? In a broad sense this probably has something to do with healthy operation and customer satisfaction; but in a narrow sense, surely every single procedure in the organization has as one of its intended results that everyone in its scope should comply with it. And if you take the term that broadly, then any failure would count as a Major. Clearly that can't be the right way to see the question.
In casual conversation, the difference is usually described in terms of extremes: a Major is "a total breakdown of the system," while a Minor is "an isolated one-off error." Of course this leaves most nonconformities somewhere in the middle, with the auditor having to decide whether a finding is more like the first or more like the second.
For example, suppose the organization has defined a specific template for all their internal documents; but when you examine these documents during the audit you find that nobody uses this template except the Quality department. Is that a Major or a Minor?
On the one hand, it's clearly not "an isolated one-off error," since you see the very same error almost everywhere. It certainly looks like the error is "systemic," or at any rate like there is no functioning system for introducing document templates and making sure everyone uses them.
- Some will, especially if they have contractual requirements to other interested parties related to the use of those templates: but those organizations won't have this finding in the first place.
- An organization where this finding turns up is an organization that doesn't see any reason to care about internal document templates — and is therefore an organization that will never take such a Major seriously.
- But can you as an auditor, in good professional conscience, justify calling it a Minor? Can you honorably say that it meets the definition of a Minor?
- It depends. If it's an internal audit, consider talking to them. Ask top management — the people who will receive your report when you are done — whether having a uniform format for internal documents is one of their "intended results." If not, then this finding does not affect the achievement of "intended results," and could count as a Minor.
- That doesn't mean that any time the organization doesn't care about something it's a Minor, of course. Some "intended results" (like customer satisfaction or legal compliance) are so serious that the organization has to care. So be reasonable.
- Note also that as the organization matures, so will their list of "intended results." Maybe in a few years they will have reached a place where they take document formatting more seriously. By the time that happens, though, you probably won't see this particular finding any more.
My very favorite explanation of the difference, though, came from a class discussion back when I took my first Lead Auditor training class. The instructor had just made the point that an audit is a sampling exercise. You can never see everything that goes on inside an organization. And one of the students had a concern.
Student: If an audit is a sampling exercise, doesn't that mean there's a big risk that when we audit an organization they might have huge, serious problems and we don't see them?
Instructor: That will never happen.
Student: But you just said an audit is a sampling. What if the big problems are all over here and we happen to be looking over there? What if we just miss them?
Instructor: That happens with Minors all the time. In fact, I guarantee that any time you do an audit, there will be minor nonconformities going on in the organization that you will miss. But if the organization has Majors, you will know it by the time you reach the Receptionist's desk! You will smell them! You will know they are there. The point is that if the organization suffers from major nonconformities, their attitude will come through in so many little things that it will be impossible for them to hide it, or for you to miss it. And then — since you already know the Majors are there waiting to be found — all you have to do is find them.
That's obviously a very informal criterion, but it makes the point beautifully.
No comments:
Post a Comment