Outsourcing and Exclusion Concepts in ISO 9001:2008 QMS

K. R. Singhal

Many organizations may find some confusion in outsourcing and exclusion concepts while implementing ISO 9001:2008 QMS.

Clause 4.1 (General requirements) in ISO 9001:2008 QMS Standard includes the outsourcing concept to highlight the fact that special attention is required when obtaining products and services from others that impact the product provided to customer. The requirements in this clause specially refer to outsourced processes to indicate that the organization must ensure control over such outsourced processes. It also requires that the type and extent of control to be applied to outsourced processes must be defined within the quality management system.

Some people may think that the requirement in clause 4.1 (General requirements) regarding outsourcing is not necessary to follow because requirements mentioned in clause 7.1 (Planning of product realization), clause 7.4 (Purchasing), and clause 7.5 (Production and service provision) contain adequate requirements to ensure the integrity provided to the customer.

An organization can’t exclude outsourcing requirements of clause 4.1 (General requirements), if it chooses to outsource any process that affects product conformity to requirements.

If we see the exclusion concept mentioned in clause 1.2 (Application), it states that exclusions are limited to requirements within clause 7 (Product realization). The requirements related to outsourcing concept are mentioned in clause 4.1 (General requirements) that relate to those activities that are essential to the quality management system of your organization, if you choose to outsource any process. When an organization may choose to outsource processes for management activities (related to clause 5), provision of resources (related to clause 6), product realization (related to clause 7), and measurement, analysis and improvement (related to clause 8) may be outsourced.

Who perform the outsourced process? Note 2 at the end of clause 4.1 (General requirements) provides the answer. It clarifies that an outsourced process is identified that process, which is needed for the quality management system, but the same process is performed by a party external to the organization.

Note 3 at the end of clause 4.1 (General requirements) clarifies points with regard to the responsibility of the organization to fulfill all customer, statutory and regulatory requirements and ensuring control over outsourced processes does not absolve the organization of such responsibility to fulfill all customer, statutory and regulatory requirements. This note also clarifies that there are various factors that may influence the type and extent of control on the outsourced process, such as – (i) potential impact of the outsourced process on the capability of the organization to provide product that conforms to requirements, (ii) the degree to which the control for the process is shared (between the organization and the party performing the process), (iii) the capability of achieving the necessary control through the application of clause 7.4 (Purchasing).

If we carefully read the exclusion requirements in clause 1.2 (Application), it also put the condition that such exclusion do not affect the ability or responsibility of the organization to provide product that meets customer and applicable statutory and regulatory requirements.

An organization, taking the benefit of exclusion provision mentioned in clause 1.2 (Application) that exclusions are limited to requirements within clause 7 (Product realization), must remember that when the organization outsource any process then according to clause 4.1 (General requirements), it is the duty of the organization to control such outsourced processes. Further the type and control to be applied to outsourced processes need to be defined.

Let us have following examples:
(i) An organization claimed exclusion from the requirements of clause 7.4 (Purchasing) since the purchasing activity of the unit (implementing ISO 9001:2008 QMS) is done at corporate level.
(ii) An organization claimed exclusion from the requirements of clause 7.1 (Planning of product realization) and clause 7.5 (Production and service provision) since the unit (implementing ISO 9001:2008 QMS) does not carry out any production process and same has been contracted to another organization.
(iii) An organization claimed exclusion from the requirements of clause 7.3 (Design and development) since the designing of the product is carried out at another unit of the organization.

In the above examples, the organization claimed exclusion on the basis that the related process not being carried out by the unit (implementing ISO 9001:2008 QMS). But if look to clause 4.1 (General requirements) then the unit can not ignore control over the processes of (i) purchasing carried out at corporate level, (ii) planning of product realization, and production and service provision, and, (iii) design and development carried out at another unit.

The process approach is having the central approach to ISO 9001:2008 QMS Standard and we have observed that during the last few years outsourcing activities in organizations have increased tremendously, so the new version has clarified its requirements by adding notes in clause 4.1 (General requirements).

Please have you comments to the above.

With kind regards,

K. R. Singhal