体系审核

- 1 - 日期：2005 年 7 月 30 日 ISO 9001 审核实践组指南 对服务型组织的审核 1. 介绍 虽然 ISO 9001:2000 的目的是适用于各类组织，不论其类型、规模 如何或提供什么产品，但是第三方审核中需要对服务型组织的一些特性 予以特别关注。因此，本文件旨在为审核员审核服务型组织对 ISO 9001:2000 要求的符合性提供指南。本文件特别强调了条款 7.3“设计和 开发”、7.5.2“生产和服务提供过程的确认”和 8.3“不合格品控制” 的要求。 2. 服务型组织 按照 ISO 9000:2000 条款 3.4.2“产品”： “服务通常是无形的，并且是在供方和顾客接触面上至少需要完成 一项活动的结果。服务的提供可涉及，例如： — 在顾客提供的有形产品（如维修的汽车）上所完成的活动； — 在顾客提供的无形产品（如为准备税款申报书所需的收益表）上所 完成的活动； — 无形产品的交付（如知识传授方面的信息提供）； — 为顾客创造氛围（如在宾馆和饭店）。” 大多数组织的产品中都包括服务的部分，从几乎 100%都是服务（例 如法律事务所），到较小比例的服务，例如制造业组织提供的售后服务。 3. 审核指南 3.1 服务的设计和开发 - 2 - 在考虑 ISO 9001:2000 条款 7.3 是否适用于一个服务型组织时，重 要的是要记住“设计和开发”的定义。按照 ISO 9000:2000 条款 3.4.4， “设计和开发”是“将要求转换为规定特性的一组过程”。而按照 ISO 9000:2000，“要求”（3.1.2）是“明示的、通常隐含的或必须履行的 需要或期望”，服务的“特性”（3.5.1）是可区分的特征，可以包括： ● 感官特性（如：与嗅觉、触觉、味觉、视觉、听觉有关的）； ● 行为特性（如：礼貌、诚实、正直）； ● 时间特性（如：准时性、可靠性、可用性）； ● 人体工效特性（如：生理特性或与人身安全有关的特性）； ● 有形特性（如：可测量的特性；这些特性可能是提供服务的物质 手段的特性，如飞机的最高速度，也可能是服务提供环境的特性， 如飞机的内部温度或设施）。 组织在对待条款 7.3 的要求时，常常只考虑产品的实物部分，而忘 了非实物产品（即服务）的设计和开发才应当是主要的关注点。另外， 组织还需要设计向顾客提供服务。 如果组织提出从质量管理体系中删减设计和开发，审核员应当根据 上述指南仔细评价删减的理由。审核员还应当检查组织是否建立了有效 的设计和开发过程，来充分地定义满足顾客需求和期望所需的服务特性 和服务提供过程特性。 3.2 生产和服务提供过程的确认 对于实现服务所需的过程，我们可以识别两种类型的服务过程： ● 顾客参与服务本身的实现（实时交付）； ● 过程实现后，才将输出交付给顾客。 - 3 - 以旅馆为例，客人的“登记入住”和“退房”过程很可能涉及“实 时”的服务交付，而客房整理通常在过程（该过程可能要接受检查，必 要时还需返工，以纠正所有不符合）完成后，才“交付”给客人。 在提供与其产品有关的服务的制造业服务中也可能发现类似的过 程，例如处理投诉和保修，组织的服务部门对产品进行维修，或者在客 户场所进行产品维护活动。 对于那些包含实时交付并在组织/顾客接口直接实施的过程，（如果 有的话），很少有可能在它们的输出（“服务”）“交付”顾客前，用 后续的监视或测量对这些输出进行验证。因此，这些过程确实应当按照 ISO 9001:2000 条款 7.5.2 的要求得到确认。这对防止不符合的发生也是 必不可少的。 为了确保所提供服务的质量得到充分控制，审核员应当： − 理解组织所规定的服务特性、服务提供过程及其接收准则（应当在第 一阶段审核中理解）； − 确定组织是否对“实时”服务提供过程（或其他需要确认的过程）进 行了确认，以及确认时是否考虑了相关的风险； − 评价组织是否向有关人员提供了适当的工具、和授权。 对于很多服务行业来说，所提供的服务是瞬间完成的（即通过“实 时”过程），很难在服务的交付进行检验。从质量的观点来说，最经济 有效的经营方式就是对这些服务应用“特殊过程”的原理：组织的过程 越正确，就越不必担心过程的输出。因此，很少有可能删减这一条款。 3.3 不合格品控制 对于顾客直接参与的服务过程，“不合格品控制”（条款 8.3）是指 组织在确定和实施正确的纠正之前对服务提供中的不符合进行处理 的方式。 - 4 - 当识别出不合格时，审核员应当检查： ● 相关人员是否得到充分授权，因而有权决定对服务的处置，例如： ● 立即终止服务； ● 更换所提供的服务； ● 提供替代方式； ● 组织的顾客索赔和投诉过程； ● 为减轻不合格的后果而临时采取的纠正（例如退款、赊账、升级等） ● 对相关服务设备、服务提供者及环境的识别、隔离和更换。 这将使审核员能够判断对不合格产品的控制是否有效。 注：对于这些情况，质量管理体系应当规定在适当的管理层次采集关于不符合的数据， 并进行信息反馈，以有效地制定和实施纠正措施。 对于在过程实现后交付服务的输出的情况，可以根据通常的监视和 检验技术来进行“不合格品控制”。审核员需要搜集这些技术的充分性、 适宜性以及得到有效实施的证据。 - 5 - Date: 30 July 2005 ISO 9001 Auditing Practices Group Guidance on: Auditing service organizations 1. Introduction Although ISO 9001:2000 is intended to apply to all kinds of organizations, regardless of type, size or product provided, there are a number of characteristics of service organizations that require specific attention during a third party audit. Consequently, this document aims to provide auditors with guidance on auditing the compliance of service organizations to the requirements of ISO 9001:2000. Particular emphasis is given to the requirements of clause 7.3 Design and development, clause 7.5.2 Validation of processes for production and service provision and clause 8.3 Control of nonconforming product. 2. Service Organizations According to ISO 9000:2000, clause 3.4.2 Product: “Service is the result of at least one activity necessarily performed at the interface between the supplier and customer and is generally intangible. Provision of a service can involve, for example, the following: — an activity performed on a customer-supplied tangible product (e.g. automobile to be repaired); — an activity performed on a customer-supplied intangible product (e.g. the income statement needed to prepare a tax return); — the delivery of an intangible product (e.g. the delivery of information in the context of knowledge transmission); — the creation of ambience for the customer (e.g. in hotels and restaurants).” Most organizations have an element of service in their product. This may range from almost 100% service (in the case of a law firm, for example), to a relatively small service component in the case of a manufacturing organization providing, for example, after-sales service. 3. Auditing Guidance 3.1 Design and development of the service When considering the applicability or not of clause 7.3 of ISO 9001:2000 to a service organization, it is important to remember the definition of “Design and development”, which, according to ISO 9000:2000 clause 3.4.4 is the “set of processes that transforms requirements into specified characteristics”. Again, according to ISO 9000:2000 requirements are “needs and expectations that are stated, generally implied or obligatory”, and characteristics of the service are distinguishing features that can include: • sensory (e.g. related to smell, touch, taste, sight, hearing) - 6 - • behavioral (e.g. courtesy, honesty, veracity) • temporal (e.g. punctuality, reliability, availability) • ergonomic (e.g. physiological characteristic, or related to human safety) • tangible (e.g. measurable characteristics; these may be either the characteristics of the physical means used to deliver the service, e.g. the maximum speed of an aircraft, or of the environment in which the service is provided, e.g. the interior temperature or facilities of an aircraft). It is quite common for organizations to consider only the tangible component of their product when addressing the requirements of clause 7.3, forgetting that the design and development of the intangible product (the service itself) should be the main focus. Additionally, the organization will need to design how the service will be delivered to its customers. If the organization proposes to justify the exclusion of design and development from its QMS, the auditor should make a careful assessment of the justifications in light of the above. The auditor should also examine whether the organization has an effective design and development process that sufficiently defines the characteristics of its service, and of its service delivery processes, that are needed to meet customer needs and expectations. 3.2 Validation of processes for production and service provision In terms of the processes needed to realize the service, we can identify two types of service processes: • those involving the customer in the realization of the service itself (real time delivery) and • those in which the output is delivered to the customer after the realization of the process Using the example of a hotel, the guest “check-in” and “check-out” processes would probably involve “real-time” delivery of the service, whilst the cleaning of the guest’s room would generally be “delivered” to the guest only after completion of the process (which could be subject to inspection and rework if necessary, to correct any nonconformities). Similar processes can also be found in manufacturing organizations providing services related to their products, for example, the handling of claims and warranties; the repair of products by the organization's service units; or product maintenance activities performed at a clients' facilities. Those processes that involve real time delivery, and are carried out directly at the organization/customer interface can rarely (if ever) have their output (“the service”) verified by subsequent monitoring or measurement before they are “delivered” to the customer. Therefore, such processes are indeed subject to validation according to the requirements of ISO 9001:2000, clause 7.5.2. This is also essential in order to prevent nonconformities from occurring. In order to ensure adequate control over the quality of the service to be provided, the auditor should: - understand the service characteristics, the service provision processes, and their acceptance criteria, as defined by the organization (this should be done during the Stage 1 audit) - determine whether validation of "real-time" service provision processes (or any other process that requires validation) has been performed and if this has taken into account the associated risks; - 7 - - assess if the appropriate tools, training and empowerment have been provided to the personnel involved. For many service industries, the service provided is instantaneous (i.e. via "real- time" processes), which does not readily allow for inspection before delivery of that service. Quality thinking says that the most cost-effective way of doing business is to apply the philosophy of “special processes” to ALL processes: the more the organization gets its processes right, the less the organization needs to worry about the outcome of their processes. Therefore it is very unlikely that this clause can be excluded. 3.3 Control of nonconforming product In the cases of service processes directly involving the customer, “the control of nonconforming product” (clause 8.3) is the way the organization deals with nonconformities in the service provision until the appropriate corrective action is defined and implemented. Where a nonconformity is identified, the auditor should examine: • whether the personnel involved are sufficiently empowered with the authority to decide the disposition of the service, for example: • to immediately terminate the service • to replace the service provided • to offer an alternative • the organization's customer claims and complaints processes • any temporary corrections that are implemented to mitigate the effect of the nonconformity (e.g. refund, credit, upgrade, etc.) • the identification, segregation and replacement of the relevant service equipment, service providers and environment. This will enable the auditor to judge whether the control of such nonconforming product is effective. Note: In such situations the quality management system should have provisions to capture data on the nonconformities and to feedback information, at the appropriate management level, for the effective definition and implementation of corrective actions. For cases in which the output of the service is delivered after the realization of the process, “control of nonconforming product” may be based on usual monitoring and inspection techniques. Evidence will need to be sought of the adequacy and effective implementation of these techniques.