Trusting ISO 13485 Certification of a Supplier... A Sad Story

R

Reg Morrison

While the thrust of this thread is around ISO 13485, which (rightfully so) places much more focus on product regulatory compliance than ISO 9001, we should remain aware of what should be reasonable expectations of properly accredited QMS certification and the (broken link removed) document does a good job at that, in my opinion.

The IAF has a new document titled (broken link removed) which correlates better with the case that triggered this thread.
 

Attachments

  • IAF__ISO_13485_0512.pdf
    2.2 MB · Views: 380
J

Julie O

"Trust, but verify!"
I didn't attribute this quote, since you read it everywhere, any time anyone gets burned from trusting. Since this has been going on for as long as humankind has had the capacity to trust instead of verify, I rather doubt that Ronald Reagan is the original source.

If you verify adequately, trust is irrelevant, and therefore not worth mentioning. The appeal of trust over verification is that trust is a decision, not an activity. As such, trust takes no time or money, and it should come as no surprise to anyone when trust turns out to be worth exactly the nothing that was invested in it.
 

Ronen E

Problem Solver
Moderator
That's very good in theory.

In practice, we all trust suppliers at some level.

When you get a CoC, how do you know it's not fraudulent? Or do you actually test everything (I mean EVERYthing)?

Verifying everthing doesn't make best business sense IMO. Not as defualt.

Cheers,
Ronen.
 

Wes Bucey

Prophet of Profit
I didn't attribute this quote, since you read it everywhere, any time anyone gets burned from trusting. Since this has been going on for as long as humankind has had the capacity to trust instead of verify, I rather doubt that Ronald Reagan is the original source.

If you verify adequately, trust is irrelevant, and therefore not worth mentioning. The appeal of trust over verification is that trust is a decision, not an activity. As such, trust takes no time or money, and it should come as no surprise to anyone when trust turns out to be worth exactly the nothing that was invested in it.

That's very good in theory.

In practice, we all trust suppliers at some level.

When you get a CoC, how do you know it's not fraudulent? Or do you actually test everything (I mean EVERYthing)?

Verifying everthing doesn't make best business sense IMO. Not as defualt.

Cheers,
Ronen.
I'm a big "trust but verify" advocate. The point is that, like the difference between "continual" and "continuous," the verification FOR THE FACTORS IMPORTANT TO THE CUSTOMER is done thoroughly ONCE, then merely monitored thereafter. The extent, depth, and detail of monitoring is dependent on the risk factors for a particular product or service provided by the supplier.

I would hope examples of the different levels of monitoring would be superfluous for THIS thread, but certainly fair game for a new thread should any Cove reader be so inclined.
 
J

Julie O

That's very good in theory.

In practice, we all trust suppliers at some level.
It's precisely in practice that trust is irrelevant if you verify adequately. The fact that "we all do it" doesn't change the fact that, if you haven't verified, you don't know.

When you get a CoC, how do you know it's not fraudulent?

My point exactly. You don't know. Ignorance and "trust" go hand in hand. If you actually know, then trust becomes irrelevant.

do you actually test everything (I mean EVERYthing)?

I certainly don't, but I don't "trust," either, which is to say I accept the fact that I don't know and the risks to which I am exposing myself by choosing to remain ignorant of underlying realities.

Verifying everthing doesn't make best business sense IMO)

What to verify and what not to verify doesn't have to be left to a matter of opinion. Risk management is the practice of making considered business decisions about what to verify and what to leave to chance, based on probabilities and consequences.
 
J

Julie O

I never imagined the price of a coverup would be so high!

In predicting the outcomes of these types of actions, it may be useful to consider who will get to set the amount of the fine and who will get the money.
 

Wes Bucey

Prophet of Profit
Advocating for verification, I get. Advocating for trust, I am completely mystified.

OK how about an example (a simple one!)

SITUATION:
An OEM requires a custom made (to OEM design) machined "widget."
The annual quantity is 100,000 pieces.
the target "price point" is $5.00 each (plus shipping)
a search for prospective suppliers produces 3 which claim to be able to meet quantity and price
STAGE ONE:

  1. Verify each prospective supplier has proper equipment and open capacity to deliver the widget
  2. Ask to see any samples of work incorporating features similar to widget (tapered threads? cross holes? smooth bores? blind holes? surface finish [either ISO N unit or Ra units in microns]? etc.
  3. Evaluate (Verify) apparent quality of samples to meet widget criteria.
  4. Order and pay for sample widgets (not necessarily PPAP - prototype could be OK) - primary purpose is to Verify finished sample against criteria of widget to assure supplier and OEM have same understanding
  5. If all three prospects are still in the running, make site visit to Verify production and inspection systems equipment, and personnel appear to meet the original criteria.
  6. Make a decision and place an order
STAGE TWO:

  1. Verify the order arrives on time and passes incoming inspection
  2. Monitor subsequent shipments and maintain communication with supplier to assure no surprise changes may disrupt OEM processes.

To Monitor is a less intense and detailed process than Verify, but depends on trust established by an overview of the supplier that it is not running a dingy sweat shop, has good relations with its own suppliers and with other customers, and fulfills its part of the bargain by continuing to supply product as contracted in a due and timely manner. In other words, once the initial verification has been satisfactory, the OEM can trust the supplier to the extent that incoming inspection is no longer the equivalent of a First Article Inspection, but a more relaxed inspection of critical characteristics only. Similarly, multiple site visits are not required to assure the work is actually being performed on premises [not sublet secretly to another, shoddier supplier.] The OEM may trust the supplier, BUT continual communication with supplier leaves open the possibility the OEM "may" drop by for another site visit expecting to see his widget in production.
 

Jim Wynne

Leader
Admin
Advocating for verification, I get. Advocating for trust, I am completely mystified.

"Trust but verify," especially in the context attributed to Reagan, is meant to be ironic, a polite way of expressing lack of trust. As Julie has correctly pointed out, if we verify, trust becomes irrelevant. At some point economic reality requires us to take calculated risks. This is not the same as trust--it's more like hope. You do your best to verify and then hope for the best.
 
J

Julie O

once the initial verification has been satisfactory, the OEM can trust the supplier to the extent that incoming inspection is no longer the equivalent of a First Article Inspection, but a more relaxed inspection of critical characteristics only. Similarly, multiple site visits are not required to assure the work is actually being performed on premises [not sublet secretly to another, shoddier supplier.] The OEM may trust the supplier, BUT continual communication with supplier leaves open the possibility the OEM "may" drop by for another site visit expecting to see his widget in production.

I just don't see how this has anything to do with trust. In my own other words:

...once the initial verification has been satisfactory, the OEM decides not to do an incoming inspection that is the equivalent of a First Article Inspection, but a more relaxed inspection of critical characteristics only. Similarly, it decides not to do multiple site visits to assure the work is actually being performed on premises. The OEM maintains continual communication with supplier and leaves open the possibility the OEM may drop by for another site visit expecting to see his widget in production.

Trust is "belief that someone or something is reliable, good, honest, effective, etc." In this case, the OEM has simply decided to accept the risks associated with a more relaxed inspection and a lack of multiple site visits, rather than to pursue further verification. There is no indication that the OEM believes anything about the supplier at all. Nor can I see any need for the OEM to believe anything about the supplier. The OEM knows what it knows and what it doesn't know, and that is enough for it to make the decision it has made.

In any case, I don't see this as an example of "trust, but verify." That which was verified was verified, no trust was involved. That which is not going to be verified is simply not going to be verified; it is not going to be trusted but verified. I see this as more of an example of "Verify some, and leave the rest to trust."
 
Top Bottom