How Does ISO Define Traceability?

One of the questions I get asked a lot (and it really is a lot!) is "How does ISO define traceability?" that's always accompanied with: what do they want, what things do I need put in place, will it be expensive and but my customer doesn't care about it!

The answer, initially at least is, "It depends!" Obviously, this is not overly helpful, so we never leave it there we need to understand what it depends upon and who you are trying to satisfy.

The 1^st part of the it depends discussion is which standard are we talking about since ISO have a great many standards and many have requirements for traceability but lets focus on the most popular which gets the most amount of interest ISO9001:2015. ISO13485:2016 for Medical Devices has additional requirements for traceability on top of 9001 as does ISO22000 for Food safety but those are for other posts.

What is the 9001 Requirements for Traceability?  

The ISO 9001:2015 clause for traceability also includes identification. That makes sense really since it will be pretty hard to trace something if you can't first identify it. There are three parts of the requirement, here's what it says:

The organisation shall use suitable means to identify outputs when it is necessary to ensure the conformity of the products and services.

The organisation shall identify the status of the outputs with respect to monitoring and measurement requirements throughout production and service provision

The organisation shall control the unique identification of the outputs when traceability is a requirement and shall retain documented information necessary to ensure traceability.

8.5.2 Identification & Traceability

As we all know when ISO says Shall it means you must, so obviously you must do these things, erm… no because they have that extra little bit when it is necessary or when it is a requirement. So who decides if it's necessary or a requirement, typically your end customer or the industry you are in is the answer, hence the original 'it depends' statement because your customers and your industry may not require them or may only require some level of traceability.

From an ISO point of view however, according to the ISO9000:2015 Fundamentals and Vocabulary document Traceability is purely the ability to trace the history, application or location of your product and it can relate to a number of things such as:

• Origin of the materials and parts
• The processing History
• The distribution and location of the product or service after delivery.

The English Translation 

Great, now we have the ISO definition what exactly does that mean in terms of traceability for products (we will talk about measurement another time), what is the plain English translation?

It is not as complicated to get your head around as some people think. Take one of your products and imagine that you need to recall them because your supplier has found a manufacturing fault at their plant that impacts some of your products but not all of them, what would you need to put in place to do that? Imagine you had to draw a straight line of sight from your suppliers parts to your customers, what would you need to put in place to be able to get the right ones?

Working backwards you need to know:

1. What products of yours are affected that means you need to know where this suppliers part was used, which of your part numbers are going to be impacted, most ERP systems allow you to run a where used report that perhaps could help you here showing you where a certain part number is used in your product line up.
2. Once you know the products affected you need to understand how many are impacted so what was the time frame that the issue occurred, how long was the window of faulty parts, was it 10, 100, 1000, 10,000 or more!
3. Now you know how what product types were impacted and how many you now need to find out exactly which ones which is where the manufacturing batch / lot number may come into play if you have used that and with that which serial numbers are impacted (hence why ISO want you to have identification!)
4. As you have arrived at exactly what products were impacted and how many you need to understand exactly when they where shipped out to, did they go to an end customer or a distribution centre, if they went to a distribution centre which one and who do they sell too? That allows you to do a recall if you need to. (Every country has its own recall requirements should you need to but again, that's a whole other post).

Some other things to think about, if you subcontract some of your process say you send your product out to someone who splits it into smaller sizes, a roll of material for example, you need to be able to keep track of those bits of material and show which larger roll they came from and that means ensuring your subcontractor has adequate traceability as well. 

The easiest way to figure this out is to work through the process that we've talked about here, from either end, i.e. a supplier tells you have a fault or a customer tells you have a fault.

When it comes from the customer you need to work back to the batch of product that the faulty product came from to identify the faulty part, then work forward again to identify all the other products made with that faulty part.

Key's to good Traceability  

Traceability is not hard when you design your system correctly and you make sensible decisions and not over complicate things.

1. Apply serial numbers to what you manufacture, include in that serial number some way of tying back to the batch / lot number or a date range. Obviously make sure it is impossible to duplicate that identification number! Many shop floor tracking or ERP systems will link serial numbers to batches for you.
2. Ensure that when you despatch things that you include a track of which batch is sent to which customer or distribution centre
3. Ensure that you work with suppliers who can provide you with traceability information as required, that may well be part of the audit and selection requirements.
4. Get Certifications of Conformance (CoC) for each batch delivered to you (and where appropriate get an initial Certificate of Analysis COA when you start working with the supplier, you may want to repeat this annually) that ensure you are getting what you think you are from the supplier.