You are carrying out an audit at a single-site organisation seeking certification to ISO 9001...

You are carrying out an audit at a single-site organisation seeking certification to ISO 9001 for the first time. The

organisation manufactures cosmetics for major retailers and the name of the retailer supplied appears on the product

packaging. Sales turnover has increased significantly over the past five years. The organisation uses a software programme called SWIFT, which is used to record sales, plan production, purchase supplies, print despatch notes, track new product development, perform traceability exercises, carry out mass balance checks, raise invoices, create budgets, and support financial control.

You are nearing the end of the audit and you are reviewing your audit notes. You notice a recurring trend concerning the SWIFT database as shown below:

You ask the Quality Manager to explain how the SWIFT database is controlled. You learn that the Operations Director is

responsible for determining and progressing SWIFT software updates. You decide to meet the Operations Director (OD).

You: "Good afternoon."

OD: "Good afternoon."

You: "What responsibility do you have concerning the SWIFT database?"

OD: "I maintain it. If anyone wishes to propose an update to the database, they send me an email with

details of their proposal. I then either process the database update myself, or I send the request to the

consultant who designed the database 20 years ago. The necessary software changes are made, and the

amended software is immediately released to users."

You: "Would you explain how the software amendments are controlled?"

OD: "Of course. I personally update every computer myself."

You: "Do you inform the database users of the changes?"

OD: "No I don't. They find out for themselves by using the software, or they come to see me if they have

any questions."

You: "How do you ensure that the database users use the latest version?"

OD: "That's easy, I update every computer myself."

You: "During the audit, I noted there were several versions of SWIFT in use (you refer to your audit

notes)."

OD: "I know. That's because some versions work better than others, and depending on user needs and

experiences, we allow users to revert to using an earlier version if they find it works better for them."

Based on the scenario, which two of the following statements are true? There is evidence of

nonconformity with a requirement defined in ...