According to the ISO 9001:2015 standard, clause 4.1 requires organizations to determine the external and internal issues that are relevant to their purpose and that affect their ability to achieve the intended outcomes of their quality management system. Clause 6.1 requires organizations to plan actions to address the risks and opportunities associated with these issues. These actions must be integrated into the quality management system processes and evaluated for effectiveness.
In this scenario, the General Manager of the pharmaceutical organization has shown a lack of understanding and involvement in the process of identifying and addressing the external and internal issues that affect their quality management system. The General Manager has relied on the legal compliance expert, who is not an employee of the organization, to guide them on this process. The General Manager has also admitted that they did not document these issues, which is contrary to the requirement of retaining documented information on the context of the organization. The General Manager has also delegated the responsibility of determining and planning the actions to address the risks and opportunities to the Technical Manager, who is absent due to COVID-19.
Based on this information, you can respond to the General Manager's suggestion by taking two options:
B: I would ask for a different guide instead of the legal compliance expert: You can request to have a different guide who is an employee of the organization and who is familiar with the quality management system processes and the external and internal issues that affect them. The legal compliance expert may not have the necessary knowledge and authority to answer your questions or provide you with the relevant evidence.
C: I would look for evidence that the actions resulting from the risk assessment had been taken: You can verify whether the organization has implemented and evaluated the actions to address the risks and opportunities associated with the external and internal issues. You can look for evidence such as records of risk analysis, action plans, monitoring and review results, and improvement measures.
These two options would help you to assess the conformity and effectiveness of the organization's quality management system with respect to the requirements of clauses 4.1 and 6.1.