4 quality management system - msasolution.com · web viewthis gap analysis checklist is designed...

Management Systems Analysis, Incwww.MSASolution

PO. Box 136Royersford, PA 19468

[email protected]

Introduction

This Gap Analysis Checklist is designed for an organization to evaluate their conformance to the requirements of ISO 9001:2000. As such the question reflect the requirements of the standard. Many of the questions are generic in nature as is the standard. This is intentional and allows a wide range of user to implement a system in compliance with the standard.

Consequently there is not one right way to meet many of the requirment. The user should develop the processes needed to meet the requirements that add value and compliment their organization without creating undue bureaucracy or burden. When done in this manner the greatest value can be realized from the system developed.

Upon completion of the Gap analysis the organization will have a simple checklist of the activities that need to be performed or processes to be revised or developed.

The Process approach

While much of the language is the same in the 1994 and 2000 versions of the standards the fundamental orientation of the standard has changed. During the 1994 revision auditors were viewed one of the primary customer of the standard. Consequently any revision was subject to the “is this auditable” questions. As a result the standard was fraught with requirements for documented procedures and records in throughout every process and these process were relatively unrelated. You could for example develop a contract review process that was unrelated to your design process, the output of the former not necessarily meeting the input needs of the later.

During the revision of the 2000 revision the customer has clearly been defined as the user, the user in this case being the organization that develops and implements the system. As a result the standard tends to be more flexible as to how the organization goes about operating their system. In addition to a quality manual there are only six processes that require documented procedures. How the organization goes about documenting their systems has been left to the up to the organization.

Management Systems Analysis, Inc.WWW.MSASolution.com

1

mailto:[email protected]

http://www.MSASolution/

The new revision also promotes the adoption of the process approach when developing and operating their system. Often the output from one process directly provides the input to the next, and so on throughout the system. A process approach provides linkage between the individual processes within the system of processes. When used within a system this approach emphasizes, understanding and meeting requirements, the addition of value provided by each process, achieving process performance and effectiveness, and continual improvement of processes. As a result the effectiveness and efficiency of the systems depends on the combination and interaction the processes in achieving customer satisfaction.

So what does all this mean to you? Well, evaluating a system to the 1994 version was a matter of reviewing the procedures and records required. The adage “say what you do and do what you say” became popular based on this approach.

The 2000 version of the standard changes this from the point of view of the organization as well as the auditor. To evaluate a system to the new revision of the standard will require that you evaluate the operation and effectiveness of each process and its output to achieve to policy and objectives of the organization. In short is a particular process operating effectively, does it add value, does it meet the input needs of the next process and most of all does it contribute to the achievement of customer satisfaction.

Using this Gap Analysis

In using this Gap Analysis an individual will need knowledge of Quality Management Principles as well as an understanding of the systems, its individual processes and how they contribute to the achievement of customer requirements leading to customer satisfaction.

The questions presented in this analysis are formulated to be as straight forward as possible without interpreting the requirements of the standard. When completing this Gap Analysis answer the questions as honestly as possible and make sure your answer are based on factual evidence.

The question could be answered by a simple yes or no or you could use a rating scale from 1 to 5. With a 1 or 0 equaling no compliance or system, and a 5 equaling the highest rating or a system that is fully implemented and both effective and efficient. This later method could provide more information regarding where to change or improve your system.

Exclusions


2

As previously stated all requirements of ISO 9001:2000 are generic and are intended to be applicable to all organizations, regardless of type, size and product provided.

The only exceptions would be where a requirement could not be applied due to the nature of an organization and its product. Where an organization claims unjustified exclusions (none applicability) statements of conformity are not acceptable. Any exclusion is limited to requirements within clause 7. Such exclusions must affect the organization's ability, or responsibility, to provide product that fulfils customer and applicable regulatory requirements.

This is obviously a change from the 1994 versions where many organizations claimed design and statistical techniques where not applicable to their systems. This revision does not provide the user with that latitude, particularly with organizations that are certified/registered. Remember these are limited to the requirements of clause 7 and only where precluded by the nature of the product or service and the organization's ability, or responsibility, to provide product that fulfils customer and applicable regulatory requirements.

4 Quality management systems

4.1 General requirements

Has the organization established, documented, implemented and maintained a quality management system in accordance with the requirements of the standard.

Does this system include continually improvement of its effectiveness?

Does this system:a) identify processes needed for the quality management system and their application throughout the organizationb) determine the sequence and interaction of these processes,c) determine criteria and methods needed to ensure that both the operation and control of these processes are effective,d) ensure the availability of resources and information necessary to support the operation and monitoring of these processes,e) monitor, measure and analyze these processes, andf) implement actions necessary to achieve planned results and continual improvement of these processes.

Are these processes managed by the organization in accordance with the requirements of the standard?


3

NOTE Processes needed for the quality management system referred to above should include processes for management activities, provision of resources, product realization and measurement.

This is the basic requirement that establishes the program and speaks to its completeness. You may want to wait to cover this question until the end of your evaluation as the results may indicate a violation to this clause.

See ISO 9001 1994 Para 4.2.1

4.2 Documentation requirements

4.2.1 General

As appropriate does the organizations quality management system documentation includea) documented statements of a quality policy and quality objectives,b) a quality manual,c) documented procedures d) documents needed by the organization to ensure the effective planning, operation and control of its processes, ande) quality records required

NOTE 2 The extent and type of quality management system documentation can differ from one organization to another due toa) the size of organization and type of activities,b) the complexity of processes and their interactions, andc) the competence of personnel.d) The form or type of medium used.

This clause establishes the requirement that the system be documented. However it is important to note that the extent of the documentation beyond those required by the standard and its form or media is up to the organization to determine,See ISO 9001 1994 Para 4.2.1 & 4.5.1

4.2.2 Quality manual

Has the organization shall established and maintains a quality manual including

a) the scope of the quality management system, b) the details and justification for any exclusionsc) the documented procedures established, or reference to them,

andd) a description of the interaction between the processes


4

This of course is the requirement for a quality manual. It is important to not here that the manual may take many differing forms and/or media. The only restrictions are in the content, and they are rather limited creating additional flexibility for smaller organizations.

See ISO 9001 1994 Para 4.2.1

4.2.3 Control of documents

Are documents required by the quality management system shall be controlled.

Has a documented procedure been established to definea) approval for adequacy prior to issue,b) review(s) and update(s) as necessary c) re-approval of documents,d) identification of changes and the current revision status e) the process to ensure relevant versions are available at points of

use,f) how documents remain legible and readily identifiable,g) identification and controlled distribution of external h) identification and retention of obsolete documents as necessary

Are controls extended to quality records.

Note this is one of the clauses that explicitly establishes a requirements for a documented procedure. This is the typical document control system that has been in use throughout the life of many quality systems standards, including the ISO 9000 series or family.

See ISO 9001 1994 Para 4.5.1, 4.5.2 & 4.5.3

4.2.4 Control of quality records

Are quality records established and maintained.Do they provide evidence of conformity to requirements? Do they provide evidence of the effective operation of the quality management system? Are provisions established to ensure quality records legible, readily identifiable and retrievable.

Has a documented procedure been established to define the controls needed for the identification, storage, protection, retrieval, retention time and disposition of quality records.


5

Note this is one of the clauses that explicitly establishes a requirements for a documented procedure. As with document control this is the typical records control procedure included many quality systems standards, including the ISO 9000 series or family.

See ISO 9001 1994 Para 4.16

5 Management responsibility

5.1 Management commitment

Is there evidence of top management commitment to the development and implementation of the quality management system and continually improving its effectiveness?

Does this include a) communicating to the organization the importance of meeting

customer as well as statutory and regulatory requirements,b) establishing the quality policy,.c) ensuring that quality objectives are established,d) conducting management reviews, ande) ensuring the availability of resources?

Note the explicit reference to “continually improving its effectiveness” that is include in the 2000 versions of ISO 9001 standard. While many would argue that continual improvement was implicit in the 1994 version it is clearly explicit in 2000. Also note the addition of statutory and regulatory requirements, as they may be applicable to your organization. However you are now given specific methods and/or documents to verify this level of commitment by top management. These will need to be evaluated to evaluate top managements commitment.

Finally, notice the use of the term “top management”. While this gain greater computability with ISO 14001 it also helps to preclude to delegation of this responsibility down the organization. For instance “top management” of a site or plant would be the Plant Manager, whatever his/her title. As opposed to top management of a corporation, which would be the President or CEO.

See ISO 9001 1994 Para 4.1 + 4.1.2.2 + 4.2.1

5.2 Customer focus


6

Does top management ensure that customer requirements are determined and fulfilled with the aim of enhancing customer satisfaction

Customer satisfaction is one of the new focuses of this standard. While the 1994 version hoped to accomplish this through documented procedure that controled processes, the 2000 version now makes it an explicit output of the system. Since this requirements accrues directly to top management it is likely that this will need to be evaluated through the internal audit and management review process.

See ISO 9001 1994 Para 4.3.2

5.3 Quality policy

Has top management established a quality policy?

Is the quality policya) appropriate to the purpose of the organization,b) includes a commitment to comply with requirements and

continually improve the effectiveness of the quality management system,

c) a framework for establishing and reviewing quality objectives,d) communicated and understood within the organization, ande) reviewed for continuing suitability.

Similar to the 1994 version of the standard, 2000 requires top management establishes and communicates it quality policy. However it is important to note the additions of continual improvement of effectiveness and that the policy now provides a framework for setting and reviewing quality objectives.

See ISO 9001 1994 Para 4.1.1

5.4 Planning

5.4.1 Quality objectives

Has top management established quality objectives,

Do these include those needed to meet product requirements

Are these established at relevant functions and levels within the organization.

Are the quality objectives measurable and consistent with the quality policy.


7

While objectives where mentioned in the 1994 version of the standard this requirement is now more explicit. Specific attention should be given to the measurability of the objectives. This implies that these will be measurable number or percentages, as opposed to statements of policy. Also, you will need to evaluated their consistency with the policy. Once you have made a commitment to improving customer satisfaction in the policy this should be reflected in a quality objective.

Finally, you will want ot assure these are communicated to the personnel that are responsible for the objective. Similar to communicating the policy you may want to ask several individuals about the objectives that apply to their jobs or function.

See ISO 9001 1994 Para 4.1.1

5.4.2 Quality management system planning

Has top management planned the quality management system to meet requirements and objectives, including

a) identification of the processes neededb) determination of the sequence and interaction of these

processes,c) determination criteria and methods needed to ensure these

processes are effective,d) ensuring the availability of resources and information necessary e) monitoring, measuring and analyzing these processes, andf) actions necessary to achieve planned results and continual?See 4.1

Does top management verify the integrity of the quality management system is maintained when changes to the quality management system are planned and implemented?

This requirement clearly establishes top managements responsibility to plan and establish the system. As such this is similar to the 1994 version of the standard, which is now made more explicit.

Verification of this is actually performed at the conclusion of any evaluation. Omission or major failures in the system can be attributed to a failure on the part of top management to perform adequate planning.

See ISO 9001 1994 Para 4.2.3


8

5.5 Responsibility, authority and communication

5.5.1 Responsibility and authority

Has top management established the responsibilities, authorities and interrelationship of personnel are defined and communicated?

For most organization this has been done as a part of the quality manual and this requirement has not changed from the 1994 version. The primary difference is that the language expressing the independence issue …imitate actions, identify problems…. has been moved to the management representative and internal audit requirements.This can usually be verified through communications within the organization or distribution of key documents like management reviews and internal audit reports.

See ISO 9001 1994 Para 4.1.2.1

5.5.2 Management representative

Has top management appointed a member of management as management representative?

Does this individual have responsibility and authority, including:a) ensuring processes needed are established, implemented and maintained,b) reporting on the performance of the quality management system and any need for improvement, andc) promotion of awareness of customer requirements throughout the organization.

While this is similar to the 1994 version several specific responsibilities have been included in this requirement. Many realize that this tend to be delegated further and further down the organization to the point where the individual designated does not have the authority to perform this function. Also, note the addition of promotion of customer requirements. This language is consistent with one of the primary themes of this document, customer satisfaction.

In addition ot reviewing reports and communication in support of the delegation of the management representative you will now need to verify the “promotion of customer requirements”


9

This might be accomplished through a separate communications program using things like bulletins or could be as simple as an extension of the training program. Be aware that further down in the training section will be a requirement for awareness training, this could be integrated with that system.

See ISO 9001 1994 Para 4.1.2.3

5.5.3 Internal communication

Has top management ensured that appropriate communication processes are established.

Do these communication include the effectiveness of the quality management system.This is clearly a new requirement. While it does gain improved compatibility with ISO 14001 EMS it is also a valuable addition to QMS. It is difficult to argue that communications are not a part of good management practices.

Most companies already have communication systems already at work. The use of shop travelers, drawing or sales order communicate customer requirements; procedures or work instruction communicate standard practices and training is typically used to address unique situations. However as previously discussed a system of Quality Bulletins or Information Notice could be useful.

Verifying the success of this process may entail reviewing these documents or even testing the system by interviewing personnel for there knowledge of relevant requirement or conditions.

No ISO 9001 1994 reference

5.6 Management review

5.6.1 General

Does top management review the organization's quality management system?

Is the frequency of management reviews specified?

Do management reviews include the continuing suitability, adequacy and effectiveness of the system?


10

Do these reviews include assessments of opportunities for improvement and the need for changes to the quality management system?

Does this include the quality policy and quality objectives?

Are there records of management reviews?

5.6.2 Review input

Do the inputs to management review include information ona) results of audits,b) customer feedback,c) process performance and product conformity,d) status of preventive and corrective actions,e) follow-up actions from previous management reviews,f) planned changes that could affect the quality management system, andg) recommendations for improvement?

5.6.3 Review output

Do the outputs from the management review include any decisions and actions related toa) improvement of the effectiveness of the system and its processes,b) improvement of product related to customer requirements, andc) resource needs..

This management review requirement is obviously much more explicit then the 1994 version of the standard. While many organization do an excellent job on their management review, for many this is little more then a form letter. Since management review is the driver for any major change in the system this requirement now requires specific inputs and outputs.

Examine a management review to determine if it addresses all of these requirements. Does it include these inputs and outputs?

See ISO 9001 1994 Para 4.1.3

6 Resource management

6.1 Provision of resources


11

Has the organization determined and provided the resources neededa) to implement and maintain the system b) to continually improve its effectiveness, andc) to enhance customer satisfaction by meeting customer

requirements.

This requirements is very similar to the 1994 version with the exception that it is now oriented toward the improvement of the system and customer satisfaction. Since this version of the standard now requires policies, objectives, analysis and review of these evaluating resources should become considerably easier.

Examine the data analysis, management review and the policy and objectives of the organization to evaluate their relationship.

See ISO 9001 1994 Para 4.1.2.2

6.2 Human resources

6.2.1 General

Do personnel performing work affecting product quality competent on the basis of appropriate education, training, skills and experience.

This requirements is very similar to the 1994 version with the exception that the word competent is used in place of qualification. This section is the introduction into the training requirements that will follow.

Examine procedures, matrices or other documents that first identify those performing activities affecting quality and second that defines the appropriate education, training, skills and experience for each.

See ISO 9001 1994 Para 4.18

6.2.2 Competence, awareness and training

Has the organization

determined the necessary competence for personnel performing work affecting product quality,This is obviously linked to the preceding equipments.


12

provided training or other actions to satisfy these needs,This is the provisions to meet the above requirements by providing training that is needed to meet the above needs identified.evaluate the effectiveness of the actions taken,This is obviously a new requirement were the organization will need to determine if the training they provided was effective. This may be accomplished by testing, reviewing nonconformance’s or corrective related to training subjects after the fact or possibly internal auditing.

ensure personnel are aware of the relevance and importance of their activities and how they contribute to the achievement of the quality objectives,This is obviously a new requirement were awareness training is provided to everyone in the organization. Organizations will need to developed awareness programs covering their quality systems that they will provide to their personnel.

maintains records of education, training, skills and experience Similar to the existing requirements the organizations will need to maintain records of all of this processes/activities and the training provided.

See ISO 9001 1994 Para 4.18

6.3 Infrastructure

Has the organization determined, provided and maintained the infrastructure needed to achieve conformity to product requirements.

This may includea) buildings, workspace and associated utilities,b) process equipment, both hardware and software, andc) supporting services such as transport or communication.

This requirement was actually addressed in the 1994 version of the standard. The difference in this version is that the requirement has become more explicit in providing examples. While organizations may have previously made an all encompassing statement in their manuals they now will need some analysis of the infrastructure needed. An extreme example here would be a clean room for the production of medical devices.


13

Examine the Management Review or other records to demonstrate that Top Management has made this determination.

See ISO 9001 1994 Para 4.1.2 & 4.9

6.4 Work environment

Does the organization determine and manage the work environment needed to achieve conformity to product requirements.

As with the previous requirement this actually addressed in the 1994 version of the standard. Organizations that did this well for the previous edition of the standards should have little trouble with this requirement.

Examine the Management Review or other records to demonstrate that Top Management has made this determination.

See ISO 9001 1994 Para 4.9

7 Product realization

7.1 Planning of product realization

Has the organization planned and developed processes needed for product realization.

Is this planning consistent with the requirements of the other processes of the quality management system.

Has the organization determined the following, as appropriate?a) quality objectives and requirements for the product;b) the need to establish processes, documents, and provide resources specific to the product;c) required verification, validation, monitoring, inspection and test activities specific to criteria for product acceptance;d) the records needed to provide evidence that processes and resulting product fulfill requirements Is the output of this planning in a form suitable for the organization's method of operations.

Planning of product realization is very smiliar to the 1994 version of the standard. This requirements combines elements of Quality Planning, Process Planning and In-process Inspection into one clause that should not require changes in your system. One item of note here is the addition of “quality


14

objectives and requirements fot the product”. This of course links back to the new section of Quality Objectives, which will now need to be considered in the process planning activities.

Verifying this will be highly dependent on the type or organization and the product or service provided. IN a simple manufacturing environment this could be a s simple as a combination of the procedure and work instructions. For larger or more complex processes it might also include the inclusion of shop travelers (e.g. work orders, sales orders) that outline the sequence of operations to be performed and the applicable requirements. In a service organization it could be a service brief or order.

You will need to examine how the organization describes their process planning activity, verify that it addresses the appropriate requirements and that this process in implemented.

See ISO 9001 1994 Para 4.2.3 + 4.9 + 4.10.1

7.2 Customer-related processes

7.2.1 Determination of requirements related to the product

Has the organization determineda) requirements specified by the customer, b) requirements for delivery and post-delivery activities,c) requirements not stated by the customer but necessary for

specified use or known and intended use,d) statutory and regulatory requirements related to the product,

ande) additional requirements determined by the organization.

While similar to the 1994 version this requirements combines some of the old contract review and design input requirements into a more explicit requirements. Also there has been a separation with this first section dealing with the determination of requirements and the second with review of requirements. The reasoning behind this is of course that many organization provide an “off the self or pre-manufactured product” or at least know the product or service they plan to offer to their customers. As such this is more proactive then the old contract review requirement.

Evaluating this may be as simple as examining the contract review process depending or the organization and the product


15

or service being offered. However it could include such areas as planning, marketing, sales information and design inputs for those organizations designing or developing a product or service to offer to a market. Is there a process that determines the appropriate requirements?

See ISO 9001 1994 Para 4.3.2 + 4.4.4

7.2.2 Review of requirements related to the product

Does the organization review the requirements related to the product.

Is this review conducted prior to the commitment to supply a product to the customer?

Does the review ensure that a) product requirements are defined,b) contract or order requirements differences are resolved, andc) the organization has the ability to meet the defined

requirements.

Are records maintained documenting the results of the review?

Do these records include actions arising from the review?

When a documented statement of requirement is not provided are customer requirements confirmed by the organization before acceptance?

Does the organization ensure that relevant documents are amended when product requirements are changed?

When changes occur does the organization make relevant personnel aware of the changed requirements?

This is the contract review requirement that you are familiar with from the 1994 version. Note that the requirements for making personnel aware have become more explicit. The standard is also more explicit regarding the lack of a documented statement of requirements. IN these cases you may need to review sales or product information, brochures or other advertising to confirm equipments that you have offered.

Select and review several contracts to verify the requirements were clearly defined and within the organization ability to meet prior to acceptance. Verify that there is evidence of acceptance, a signature, initials or electronic.


16

See ISO 9001 1994 Para 4.3.2 + 4.3.3 + 4.3.4

7.2.3 Customer communication

Has the organization determined and implemented effective arrangements for communicating with customers?

Do these communication include a) product information,b) enquiries, contracts or order handling, c) amendments or changes andd) customer feedback, including complaints.

Obviously this is new or at least a bit different then the 1994 version. If you take a minute a look at the requirements your already communicating through many of your existing processes. Perhaps the only genuine new subject is product information. This of course will include things like brochures, advertising and possibly even your web page. IN any case this might all be addressed in your manual by referencing or the sections or procedures that already exist.

Review your process for customer communications. Verify the process addresses product information, enquiries, contracts or order handling, amendments or changes andcustomer feedback, including complaints. Does it address all the forms of product information you use. Review the evidence of these communications.

See ISO 9001 1994 Para 4.3.2

7.3 Design and development

7.3.1 Design and development planning

Is the design and development of the product planed and controlled?

During this design and development planning does the organization determine:

a) design and development stages,b) review, verification and validation appropriate to each stage, andc) responsibilities and authorities?

Does the organization manage the interfaces between different groups involved in design and development?


17

Do these interface arrangements ensure effective communication and clear assignment of responsibility?.Is planning output updated, as appropriate, as the design and development progresses?

This is the overarching requirement for the design and development requirement almost identical to the 1994 version. These requirements are further alliterated in the sections that follow. Perhaps the more important issue here is the application section at the beginning of the standard that now act as a limitation to declaring this process as not applicable. It is perhaps helpful to look at the definition of design and development as “set of processes that transforms requirements into specified characteristics or into the specification of a product, process or system.” As you can see design and development could be applied to the design of a process or a service. Consequently there are few situation that cannot apply design and development.

Review the procedure and/or process of design a devlopement to assure that it addresses all aspects list.

See ISO 9001 1994 Para 4.4.2 + 4.4.3 + 4.4.6 + 4.4.7 + 4.4.8

7.3.2 Design and development inputs

Are Inputs relating to product requirements determined?

Are records of these inputs maintained?

Do these inputs includea) functional and performance requirements,b) applicable statutory and regulatory requirements,c) where applicable, information derived from previous similar

designs, andd) other requirements essential for design and development.

Are these inputs reviewed for adequacy?

Are requirements complete, unambiguous and without conflict?

The design and development inputs are of course very similar to the 1994 version. The two additional items of note here are the inclusion of “functional and performance requirements” and the use of “applicable information from previous similar designs”. The significance of either of these items will depend


18

on the industry you work in and the product you provide. In many cases these could easily be construed as contract requirements or as complex as the customer expectation for a consumer product.

Review the procedure and/or process to determine how input requirements are addressed. Based on this review examine several design projects and review the inclusion of all input requirements. This may include:

Contract requirements Operation requirements Processing requirements Laws and/or regulation Consumer requirements Similar designs

See ISO 9001 1994 Para 4.4.4

7.3.3 Design and development outputs

Are the design and development outputs provided in a form that enables verification against the input?

Are these outputs approved prior to release?

Do design and development outputs a) meet the input requirements,b) provide appropriate information for purchasing, production and

for service provision,c) contain or reference product acceptance criteria, andd) specify the characteristics of the product essential for its safe

and proper use..

As before design and development outputs are verified against inputs to assure they have been addressed in the process. There is of course some minor changes in this requirement and as before its significance will depend on your markets, process, and/or products. This requirement now includes “output information for purchasing, production and for service.” This addition now provides the explicit link between the design and development process and subsequent processes that will use the information provided. The verification process is now contained in 7.3.5.

Review the procedure and/or process to determine how output requirements are addressed. If you have done a good job on


19

the inputs the outputs should be simple. Examine design documents to verify the input requirements have been addressed along with, acceptance criteria, information need for subsequent processes and necessary for safe and proper use.

See ISO 9001 1994 Para 4.4.5

7.3.4 Design and development review

Are systematic reviews of design and development conducted at suitable stages?

Do these reviews includea) evaluation of the ability of the results to fulfill requirements, andb) identification of any problems and proposed necessary actions.

Do participants of such reviews include representatives of functions concerned with the design and development stage(s) being reviewed?

Are records of the results of reviews and any necessary actions maintained?

The addition here is to the contents of the review. The 1994 version discussed the process and the participants. IN the new standard these review must now include “an evaluation of the results to fulfill requirements” and Identification of any problems and solutions. As such the standard now makes explicit what was believed to be implicit to the process. There would be little point of any review that did not meet these requirements.

Review the procedure and/or process to determine how reviews are conducted and documented. Examine design review records to verify particpation, evaluation of results and resolution of identified problems.

See ISO 9001 1994 Para 4.4.6

7.3.5 Design and development verification

Are verification performed to ensure that the design and development outputs have satisfied the input requirements?

Are records of the results of the verification and any necessary actions shall be maintained?


20

Design and development verification are now more explicit. For many companies the difference between reviews and verifications were unclear. IN this version of the standard verification explicitly are addressing the process of verifying outputs satisfy inputs.

Review records of verification to assure outputs satify inputs.

See ISO 9001 1994 Para 4.4.7

7.3.6 Design and development validation

Are validations of design and development performed in accordance with planned arrangements?

Do these ensure that the resulting product is capable of fulfilling the requirements for the specified or known intended use or application?

Are validations completed prior to the delivery or implementation of the product. Wherever practicable?

Are records of the results of validation and any necessary actions maintained?

The new validation clause clarifies some of the confusion between, reviews, verification and validations. This requirement makes clear that validations are performed to ensure the product is capable of meeting the requirements for the specified use or application. It also recognizes that this may not be possible until after delivery. As such a validation may take place after delivery.

Review records of validation to ensure their completion and maintenance. You may also want to verify these records ensure the product meets the requirements specified by the customer.

See ISO 9001 1994 Para 4.4.8

7.3.7 Control of design and development changes

Are changes to the Design and development identified?

Are records of these changes maintained?

Are changes reviewed, verified and validated, as appropriate, and approved before implementation?


21

Are changes evaluated for the effect on constituent parts and delivered product.

Are records of the results of the review of changes and any necessary actions shall be maintained?

The primary change here is the addition of consideration of the effect of changes on constituent parts and delivered product. While this may not effect many organizations, these additional requirements effect organizations providing more complex products or services. You may want ot review your procedure to determine how this evaluation is or should be accomplished.

Review several design and development changes to verify changes are reviewed, verified and validated, that records are maintained and finally the an evaluation of their impact is performed.

See ISO 9001 1994 Para 4.4.9

7.4 Purchasing

7.4.1 Purchasing process

Does the organization ensure that purchased product conforms to specified purchase requirements?

Is the type and extent of control applied to the supplier and purchased product dependent upon the effect on subsequent product realization or the final product?

Are suppliers evaluated and selected based on their ability to supply product in accordance with the organization's requirements.

Is criteria for selection, evaluation and re-evaluation established?

Are records of the results of evaluations and subsequent actions from the evaluation maintained?

The evaluation and selection of supplier is similar to the 1994 version. The change here has to do with periodic evaluations. For many organizations once a supplier was selected the remained approved indefinitely. The new standard now requires periodic re-evaluation. This will cause many organizations to determine how often this will be done and how the evaluation will be performed.


22

Review the procedure and/or process for the evaluation and selection of suppliers. Review the list of selected, evaluated or approved suppliers for completeness. Selected several supplier from this list and review the records used to evaluate and select these suppliers. Finally verify these suppliers are periodically evaluated.

See ISO 9001 1994 Para 4.6.2

7.4.2 Purchasing information

Does purchasing information describe the product to be purchased?

Does this include as appropriatea) requirements for approval of product, procedures, processes and

equipment,b) requirements for qualification of personnel, andc) quality management system requirements.

Does the organization ensure the adequacy of specified requirements prior to communication to the supplier?

The change to this requirement deals solely with the succinctness or brevity of the language used in the first part and flexibility to allow for such things as electronic systems in the second. The requirement has not changed form the 1994 version it has simply been rewritten to add clarity.

Review the procedure and/or process for purchasing documents. Select a sample of purchase orders and verify they include all appropriate requirements and have been approved prior to release. Note the language here is broad enough for electronic or EDI systems.

See ISO 9001 1994 Para 4.6.3

7.4.3 Verification of purchased product

Has the organization established and implemented inspection or other activities necessary for ensuring that purchased product meets specified purchase requirements?.

Does the organization state the intended verification arrangements and method of product release at the supplier's premises in the purchasing information?


23

Does this include arrangements where the customer intends to perform verification at the supplier's premises?

This clause previously dealt with verification performed by the organization or its customers at the subcontractors facility. This clause is now rewritten to include receiving inspection (verification or validation) activities. Within the business process management model used in the new standard you can debate were receipt inspection should be located. As written in is now part of the process, closing the purchasing loop.

Beyond the subject of receipt inspection the “right of access clause” is little change in content or intent. You must include arrangement for your organization or your customer to verify product at the suppliers facility.

Examine procedure and/or processes to determine how these activities are performed. Select several products or purchase orders to and obtain receiving inspection records. Verify the records are complete and accurate.

Review purchase orders for the inclusion of the right of access clause as appropriate for you or your customer.

See ISO 9001 1994 Para 4.6.4 + 4.10.2 + 4.10.3 + 4.10.4

7.5 Production and service provision

7.5.1 Control of production and service provision

Does the organization plan and carry out production and service provision under controlled conditions?

Do these conditions include, as applicablea) the availability of information that describes the characteristics

of the product,b) the availability of work instructions,c) the use of suitable equipment,d) the availability and use of monitoring and measuring devices,e) the implementation of monitoring and measurement, andf) the implementation of release, delivery and post-delivery

activities.

This requirement now deals with the subjects of process control, in-process inspection, delivery and service. While this may initially be confusing the change here is driven first by the business process model that is being used and then by the broadening of the requirements to accommodate services.


24

Take note of the as applicable that precedes the list. Your organization will need to determine which of these apply to your processes. In the 1994 version many organizations placed great emphasis on the work instruction, even after the term was removed from the standard. This requirement may take a little more thought in deciding what actually applies to your processes.

Of course some of this integrates into other sections of the standard, resources, in-process monitoring and measurement, calibration all will interface here.

Examine procedure and/or processes to determine how the production and/or service process is controlled. Examine as necessary:

production travelers or sales orders quality plans service briefs work instruction in use. monitoring and measurement records maintenance of equipment

Are the measures employed adequate to assure the quality of the product or service delivered?

Are the controls described implemented?

See ISO 9001 1994 Para 4.9 + 4.10.3 + 4.15.6 + 4,19

7.5.2 Validation of processes for production and service provision

Does the organization validate processes for production and service where the resulting output cannot be verified by subsequent monitoring or measurement?

Does this include any processes where deficiencies become apparent only after the product is in use or the service has been delivered?

Do validation demonstrate the ability of these processes to achieve planned results?

Do arrangements for these processes including, as applicablea) defined criteria for review and approval of the processes,b) approval of equipment and qualification of personnel,c) use of specific methods and procedures,d) requirements for records, and


25

e) revalidation.

This is the special processes clause from the 1994 version. As you have learned by now a special processes is any process the results of which cannot be easily verified. A common example welding, the only method of ascertaining the integrity of the weld is to pull it apart. Since this would destroy the product the critical variable, procedure, personnel, equipment, are controlled to assure the quality of the weld.

New to this clause is the subject of revalidation. Consequently these processes will need to be revalidated, including the procedure, personnel, and equipment.

Take note that in the service industry this list could become extensive, as many of the process cannot be inspected.

First list all of the special process performed by your organization.

Review the procedure and records for each to determine that specific methods and procedures are used criteria for review and approval have been defined, equipment has been approved personnel have been qualified results are recorded, and, provisions and performance of periodic revalidation is

performed.

See ISO 9001 1994 Para 4.9

7.5.3 Identification and traceability

Does the organization identify the product, where appropriate, by suitable means throughout product realization?

Is the product status with respect to monitoring and measurement requirements identified?

When traceability is a requirement do controls and records provide for the unique identification of the product?

This clause remain very similar to the 1994 version with the addition of monitoring and measurement (inspection & test) status. If you


26

combined the Identification and status section or procedures of your existing system they would meet the requirements of this clause.

Examine product throughout the organization to determine that it is identified. Can you walk up to the product and determine what it is by

Location Marking Tags Accompanying paper work

Is the status of product you examine indicated. Is it on hold, nonconforming, accepted, awaiting inspection..?

Determine if traceability is a requirement. If so can you use the identification previously observed to find associated certifications, process records, test records, etc.

For services and software this can become more challenging. For example, is the software identified by a version, product number, or serial number even when installed in a PC?

See ISO 9001 1994 Para 4.8 + 4.10.5 + 4.12

7.5.4 Customer property

Does the organization identify, verify, protect and safeguard customer property provided for use or incorporation into the product.

Is property that is lost, damaged or otherwise found to be unsuitable for use reported to the customer?

Are these records maintained?

Customer supplied product in the 1994 version is now broadened to customer property. The reasoning behind this is quite simple that customer can provide more than product. Often time they provide tolling equipments fixtures and other property to their supplier. All of these will need to be controlled under this new clause. Also take note of the note, this could include intellectual property. Drawings, specification, procedures and software all could be considered intellectual property requiring control under this clause

Review the manual and associated procedure(s) about what property is controlled? Question Quality Production and Engineer personnel about property provided by the customer?


27

Once you have identified all of the customer property used review the controls used and examine the property.

Review records for each to determine how they are controlled, verified upon receipt, protected, and safeguarded.Review records of any lost or damaged property. Have these been reported to the customer?

See ISO 9001 1994 Para 4.7

7.5.5 Preservation of product

Is product conformity preserved during internal processing and delivery to the intended destination?

Does this preservation include identification, handling, packaging, storage and protection?

Does this preservation also apply to the constituent parts of the product.?

While the redundancies have been eliminated this is basically the handling, storage, packaging, preservation and delivery clause from the 1994 version of the standard. There is little change here other then to eliminate the receptiveness. The one item of note is the elimination of “appropriate methods for authorizing receipt and the dispatch….” and the periodic assessment of product in stock.Examine procedure and/or processes to determine how handling, storage, packaging, preservation and delivery processes are controlled?

Examine product and records throughout the organization to determine conformance to these controls.

See ISO 9001 1994 Para 4.15.2 + 4.15.3 + 4.15.4 +.4.15.5 + 4.15.6

7.6 Control of monitoring and measuring devices

Has the organization determined the monitoring and measurement to be undertaken?


28

Has the organization provided the monitoring and measuring devices needed to provide evidence of conformity of product to determined requirements? Are processes established to ensure that monitoring and measurement are carried out in a manner that is consistent with the monitoring and measurement requirements?

Does this include where necessary to ensure valid results,:a) calibration or verification at specified intervals, or prior to use, b) calibration or verification against measurement standards

traceable to international or national measurement standards; c) where no such standards exist, is the basis used for calibration or

verification recorded;d) adjustment or re-adjustment as necessary;e) identification to enable the calibration status;f) safeguards from adjustments that would invalidate the

measurement result;g) protection from damage and deterioration during handling,

maintenance and storage.

Does the organization assess and record the validity of the previous measuring results when the equipment is found not to conform to requirements?

Does this include taking appropriate action on the equipment and any product affected.

Are records of the results of calibration and verification maintained

When computer software is used in the monitoring and measurement of specified requirements is its ability to satisfy the intended application confirmed.

Is this undertaken prior to initial use and reconfirmed as necessary?

What many of use refer to as calibration or as it is titled in the 1994 version “Control of inspection, measuring and test equipment” is very similar to the new standard. The standard has changed to monitoring and measurement as a more neutral phrase for both software and the service sectors. Words such as accuracy and uncertainty have been intentionally eliminated due to improper use and/or a lack of definition. These terms can of course be found in 10012-1 and 10012-2 as referenced in the note in the 2000 version.

What has been added is more specific language regarding computer software used in monitoring and measurement that


29

must be now be validated prior to use. While “test software was mentioned in the 1994 version this additional language should help to clarify which software is included. Validation could be as simple as recording the operations manually and comparing the results to the software results to confirm they are the same. Reconfirmation will needed to be performed when the version of the software changes.Examine procedure and/or processes to determine how these activities are performed.

Is the equipment or software provided adequate to verify product requirements?

Tour the facility to identify monitoring and measurements equipment and software in use. Is each

Identified with unique and traceable markings (serial number)

Identified with a calibration status (calibration label or indicator)

Safeguarded from unauthorized adjustment, Protected from damage or deterioration Within it current calibration cycle

Review calibration records to determine they are being maintained?.

Examine records for the equipment identified to determine that each is

Calibrated or verified against standards traceable to international or national standards; (NIST) or

the basis used for calibration or verification recorded, where standard do not exist;

adjusted or re-adjusted as needed,

When the equipment is found not to conform to requirements is the condition recorded and evaluated for impact on previously accepted product?

See ISO 9001 1994 Para 4.11.1 + 4.11.2

8 Measurement, analysis and improvement

8.1 General

Does the organization plan and implement the monitor, measure, analyze and improve processes neededa) to demonstrate conformity of the product,b) to ensure conformity of the quality management system, and


30

c) to continually improve the effectiveness of the quality management system.

Does this include determining of applicable methods, including statistical techniques, and the extent of their use.

This section is a general overview to the following sections. As such each of these sections should meet the requirements specified in the clause. Take note that this is the only place in the standards that statistic are used. Statistical techniques could include a wide range of tools. For instance, sampling plans, percent of defects are both statistical techniques. Do not confuse techniques with SPC, only one tool that could be employed for these techniques.

Verification of the requirements of this clause is accomplished by evaluation of the following requirements.

See ISO 9001 1994 Para 4.10 + 4.17 + 4.20.1

8.2 Monitoring and measurement

8.2.1 Customer satisfaction

Does the organization measure customer perception as a measurements of the performance of the quality management system in fulfilled customer requirements

Are the methods for obtaining and using this information determined/specified?

This is unquestionably a new requirement. The question of measuring customer satisfaction has been a long and often difficult debate. While everyone agrees that it is a key business factor and input into quality how do you measure it? As you can see it is now the minimum, fulfillment of customer requirements. As a result an organization could use customer complaints as a measure of customer satisfaction. However these complaints will now need to be analyzed, probably over a specified period to identify trends or serious condition.

Review the methods the organization uses to determine customer satisfaction. Review the results of the analysis of customer surveys, complaint or other records.

See ISO 9001 1994 No Reference


31

8.2.2 Internal audit

Are the responsibilities and requirements for planning and conducting audits, and for reporting results and maintaining records defined in a documented procedure.

Does organization conduct internal audits.

Are they performed at planned intervals

Do these audits determine whether the quality management systema) conforms to the planned arrangementsb) to the requirements of ISO 9001this International Standard c) to the quality management system requirements established,

andd) is effectively implemented and maintained.

Do these audit take into consideration the status and importance of the processes and areas to be audited,

Do these audit take into consideration the results of previous audits?

Are the audit criteria, scope, frequency and methods defined?

Are auditors objective, impartial: and not responsible to audit their own work?

Is management responsible for the area being audited responsible for taking action to eliminate detected nonconformities and their causes?

Do follow-up activities include the verification of the actions taken and the reporting of verification results?

This section is the typical internal audit requirements that we are all familiar with in the 19994 version. The sole new addition here is the independence and objectivity of the auditor. The standard now explicitly defines independence as not auditing your own work. This should not be a change for most organizations.

Note that this is one of the few sections that explicitly requires a documented procedure.

Review the procedure and audit reports for compliance to the requirements stated.Review corrective action to previous audits.Review distribution of the audit report to management.Review the qualification of the auditors performing the audit.


32

See ISO 9001 1994 Para 4.17

8.2.3 Monitoring and measurement of processes

Does the organization apply suitable methods for monitoring?

Where applicable does this include measurement of the quality management system processes?

Do these methods demonstrate the ability of the processes to achieve planned results?

Is correction and corrective action shall be taken when planned results are not achieved to ensure conformity of the product?

While this may seem new to some these requirements where contained in the 1994 version. Specifically, process control, internal audits and statistical techniques where all used to measure processes. An organization might use elements of in-process inspection to achieve the measurement of the process or could use statistical process control. The methods used will depend on the process.

Review the organization plans or methods for measurement of the process. Examine records of these measurements to verify they are being carried out. Does this evidence demonstrate the achievement of planned results? Is it limited to the system or are processes included?

See ISO 9001 1994 Para 4.9 + 4.17 + 4.20.1

8.2.4 Monitoring and measurement of product

Does the organization monitor and measure the characteristics of the product to verify that requirements are fulfilled.

Is this carried out at appropriate stages of the product realization process?

Is it in accordance with the planned arrangements?


33

Does the organization maintain evidence of conformity with acceptance criteria?

Do the records indicate the person(s) authorizing release of product?

Is product release and service delivery restricted until all planned arrangements have been satisfactorily completed, unless otherwise approved by a relevant authority or by the customer?

While the wording is different this is Inspection and test from the 1994 version. The change to monitoring and measurement achieves greater understanding in the services and software sectors while gaining compatibility with ISO 14001.

Review the planned arrangements for monitoring and measurement. Do they cover all appropriate stages of the process? Are records maintained (inspection and test)? Is the acceptance criteria specified and do the records demonstrate conformity? Is the person authorized to release product specified? Finally is the release of service or product restricted until the planned arrangements have been carried out?

See ISO 9001 1994 Para 4.10.2 + 4.10.3 + 4.10.4 + 4.10.5 + 4.20.1

8.3 Control of nonconforming product

Does the organization have a process to identify and control nonconformance to prevent unintended use or delivery.

Is there a documented procedure?

Does it include controls and related responsibilities and authorities for dealing with nonconforming product?

Does the organization deal with nonconforming product by at least one of the following:a) taking action to eliminate the detected nonconformity; (reworking or repairing)b) authorizing its use, release or acceptance under concession by relevant authority or by the customer; (referring to the customer)c) taking action to preclude its original intended use or application. (scraping or regarding)

Are records maintained, including the nature of nonconformities and any subsequent actions taken, including concessions obtained?


34

Is corrected nonconforming product subject to re-verification to demonstrate conformity to the requirements?

Does the organization take appropriate action for nonconforming product detected after delivery or use has started?

Similar to the 1994 version control of nonconforming product has very few changes. The rewording accommodates both the software and services industries, specifically in the area of dispositions. As a result your current system should satisfy these requirements.


Review the procedures and records for control of nonconforming product. Also, verify nonconforming product is identified. Can the nonconforming product in the organization be traced to the records.

Review dispositioned nonconformances to determine if the disposition has been carried out. Has product been reinspected?

See ISO 9001 1994 Para 4.13.1 + 4.13.2

8.4 Analysis of data

Does the organization determine, collect and analyze appropriate data to demonstrate the suitability and effectiveness of the quality management system

Is this data used to evaluate where continual improvement of the quality management system can be made.

Does this include data generated from monitoring and measurement and other relevant sources?

Does this analysis of data provide information relating toa) customer satisfaction b) conformance to product requirements

d) characteristics and trends of processes and products including opportunities for preventive action, and

e) suppliers.


35

User will note the elimination of Statistical Technique in the 1994 version. However the organization must analyze data and the data to be analyzed. This may be new to many organizations. You should note several links to other sections or concepts in the standard. Obviously there are input into this section from customer satisfaction, monitoring and measurement sections, preventive actions and supplier (receiving inspection and supplier evaluation). This being the case many organizations may face a configuration of data issue, as you will need to be able to analyze these data.

The purpose or output of this process will be three fold, the evaluation of the effectiveness of the systems, the identification of improvement opportunities and as an input to the management review process,

Review the process the organization uses to verify the appropriateness of data sources and outputs. Examine records of the performance of this process.

This also provides an opportunity to examine the input of this information into the management review process and what action are taken.

See ISO 9001 1994 No reference

8.5 Improvement

8.5.1 Continual improvement

Does the organization continually improve the effectiveness of the quality management system?

Does this include through the use of the quality policy, quality objectives, audit results, analysis of data, corrective and preventive actions and management review?

Improvement was an implicit requirement of the 1994 version that now is made explicit. Note that while continual improvement is a requirement of many other sections of the standard it is dealt with as a concept that works its way throughout the standard. As such an organization will be required to demonstrate improvement, how much and what form this takes will be up to the organization.

To evaluate continual improvement you will need to review the records of several other clauses. These include:

quality policy,


36

quality objectives, audit results, analysis of data, corrective and preventive actions and management review?

To do this you will need to evaluate the continuity and efficacy of data flowing through the systems and its use to achieve the stated policy and objectives.

See ISO 9001 1994 Para. 4.1.3

8.5.2 Corrective action

Does the organization take action to eliminate the cause of nonconformities in order to prevent recurrence?

Are corrective actions appropriate to the effects of the nonconformities encountered?


Does the procedure include requirements for?a) reviewing nonconformities (including customer complaints),b) determining the causes of nonconformities,c) evaluating the need for action to ensure that nonconformities do not recur,d) determining and implementing action needed,e) records of the results of action taken (see 4.2.4), and

f) reviewing corrective action taken

This requirement is essentially the same as the 1994 version. While the language is a little tighter there are no significant changes. However since the data is likely to be used in both analysis of data and management review you may want to evaluate its suitability.

Note that this is one of the few sections that explicitly require a documented procedure.

Review the documented procedure for corrective action.Select several completed corrective action reports to determine

The cause has been determined., Evaluation and action to preclude recurrence Action have been implemented Results of the action have been recorded The action taken have been reviewed


37

Review customer complaints and the resulting corrective actions.

See ISO 9001 1994 Para 4.14.1 + 4.14.2

8.5.3 Preventive action

Does the organization determine action needed eliminate the causes of potential nonconformities?

Are preventive actions appropriate to the effects of the potential problems.


Does the procedure include requirements for?a) determining potential nonconformities and their causes,b) evaluating the need for action to prevent occurrence of nonconformities,c) determining and implementing action needed,d) recording of results of action taken ande) reviewing preventive action taken.

This requirement is essentially the same as the 1994 version. While the language is a little tighter there are no significant changes. However since the data is likely to be used in both analysis of data and management review you may want to evaluate its suitability.


Review the documented procedure for preventive action.Select several completed preventive action reports to determine

The potential cause has been determined. Evaluation and action to preclude occurrence Action have been implemented Results of the action have been recorded The action taken have been reviewed

See ISO 9001 1994 Para 4.14.1 + 4.14.3


38

4 quality management system - msasolution.com · web viewthis gap analysis checklist is designed...

Documents