ISO 9001:2015 Structure4 Context of the organization
5 Leadership 10 Improvement6 Planning for the quality management system
7 Support 8 Operations 9 Performanceand evaluation
Understandingof the organization and its context
Understanding the needs and expectations of interested parties
Scope of management systems
QMS
Leadership and commitment
Quality policy
Organizational roles,responsibilitiesand authorities
Action to address risk and opportunity
Quality objectives
Planning of changes
Resources
Competence
Awareness
Communication
DocumentedInformation
Release of products and services
Operationsplanning and control
Requirements for products and services
Design and development of products and services
Control of externally provided products and services
Production and service provisions
Control of non-conforming outputs,
Monitoring,measurement.analysis andevaluation
Internal audit
Management review
Nonconformity and correctiveaction
Continual Improvement
Plan
Do
Check Act
General
3
Key Themes• Process Approach• Risk Based Thinking• Context of the Organization• Leadership• Planning the Quality Management System• Documented Information• Organizational Knowledge• Control of Externally Provided Processes, Products and Services• Exclusions/Scope• Evaluation• Internal Audit• Plan Do Check Act (PDCA)
4
Why Audit? ISO 9001:20159.2 Internal audit9.2.1 The organization shall conduct internal audits at planned intervals to provide information on whether the quality management system:
a) conforms to:1) the organization’s own requirements for its quality management system;2) the requirements of this International Standard;
b) is effectively implemented and maintained.
6
Why Audit? ISO 9001:20159.2.2 The organization shall:a) plan, establish, implement and maintain an audit program(s) including the frequency, methods, responsibilities, planning requirements and reporting, which shall take into consideration the importance of the processes concerned, changes affecting the organization, and the results of previous audits;b) define the audit criteria and scope for each audit;c) select auditors and conduct audits to ensure objectivity and the impartiality of the audit process;d) ensure that the results of the audits are reported to relevant management;e) take appropriate correction and corrective actions without undue delay;f) retain documented information as evidence of the implementation of the audit program and the audit results.
7
Why Audit? ISO 9001:20159.2.1 The organization shall conduct internal audits at planned intervals to provide information on whether the quality management system:
a) conforms to:1) the organization’s own requirements for its quality management system;2) the requirements of this International Standard;
Conformance/Compliance to: – Customer Requirements– Statutory & Regulatory Requirements– Organization’s SOP’s & Policies– ISO 9001:2015
8
Why Audit? ISO 9001:20159.2.1 The organization shall conduct internal audits at planned intervals to provide information on whether the quality management system:
b) is effectively implemented and maintained.System/Process Based Audit :
– Effective is a measure that an organization is getting the results expected
– It suggests a horizontal approach looking at the outputs of processes
– All processes are inter-connected into a QMS
9
Why Audit? Value Added9.2.2 The organization shall:
plan, establish, implement and maintain an audit program(s) including the frequency, methods, responsibilities, planning requirements and reporting, which shall take into consideration the importance of the processes concerned, changes affecting the organization, and the results of previous audits;d) ensure that the results of the audits are reported to relevant management;
Consider more frequent audits where– Areas have had prior findings– Known changes have taken place in processes
10
Why Audit? Value AddedConsider more frequent audits where
– Areas are considered higher risk . Risk can be due • New customer requirements• Supplier Issues• Technology• Regulations• Process changes• Material, equipment, etc.
Consider fewer audits in areas that have demonstrated few or no issues
Develop an audit schedule based on data and risk; this adds value
11
Why Audit? Value AddedInternal audit management programs should:• Schedule based on risk and customer feedback rather
than something done simply for compliance. • Elevate the role of auditor to a strategic one, rather than a
job of simply checking compliance. • Improve the internal audit program to ensure corrective
actions are seen as important to process results • Demonstrate the management reviews of the quality
management system become an integral way of managing the business.
12
Process(Major Elements & Boundaries)
StartEndProcess Owners:
Outputs Customers(for Whom?)
InputsSuppliers(By Whom)
Materials(With What?)
Measures(Trend Charts)(Metrics)
Manpower(Training)(Skills)
Methods(How?)
Machine(With What?)
Environment (Area Conditions?)
15
Process8.1,2,3,4,5,6 Operations
:
Outputs8.6 Conforming products and
services8.5.5 Post
Delivery Activities
Customers
Inputs8.2 Customer Requirements
4.4 QMS Requirements
4.1 Context4.2 Interested
Parties
Suppliers
Materials8.4 Externally provided7.1.3 Infrastructure
Measures9.1 Measurements9.2 Internal Audit9.3 Mgmt Review
4.3 Scope
Manpower7.1.2 People
7.2 Competence7.3 Awareness
6.2 Quality Objectives5.2 Quality Policy
7.1.6 Organizational Knowledge5.3 Org. Roles/Responsibilities
Methods7.5 Documented Information
Machine7.1.5 Monitoring and
Measuring7.1.3 Infrastructure
Environment7.1.4 Environment7.4 Communication
ISO 9001:2015 Elements to Consider During a Process Audit
Risk6.1 Planning
4.4 QMS
Evaluating QMS ProcessesEstablishing Appropriate Measures
• At least one “measure” should be established for each “key” QMS process
Evaluating the Use of Measures to Assess Effectiveness and the Need for Improvement
• Review for adequacy the system for using measures to: establish and carry out objectives and plans, and identify and carry out improvement initiatives
17
Understanding the Organization and its Context
This is a New Requirement
The organization shall understand their internal and external environments • Determine the issues that are relevant to the organization in both
environments• Assess those issues, and if not mitigated, which could prevent the success
of quality management system implementation• Using these issues, understand how they will influence the quality
changes in their organization on a continual basis.
ISO 9001, clause 4.1
19
Understanding the Organization and its Context
Analyzing the External Environment• Your organization may already be doing this type of analysis
• Are you doing any strategic planning, market research, or benchmarking which identifies external issues which are being acted on in your business/quality management system?
• Does it drive your Vision, Mission, Quality Policy, Strategic Planning, Business Objectives,Policy Deployment, etc.?
• Can you demonstrate how you are doing it?
• Unfortunaterly, ISO 9001:2015 provides no suggested methods to analyze the context of an organization
20
Understanding the Organization and its Context
Analyzing the Internal Environment
Understanding the structure/hierarchy and positions of the organization related to the scope at the levels:• Who sets the policies and strategic directions of the organization?• Who coordinates and manages the operations?• Who is involved in production, service and support activities?
21
Understanding the Organization and its Context
It is necessary to identify the structures comprising the various bodies and relations between them (hierarchical and functional). • These include segregation of duties, responsibilities,
authority and communication within the organization that should be studied.
• The functions outsourced to the subcontractors should also be identified.
Analyzing the Internal Environment
22
Interested Parties, Needs, & Expectations (Continued)
NOTE Although most organizations use similar descriptions for their interested parties (e.g. customers, owners/shareholders, suppliers and partners, people in the organization), the composition of those categories can differ significantly over time and between organizations, industries, nations and cultures.
Interested party Needs and expectations
Customers Quality, price, & delivery of products and services
Owners/Share Holders Sustained profitabilityTransparency
People in the organization Good work environmentJob securityRecognition and reward
Suppliers & partners Mutual benefit and continuity
Society Environmental protectionEthical behaviorCompliance with statutory and regulatory requirements
23
What is “Risk-Based Thinking”?
• Risk-based thinking is something we all do automatically and often sub-consciously
• The concept of risk has always been implicit in ISO 9001 –the 2015 revision makes it more explicit and builds it into the whole management system
• Risk-based thinking is already part of the process approach• Risk-based thinking makes preventive action part of the
routine
25
Key Points to Remember Risk Based Thinking = Preventative ActionRisk Based Thinking is everybody’s business!
– Risk Based Thinking is not just the responsibility of management
– Risk Based Thinking must become an integral part of the organizational culture
26
Why Should I adopt “Risk-Based Thinking”?
• To improve customer confidence and satisfaction
• To assure consistency of quality of products and services
• To establish a proactive culture of prevention and improvement
• Successful companies intuitively take a risk-based approach
27
What Should I Do? (continued)
• Analyse and prioritize the risks and opportunities in your organization– what is acceptable?– what is unacceptable?
• Plan actions to address the risks– how can I avoid or eliminate the risk?– how can I mitigate the risk?
• Implement the plan – take action• Check the effectiveness of the actions – does it work?• Learn from experience – continual improvement
28
What is Risk?
Risk is the possibility of events or activities impeding the achievement of an organization’s strategic and operational objectives.
29
Risk Definitions
Risk can be defined by two (2) parameters– Severity
• This is the Seriousness of the harm
– Probability• This is the Probability that the harm will occur
30
9.2 Internal Audit (cont.)
Question?
Where does Risk get introduced into an internal audit program?
34
Process(Major Elements & Boundaries)
StartEndProcess Owners:
Outputs Customers(for Whom?)
InputsSuppliers(By Whom)
Materials(With What?)
Measures(Trend Charts)(Metrics)
Manpower(Training)(Skills)
Methods(How?)
Machine(With What?)
Environment (Area Conditions?)
Risks(What Can Go Wrong?)
35
Internal audits are at planned intervals to provide information on whether the quality management system;• Conforms to:
– Organization’s own requirements for its quality management system;
– Requirements of ISO 9001:2015– Take into consideration the status and importance
of specific processes in meeting customer needs, regulatory compliance, etc.
• Is effectively implemented and maintained.
Internal Audit
36
Audit (Risk Based)• Audit schedules should take into account “Risk” in
developing a schedule• Risk can be due to :
– New customer requirements– Supplier Issues– Technology– Regulations– Process changes– Material, equipment, etc.
37