gmx understanding & implementing iso 9001:2008

UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008

PREPARED & EDITED BY: ENG. A. KARAM MALKAWI

GLOBAL MATRIX CONSULTATION CO.

AMMAN-JOR

VERSION 1.0

APRIL 24, 2016


Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]

Page 1 of 100

SECTION I ................................................................................................................................................................................. 6

IMPLEMENTING ISO 9001:2008 .................................................................................................................................................. 6

STEPS TO IMPLEMENT ISO 9001:2008 ................................................................................................................................... 9

ISO 9001 REQUIREMENTS ........................................................................................................................................................ 15

INTRODUCTION TO ISO 9001 REQUIREMENTS ......................................................................................................................... 17

ISO 9001-CLAUSE 1, 2 AND 3 ................................................................................................................................................... 18

CLAUSE 1 SCOPE................................................................................................................................................................. 18

CLAUSE 1.1 GENERAL .......................................................................................................................................................... 18

ISO 9001-REQUIREMENT ..................................................................................................................................................... 18

EXPLANATION ..................................................................................................................................................................... 18

CLAUSE 1.2 APPLICATION ................................................................................................................................................... 19

ISO 9001-REQUIREMENT ..................................................................................................................................................... 19

EXPLANATION ................................................................................................................................................................ 19

Clause 2 Normative references ............................................................................................................................................. 20

ISO 9001-REQUIREMENT ..................................................................................................................................................... 20

EXPLANATION ................................................................................................................................................................ 20

CLAUSE 3 TERMS AND DEFINITIONS ................................................................................................................................... 20

ISO 9001-REQUIREMENT ..................................................................................................................................................... 20

EXPLANATION ................................................................................................................................................................ 20

ISO 9001-CLAUSE 4.1 .......................................................................................................................................................... 20

4.0 QUALITY MANAGEMENT SYSTEM ................................................................................................................................... 20

EXPLANATION ................................................................................................................................................................ 20

ISO 9001-Clause 4.1 ............................................................................................................................................................ 21

4.1 GENERAL REQUIREMENTS ............................................................................................................................................. 21

ISO 9001 REQUIREMENT ..................................................................................................................................................... 21

EXPLANATION ................................................................................................................................................................ 22

ISO 9001-CLAUSE 4.2 .......................................................................................................................................................... 25

ISO 9001-CLAUSE 4.2 DOCUMENTATION REQUIREMENTS .................................................................................................... 25

4.2.1 GENERAL ................................................................................................................................................................... 25

ISO 9001 REQUIREMENT ..................................................................................................................................................... 25

EXPLANATION ................................................................................................................................................................ 25

4.2.2 QUALITY MANUAL ...................................................................................................................................................... 26

ISO 9001 REQUIREMENT ..................................................................................................................................................... 26

EXPLANATION ................................................................................................................................................................ 26

4.2.3 CONTROL OF DOCUMENTS ......................................................................................................................................... 26

ISO 9001 REQUIREMENT ..................................................................................................................................................... 26

EXPLANATION ................................................................................................................................................................ 27

4.2.4 CONTROL OF RECORDS .............................................................................................................................................. 28

ISO 9001 REQUIREMENT ..................................................................................................................................................... 28

EXPLANATION ................................................................................................................................................................ 28

mailto:[email protected]



Page 2 of 100

ISO 9001-CLAUSE 5.1, 5.2 & 5.3 .......................................................................................................................................... 30

CLAUSE 5 MANAGEMENT RESPONSIBILITY ........................................................................................................................... 30

ISO 9001-CLAUSE 5.1, 5.2 & 5.3 .......................................................................................................................................... 30

5.1 MANAGEMENT COMMITMENT ........................................................................................................................................ 30

ISO 9001 REQUIREMENT ..................................................................................................................................................... 30

EXPLANATION ................................................................................................................................................................ 31

5.2 CUSTOMER FOCUS ........................................................................................................................................................ 31

ISO 9001 REQUIREMENT ..................................................................................................................................................... 31

EXPLANATION ................................................................................................................................................................ 31

5.3 QUALITY POLICY ........................................................................................................................................................... 32

ISO 9001 REQUIREMENT ..................................................................................................................................................... 32

EXPLANATION ................................................................................................................................................................ 32

ISO 9001-CLAUSE 5.4 .......................................................................................................................................................... 34

ISO 9001-CLAUSE 5.4 PLANNING ......................................................................................................................................... 34

CLAUSE 5.4.1 QUALITY OBJECTIVES .................................................................................................................................... 34

ISO 9001 REQUIREMENT ..................................................................................................................................................... 34

EXPLANATION ................................................................................................................................................................ 34

CLAUSE 5.4.2 QUALITY MANAGEMENT SYSTEM PLANNING ................................................................................................... 36

ISO 9001 REQUIREMENT ..................................................................................................................................................... 36

EXPLANATION ................................................................................................................................................................ 36

ISO 9001-CLAUSE 5.5 .......................................................................................................................................................... 38

ISO 9001-CLAUSE 5.5 RESPONSIBILITY, AUTHORITY AND COMMUNICATION ........................................................................ 38

ISO 9001-CLAUSE 5.5.1 RESPONSIBILITY AND AUTHORITY .................................................................................................. 38

ISO 9001 REQUIREMENT ..................................................................................................................................................... 38

EXPLANATION ................................................................................................................................................................ 38

ISO 9001 REQUIREMENT ..................................................................................................................................................... 39

EXPLANATION ..................................................................................................................................................................... 39

ISO 9001-CLAUSE 5.5.3 INTERNAL COMMUNICATION ........................................................................................................... 40

ISO 9001 REQUIREMENT ..................................................................................................................................................... 40

ISO 9001-CLAUSE 5.6 .......................................................................................................................................................... 42

ISO 9001-CLAUSE 5.6 MANAGEMENT REVIEW ...................................................................................................................... 42

ISO 9001 REQUIREMENT ISO 9001-CLAUSE 5.6.1 GENERAL ................................................................................................. 42

ISO 9001-CLAUSE 5.6.2 REVIEW INPUT .............................................................................. Error! Bookmark not defined.

ISO 9001 REQUIREMENT ..................................................................................................................................................... 42

ISO 9001-CLAUSE 5.6.3 REVIEW OUTPUT ........................................................................... Error! Bookmark not defined.

ISO 9001 REQUIREMENT ..................................................................................................................................................... 42

EXPLANATION ................................................................................................................................................................ 42

ISO 9001-CLAUSE 6 ............................................................................................................................................................ 44

ISO 9001-CLAUSE 6: RESOURCE MANAGEMENT ................................................................................................................... 44

ISO 9001-CLAUSE 6.1 PROVISION OF RESOURCES ............................................................................................................... 44

ISO 9001 REQUIREMENT ..................................................................................................................................................... 44

EXPLANATION ................................................................................................................................................................ 44




Page 3 of 100

ISO 9001-CLAUSE 6.2 HUMAN RESOURCES .......................................................................................................................... 45

ISO 9001 REQUIREMENT ..................................................................................................................................................... 45

ISO 9001-CLAUSE 6.2.1 GENERAL ........................................................................................................................................ 45

EXPLANATION ................................................................................................................................................................ 45

ISO 9001-CLAUSE 6.3 INFRASTRUCTURE ............................................................................................................................. 46

ISO 9001 REQUIREMENT ..................................................................................................................................................... 46

ISO 9001-CLAUSE 6.4 WORK ENVIRONMENT ........................................................................................................................ 47

ISO 9001 REQUIREMENT ..................................................................................................................................................... 47

EXPLANATION ................................................................................................................................................................ 47

ISO 9001-CLAUSE 7.1 .......................................................................................................................................................... 49

ISO 9001-CLAUSE 7 PRODUCT REALIZATION ....................................................................................................................... 49

ISO 9001-CLAUSE 7.1 PLANNING OF PRODUCT REALIZATION ............................................................................................... 49

ISO 9001 REQUIREMENT ..................................................................................................................................................... 49

EXPLANATION ................................................................................................................................................................ 49

ISO 9001-CLAUSE 7.2 .......................................................................................................................................................... 51

ISO 9001-CLAUSE 7.2 CUSTOMER-RELATED PROCESSES ...................................................................................................... 51

ISO 9001 REQUIREMENT ISO 9001-Clause 7.2.1 Determination of requirements related to the product ................................... 51

EXPLANATION ................................................................................................................................................................ 52

ISO 9001-CLAUSE 7.3 .......................................................................................................................................................... 55

ISO 9001-CLAUSE 7.3 DESIGN AND DEVELOPMENT .............................................................................................................. 55

ISO 9001-CLAUSE 7.3.1 DESIGN AND DEVELOPMENT PLANNING .......................................................................................... 55

ISO 9001 REQUIREMENT ..................................................................................................................................................... 55

EXPLANATION ................................................................................................................................................................ 55

ISO 9001-CLAUSE 7.3.2 DESIGN AND DEVELOPMENT INPUTS ............................................................................................... 56

ISO 9001 REQUIREMENT ..................................................................................................................................................... 56

EXPLANATION ................................................................................................................................................................ 56

ISO 9001-CLAUSE 7.3.3 DESIGN AND DEVELOPMENT OUTPUTS ............................................................................................ 57

ISO 9001 REQUIREMENT ..................................................................................................................................................... 57

EXPLANATION ................................................................................................................................................................ 57

ISO 9001-CLAUSE 7.3.4 DESIGN AND DEVELOPMENT REVIEW .............................................................................................. 58

ISO 9001 REQUIREMENT ..................................................................................................................................................... 58

EXPLANATION ................................................................................................................................................................ 58

ISO 9001-CLAUSE 7.3.5 DESIGN AND DEVELOPMENT VERIFICATION .................................................................................... 58

ISO 9001 REQUIREMENT ..................................................................................................................................................... 58

EXPLANATION ................................................................................................................................................................ 58

ISO 9001-CLAUSE 7.3.6 DESIGN AND DEVELOPMENT VALIDATION ....................................................................................... 59

ISO 9001 REQUIREMENT ..................................................................................................................................................... 59

EXPLANATION ................................................................................................................................................................ 59

ISO 9001-CLAUSE 7.3.7 CONTROL OF DESIGN AND DEVELOPMENT CHANGES ....................................................................... 59

ISO 9001 REQUIREMENT ..................................................................................................................................................... 59

EXPLANATION ................................................................................................................................................................ 59

ISO 9001-CLAUSE 7.4 .......................................................................................................................................................... 62




Page 4 of 100

ISO 9001-CLAUSE 7.4 PURCHASING ..................................................................................................................................... 62

ISO 9001-CLAUSE 7.4.1 PURCHASING PROCESS ................................................................................................................... 62

ISO 9001 REQUIREMENT ..................................................................................................................................................... 62

EXPLANATION ................................................................................................................................................................ 62

ISO 9001-CLAUSE 7.4.2 PURCHASING INFORMATION ........................................................................................................... 63

ISO 9001 REQUIREMENT ..................................................................................................................................................... 63

EXPLANATION ................................................................................................................................................................ 63

ISO 9001-CLAUSE 7.4.3 VERIFICATION OF PURCHASED PRODUCT ........................................................................................ 64

ISO 9001 REQUIREMENT ..................................................................................................................................................... 64

EXPLANATION ................................................................................................................................................................ 64

ISO 9001-CLAUSE 7.5 .......................................................................................................................................................... 66

ISO 9001-CLAUSE 7.5 PRODUCTION AND SERVICE PROVISION ............................................................................................ 66

ISO 9001-CLAUSE 7.5.1 CONTROL OF PRODUCTION AND SERVICE PROVISION ..................................................................... 66

ISO 9001 REQUIREMENT ..................................................................................................................................................... 66

EXPLANATION ................................................................................................................................................................ 66

ISO 9001-CLAUSE 7.5.2 VALIDATION OF PROCESSES FOR PRODUCTION AND SERVICE PROVISION ....................................... 67

ISO 9001 REQUIREMENT ..................................................................................................................................................... 67

EXPLANATION ................................................................................................................................................................ 67

ISO 9001-CLAUSE 7.5.3 IDENTIFICATION AND TRACEABILITY .............................................................................................. 68

ISO 9001 REQUIREMENT ..................................................................................................................................................... 68

EXPLANATION ................................................................................................................................................................ 68

ISO 9001-CLAUSE 7.5.4 CUSTOMER PROPERTY .................................................................................................................... 69

ISO 9001 REQUIREMENT ..................................................................................................................................................... 69

EXPLANATION ................................................................................................................................................................ 69

ISO 9001-CLAUSE 7.5.5 PRESERVATION OF PRODUCT .......................................................................................................... 70

ISO 9001 REQUIREMENT ..................................................................................................................................................... 70

EXPLANATION ................................................................................................................................................................ 70

ISO 9001-CLAUSE 7.6 .......................................................................................................................................................... 73

ISO 9001-CLAUSE 7.6 CONTROL OF MONITORING AND MEASURING EQUIPMENT ................................................................. 73

ISO 9001 REQUIREMENT ..................................................................................................................................................... 73

EXPLANATION ................................................................................................................................................................ 73

ISO 9001-CLAUSE 8.1 .......................................................................................................................................................... 76

ISO 9001-CLAUSE 8 MEASUREMENT, ANALYSIS AND IMPROVEMENT .................................................................................... 76

ISO 9001-CLAUSE 8.1 GENERAL ......................................................................................................................................... 76

ISO 9001 REQUIREMENT ..................................................................................................................................................... 76

EXPLANATION ................................................................................................................................................................ 77

ISO 9001-CLAUSE 8.2 .......................................................................................................................................................... 78

ISO 9001-CLAUSE 8.2 MONITORING AND MEASUREMENT ..................................................................................................... 78

ISO 9001-CLAUSE 8.2.1 CUSTOMER SATISFACTION ............................................................................................................. 78

ISO 9001 REQUIREMENT ..................................................................................................................................................... 78

EXPLANATION ................................................................................................................................................................ 78

ISO 9001-Clause 8.2.2 Internal audit .................................................................................................................................... 79




Page 5 of 100

ISO 9001 REQUIREMENT ..................................................................................................................................................... 79

EXPLANATION ................................................................................................................................................................ 80

ISO 9001-CLAUSE 8.2.3 MONITORING AND MEASUREMENT OF PROCESSES .......................................................................... 81

ISO 9001 REQUIREMENT ..................................................................................................................................................... 81

EXPLANATION ................................................................................................................................................................ 82

ISO 9001-CLAUSE 8.2.4 MONITORING AND MEASUREMENT OF PRODUCT ............................................................................. 82

ISO 9001 REQUIREMENT ..................................................................................................................................................... 82

EXPLANATION ................................................................................................................................................................ 83

ISO 9001-CLAUSE 8.3 .......................................................................................................................................................... 86

ISO 9001-CLAUSE 8.3 CONTROL OF NONCONFORMING PRODUCT ........................................................................................ 86

ISO 9001 REQUIREMENT ..................................................................................................................................................... 86

EXPLANATION ................................................................................................................................................................ 86

ISO 9001-CLAUSE 8.4 & CLAUSE 8.5 .................................................................................................................................... 88

ISO 9001-CLAUSE 8.4 & CLAUSE 8.5 .................................................................................................................................... 88

CLAUSE 8.4 ANALYSIS OF DATA .......................................................................................................................................... 88

ISO 9001 REQUIREMENT ..................................................................................................................................................... 88

EXPLANATION ................................................................................................................................................................ 88

CLAUSE 8.5 IMPROVEMENT ................................................................................................................................................. 89

8.5.1 CONTINUAL IMPROVEMENT ........................................................................................................................................ 89

EXPLANATION ..................................................................................................................................................................... 89

8.5.2 Corrective action ......................................................................................................................................................... 90

ISO 9001 REQUIREMENT ..................................................................................................................................................... 90

EXPLANATION ................................................................................................................................................................ 90

8.5.3 PREVENTIVE ACTION .................................................................................................................................................. 91

ISO 9001 REQUIREMENT ..................................................................................................................................................... 91

EXPLANATION ................................................................................................................................................................ 91

SECTION II ............................................................................................................................................................................. 94

DOCUMENTATION REQUIREMENTS OF ISO 9001:2008 .............................................................................................................. 94

Introduction to Documentation Requirements of ISO 9001: 2008 ........................................................................................... 95

What is a “document” .......................................................................................................................................................... 95

Documentation requirements of ISO 9001:2008 .................................................................................................................... 96

Guidance on Clause 4.2 of ISO 9001:2008 ............................................................................................................................ 96

Documented procedures ...................................................................................................................................................... 97

Records .......................................................................................................................................................................... 98

Organizations preparing to implement a QMS ........................................................................................................................ 99

Organizations wishing to adapt an existing QMS .................................................................................................................. 100

Demonstrating conformity with ISO 9001:2008 ................................................................................................................... 100




Page 6 of 100

SECTION I

IMPLEMENTING ISO 9001:2008




Page 7 of 100

There is no quick step-by-step for implementing ISO9001 according to ISO9001 into any other serious

standard. Many have publicized it, but there are too many steps to do and to go through thoroughly

making the implementation process complicated.

In this approach we claim that all the really needed elements are discussed. What is not needed is not

discussed.

The implementation of a formal management system is best handled as a specific project with a

professional project manager, who should be a key member of the organization’s management team and

having sufficient authority and trust of the personnel involved.

In the ideal situation this person will also be the Management Representative, but skills in project

management are essential. It is important that none of the stages in the flow chart are omitted.

The existing system of management and working practices must be known in some detail, before the

framework of the formal QMS-documentation can be designed. The system is best designed around

existing processes as the development of new systems that require additional resources may simply

delay the implementation process.

The total flow chart for the implementation of the QMS is visualized. On the following pages each step

of the implementation process is described that have to be carried out before moving to the next step.

It is advised to get more people involved in decision making and not to leave the decision to move to the

next step up to one person only. Everybody involved must feel comfortable that a part is under control

and that the organization is ready to move on.

The total implementation process for QMS takes fourteen steps. Communicate with the employees what

has done, what has to be done and when it is expected to be completely implemented. This creates interest

and involvement and will speed-up the process of implementation.




Page 8 of 100

Implementation flow chart




Page 9 of 100

STEPS TO IMPLEMENT ISO 9001:2008

STEP 1: Evaluate the organization’s objectives and targets for implementing ISO9001

The need for a QMS may arise from repeated customer complaints, frequent warranty returns, delayed

deliveries, too high inventories, frequent production hold-ups or a high level of rework or rejection of

products or services.

Also it could be that the need for implementing ISO9001 comes from the market, that is demanding a

certified QMS, or otherwise it is impossible to operate in this market, or supply this dominant customer.

Strong technological driven markets such as the aircraft and automotive business put this demand on their

contractors and subcontractors for cost reasons but also for safety and liability reasons. This third party

certification demonstrates the abilities of the organization to the potential customer.

At this stage, identify the goals and objectives which should be achieved through a QMS, such as an

improved company structure, greater efficiency, better profitability, reliable supplier etc.

Introduce the Eight Quality Management principles to top management and get them motivated and

committed to apply to these principles.

Checklist at this stage:

Check that the management has adopted the 8 leadership principles and is motivated and committed

to apply them.

Communicate the objectives and targets for the implementation of the QMS with all the staff.

STEP 2: Obtain knowledge about the ISO 9000 family and appoint a management

representative

Decide on the responsibilities of the person who will be involved in developing and documenting the

QMS, including the appointment of a management representative who will oversee the implementation

of the QMS. The person made responsible for the process of implementing the QMS should understand

the requirements of ISO 9000 and 9001 and read the contents of ISO 9004.


Check to see that the management representative should has been appointed at this stage.

Check that the contents and the philosophy of ISO 9000 and 9001 have been made clear and have

been accepted.

STEP 3: Organize the resources

Decide on the responsibilities of the person who will be involved in developing a documenting the QMS,

including the appointment of a management representative who will oversee the implementation of the

QMS. Establishing a project or ISO-team may also prove to be useful to oversee progress and in providing

resources wherever required. The ISO team should consist of involved employees from different levels.




Page 10 of 100

Some authority can be given by top management to speed up the process.

If within the organization no adequate competence is available, or no resources such as time and

knowledge can be made available, then a consultant should be appointed. Before doing so, it is good to

realize that with subcontracting a part of the implementation process, a part of the knowledge and the

commitment is lost. An organization can learn more and better from its mistakes and own developments,

than from just doing what a consultant is recommending. Prepare a cost estimate and procure and

allocate the resources for this project. Raise commitment from the top management.


Check that the management has decided upon the individual who will develop the QMS and about

its authority.

At this stage, check that the supporting ISO-team is established and the objectives for the team

should have been made clear.

Check if commitment has been made at this stage to the implementation process, if not, it should

be stopped here.

Don’t continue if there is no support group such as an ISO-team or a similar solution.

Check that the needed resources such as manpower, money and time have been made available to

the Management Representative and the ISO-team.

STEP 4: Raise awareness and provide training:

Raise awareness about QMS requirements amongst all personnel performing activities and tasks that

affect quality. Plan for and provide specific training on how to develop quality manual, procedures and

work instructions. Besides that, it is important to instruct people how to identify and implement

improvement processes and how to audit compliance with the QMS. Appoint a certain number of people

to be the internal auditors and provide sufficient training. The ISO-team and/or the consultant should be

resources for assistance during the training.


Check that training has been provided to the people involved in the writing of procedures and work

instructions. Make sure that the written documents reflect the actual situation and not the desired

situation.

Check if a number of people have been selected as internal auditors and that the internal auditor

training has been provided.

Check that the ISO-team assist in providing insight into the QMS to the other employees by means

of presentations, newsletters and other ways of communication.

Develop forms that can replace difficult status reporting and provide instruction on how to use

them.

STEP 5: Gap Analysis

Evaluate the gaps between the existing QMS and the requirements of ISO 9001:2008. Prepare how to

bridge these gaps, including the planning for any additional resources required. Gap analysis may be

carried out through self-assessment, by the ISO-team or by an external consultant.





Page 11 of 100

Check that the gap analysis has been carried out and study the outcome.

With this analysis it should be possible to identify the gaps when it is compared with the ISO 9001

QMS

Check that a plan has been developed to bridge the found gaps. Make sure that the plan also contains

a time schedule and that the actions are realistic and can be finished in time.

Check that the results of the gap analysis and the actions to bridge the gaps have been reported to

top management and that management is also committed.

STEP 6: Product realization processes

Review clause 7 of ISO 9000:2008 relating to Product Realization to determine how the

requirements apply or do not apply to the company’s QMS.

The processes covered by this clause include:

Customer related processes.

Design and development.

Production and service provision.

Control of measuring and monitoring devices.

Note that if the company is not responsible for preparing the design of the product, it can exclude

the requirement for design and development from the QMS, as long as the reasoning is mentioned

in the quality manual.

Flow chart each process in detail and discuss these flowcharts with the experts, in another words,

the people that work with these processes.

Draft the framework of the quality management system and identify the supporting documents.

Then develop the QMS documentation.


Check to see that all the processes have been properly documented.

Have this documentation done by the experts, the people that are responsible for these processes.

Check on the requirements of the standard and exclude the elements that are not applicable to the

organization.

Get the approval from top management for these exclusions

STEP 7: Planning and time frame

In this stage the allocation of the resources for the QMS project should be defined. Prepare a complete

plan including the plan to close the gaps identified in the Gap Analysis, to develop the QMS processes.

In the plan, include activities to be performed, resources required, responsibilities and an estimated

completion time for each activity. Build in check point to assure in time completion.

Clause 4.1 and 7.1 of ISO 9000:2008 provide information that should be used when developing the

plan.

The total time required for each phase (planning, documentation, implementation and evaluation)

depends on the extent of the gaps in the existing QMS.

Communicate the master plan to all staff, but especially the ISO-team and the people involved.





Page 12 of 100

Check that the plan is complete, including the actions to bridge the gaps, a time schedule and the

allocation of the resources such as manpower, money and time.

Check that enough effort has been made to communicate the plan and the result of it to all staff. If

needed provide extra information to key people and the ISO-team.

STEP 8: Draft a Quality manual and develop a Quality Policy

Draft the quality policy for the organization. Get the policy committed by top management.

Make sure that the policy is a strong statement, original and applies to the organization.

In the quality manual:

Include how the QMS applies to the products, processes, locations and departments of the

organization.

Exclude any requirement with justification if applicable.

Refer to or include documented procedures (if available already) for QMS.

Describe the interaction between the processes of the QMS, e.g. the interaction between product

realization processes and other management, measurement and improvement processes.


Check that there is an adequate policy developed, that top management is committed and it is a

strong statement. Do not continue without this policy statement.

Check that everybody in the organization has seen it, understands it and can repeat it in his/her own

words.

Check that the QMS manual is ready. Don t continue without an approved manual.

Check that the requirements from the standards are fulfilled and that reference is made to at least

six procedures, but no more than that are needed.

Keep it simple.

If there is still not sufficient commitment from top management, don’t continue.

STEP 9: Draft the Documentation, design the QMS and implement it

The implementation has two parts. The implementation of the QMS, and that of the supporting paperwork.

The implementation of the QMS is another way of working. Define the structure and get the people

involved committed to work accordingly. Introduce the quality manual to the top management. Explain

the document structure and how it fits in the QMS. After top management introduction, middle

management should be made aware of the document structure. Top management should be showing that

they are working according to the leadership principles.

After companywide commitment, procedures have to be written. ISO 9000 outlines clearly what has to

be documented. What is not needed can be decided by the organization. In principle the employees that

work with the documents must write these procedures. The procedures should reflect the actual situation,

not the desired one. After the completion and implementation of the procedures, the next level will be the

work instructions. Here the same system applies. Get the experts to describe their work and activities.

Finally a complete documentation set should be available. It should be noted that only six procedures are

required by the standard. Key is that the people involved, work according to these documents. Maintain

the QMS for three months before internal auditing should take place. Correct the QMS where needed.




Page 13 of 100


Check that the elements of the standards are implemented in the organization.

Elements such as continual improvement, leadership principles and customer orientation.

Check that all the needed procedures have been developed and that the work instructions have been

written.

Check that the process owners are involved in the development of the work instructions.

STEP 10: Carry out internal audits

During the phase of implementation of some three to six months after the documentation has been written,

the trained auditors should carry out one or two internal audits covering all activities for the QMS, and

concerned management should take corrective action on the audit findings without delay.

Wherever required, revise the manuals, procedures and objectives. After each internal audit, the top

management should review the effectiveness of the system and provide resources for corrective actions

and improvements.


Check that the responsible people have been trained for the internal auditor function.

Record their training results and data.

Check that internal auditors do not audit their own department or work area.

Check that the results of the internal audits are fed back into the system and lead to improvement

of the QMS, the processes and the documents.

Check that the results of the internal audits are reviewed on top management level and that

appropriate action has been taken.

Check that there is a time schedule for internal audits and that it is maintained.

STEP 11: Conduct a Management Review

It is important in this stage to have a formal management review that shows the commitment of all levels.

The recommendations from this review have to be carried out.

Use the Management Review procedure developed for the organization.


Check that the result of the management review is functioning well and that all people involved

know what is expected from them. Check the involvement and commitment of the top management.

Check that actions are taken and decisions are made.

Check that the main focus is on the customer s satisfaction.

Check that the decision makers are present.

STEP 12: Pre-assessment. Apply for certification

Carry out a pre-assessment. Correct the QMS and the documentation where needed. Re-assessment can

be done with the help of an external certification body, but also by local consultants or by consultants

from the branch organization. On satisfactory completion of the previous step, and if the company decided

to obtain third party certification, an application for certification should be made to a certification body.





Page 14 of 100

Carry out a pre-assessment to win trust and confidence among the people involved in the

certification process.

Check that actions are taken and decisions are made based on the results of the pre-assessment.

Check that the right partner has been found to carry out the pre-assessment.

Check that a certification body has been approached for the final assessment.

STEP 13: Conduct periodic evaluations and initiate corrective and preventive actions

After certification, the organization should periodically conduct internal audits to review the effectiveness

of the QMS and see how it can be continually improved.

The organization should evaluate periodically if the purpose and goals for which the QMS was

developed are being achieved, including its continual improvement.

It is needed to look at the organization s overall systems performance and then decide when and where

the most effective improvements can be realized. Then objectives have to be set for those improvements

and a periodic evaluation has to be conducted to monitor achievements.

Improvements could be the reduction of cycle time within a process or the reduction of contamination in

a manufacturing process.


Check that periodically internal audits are planned and conducted.

Check that the non-conformities from the final assessment will be solved as soon as possible.

Check that the organization will review its goals and objectives on a regular basis.

Check that management reviews are planned and conducted periodically

STEP 14: Evaluation

The certification is certainly not the last phase. The people involved need to measure the success of the

implementation of the QMS during the implementation process and by the conclusion of the process.

Measurements should be made against the original aims and goals and the key indicators of an effective

QMS as stated below:


Check that senior management is fully committed to the QMS and owns the appropriate processes.

Check that the QMS is designed around business processes and not around ISO 9001 or any other

standard.

Check that staff knows how to access the QMS documentation.

Check that visibility of processes and the clarity of the instructions in the QMS documentation set

are clear, concise, readable and understandable. The people involved maintain their own documents

Check that the organizational culture is a culture of opportunities, focused around continual

improvement rather than a person-to-blame culture.

Check that the quality management representative is a key organization person rather than a sideline

person.

Check that internal auditing is seen as adding value and part of the continual improvement of the

QMS.

Ensure that there is continual improvement in system.

Keep up with regular internal audits and Management Reviews.




Page 15 of 100

ISO 9001 REQUIREMENTS

The ISO 9001 REQUIREMENTs has the following clauses;

0 Introduction to ISO 9001 REQUIREMENTs

1 Scope

1.1 General

1.2 Application

2 Normative references

3 Terms and definitions

4 Quality management system

4.1 General requirements

4.2 Documentation requirements

4.2.1 General

4.2.2 Quality manual

4.2.3 Control of documents

4.2.4 Control of records

5 Management responsibility

5.1 Management commitment

5.2 Customer focus

5.3 Quality policy

5.4 Planning

5.4.1 Quality objectives

5.4.2 Quality management system planning

5.5 Responsibility, authority and communication

5.5.1 Responsibility and authority

5.5.2 Management representative

5.5.3 Internal communication

5.6 Management review

5.6.1 General

5.6.2 Review input

5.6.3 Review output

6 Resource management

6.1 Provision of resources

6.2 Human resources

6.2.1 General

6.2.2 Competence, training and awareness

6.3 Infrastructure

6.4 Work environment

7 Product realization

7.1 Planning of product realization

7.2 Customer-related processes

7.2.1 Determination of requirements related to the product




Page 16 of 100

7.2.2 Review of requirements related to the product

7.2.3 Customer communication

7.3 Design and development

7.3.1 Design and development planning

7.3.2 Design and development inputs

7.3.3 Design and development outputs

7.3.4 Design and development review

7.3.5 Design and development verification

7.3.6 Design and development validation

7.3.7 Control of design and development changes

7.4 Purchasing

7.4.1 Purchasing process

7.4.2 Purchasing information

7.4.3 Verification of purchased product

7.5 Production and service provision

7.5.1 Control of production and service provision

7.5.2 Validation of processes for production and service provision

7.5.3 Identification and traceability

7.5.4 Customer property

7.5.5 Preservation of product

7.6 Control of monitoring and measuring equipment

8 Measurement, analysis and improvement

8.1 General

8.2 Monitoring and measurement

8.2.1 Customer satisfaction

8.2.2 Internal audit

8.2.3 Monitoring and measurement of processes

8.2.4 Monitoring and measurement of product

8.3 Control of nonconforming product

8.4 Analysis of data

8.5 Improvement

8.5.1 Continual improvement

8.5.2 Corrective action

8.5.3 Preventive action




Page 17 of 100

INTRODUCTION TO ISO 9001 REQUIREMENTS

The implementation of a QMS should be a strategic decision of the organization implementing QMS.

Various factors influence the design and implementation of QMS.

These include – diverse needs and risks of organizations; particular goals and objectives; complexity of

products and services provided; number of and complexity of processes employed; and size and structure

of the organization. As a result of these and other underlying factors, the ISO 9001 standard does not require

uniformity of QMS structure or documentation.

The QMS requirements specified in ISO 9001 are complementary to requirements for product. The standard

specifies requirements for organization’s QMS, whereas requirements for product come from customers

and regulatory authorities. ISO 9001:2008 standard can be used by internal and external parties, including

certification bodies, to assess an organization’s ability to meet customer, regulatory and the organization’s

own requirements. The quality management principles stated in ISO 9000 and ISO 9004 have been taken

into consideration in developing this standard.

The present editions of ISO 9001 and ISO 9004 have been developed as a consistent pair of quality

management system standards, which have been designed to complement each other, but can also be used

independently. Although the two standards have different scopes, they have similar structures in order to

assist their application as a consistent pair.

PLAN - DO - CHECK - ACT (PDCA) – is a very effective tool for business management and the ISO

9001 standard strongly recommends its use. PDCA is a dynamic cycle that can be applied to each of the

organization’s processes, and also to the system of processes as a whole. It may be used to plan, implement,

control and continually improve both product realization and other QMS processes.

Maintenance and continual improvement of QMS processes can be achieved by applying PDCA to

processes at all levels within the organization – from the executive high-level strategic processes, such as

business planning or management review to operational processes such as product realization or calibration.

Plan: Establish the objectives and processes necessary to deliver results in accordance with customer

requirements and the organization’s policies.

Do: Implement the processes

Check: Monitor and check processes and product against policies, objectives and requirements for the

product and report the results

Act: Take actions to continually improve process performance

ISO 9001 specifies requirements for a quality management system that can be used for internal

application by organizations, or for certification, or for contractual purposes. It focuses on the

effectiveness of the quality management system in meeting customer requirements.

ISO 9004 gives guidance on a wider range of objectives of a quality management system than does ISO

9001, particularly for the continual improvement of an organization’s overall efficiency, as well as

effectiveness. ISO 9004 is recommended as a guide for organizations whose top management wishes to

move beyond the requirements of ISO 9001, in pursuit of continual improvement of performance.

However, it is not intended for certification or for contractual purposes.




Page 18 of 100

This Standard has been aligned with ISO 14001 in order to enhance the compatibility of the two standards

for the benefit of the user community. This Standard does not include requirements specific to other

management systems, such as those particular to environmental management, occupational health and

safety management, financial management or risk management. However, this standard enables an

organization to align or integrate its own quality management system with related management system

requirements.

ISO 9001-CLAUSE 1, 2 AND 3

CLAUSE 1 SCOPE

CLAUSE 1.1 GENERAL

ISO 9001-REQUIREMENT

This International Standard specifies requirements for a quality management system where an

organization

a) needs to demonstrate its ability to consistently provide product that meets customer and

applicable statutory and regulatory requirements, and

b) aims to enhance customer satisfaction through the effective application of the system,

including processes for continual improvement of the system and the assurance of conformity to

customer and applicable statutory and regulatory requirements.

NOTE 1 In this International Standard, the term “product” only applies to:

a) product intended for, or required by, a customer,

b) any intended output resulting from the product realization processes.

NOTE 2 Statutory and regulatory requirements can be expressed as legal requirements.

EXPLANATION

Your organization must meet requirements consistently and enhance customer satisfaction by effective

application of QMS, continual improvement of QMS and providing assurance of conformity to customer

and applicable regulatory requirements which can be expressed as legal requirements .Product means any

product or service which is required by a customer or intended for a customer and can be output of product

realization processes. Ability means that the organization has the capability to determine customer’s needs

and requirements; design and develop product; know-how and capacity to manufacture product; package

product; deliver on time; provide service and support; etc.. Consistency is being able to repeat your

capability within specified parameters for quality as defined by customers, your own organization or

regulatory bodies.




Page 19 of 100

CLAUSE 1.2 APPLICATION


All requirements of this International Standard are generic and are intended to be applicable to all

organizations, regardless of type, size and product provided.

Where any requirement(s) of this International Standard cannot be applied due to the nature of an

organization and its product, this can be considered for exclusion.

Where exclusions are made, claims of conformity to this International Standard are not acceptable unless

these exclusions are limited to requirements within Clause 7, and such exclusions do not affect the

organization’s ability, or responsibility, to provide product that meets customer and applicable statutory

and regulatory requirements.

EXPLANATION

All requirements of ISO 9001 are generic and are intended to be applicable to all organisations, regardless

of type, size and product provided. Where any requirements of this standard cannot be applied, due to the

nature of an organisations and its product, this can be considered for exclusion. Where exclusions are made,

claims of conformity to ISO 9001 are not acceptable unless these exclusions are limited to requirements

within clause 7, and such exclusions do not affect the organization’s ability, or responsibility, to provide

product that meets customer and applicable regulatory requirements. This clause requires to state clearly if

any areas of the standard do not apply to the organisations, together with an EXPLANATION of the reason

for this exclusion.

For example, if you do not design product, but only manufacture product from customer provided

specifications, then clause 7.3 Product Design and Development may not be applicable to you. However,

if you buy a complete design and manufacture a product to that design and sell it under your own brand

name, then you must include Product Design and Development in the scope of your QMS. The rationale

here is that if a capability is required or responsibility implied, to meet customer requirements, then that

capability must be included in your QMS. It is your responsibility to perform the required capability

whether you purchase, outsource or do it yourself.

The standard mentioned specifically that in case of exclusions, the organization’s ability will not be

affected to supply a product or service that will meet customer expectations.

If you do make any exclusion and these exclusions affect your ability or responsibility to meet contracted

customer requirements or applicable regulatory requirements, then you cannot claim conformity to ISO

9001. All exclusions, with appropriate justification must be specified in your Quality manual.

Your QMS scope must include – specific products; processes; locations; any exclusions from the ISO 9001

standard with appropriate justification; etc.




Page 20 of 100

CLAUSE 2 NORMATIVE REFERENCES


The following referenced documents are indispensable for the application of this document. For

dated references, only the edition cited applies. For undated references, the latest edition of the referenced

document (including any amendments) applies.

ISO 9000:2005, Quality management systems — Fundamentals and vocabulary

EXPLANATION

This clause explains that the Fundamentals and vocabulary given ISO 9000:2005 Quality Management

Systems -fundamentals and vocabulary, apply.

CLAUSE 3 TERMS AND DEFINITIONS


For the purposes of this document, the terms and definitions given in ISO 9000 apply.

Throughout the text of this International Standard, wherever the term “product” occurs, it can also

mean“service”.

EXPLANATION

ISO 9000:2005 Quality Management Systems -fundamentals and vocabulary, apply. For service industries

or for industries where service is also part of customer requirement, wherever the terms product occurs, it

will also include service provided by the organization

ISO 9001-CLAUSE 4.1

4.0 QUALITY MANAGEMENT SYSTEM

EXPLANATION

The Quality Management System (QMS) is the means by which the organisations should be managed and

controlled. How to do this is entirely up to the top management. However, the system should use processes

to achieve this. Those processes consist of a balance between procedures and competencies. The current

systems for control may already have much of the detail that is needed for the revised standard. There is an

all-embracing requirement to identify the processes, determine their interaction, and ensure that there is

enough information to monitor them and to document them where they are needed to maintain control.

A process is described in the standard as a set of interrelated or interacting activities, which transform inputs

into outputs. Put more simply they are those chains of activities that take place across an organisations and

deliver the organization’s products or services to either internal or external customers. Processes are what




Page 21 of 100

need to be done, which needs to do it and what is the result. Either procedures and/ or competencies will

support processes. Procedures and other documents, work instructions etc. define how an activity is required

to be done.

In the past there has been a perception that the standard requires a detailed description of every activity

undertaken by an organisations and this has led to cases of severe over documentation. A quality manual is

needed. The standard allows flexibility in respect of its status and structure. It can be part of the overall

system, and need only contain the scope of the QMS, processes and any related procedures. System

processes need to be detailed. The standard requires control of documents and records per procedure.

ISO 9001-CLAUSE 4.1

4.1 GENERAL REQUIREMENTS

ISO 9001 REQUIREMENT

The organization shall establish, document, implement and maintain a quality management system and

continually improve its effectiveness in accordance with the requirements of this International Standard.

The organization shall;

Determine the processes needed for the quality management system and their application throughout

the organization (see 1.2),

Determine the sequence and interaction of these processes,

Determine criteria and methods needed to ensure that both the operation and control of these processes are

effective,

Ensure the availability of resources and information necessary to support the operation and monitoring

of these processes,

Monitor, measure where applicable, and analyze these processes, and

Implement actions necessary to achieve planned results and continual improvement of these processes.

These processes shall be managed by the organization in accordance with the requirements of

this International Standard.

Where an organization chooses to outsource any process that affects product conformity to requirements,

the organization shall ensure control over such processes. The type and extent of control to be applied to

these outsourced processes shall be defined within the quality management system.

NOTE 1 Processes needed for the quality management system referred to above include processes for

management activities, provision of resources, product realization, measurement, analysis and

improvement.

NOTE 2 an “outsourced process” is a process that the organization needs for its quality management

system and which the organization chooses to have performed by an external party.

NOTE 3 Ensuring control over outsourced processes does not absolve the organization of the

responsibility of conformity to all customer, statutory and regulatory requirements. The type and extent of

control to be applied to the outsourced process can be influenced by factors such as:




Page 22 of 100

The potential impact of the outsourced process on the organization’s capability to provide product

that conforms to requirements,

The degree to which the control for the process is shared,

The capability of achieving the necessary control through the application of 7.4.

EXPLANATION

The primary focus of clause 4.1 requirements is to manage and control all your QMS processes including

product realization processes. QMS includes processes for management activities, provision of resources,

product realization, and measurement as part of QMS. Clause 4.1 requires the ‘Process Approach’ to be

used in defining your QMS. Documentation of QMS processes and the need for and detail of specific

process documentation is determined by ISO 9001, customer, regulatory and your own organizational

requirements, complexity of products and processes, effect on quality, risk of customer dissatisfaction,

economic risk, effectiveness and efficiency, competence of personnel. Clause 4.2.1d requires you to have

documents needed to ensure the effective planning, operation and control for QMS processes. Based on

these factors, you must determine what processes need to be documented and how you will document it.

Not all processes need to be documented; however your quality manual must include a description of the

interaction between your QMS processes.

A number of different methods can be used to document processes, such as graphical representations,

written instructions, checklists, flow charts, visual media, or electronic methods, etc. Process flowcharts

or block diagrams can show how policies, objectives, influential factors, job functions, activities,

material, equipment, resources, information, people and decision making interact and/or interrelate in a

logical order. Procedures may be an acceptable way to document processes provided they describe inputs

and outputs, appropriate responsibilities, controls and resources needed to satisfy customer

requirements. Regardless of whether or not you document all of your processes, you must provide

evidence of effective implementation of all your QMS processes. Such evidence does not necessarily

need to be documented.

Clause 4.1c requires you to determine criteria for effective process operation and control. You could

determine criteria to control inputs, outputs and resources used. For example

Raw materials as an input to production would have acceptance criteria that it must meet before it can

be used.

Finished product as an output of the production process must meet acceptance criteria before it can be

shipped to the customer;

The equipment used to transform raw materials into finished product may have set-up and capability

criteria or parameters that it must meet in order to produce conforming product.

These prevention based criteria (controls) must be established for each QMS process. Note that such

controls may also come from the customer, regulatory or industry bodies. Equally important are the

specific methods required for effective operation and control of each process. These may include job

travelers; work instructions; in process inspection sheet; specifications and drawings; SPC charts; set up

checklist; machine manuals; etc. Note these control methods may apply to any or all of inputs, outputs or

conversion activities.

Under 4.1d, resources for QMS processes may include facility, material, equipment, labor, supplies,

utilities etc. Every QMS process will require a different combination of resources. Resource details may

be identified in specifications, production schedules, bill of materials, production travelers or routers,




Page 23 of 100

work instructions, etc. Information for QMS processes will vary from process to process and may include

-production schedules, bill of materials, product acceptance and process performance criteria, production

traveler or router, work instructions etc. Use clause 4.2.3 and other relevant clauses to control process

information.

Clause 4.1e requires you to monitor and measure your QMS processes. Clause 8 provides requirements to

plan and implement these controls for monitoring and measuring conformity to process performance

criteria determined in 4.1c above. Ways to monitor and measure QMS processes may include – tracking

against process parameters, goals and objectives, using tools and records such as process check-sheets;

product acceptance criteria; SPC records; production records; maintenance records; labor records, etc.

More details on monitoring and measuring controls are covered in clause 8.

Clause 4.1e requires analysis of QMS processes may be done through a review of measurement and

monitoring records and performance indicators for each process. These reviews must identify

opportunities to improve QMS processes, use of resources and product quality.

Under clause 4.1.f, when process nonconformities occur, then corrective action is required to bring the

QMS process under control. Remember, the corrective action process is not just for product related

nonconformities. Processes must be continually improved through setting of incrementally realistic,

measurable objectives. Planning for continual improvement requires a review of process data, resources

and controls to bring about the desired change.

Clause 4.1a – 4.1.f must be applied to all QMS processes. Note also that many ISO 9001 clauses (e.g.

clause 7.2; 7.4; 7.6; etc.), require specific processes to be established within your QMS, These processes

must also be identified and controlled in your QMS.

Make sure you include all outsourced processes affecting product quality, in the scope of your QMS. An

outsourced process is any value-adding or conversion activity related to your product or service, that is

performed by an external organization such as a subcontractor, sister facility, etc. Note that the external

organization may perform the outsourced activity at their facility or yours. A manufacturing company

may outsource welding, heat treatment or painting of product. A software company may outsource

software development. A bank may outsource check clearing services. You must be able to demonstrate

sufficient controls over outsourced processes to ensure that such processes are performed according to the

relevant requirements of ISO 9001:2008. The nature and scope of such control will depend on the nature

of the outsourced or subcontracted process and the risk involved. Outsourced processes may be

controlled in any number of ways, e.g., providing the vendor with product specifications; your supplier

quality manual that they must meet; asking for inspection and test results or certificates of compliance;

validation of outsourced process; conducting product and QMS audits of your vendor; etc. The

expectation here is that you flow down to your vendor, the relevant ISO 9001 REQUIREMENTs that you

would have to implement, had you performed the process at your own facility.

In systematically applying clause 4.1 requirements to each QMS process, we are intuitively using the

PDCA approach to development of QMS processes.

PLAN will call upon sub-clauses 4.1.a – 4.1e as well as other applicable ISO 9001 clauses as shown

above;

DO is required by 4.1.f as well as other applicable ISO 9001 clauses

CHECK is controlled by 4.1.e as well as other applicable ISO 9001 clauses;

ACT is governed by clause 4.1.e-f as well as clause 8.




Page 24 of 100

AUDIT CHECKLIST

Does the QMS address all of the requirements within ISO 9001:2008?

Is there evidence that the QMS has been improved over the past year?

Have the processes of the business been identified? How have they been documented? Who

developed/defined them? Are they reviewed?

How do these processes connect or link to each other? Are outputs identified? Is it clear who the customer

is of each process? The owner?

How are the business processes monitored, measured and controlled?

How are improvements identified for these processes?

Are any of these processes (or sub-processes within them) outsourced to other organizations who carry

them out? If so, how are they identified and how are they controlled? Have any outsourced processes been

the root cause of problems either internal or external?

MANDATORY PROCEDURE Not applicable

Mandatory record: Nor applicable

Process map or process flow chart (part of quality manual)

EVIDENCE / IMPLEMENTATION DOCUMENT Not mandatory but helps in fulfillment of

requirement

Different methods used to document processes: Quality manual, Graphical representations, written

instructions, checklists, flow charts, visual media, or electronic methods. Process flowcharts or block

diagrams can show how policies, objectives, influential factors, job functions, activities, material,

equipment, resources, information, people and decision making interact and/or interrelate in a logical

order.

Methods for effective operation and control of processes: Process flowcharts, block diagrams, job

travelers, work instructions, in process inspection sheet, specifications and drawings, SPC charts, set up

checklist, machine manuals.

Resources for QMS processes may include – facility, material, equipment, labor, supplies, utilities,

Resource details may be identified in specifications, production schedules, bill of materials, production

travelers or routers, work instructions, etc.

Information for QMS processes will vary from process to process and may include – production

schedules, bill of materials, product acceptance and process performance criteria, production traveler or

router, work instructions,

Ways to monitor and measure QMS processes may include – tracking against process parameters, goals

and objectives, using tools and records such as process check-sheets, product acceptance criteria, SPC

records, production records, maintenance records, labor records, etc.

Outsourced processes may be controlled in any number of ways, e.g., providing the vendors with

product specifications, your supplier quality manual that they must meet, asking for inspection and test




Page 25 of 100

results or certificates of compliance, validation of outsourced process, conducting product and QMS

audits of your vendors, etc.

ISO 9001-CLAUSE 4.2

ISO 9001-CLAUSE 4.2 DOCUMENTATION REQUIREMENTS

4.2.1 GENERAL


The quality management system documentation shall include

a) Documented statements of a quality policy and quality objectives,

b) A quality manual,

c) Documented procedures and records required by this International Standard, and

d) Documents, including records, determined by the organization to be necessary to ensure the

effective planning, operation and control of its processes.

NOTE 1 where the term “documented procedure” appears within this International Standard, this means

that the procedure is established, documented, implemented and maintained. A single document may

address the requirements for one or more procedures. A requirement for a documented procedure may be

covered by more than one document.

NOTE 2 the extent of the quality management system documentation can differ from one organization to

another due to

a) the size of organization and type of activities,

b) the complexity of processes and their interactions, and

c) the competence of personnel.

NOTE 3 the documentation can be in any form or type of medium.

EXPLANATION

Clause 4.2.1 specifies all the different types of documentation needed for your QMS. The need to have

additional documentation beyond those specified in this standard may depend upon – customer; regulatory

and your own organizational requirements. Other factors to consider may include complexity of products

and processes, effect on quality, risk of customer dissatisfaction, economic risk, effectiveness and

efficiency, competence of personnel. Clause 4.2.1d requires you to have documents needed to ensure the

effective planning, operation and control for QMS processes. Each organization must determine what

documentation is needed to achieve this based upon complexity of products and processes, effect on quality,

risk of customer dissatisfaction, economic risk, effectiveness and efficiency, competence of personnel.

You must have documented statements of your quality policy and objectives. A procedure is a specific way

to perform an activity or process, and it may or may not be written. If it is established, documented,

implemented and maintained, it is called a documented procedure. A document is information that is written

or recorded on some medium such as paper or computer. A document may specify requirements for e.g. a




Page 26 of 100

drawing or technical specification, may provide direction for e.g. quality plan, or show results or evidence

of activities performed for e.g. records.

4.2.2 QUALITY MANUAL


the organization shall establish and maintain a quality manual that includes

a) The scope of the quality management system, including details of and justification for any

exclusions (see 1.2),

b) The documented procedures established for the quality management system, or reference to them, and

c) A description of the interaction between the processes of the quality management system.

EXPLANATION

The quality manual is a special type of document that describes your QMS. Besides describing your

QMS, your quality manual could provide information on organizational background and capabilities. It

may be used by customers, regulatory bodies, suppliers and company personnel for a variety of purposes.

There are many acceptable ways to document your quality manual. You must define the scope of your

QMS in your quality manual. Your QMS scope should include facilities (manufacturing and support

locations), products, processes, Quality Management and other standards, etc. Customers will want to

know the extent of your capabilities and the Registrar will want to determine the time and effort needed to

audit your organization.

Provide details of any clause exclusions from your scope, and justification for it. You must justify all

exclusions and remember, exclusions can only be made from clause 7.Your quality manual must include a

description of the interaction of your QMS processes.

You have flexibility in whether or not to include your procedures and lower level documentation with your

quality manual or organize them in some other fashion. You may include all or some of your procedures in

your Quality Manual or reference them to your Quality Manual. Keep a listing or index at the front or back

of your Manual showing the complete list of your procedures whether included or referenced.

As a controlled document, the quality manual is subject to all of the controls in clause 4.2.3.

4.2.3 CONTROL OF DOCUMENTS


Documents required by the quality management system shall be controlled. Records are a special type

of document and shall be controlled according to the requirements given in 4.2.4.

A documented procedure shall be established to define the controls needed

a) to approve documents for adequacy prior to issue,

b) to review and update as necessary and re-approve documents,




Page 27 of 100

c) to ensure that changes and the current revision status of documents are identified,

d) to ensure that relevant versions of applicable documents are available at points of use,

e) to ensure that documents remain legible and readily identifiable,

f) to ensure that documents of external origin determined by the org to be necessary for the planning and

operation of the quality management system are identified and their distribution controlled, and

g) to prevent the unintended use of obsolete documents, and to apply suitable identification to them if they

are retained for any purpose.

EXPLANATION

A document is information that is written or recorded on some medium such as paper or computer. Clause

4.2.1 tells you what documents you must include in your QMS. All documents that you determine under

clause 4.2.1 to be needed for your QMS processes must be controlled. This clause 4.2.3 provides

requirements on how these documents must be controlled. Documents outside the QMS need not be subject

to these controls. This clause requires you to have a documented procedure. Ensure that your procedure

specifically addresses each of the control requirements, in terms of who, what when, where and how as

applicable. Your procedure must address new and old as well as internal and external documents used by

the QMS. You must approve all new QMS documentation prior to issue. Some degree of checking,

examination or assessment is inherent in ‘approval for adequacy’. You must periodically determine if any

updating or revisions of any QMS documentation is needed, and if they are changed, they must be re-

approved for adequacy.

The frequency of this review, responsibility and method must be defined in your procedure. This will be

determined by events within your organization and how mature or recent your QMS is. Auditors will

explore this if they find that your documents have not changed in years, while the nature of your business

has changed significantly. Identify changes made to documents so users know exactly what has changed.

There are many ways of doing this on printed as well as computerized documents. Have a method for

revision control such as a revision log and master-list of documents which identifies the current revision

status. Again, there are other ways of doing this as well.

Not all documents need to be available everywhere within your organization. You must determine what

document is applicable (i.e. needed to assure product or process quality) to a specific process or activity

and make the relevant version of that document available to that activity, e.g. providing current packaging

and shipping work instructions to the shipping department.

Once you determine that certain documents need to be made available at various locations, implement some

form of distribution control. There are many ways to do this. One way would be to keep a distribution log.

Documents can take a beating in very harsh environments (covered in oil, dust, acid eaten, weather-beaten,

etc.) to the point of being illegible. You must regularly review the condition of frequently used hard copy

documents to determine whether they need to be replaced. Documents must also be readily identifiable as

to its purpose and scope. A simple heading may suffice, (e.g. In-process Inspection Sheet). Computerized

documents are sometimes given file names that don’t identify its contents and this might require numerous

files to be opened before you find the right one. Identification also implies effective filing for timely

retrieval, whether manual or computerized. A frequent nonconformity is not being able to retrieve a

document or record because of poor filing procedures. External documents (such as customer drawings or




Page 28 of 100

supplier material/part specifications) must be identified. There are many ways to do this. One way would

be to keep a manual or computer list of these documents. Determine who needs these documents and have

some form of distribution control. Don’t overlook supplier, regulatory or industry documents. Apply

applicable controls to these as well.

Obsolete documents can cause many problems if not controlled. There are many ways to do this. One way

would be to provide computerized documents in read-only mode and make only the current version

accessible at workstation computer screens. Obsolete hard copy documents can be removed through

distribution control. Ensure your procedure a covers methods to disallow unauthorized and unapproved or

incorrect documents from being created, used or distributed.

If documents are archived, make sure that all such documents are properly identified, indexed and filed,

and preferably have controlled or restricted access to them. Nonconformities against the document control

process are one of the most frequent audit findings. Develop appropriate performance indicators to

demonstrate effective implementation of your document control process. Examples include – number of

obsolete or unauthorized documents found being used; number of unauthorized changes found; number of

instances documents were not available at points of use; etc. Track trends in these indicators and use this

information to tighten your controls and continually improve your document control process. Use the

PDCA to plan, implement, measure and improve your document control process.

4.2.4 CONTROL OF RECORDS


Records established to provide evidence of conformity to requirements and of the effective operation of

the quality management system shall be controlled.

The organization shall establish a documented procedure to define the controls needed for the

identification, storage, protection, retrieval, retention and disposition of records.

Records shall remain legible, readily identifiable and retrievable.

EXPLANATION

A record is a special type of document that provides written evidence of results achieved or activity

performed (e.g. an inspection record). Records provide one of the strongest forms of evidence of

maintaining and demonstrating the effectiveness of your QMS. Ensure that your documented procedure

for control of QMS records addresses each of the control requirements specified in this clause, in terms of

who, what when, where and how. These controls apply to all QMS records whether they are hard copy or

computerized.

ISO 9001 calls for many records. Some records are specified, while others are implied. The onus is on you

to demonstrate or provide evidence (records) of conformity to requirements, whether the specific clauses

ask for records or not. Requirements for records may originate from the customer, regulatory, industry, or

within your organization. Ensure you maintain records to conform to all of these as applicable. Records

may also come from suppliers and vendors. All these records are subject to the above controls. The

comments under document control regarding legibility, being identifiable and retrievable apply equally to

QMS records.




Page 29 of 100

Readily identifiable – relates to easily determining the purpose and scope of the record, e.g. an inspection

record for a product at final inspection. The design of QMS records must prevent confusion or ambiguity

in the completion and use of records. Records must be written legibly to be useful. Also make sure that they

are not exposed to unauthorized change or alteration. For the duration that they are kept, store records in

locations and mediums that will protect against unauthorized access and environmental damage – (covered

in oil, dust, acid eaten, weather-beaten, etc.). Regularly review the condition of records. The indexing and

filing of records (hardcopy or computer) must ensure easy retrieval. Keep a listing of all the different

categories of records and define the retention times associated with each category (inspection and test; sales

and purchasing; management review; calibration; training; etc.). Retention times are typically determined

by customer, regulatory, industry or organizational requirements and policies.

Records must eventually be disposed-off once past their defined retention times. Disposition could range

from permanent destruction of records to permanent storage in a secure onsite or off-site archive. The intent

here is to remove the risk of inadvertent use and availability for current activities and unauthorized access.

Depending upon the industry, specific records may be kept indefinitely.

Nonconformities against the process for control of records arise frequently. Develop appropriate

performance indicators to demonstrate effective implementation of your record control process. Examples

of indicators could include – number of instances of inability to retrieve records; amount of time spent

looking for records; number of instances of incomplete records; number of instances of damaged records

found; etc. Track trends in these indicators and use this information to tighten your controls and continually

improve your record control process. Use the PDCA to plan, implement, measure and improve your process

for record control.

AUDIT CHECKLIST

An audit checklist should cover these areas:

Does the documented Quality Management System (QMS) include a Quality Policy, Quality Objectives,

Quality Manual, Procedures, Work Instructions and Records?

How does the Quality Manual address the ISO requirements? Does it show the exclusions which are not

applicable? Does it have the all the procedures or reference of Procedures?

Does it covers the mandatory 6 Procedures and 19 Records, as required by ISO 9001 STD?

How QMS are controlled documents identified? (Master List?)

Are personnel using up-to-date “instructional” QMS documents?

How these QMS documents are kept current? What triggers a review?

How was the last new QMS document issued? How was the last change or revision handled? Who

approved these changes?

How are new/ changed QMS documents communicated? Was any training done?

Is there a list of QMS records that are controlled? Verify through sampling that they exist, are legible, are

retained, and kept in a secure/safe location. Look at both electronic and paper records.

MANDATORY PROCEDURE

Clause 4.2.1: Not applicable




Page 30 of 100

Clause 4.2.2: Quality Manual

Clause 4.2.3: Procedure for control of Document

Clause 4.2.4: Procedure for control of Records.

Mandatory record: Not applicable





EVIDENCE/IMPLEMENTATION DOCUMENT Not mandatory but helps in fulfillment of

requirement;

Clause 4.2.1:

A document may specify requirements (e.g. a drawing or technical specification), provide direction (e.g.

quality plan), or show results or evidence of activities performed (e.g. records).

Clause 4.2.2: Quality Manual

Have a method for revision control such as a revision log and master-list of documents which identifies the

current revision status. Distribution log for distribution control, in process inspection sheet-readily

identifiable.

Some of the documents for external control may be standards such as ISO standards or Engineering

specification and also customer drawing

Master list of operating procedures, Master list of Work Instruction, Master list of Quality Manual.

ISO 9001-CLAUSE 5.1, 5.2 & 5.3

CLAUSE 5 MANAGEMENT RESPONSIBILITY

ISO 9001-CLAUSE 5.1, 5.2 & 5.3

5.1 MANAGEMENT COMMITMENT


Top management shall provide evidence of its commitment to the development and implementation of

the quality management system and continually improving its effectiveness by

communicating to the organization the importance of meeting customer as well as statutory and

regulatory requirements,

establishing the quality policy,

ensuring that quality objectives are established,

conducting management reviews, and




Page 31 of 100

ensuring the availability of resources.

EXPLANATION

It is the responsibility of top management to provide leadership and direction for quality management within

the organization. They must establish strategic quality management policies, directives and objectives

consistent with the purpose and capabilities of the organization. They must establish the organizational

structure and internal environment that motivates personnel to achieve the organization’s quality

management goals and objectives. They must provide adequate resources to develop, implement, maintain

and improve the QMS. They must periodically review QMS performance to determine it suitability,

adequacy and effectiveness.

Auditors are expected to review documents and records showing top managements role in planning and

implementing the processes that apply clause 5 requirements. The processes within your organization that

perform these activities must be identified. These processes would typically include – business planning,

quality planning, management review, internal communication, organization structure etc. Top

management would be the process owner of all these processes. Top management must communicate

regularly to the organization on the importance of meeting customer and regulatory requirements. The

communication process should define what needs to be communicated, to whom, the methods used.

The frequency and the means for determining communication effectiveness. Top management may

communicate in any number of ways including meetings, documented policies, memos, directives, email

etc. Effectiveness may be measured by asking – how much of the planned activities did we get done? Or to

what extent did we achieve planned results? Clause 5.1 does not require a ‘documented’ procedure.

However, you must identify and document for e.g. process map, process flow diagram etc. the processes

for business planning; quality planning; management review; internal communication; organization

structure; etc. as part of your QMS. You must also identify what specific documents are needed for effective

planning, operation and control of these processes. These documents may include a documented procedure,

business plan, statement of policies and objectives etc. Look at the risks related to your business, products,

processes and resources in determining the nature and extent of documented controls you need to have for

this clause. Where some of clause 5 activities are performed off-site (e.g. at head-office), your QMS must

identify the off-site processes within your QMS and ensure that such processes comply with ISO 9001

REQUIREMENTs. The expectation is to flow down to the off-site facility, the relevant ISO 9001

REQUIREMENTs that you would have to implement, had you carried out the process at your own facility.

5.2 CUSTOMER FOCUS


Top management shall ensure that customer requirements are determined and are met with the aim of

enhancing customer satisfaction (see 7.2.1 and 8.2.1).

EXPLANATION

Organizations depend on their customers. So it is important that customer relationships be effectively

managed. Accordingly, you must understand current and future needs of customers; you must meet their

requirements and strive to exceed their expectations. To ensure this you must understand your customer’s




Page 32 of 100

specific needs and requirements in terms of products, price, delivery communication, service and support.

You must have an effective communication process between your customer and your organization, for

discussion, review, timing, action and responsibility on the above issues. You must have an effective

process for communication and review of the above requirements to relevant personnel or departments

within your own organization. It is top management role to provide the leadership and commitment of time

and resources to ensure this happens. Auditors will look for evidence of this. Clause 7.2.1 gets further into

the details of understanding and processing customer requirements. Clause 8.2.1 sets requirements for

monitoring and measuring customer satisfaction. Clause 5.2 provides the top management’s overall

responsibility for customer relationship management, while clause 7.2.1 provides the front end and clause

8.2.1 provides the back end, of the underlying and detailed activities of customer relationship management.

The requirements of clause 5.2 – customer focus can be included the following processes – business

planning; communications; sales and marketing; and customer satisfaction feedback; etc. You must also

identify what specific documents may be needed for effective planning, operation and control of these

processes. Examples of such documents may include a business plan, statement of customer related policies

and objectives etc.

5.3 QUALITY POLICY


Top management shall ensure that the quality policy

is appropriate to the purpose of the organization,

includes a commitment to comply with requirements and continually improve the effectiveness of the

quality management system,

provides a framework for establishing and reviewing quality objectives,

is communicated and understood within the organization, and e) is reviewed for continuing suitability.

EXPLANATION

Developing a QMS must be a strategic business decision and therefore top management must provide the

necessary direction and leadership, starting with establishing the quality policy and objectives. Your quality

policy provides top management’s vision on quality management for the organization. It provides the

organization with focused direction, i.e. high level goals and objectives for quality management. Your

quality policy must be consistent with the scope of your QMS and other business, management and

organizational strategies within the organization. Clause 4.1.a requires that you document your quality

policy and clause 5.3.c requires that you specify your commitment to ‘meet requirements’ and ‘continually

improve the effectiveness of your QMS’. Clause 1 specifies requirements for the scope of your QMS. The

wording of the quality policy should preferably specify what requirements are being complied with

customer, regulatory, ISO 9001, etc. It must also clearly state your commitment to continually improve the

effectiveness of the QMS. it may also include other complementary and important policies for business

growth, product or manufacturing technology, workforce competence, business flexibility, etc. What you

state in your quality policy must lead to establishing quality objectives, e.g. if you state in your quality

policy that you will “meet customer requirements”, then from this, you might derive customer focused

objectives for – product defects; customer complaints and returns; on time delivery, etc. Similarly, for the




Page 33 of 100

phrase -“meet ISO 9001 REQUIREMENTs”; from this you might derive process objectives for effectively

using ISO 9001 REQUIREMENTs to manage, control and improve all of your QMS processes. Check out

the process performance indicators suggested in our coverage of clause 4.2.3 and 4.2.4. Stating that you

will continually improve the effectiveness of your QMS in your quality policy – can lead to a number of

objectives, as your QMS is comprised of many processes and you could have one or more objectives for

each process. Therefore, each statement in your quality policy may result in one or more quality objectives.

These quality objectives do not need to be stated in your quality policy, but top management must clearly

be involved in providing direction, establishing and reviewing these objectives. Your internal

communication process should cover how the quality policy is communicated throughout the organization.

There are many ways of doing this. Personnel must understand the importance and impact of the quality

policy on the work they do. Your quality policy may be documented in your quality manual or as an

independent document or both. The quality policy is not written in stone. It must be reviewed periodically

by top management, for significant changes in your organization, e.g. management, ownership, relocation,

product, shift in customer base, etc. Such changes may result in changes to the quality policy. The

establishment of the quality policy should be part of the business planning or QMS planning processes. A

review of the quality policy for continuing suitability should be part of your management review process.

As a quality document, the quality policy is also controlled by 4.2.3 control of documents.

AUDIT CHECKLIST


Check for evidence of how top management shows its commitment to:

Communicating to the organization the importance of meeting customer as well as statutory and

regulatory requirements,

Establishing the quality policy,

Ensuring that quality objectives are established,

Conducting management reviews, and

Ensuring the availability of resources.

Look for how its made clear how a Customer requirement is translated into action, how the Quality

Policy is communicated regularly, how Quality Objectives are established and by whom, that

reviews are held regularly on the status of business operations, finally how resources are allocated

to the functional areas.

For Clause 5.2, review Customer Satisfaction data that is being collected. Is the data showing that

satisfaction levels are increasing? Have any actions been taken to improve how Customers perceive you?

For Clause 5.3, check the Quality Policy to see if it satisfies Clause 5.3 a, b and c? Through interviews

with personnel, determine if they can tell you what the Quality Policy means in their words? Who reviews

the Quality Policy, how is it done, and how often does this review occur?

When was the last time the Quality Policy was revised and how were the revisions communicated to all

personnel?

MANDATORY PROCEDURE

Clause 5.1: Not applicable






Page 34 of 100

MANDATORY RECORD:




EVIDENCE/ IMPLEMENTATION DOCUMENT NOT MANDATORY BUT HELPS

IN FULFILLMENT OF REQUIREMENT;

Clause 5.1:

Role in planning and implementing the processes- business planning, quality planning, management

review, internal communication, organization structure

Documents for the processes: process map, process flow diagram, a documented procedure, business plan,

statement of policies and objectives

Communicate- meetings, documented policies, memos, directives, email

Clause 5.2:

Process for customer focus: business planning, communications, sales and marketing, and customer

satisfaction feedback

Documents needed for effective planning, operation and control of these processes: – a documented

procedure, business plan, statement of customer related policies and objectives

Clause 5.3:

Documented statement of Quality Policy

ISO 9001-CLAUSE 5.4

ISO 9001-CLAUSE 5.4 PLANNING

CLAUSE 5.4.1 QUALITY OBJECTIVES


Top management shall ensure that quality objectives, including those needed to meet requirements for

product (see 7.1 a), are established at relevant functions and levels within the organization. The quality

objectives shall be measurable and consistent with the quality policy.

EXPLANATION

The purpose of quality objectives is to determine conformity to (customer and regulatory) requirements,

and effective deployment and improvement of the QMS. Clause 4.1e requires you to measure and analyze

QMS processes and clause 7.1 requires objectives for product. Clause 4.2.1a requires you to document it.

Clause 8.2.3 and 8.2.4 require you to monitor and measure and evaluate results to your planned objectives.

This clause 5.4.1 sets out specific requirements for planning of quality objectives.Top management must




Page 35 of 100

provide the leadership, organization and resources to deploy and achieve planned quality

objectives. Quality policy provides the framework for establishing quality objectives in order to be

consistent with it and provided examples of such consistency. In this clause, top management must ensure

that specific quality objectives are established. Quality objectives is used to measure the performance of

products, processes, customer satisfaction, suppliers, use of resources and the overall performance and

effectiveness of the QMS. Quality objectives may be established for all QMS processes.

Examples of quality objectives:

Product – reduction in defect rates, PPM’s (defective parts per million), scrap rates, rework; improvement

in on time delivery (see clause 7.1a).

Process – objectives generally focus on improving process productivity through the elimination or

reduction of variation and waste in process – inputs, outputs, conversion activity and related use of

resources.

Monitor and improve process – productivity, reduction of cycle time, errors, omissions and failures; etc.

Examples could include objectives for – set-up time, run rates, process cycle time, etc.

Customers – reduction in # of complaints, improvement in customer satisfaction rating, on time delivery,

service, support, etc.

Suppliers – material defects, on time delivery, no of complaints with supplier.

Resources includes facility, equipment, labor, etc.- objectives could be established based on availability,

capability, maintenance, personnel competency, absenteeism, production rates; efficiency; safety; etc.

For the QMS – customer satisfaction feedback, internal audit results, # of improvement opportunities; etc.

Quality objectives may be set at various functional levels of the organization – top management,

departments, processes, functional groups, work cells, project teams, individuals, etc. It would be useful

to cover these levels as they add value and contribute to customer or organizational objectives. Employees

at all of these levels must be made aware of the importance of and how they must contribute to the

achievement of these objectives.

Quality objectives must be measurable. Measurement can be done quantitatively or qualitatively.

Quantitative measures are generally more objective in determining whether conformity or effectiveness

has been achieved. In some situations, the use of qualitative measurements may be appropriate. Objectives

based on yes/no criteria, (e.g. – develop new product by March 2006), are also acceptable.

These quality objectives must be deployed and measured and top management must conduct an effective

review of the measurement results. These measurement results must also be used for corrective action and

continual improvement. The quality objectives must be achieved within a defined time period to ensure

accountability. This could be determined by your customer, your management, your head office,

regulatory bodies, etc. Your business or quality planning process must establish these time periods and

include the communication of objectives and timelines to those responsible for achieving them. Quality

objectives may be documented in any or all of these documents such as quality manual, QMS processes,

procedures, quality plans etc. The establishment of quality objectives should be part of the business

planning or QMS planning processes. A review of the quality objectives should be part of your

management review process. As a quality document, your documented statement of objectives must be

controlled by 4.2.3 control of documents. You must be careful not to overwhelm your organization with

too many objectives as this may cause more frustration than positive results. Start with objectives that




Page 36 of 100

focus on meeting customer requirements and then slowly develop meaningful objectives for key processes

and risk prone processes, as initial targets are achieved.

CLAUSE 5.4.2 QUALITY MANAGEMENT SYSTEM PLANNING


Top management shall ensure that

a) the planning of the quality management system is carried out in order to meet the requirements given

in 4.1,as well as the quality objectives, and

b) the integrity of the quality management system is maintained when changes to the quality

management system are planned and implemented.

EXPLANATION

It is the responsibility of top management to provide direction, authorization and, resources and review

for QMS planning. When developing your QMS process controls for determining customer

requirements, design, development, manufacture, delivery and customer support, you must focus on

meeting customer and regulatory requirements as well as the planned QMS objectives established in

clause 5.4.1. QMS planning requires you to identify all your QMS processes and describe their sequence

and interaction. The criteria and methods for planning, operation and control of these processes come

from the rest of the ISO requirements as well as your customer and your own organization.

The continuity and effectiveness of your QMS must be substantially maintained in the event of

significant changes in your QMS or organization, e.g. management, ownership, relocation, technology,

product, shift in customer base, etc. Changes must be carefully planned so as not to disrupt your

organizations ongoing capability and responsibility to effectively meet customer and regulatory

requirements. In such instances, change control would require:

careful planning of the nature and timeline for the changes;

determining the impact or outcome of such changes;

ensuring adequate resources are available to implement the change;

top management authorization

change deployment and follow-up

Review of the QMS by top management after changes are effected.

QMS planning could be a part of business planning or treated as an independent process depending on

organizational structure and responsibilities. The management representative typically facilitates QMS

planning with the various process owners. The process owners must take responsibility for

implementation, maintenance and improvement of their processes. The management representative may

provide training and technical assistance as needed. Top management through business planning must

provide leadership, resources and review of QMS performance. Performance indicators to demonstrate

effective QMS planning could include – achievement of quality objectives; improved customer

satisfaction ratings; reduced number and seriousness of internal/external audit non conformities.

AUDIT CHECKLIST





Page 37 of 100

For Clause 5.4.1:-

Do Quality Objectives exist? Are they written down?

Do they relate/connect directly to your products/services?

Are they measurable? Are they being measured? Reported?

Does top management ensure that quality objectives are established at relevant functions and levels with

the organisations?

Are the quality objectives measureable and consistent with the quality policy?

Are quality objectives established to ensure that product requirements met?

For Clause 5.4.2:-

How are the QMS/ processes planned out?

Does the top management ensure that QMS planning is carried out in order to meet requirements given in

section 4.1, as well as the quality objectives?

Does the top management ensure that integrity of the QMS is maintained when changes to the QMS are

planned & implemented?

Is the output of this planning documented?

Are there plans in place to achieve the Quality Objectives? Are the plans documented?

Are changes to the QMS implemented in a controlled manner? (As a result of trying to achieve Quality

Objectives, have Customer complaints gone up? Returns or credits risen? More non-conforming products

or services produced? On-time Delivery performance gone down?)

MANDATORY PROCEDURE



Mandatory record:



Evidence/ Implementation document (Not mandatory but helps in fulfillment of requirement):

Clause 5.4.1: Documented statement of Quality objectives

Example of Quality objective includes

Product – reduction in defect rates, PPM’s (defective parts per million), scrap rates, rework;

improvement in on time delivery

Process – objectives generally focus on improving process productivity through the elimination or

reduction of variation and waste in process – inputs, outputs, conversion activity and related use of

resources. Objectives may be used to monitor and improve process – productivity; reduction of cycle

time, errors, omissions and failures; etc.

Examples could include objectives for – set-up time; run rates; process cycle time; etc.

Customers – reduction in # of complaints; improvement in customer satisfaction rating; on time




Page 38 of 100

delivery; service; support, etc, Suppliers – material defects; on time delivery; # of complaints with

supplier.

Resources – (includes facility; equipment; labor; etc.) – objectives could be established based on

availability; capability; maintenance; personnel competency, absenteeism; production rates; efficiency;

safety; etc.

For the QMS – customer satisfaction feedback; internal audit results; # of improvement opportunities;

etc.

Clause 5.4.2:

EVIDENCE could include – achievement of quality objectives; improved customer satisfaction ratings;

reduced number and seriousness of internal/external audit nonconformities.

ISO 9001-CLAUSE 5.5

ISO 9001-CLAUSE 5.5 RESPONSIBILITY, AUTHORITY AND

COMMUNICATION

ISO 9001-CLAUSE 5.5.1 RESPONSIBILITY AND AUTHORITY


Top management shall ensure that responsibilities and authorities are defined and communicated within

the Organization.

EXPLANATION

Top management must establish the organization necessary to deploy the QMS. It must define the

structure, hierarchy and lines of reporting. Additionally, it must ensure that duties, responsibilities and

authority of all personnel are defined and communicated. All personnel must be clear on their duties,

responsibilities and authority in meeting customer and regulatory requirements. Organization charts, job

descriptions, Standard operating procedures, work instructions, etc., are some of the many ways that top

management may use to define and document this. These must be communicated and deployed, as

applicable, throughout the organization. Orientation training, appointment postings, training on

procedures and work instructions, etc., are some of the many ways in accomplishing this.

The organization structure and lines of reporting; responsibility and authority of managerial functions and

departments may be established by top management and the responsibilities and authorities for the rest of

the organization may be established by the HR function working with various process owners. Again, this

would depend on the size, complexity and culture of the organization. The effective planning, operation

and control of internal communication processes may be demonstrated through the performance indicators.




Page 39 of 100

ISO 9001-CLAUSE 5.5.2 MANAGEMENT REPRESENTATIVE


Top management shall appoint a member of the organization’s management who, irrespective of

other responsibilities, shall have responsibility and authority that includes

a) ensuring that processes needed for the quality management system are established, implemented

and maintained,

b) reporting to top management on the performance of the quality management system and any need

for improvement, and

c) ensuring the promotion of awareness of customer requirements throughout the organization.

NOTE The responsibility of a management representative can include liaison with external parties on

matters relating to the quality management system.

EXPLANATION

A member of management, who has sufficient authority to effectively carry out QMS

responsibilities should be appointed as the MR of the organization. The MR’s role is to facilitate,

motivate and promote the deployment of QMS requirements throughout the organization, through

guidance, training, teamwork and assistance. In carrying out QMS responsibilities, the MR may need to

communicate, delegate, empower, report, oversee and interact with individuals at all levels internal and

external to the organization. Irrespective of other responsibilities” means that the MR may wear other

hats and the MR hat does not have to be the primary one. Regardless, once appointed as the MR, the

individual must effectively perform all QMS responsibilities specified in this sub-clause. Much of this

can be done through having access to appropriate resources and through delegation. Top management

may show evidence of the appointment of the MR through an appointment posting, attendance at QMS

review meetings, provision of support, authorization and resources to QMS activities.

Since quality is the responsibility of the entire organization, the role of the MR is to assist process owners

in developing their processes according to the requirements of ISO 9001 relevant to their process. For

example the purchasing, production or warehousing processes must also know how to control

nonconforming product (clause 8.3); take corrective action (clause 8.5.2) or control their records (clause

4.2.4); etc.

Reporting to top management on QMS performance may take place at management review meetings or

other meetings. The information for the report will come from the results of the measurement and

monitoring requirements specified in clause 8 (e.g. internal audits and customer satisfaction feedback,

etc.). The MR must delegate and facilitate the compilation of this information from all the process

owners. The report must include any recommendation to improve the QMS based on the MR’s review of

all QMS measurement and monitoring data. It would be appropriate to discuss and obtain agreement with

affected process owners. ISO 9001 focuses heavily on meeting customer and regulatory requirements and

enhancing customer satisfaction. The MR must likewise promote this focus through all processes that are

directly and even indirectly involved in achieving this. There are many ways of doing this including the

use of training, cross-functional teams, customer focused project teams, project milestone reviews,

designated customer representative, interfaces with the customer, customer specifications, customer

product specific work instructions, etc.




Page 40 of 100

The MR’s activities must be included in quality planning, management review and communication

processes.

Overall QMS performance indicators may be used to determine how well the MR has performed the

responsibilities.

ISO 9001-CLAUSE 5.5.3 INTERNAL COMMUNICATION


Top management shall ensure that appropriate communication processes are established within

the organization and that communication takes place regarding the effectiveness of the quality

management system.

EXPLANATION

Communications is a complex and difficult activity. Problems may arise due to incomplete, ambiguous

or inaccurate information being transmitted; transmission to the wrong person, too late or at the wrong

time; use of inappropriate or unreliable media, etc. Communication problems are probably the most

common cause of QMS nonconformities. Tracking some of the more serious communication issues

could serve as useful performance indicators to determine and improve communication process

effectiveness. Clause 4.1 control of processes requires you to determine the sequence and interaction of

QMS processes. Each process requires inputs to flow from one process and outputs to flow to another

process. There is a continuous (communication) flow regarding tangible (materials and product) and

intangible (information) inputs and outputs taking place within your organization.

Top management must plan for internal and external communication methods and resources at the high

level using the business planning process and deploy these methods though the information technology,

logistic and HR processes.

Each process owner must identify the methods of communication such as computer, documents, telephone,

meetings, directives, visual, etc.

use and determine whether these methods are appropriate and are they effective for the purpose intended?

– (do they prevent non-conformities from arising due to the reasons mentioned above?). Process owners

should provide feedback on communications effectiveness to the processes providing and controlling such

resources. Communication by the MR on the effectiveness of the QMS must not only take place at the top

management level but also at appropriate levels within the organization. If everyone is responsible for

quality, then all process owners as well as their personnel are entitled to receive periodic feedback on their

areas of responsibility. ISO 9001 clauses that specify communication requirements include- 4.1.d; 5.1.a;

5.3.d; 5.5.1; 5.5.2.b; etc.

AUDIT CHECKLIST

For Sub-clause 5.5.1:

Are the responsibilities & authority for various functions defined & communicated to facilitate effective

quality mgmt?

Do Organization Charts/Job Descriptions exist? Are they current and accurate? Cover all personnel

identified in the QMS?

How do we publish, or make available, this information?




Page 41 of 100

For sub-Clause 5.5.2:

Is a management representative appointed by top management to ensure the processes of the QMS are

established, implemented and maintained?

Is Management Representative identified? How? Shown on Organization Chart?

Are responsibilities of Management Representative identified? How do they maintain the QMS?

How do MR report on QMS performance to the Top Management? How do they find improvements?

How do MR promote awareness of customer requirements throughout the organization?

How do MR liaise with external parties on matters relating to the QMS?

For sub-Clause 5.5.3:

Are the processes of the QMS and their effectiveness communicated between various levels and functions

within the organization?

How is information circulated or distributed to personnel regarding business operating performance? Is it

systematic? Regular meetings?

Do report distribution lists exist? (Check people shown on distribution lists and confirm they receive the

reports)

MANDATORY PROCEDURE




Mandatory record:




Evidence/Implementation document (Not mandatory but helps in fulfillment of requirement):

Clause 5.5.1:

Clarity on their duties, responsibilities and authority: Organization charts, job descriptions, procedures,

work instructions, Orientation packages, appointment postings, sign-off on job descriptions, training on

procedures and work instructions, etc.

Documentation of control methods could include technical manuals, training provided, signage,

computer system etc.

Organization chart (can be part of Quality Manual)

Job Description (can be a separate document or part of Quality Manual)

Clause 5.5.2:

Enhancing customer satisfaction: the use of training, cross-functional teams, customer focused project

teams, project milestone reviews, designated customer representative, electronic interfaces with the

customer, customer specifications, customer product specific work instructions.




Page 42 of 100

Job Description of Management Responsibility (can be a separate document or part of Quality Manual)

Management Review Record

Clause 5.5.3:

Minutes of Meeting

ISO 9001-CLAUSE 5.6

ISO 9001-CLAUSE 5.6 MANAGEMENT REVIEW


ISO 9001-CLAUSE 5.6.1 GENERAL

Top management shall review the organization’s quality management system, at planned intervals, to

ensure its continuing suitability, adequacy and effectiveness. This review shall include assessing

opportunities for improvement and the need for changes to the quality management system, including the

quality policy and quality objectives.

Records from management reviews shall be maintained (see 4.2.4).

ISO 9001-CLAUSE 6.5.2 REVIEW INPUT


The input to management review shall include information on a) results of audits, b) customer feedback, c) process performance and product conformity, d) status of preventive and corrective actions, e) follow-up actions from previous management reviews, f) changes that could affect the quality management system, and g) recommendations for improvement.

ISO 9001-CLAUSE 5.6.3 REVIEW OUTPUT


The output from the management review shall include any decisions and actions related to a) improvement of the effectiveness of the quality management system and its processes, b) improvement of product related to customer requirements, and c) resource needs.

EXPLANATION

The purpose of conducting management reviews of the QMS is to gauge the health of the QMS. The review

must determine QMS suitability, adequacy and effectiveness. Are the QMS resources and controls that

were planned and implemented suitable and adequate for the QMS to be effective in achieving customer

and regulatory requirements; and in achieving quality objectives? Are changes needed to improve product,




Page 43 of 100

processes and use of resources? It would be logical to have a process for management review as it has

specific requirements for management review inputs, value-adding review activities and outputs. The

process should address the frequency, schedule, quorum and agenda for review meetings to be attended by

top management. For the management review process itself to be effective, top management must plan the

review all agenda items with some regularity and take timely action to change or improve any part of it,

including the quality policy and objectives. To avoid problems on frequency and scope of review, an

effective way would be incorporate QMS agenda items into regular monthly or quarterly operational

meetings.

Management review input should preferably be in summary form, showing QMS and operational

performance measured against the business and quality plans, customer and regulatory objectives and goals.

Appropriate actions must result from such reviews.

Review decisions and actions must relate to improving products and processes or even creating new ones,

providing more resources or perhaps improving the efficiency of existing resources, improving QMS

controls, policies and objectives, improving overall QMS effectiveness and customer satisfaction.

Responsibilities and timelines should accompany these decisions and actions. The performance of these

actions must be followed up at subsequent management review meetings. Performance indicators to

measure the effectiveness of the management review process could include – achievement of quality

objectives and improvement in customer satisfaction rating. Clause 5.6 does not require a ‘documented’

procedure. However, you must identify and document the management review process as part of your QMS.

You must also identify what specific documents are needed for effective planning, operation and control of

this process. These documents may include – a documented procedure, review schedule, agenda and action

forms etc., combined with unwritten practices, procedures and methods. Management review records must

include topics discussed, decisions, responsibilities for corrective or improvement actions and related

timelines, provision of resources, and follow-up actions from previous management reviews.

AUDIT CHECKLIST

Is there a review of the QMS by top mgmt at planned intervals to ensure its continuing suitability,

adequacy and effectiveness?

How many top management meetings are considered “Management Review”? How often do they occur?

Who attends the Management review meeting? Meeting results recorded?

Does the review include assessing opportunities / recommendations for improvements of the QMS & its

processes?

Does the review include assessing opportunities / recommendations for improvements of product related

to customer requirements?

Does the review include assessing need to change the QMS, including quality policy & objectives?

Does the review include review of audit results & customer feedback?

Does the review include process performance & product conformance?

Does the review include status of corrective & preventive actions?

Does the review include follow-up actions from earlier review meetings?




Page 44 of 100

Does the review include changes that could affect the QMS?

Does the review include resource needs for QMS implementation & improvement?

Does the review include the results of the management review recorded?

MANDATORY PROCEDURE

Not applicable

MANDATORY RECORD

Management review record

Implementation document (Not mandatory but helps in fulfillment of requirement):

Procedure for management review

Monitoring of Quality objective

Management Review Agenda and Minutes

ISO 9001-CLAUSE 6

ISO 9001-CLAUSE 6: RESOURCE MANAGEMENT

ISO 9001-CLAUSE 6.1 PROVISION OF RESOURCES


The organization shall determine and provide the resources needed

a) to implement and maintain the quality management system and continually improve its effectiveness,

and

b) to enhance customer satisfaction by meeting customer requirements.

EXPLANATION

Top management has the responsibility to ensure the availability of resources to develop and maintain your

QMS. Clause 6.1 requires you to determine the nature and availability of such resources. This is typically

done through business and quality planning. Having adequate resources is vital to ensure product

conformity or satisfy customer requirements – e.g. having adequate personnel, materials and equipment to

ensure timely production and delivery of product. Use business planning (clause 5.1), quality management

planning (clause 5.4) and planning for QMS processes (clause 4.1), to identify and determine the nature of

resource needs of QMS each process and plan for its availability. The actual amount of resources needed

may vary day to day and over time. This is one reason why top management must review QMS performance

regularly. Consider developing performance indicators for each major category of resources used, (e.g.

machinery and equipment; human resources; facility and environment; transport; communication systems;

etc.) to determine the effective use of such resources.

Where the resource planning process is performed off-site (e.g. at head-office), your QMS must include the

off-site processes within your QMS and ensure that such processes comply with ISO 9001




Page 45 of 100

REQUIREMENTs. Evidence of the off-site facility’s compliance may include – a copy of their ISO 9001

certification; results of their internal audits to ISO 9001; auditing the outsourced facility; etc.

The expectation is to flow down to the off-site facility, the relevant ISO 9001 REQUIREMENTs that you

would have to implement, had you carried out the process at your own facility.

ISO 9001-CLAUSE 6.2 HUMAN RESOURCES


ISO 9001-CLAUSE 6.2.1 GENERAL

Personnel performing work affecting conformity to product requirements shall be competent on the basis

of appropriate education, training, skills and experience.

NOTE Conformity to product requirements can be affected directly or indirectly by personnel performing

any task within the quality management system.

ISO 9001-CLAUSE 6.2.2 COMPETENCE, TRAINING AND AWARENESS

The organization shall

a) determine the necessary competence for personnel performing work affecting conformity to

product requirements,

b) where applicable, provide training or take other actions to achieve the necessary competence,

c) evaluate the effectiveness of the actions taken,

d) ensure that its personnel are aware of the relevance and importance of their activities and how

they contribute to the achievement of the quality objectives, and

e) maintain appropriate records of education, training, skills and experience (see 4.2.4).

EXPLANATION

Top management is responsible for ensuring the availability of resources which includes HR. Clause 5.5.1

requires top management to define the organization and its responsibilities and authorities. Clause 6.1

required that adequate resources including HR be determined and provided. And here in clause 6.2 the

specific requirements for controlling HR are defined. Planning for HR process controls must include

determining competency criteria, skills evaluation, identification of training needs, types of training,

provision of training, how training effectiveness is evaluated, methods to communicate awareness of the

importance of quality requirements and meeting quality objectives, to all employees. Although training may

end up being the best solution, don’t overlook other actions, such as, changing processes, improving

procedures, rotating jobs, outsourcing, or recruiting fully training people. Criteria for competency must be

developed based on appropriate education, skills, training and experience for activities, tasks, functions and

processes. The level and detail of such qualifications, skills, training and experience will depend upon the

complexity of product, process, technology and customer and regulatory requirements. It is up to your

organization to determine the necessary criteria for the various functions and activities affecting product

and QMS based on these factors. A “Skills Matrix” is a useful tool used by organizations to determine and




Page 46 of 100

manage the competency levels required by different activities and functions. Organizations undergo

significant changes through growth or decline, acquisitions, new technology and new products and

processes, Also, many organizations are now outsourcing their production labor to save on payroll costs

and benefits. Labor related nonconformities can easily arise in such cases. Planning for your HR process

must ensure that contract and agency personnel performing work affecting product quality have adequate

competency and training. Appropriate records must be kept of such training.

Quality awareness must be focused on meeting customer and regulatory requirements. The process to

promote quality awareness may include the use of methods such as – cross-functional teams, involvement

in quality planning, quality circles, improvement suggestions, product workshops, zero defect programs,

product review checklist etc. QMS personnel must be motivated to achieve the organizations quality

objectives. The process to motivate employees may include the use of methods such as – employee

recognition awards, ongoing training programs, performance reviews, employee surveys, poster campaigns

etc.

You must determine and keep appropriate records of education, training, skills and experience. These

records must demonstrate the effective operation of HR process controls. Performance indicators to

measure the effectiveness of the HR process in determining competency and training needs of the

workforce, could include – employee turnover, employee complaints, number of instances unqualified

personnel were found performing QMS activity, number of instances competency criteria were not met and

number of instances no training or competency records maintained; etc.

ISO 9001-CLAUSE 6.3 INFRASTRUCTURE


The organization shall determine, provide and maintain the infrastructure needed to achieve conformity

to product requirements. Infrastructure includes, as applicable,

a) Buildings, workspace and associated utilities,

b) process equipment (both hardware and software), and

c) supporting services (such as transport, communication or information systems).

EXPLANATION

Planning for the types of infrastructure resources needed for your business may include facility,

production equipment, IT equipment and software, laboratory, packaging, dies, molds, tooling, jigs,

fixtures, storage, transportation, communication, office, materials, labor, utilities and supplies, etc.

The key strategic business factors to be considered for infrastructure planning include future needs,

current availability and capacity, cushion for growth, contingency planning, linkage to current and future

product programs. This planning may be done through business planning (clause 5.1); quality

management planning (5.4) and planning for QMS processes Clause 4.1). The actual deployment of such

resources may be determined by each process owner.

You are required to maintain your infrastructure. Your planned preventive maintenance program should

include controls for schedule and timing, availability and training of personnel, types and scope of




Page 47 of 100

maintenance, maintenance and competency/training records, tracking to maintenance objectives, use,

storage and control of spare parts, control of any maintenance outsourcing etc.

ISO 9001-CLAUSE 6.4 WORK ENVIRONMENT


The organization shall determine and manage the work environment needed to achieve conformity to

product requirements.

NOTE The term “work environment” relates to those conditions under which work is performed including

physical, environmental and other factors (such as noise, temperature, humidity, lighting or weather).

EXPLANATION

Work environment include controls for ergonomics, personnel safety and facility conditions that are

conducive to achieving product quality. Some of the factors to consider in determining and managing the

work environment include ergonomics (worker movement; fatigue; manual effort and loads, etc.),

workplace location, heat, light, humidity, airflow, noise, vibration, hygiene, cleanliness, pollution, adequate

facilities (lockers, lunchroom, cafeteria, washrooms etc); health and safety regulations; cleanliness of

premises; etc. the extent to which the above environmental factors may apply to any organization will vary

based on size, risk and other considerations. The focus should be employee safety, welfare and product

conformity. Performance indicators to measure the effectiveness of processes that determine and control

the effective use of infrastructure may include equipment maintenance – uptime / downtime; productivity

– equipment and workforce; accident and safety incidents; non-value added use of floor space; excessive

handling and storage; number of instances specific resources were not available or delayed;

AUDIT CHECKLIST

For Clause 6.1:

How are resource needs identified and provided, for all areas of the quality management system?

Are resources determined and provided for implementing, maintaining and improving the processes of

the quality management system?

Are resources determined and provided for enhancing customer satisfaction by meeting customer

requirements?

Are resources directed towards improving the effectiveness of the quality management system? How?

(Obtain examples)

How have resources been provided to “enhance” Customer satisfaction levels? (Obtain examples)

Keep in mind that to audit Clause 6.1 you need an overall perspective of the entire QMS in order to make

an informed assessment here.

For Clause 6.2:

Are personnel assigned responsibilities defined in the QMS competent on the basis of applicable

education, training, skills/qualifications and experience?

Are competency needs for personnel performing activities affecting quality identified?




Page 48 of 100

Are training provided to satisfy the competency needs?

Is effectiveness of training provided evaluated?

Are appropriate records of education, experience, skills/qualifications and training maintained?

How do you ensure that a person is competent in their job? How is this checked? How often does this

check occur?

How are competency gaps identified? How are gaps closed?

How do you know that the action that was taken actually closed the gap?

How are employees advised on how they can individually contribute to achieving any of the Quality

Objectives?

For Clause 6.3:

How does the organization identify a need to add to the current infrastructure? (i.e. new buildings or

additions, new or replacement process hardware or software, enhanced support services such as new

or upgraded information technology)

Is there a capital expenditure budget process? What has been done to the infrastructure in the past 12

months? Once the proper infrastructure is in place, how is it maintained?

Any Customers orders being affected by lack of a proper infrastructure?

For Clause 6.4:

How are employees provided with a suitable work environment for supplying the products and services

being offered by the company?

Are work areas properly controlled for lighting and climate conditions?

Are work areas organized and provide safe working conditions?

MANDATORY PROCEDURE

Not applicable

MANDATORY RECORD

For Clause 6.1: Not applicable

For Clause 6.2: List of employees showing records of education, training, skills and experience



Implementation document (Not mandatory but helps in fulfillment of requirement)

For Clause 6.1:

List of employees showing records of education, training, skills and experience

Competency Matrix

For Clause 6.2:

Competency Matrix

Induction training record




Page 49 of 100

Training record

Training needs

Skills matrix

For Clause 6.3:

Site layout plan

Equipment list

Transport list

For Clause 6.4:

Accident record

Housekeeping record

ISO 9001-CLAUSE 7.1

ISO 9001-CLAUSE 7 PRODUCT REALIZATION

ISO 9001-CLAUSE 7.1 PLANNING OF PRODUCT REALIZATION


The organization shall plan and develop the processes needed for product realization. Planning of

product realization shall be consistent with the requirements of the other processes of the quality

management system (see 4.1).

In planning product realization, the organization shall determine the following, as appropriate:

a) quality objectives and requirements for the product;

b) the need to establish processes and documents, and to provide resources specific to the product;

c) required verification, validation, monitoring, measurement, inspection and test activities specific to

the product and the criteria for product acceptance;

d) records needed to provide evidence that the realization processes and resulting product meet

requirements (see 4.2.4).

The output of this planning shall be in a form suitable for the organization’s method of operations.

NOTE 1 A document specifying the processes of the quality management system (including the product

realization processes) and the resources to be applied to a specific product, project or contract can be

referred to as a quality plan.

NOTE 2 the organization may also apply the requirements given in 7.3 to the development of product

realization processes.

EXPLANATION

Clause 7.1 is essentially a repeat of clause 4.1, but applied specifically to product realization processes.

The focus is on controls governing the making of product to meet customer requirements and all the QMS

processes that, directly or indirectly, make this happen. Product realization processes may include

customer related processes (sales and marketing), design and development, production, shipping,

receiving, packaging, measurement and monitoring of product and processes, etc., whether performed




Page 50 of 100

onsite or off-site. Some of the support processes that come to bear on product realization include

document control, record control, human resources, infrastructure provision and maintenance, IT,

purchasing and materials management, laboratory services and control of monitoring and measuring

devices, business planning etc. The output of product realization planning may be implemented in many

different ways. It does not necessarily have to be all in one document, but may sometimes include several

documents such drawings, machine set-up, inspection criteria, process sheets etc. These must be readily

available to those performing realization processes.

You may also consider using specific product, contract or project quality plans to accomplish this. Your

quality plans should include the processes needed, process sequence and control parameters, specific

resources needed to make, verify and deliver product, product acceptance criteria and quality objectives,

product and process monitoring and measurement controls, plans to control and correct any product or

process nonconformities, reference to support processes, documents needed such as work instructions or

engineering specifications, etc. and details of records to be kept. Focus on defect prevention in planning

the controls for product realization. The notes to 7.1 also permit you to use other project management

tools or clause 7.3 product design and development requirements to plan for product realization processes.

Quality objectives may include defect rates, scrap rates, etc. Requirements or criteria for the product may

include physical properties, dimensional, functional, etc., and their related measurements, tolerances and

acceptance levels.

In many instances, depending on the nature of the product, the customer may specify objectives and

requirements and criteria for the product realization processes as well. You must identify and document

all processes addressing this clause as part of your QMS. For these processes, you must also identify what

specific documents are needed for effective planning, operation and control of production

processes. These documents may include contracts, specifications, orders, product quality plans, work

instructions, a documented procedure etc., combined with unwritten practices, procedures and

methods. Look at the risks related to your product, processes and resources in determining the nature and

extent of documented controls you need to have. Where any of the product realization processes are done

off-site (e.g. at head-office), your QMS must include the off-site processes within your QMS and ensure

that such processes comply with ISO 9001 requirements. The expectation is to flow down to the off-site

facility, the relevant ISO 9001 REQUIREMENTs that you would have to implement, had you carried out

the process at your own facility. Performance indicators to measure the effectiveness of product

realization in meeting requirements and achieving quality objectives will be specific to each realization

process and focus on reducing variation and waste in realization processes and related use of

resources. Objectives may be used to monitor and improve process productivity, reduction of cycle time,

errors, omissions and failures etc. You must also consider indicators to measure product performance

such as – reduction in defect rates, PPM’s (defective parts per million), scrap rates, waste and rework,

improvement in on time delivery, product returns from customers etc.

AUDIT CHECKLIST

Are the processes needed for product realization planned, developed and documented in a quality plan?

Are the following determined in the quality plan, as appropriate:

1) Quality objectives for product, project or contract

2) Need to establish processes / documents

3) Need to provide resources / facilities

4) Required verification, validation, monitoring, inspection, test activities & criteria for acceptance

5) Records to provide evidence of conformity to established processes & product requirements?




Page 51 of 100

Interview those employees responsible for launching new products, services and processes. Get answers

to these questions:

1. is there a plan on how existing products/services will be produced or supplied? Is there a flowchart of

the main steps?

2. Is a plan in place for introducing: New products? New services? New contracts? New processes?

New projects? New locations? New computer systems?

3. Any examples of these “new” activities in the past 12 months? If so, was a plan followed? Is a

checklist used? How was implementation of all the critical steps managed?

4. How is the transition from “new” to “normal operations” managed?

5. How are new processes monitored and measured? How are any new records identified? What is the

result/output of any planning activities?

MANDATORY PROCEDURE

Not applicable

MANDATORY RECORD

records needed to provide evidence that the realization processes and resulting product meet

requirements. This is bit tricky and can be done in number of ways depending on the type of organization.

For e.g. in manufacturing process it can be done in the following steps

1) Understanding customer requirement- Contract review or order details

2) Converting requirement into plan- Quality plan, Process plan

3) evidence of product meeting requirement-Pre dispatch inspection report

4) evidence of process meeting requirement- in process inspection report

EVIDENCE/IMPLEMENTATION DOCUMENT

Not mandatory but helps in fulfillment of requirement

Output of product realization planning: drawings, machine set-up, inspection criteria, process sheets,

work instructions or engineering specifications, Objectives may be used to monitor and improve process –

productivity, reduction of cycle time, errors, omissions and failures, etc.

ISO 9001-CLAUSE 7.2

ISO 9001-CLAUSE 7.2 CUSTOMER-RELATED PROCESSES

ISO 9001-CLAUSE 7.2.1 DETERMINATION OF REQUIREMENTS

RELATED TO THE PRODUCT

ISO 9001 REQUIREMENT The organization shall determine a) requirements specified by the customer, including the requirements for delivery and post-delivery activities, b) requirements not stated by the customer but necessary for specified or intended use, where known, c) statutory and regulatory requirements applicable to the product, and

d) any additional requirements considered necessary by the organization.

NOTE Post-delivery activities include, for example, actions under warranty provisions, contractual

obligations such as maintenance services, and supplementary services such as recycling or final disposal.




Page 52 of 100

ISO 9001-CLAUSE 7.2.2 REVIEW OF REQUIREMENTS RELATED TO

THE PRODUCT


The organization shall review the requirements related to the product. This review shall be conducted prior

to the organization’s commitment to supply a product to the customer (e.g. submission of tenders,

acceptance of contracts or orders, acceptance of changes to contracts or orders) and shall ensure that

a) product requirements are defined,

b) contract or order requirements differing from those previously expressed are resolved, and

c) the organization has the ability to meet the defined requirements. Records of the results of the review

and actions arising from the review shall be maintained (see 4.2.4).

Where the customer provides no documented statement of requirement, the customer requirements shall

be confirmed by the organization before acceptance. Where product requirements are changed, the

organization shall ensure that relevant documents are amended and that relevant personnel are made aware

of the changed requirements.

NOTE In some situations, such as internet sales, a formal review is impractical for each order. Instead the

review can cover relevant product information such as catalogues or advertising material.

ISO 9001-CLAUSE 7.2.3 CUSTOMER COMMUNICATION

The organization shall determine and implement effective arrangements for communicating with

customers in relation to

a) Product information,

b) inquiries, contracts or order handling, including amendments, and

c) customer feedback, including customer complaints.

EXPLANATION

Customer related processes must include controls for determining customer and regulatory requirements, a

review of such requirements, and communication with the customer. Customer requirements extend beyond

product specifications and may include on-time delivery, packaging, labeling, mode of delivery,

documentation, communications, QMS requirements, after sales servicing, etc. Many of these requirements

may also come from regulatory, industry or from within your own organization. Depending on the product

or service, you must determine if any industry or regulatory requirement is applicable on product

characteristics or process parameters that affect the product’s safety or compliance with regulatory

requirements. You must consider all laws and regulatory requirements that may affect your product,

materials, labor, production processes, your facility and work environment, etc. Where some or all of the

processes – for determining customer requirements; for contract review and customer communication; etc.,

are done offsite, then you must show the linkages and interaction of these offsite activities with your on-

site QMS processes. The nature of requirements review may be different for different types of product or

services. Your review records must show the basis of review. Make sure you do your due diligence and risk

analysis before you commit to contractual arrangements. I have seen many companies get into serious

financial trouble, for taking on products transferred from another supplier, because they did not assess all




Page 53 of 100

the risks. Manufacturing risk analysis is an assessment of your organization’s capacity and capability to

effectively and efficiently provide the customer specified deliverables. Risk analysis should include timing,

resources, development costs and investments, potential for, and effects of, possible failures in processes,

including suppliers. You should also consider financial and profitability risk. Sometimes it may take a few

months to receive an order or contract from the customer, after you have sent them your quotation. Your

review process must ensure that you compare the customer’s order or contract with your latest quotation,

and resolve any differences (accept or re-negotiate), before you accept the order or contract. Your customer

relations management process must include a sub-process for change control and must include – a review

of the change either from customer or internal from organization and its impact on fit, form, functionality,

other processes, financial, delivery, etc. Have a process for change control. For significant issues or

changes, obtain customer approval in writing for any waivers or changes of contractual or QMS

requirements. Customer communications may take many forms such as software and interfaces for design

and development, logistics, customer satisfaction feedback, etc. You must ensure that personnel at all levels

have the competency and training to use these communications media and tools. You must identify and

document all processes addressing this clause as part of your QMS. For these processes, you must also

identify what specific documents are needed for effective planning, operation and control of production

activities. These documents may include – contracts, specifications, orders, product quality plans, work

instruction, a documented procedure etc., combined with unwritten practices, procedures and

methods. Look at the risks related to your product, processes and resources in determining the nature and

extent of documented controls you need to have. Performance indicators to measure the effectiveness of

customer-related processes in meeting requirements and achieving quality objectives should focus on

reducing variation in and improving these processes and related use of resources. Indicators may include

reduction in quote cycle time, pre and post-award review cycle time, order-entry errors and omissions etc.,

and improvement in conversion ratio (i.e. ratio of contracts/orders awarded to quotes).

AUDIT CHECKLIST

For Clause 7.2.1:

How are Customer requirements determined? Any specification being provided?

What are the requirements specified by the customer, including delivery and post-delivery activities?

What are the requirements not specified by the customer but necessary for intended or specified use?

What are the statutory, regulatory requirements and any other requirements determined by the

organisations?

For Clause 7.2.2:

How are product and service requirements adequately defined/documented?

Are quotes/proposals reviewed prior to issue? Are they checked against subsequent orders that are

received? Can orders be received verbally?

Does the organisations has the ability to meet the defined requirements?

How are requirements reviewed to ensure they can be met? Who does the review?

Are the results of the product/contract review and subsequent follow-up actions recorded?

Are customer requirements confirmed, if the customer provides no documented requirements?




Page 54 of 100

How are Contract or order requirements that differ from those previously expressed resolved?

Where product/contract requirements are changed, does the organisations ensure that relevant

documentation is amended? Relevant personnel are made aware of the changed requirements?

For Clause 7.2.3:

How is product/service information provided to Customers?

How are inquiries handled? Placing of orders? Changes to orders?

How can Customers provide feedback? Is there a process to handle it?

Does the organisations identify and implement arrangement for communication with the customers

relating to product information, Inquiries, contract or order handling, including amendments and

Customer feedback, including customer complaints.

MANDATORY PROCEDURE

Not applicable

MANDATORY RECORD

Records of the results of the review and actions arising from the review shall be maintained-Contract

Review

EVIDENCE/ IMPLEMENTATION DOCUMENT Not mandatory but helps in fulfillment of

requirement.

For Clause 7.2.1:

Customer requirements extend beyond product specifications and include – on-time delivery, packaging,

labeling, mode of delivery, documentation, communications, QMS requirements, after sales servicing, etc.

Documents are needed for effective planning, operation and control of production activities: contracts,

specifications, orders, product quality plans, work instructions, a documented procedure, etc., combined

with unwritten practices, procedures and methods.

For Clause 7.2.2:

Evidence of review of customer requirement may include Minutes of meeting of contract review, procedure

for contract review, Verbal Communication form, Order Acknowledgment, Proforma Invoice, Invoice

Excise, Quotation form, Product Catalogs etc.

For Clause 7.2.3:

Customer communications – management representative, computerized interfaces and software for product

(EDI, CAD), Customer provided software and interfaces for design and development, logistics, customer

satisfaction feedback.




Page 55 of 100

ISO 9001-CLAUSE 7.3

ISO 9001-CLAUSE 7.3 DESIGN AND DEVELOPMENT

ISO 9001-CLAUSE 7.3.1 DESIGN AND DEVELOPMENT PLANNING


The organization shall plan and control the design and development of product.

During the design and development planning, the organization shall determine

a) the design and development stages,

b) the review, verification and validation that are appropriate to each design and development stage, and

c) the responsibilities and authorities for design and development.

The organization shall manage the interfaces between different groups involved in design and

development to ensure effective communication and clear assignment of responsibility.

Planning output shall be updated, as appropriate, as the design and development progresses.

NOTE Design and development review, verification and validation have distinct purposes. They can be

conducted and recorded separately or in any combination, as suitable for the product and the organization.

EXPLANATION

You must include product design and development in your QMS scope if you contract or convey the

perception that you design product, regardless whether you buy, outsource or actually do design and

development. The scope of your design and development activity must consider all aspects of the product

and product realization processes to ensure its conformity to requirements. This includes product

identification, handling, packaging, storage and protection during internal processing and delivery to the

customer. Product design and development sometimes results in new manufacturing processes or changes

to existing manufacturing processes. This clause is equally applicable for designing and developing

manufacturing processes. Product design and development planning must focus on error prevention

rather than detection in product quality as well as product realization processes.

You must have an overall plan for your design project. Your plan must specify the design and

development stages, activities and tasks, responsibilities, timeline and resources, specific tests,

validations, and reviews, and outcomes. There are many tools available for planning ranging from a

simple checklist to complex software. The degree and details of planning may vary according to size and

length of contract or project, complexity, risk, product life, customer and regulatory requirements, past

experience with similar product, etc. You have flexibility in determining the scope of the stages, review,

verification and validation required for your product design and development projects.

Your plan must be dynamic and updated as requirements and circumstances change. You must track

progress against your plan at regular intervals or project milestones and update the plan as activity

progresses. Your design and development plan must include methods to communicate information,

responsibilities, results, discussions, reviews and resources. You must take a multi-disciplinary approach

that includes as needed, other functions (besides design) such as quality, engineering, purchasing, sales,

tooling, production, etc. Your plan must clearly identify these other functions and their specific role and

responsibilities regarding the project. Consider including customer and supplier personnel at appropriate

stages to do work and review results or progress.

A multi-disciplinary approach applies collective and relevant knowledge and skills of these different

functions to carry out or review design and development activities. The design and development project

plan serves as both a document and a record as it is updated for completion for various activities. Where




Page 56 of 100

some or all of clause 7.3 design and development activities are done offsite, then you must show the

linkages and interaction of these offsite activities with your on-site QMS processes.

You must identify and document all processes addressing this clause as part of you. For these processes,

you must also identify what specific documents are needed for effective planning, operation and control

of production activities these documents may include contracts, technical drawings and specifications, a

documented plan for design and development, work instructions, a documented procedure etc., combined

with unwritten practices, procedures and methods. Look at the risks related to your product, processes and

resources in determining the nature and extent of documented controls you need to have. Many

organizations use various software tools to document their product or process design and development

plans. If the nature of your business does not require you to design and develop product (e.g. you

manufacture strictly from customer provided engineering drawings and specifications), then you must

clearly state this exclusion to your QMS scope, in your quality manual. Performance indicators (to

measure the effectiveness of design and development processes in meeting requirements and achieving

quality objectives) should focus on reducing variation in and improving these processes and related use of

resources. Indicators may include reduction in design cycle time, development cycle time, specification

errors, omissions, changes, design and development costs etc., as well as measurable improvements in

products developed.

ISO 9001-CLAUSE 7.3.2 DESIGN AND DEVELOPMENT INPUTS


Inputs relating to product requirements shall be determined and records maintained (see 4.2.4). These

inputs shall include

a) functional and performance requirements,

b) applicable statutory and regulatory requirements,

c) where applicable, information derived from previous similar designs, and

d) other requirements essential for design and development.

The inputs shall be reviewed for adequacy. Requirements shall be complete, unambiguous and not in

conflict with each other.

EXPLANATION

You must identify, document and review design inputs requirements for function, performance, safety,

regulatory, quality, reliability, durability, life, timing, maintainability, cost, identification, traceability,

packaging, special or safety characteristics from the customer or regulatory body, and other requirements

essential to the product. You must have a process that should be part of your design and

development plan to identify, document, review , deploy and use design input information such as

documents coming from various sources such as customer contracts, drawings and specifications, your

own organization’s database of previous design and development projects, competitor analysis, industry

standards, feedback from suppliers, field data.

Design and Development usually requires the input and involvement of many other functions and

processes such as contract review, product realization, purchasing, top management etc. within the

organization and your process must manage this interaction by defining responsibilities and means of

communications. Inclusion of these controls in your design and development plan is one of many




Page 57 of 100

effective ways to achieve this. Such a multi-disciplinary approach has the benefit of applying the

collective and relevant knowledge and skills of these different functions to carry out or review design and

development activities.

You must identify and include any special and safety characteristics in your process control documents

such as quality plans, product drawings, operator instructions and other documents used to make or verify

product. Note that special requirements can also include process parameters such as temperature, timing,

concentrations, etc. You must review all input requirements, review design and development progress,

verify product design and validate developed product at various stages of your design and development

process. The nature, frequency and scope of these controls must be defined in your design and

development plan or other document. You must carry out these controls according to your plan and keep

appropriate records.

ISO 9001-CLAUSE 7.3.3 DESIGN AND DEVELOPMENT OUTPUTS


The outputs of design and development shall be in a form suitable for verification against the design

and development input and shall be approved prior to release.

Design and development outputs shall

a) meet the input requirements for design and development,

b) provide appropriate information for purchasing, production and service provision,

c) contain or reference product acceptance criteria, and

d) specify the characteristics of the product that are essential for its safe and proper use.

NOTE Information for production and service provision can include details for the preservation of

product.

EXPLANATION

Design and development output may be product or documentation or both. Product may be prototype or

finished product and documentation could be a computerized or hardcopy drawing or specification. Check

design and development output against the input requirements specified in 7.3.2, before you use it any

further. Provide appropriate design and development output information to:

Purchasing material or service specifications

Production output such as product specifications, special characteristics, drawings, diagnostics, etc.

Service output such as product specifications; performance reliability and maintenance criteria.

Initially, this information may be used for trials and validation, before being firmed up. Many documents

are created from the design and development output stage such as drawings, quality plans, work

instructions, etc. These documents must be controlled as per clause 4.2.3 such as approval, revision control,

distribution, etc.

Where any sophisticated design and development tools such as AutoCAD are used requiring specific

competency or training, ensure you provide and keep appropriate records of competency and training of

personnel performing design and development activities and use of these tools.




Page 58 of 100

ISO 9001-CLAUSE 7.3.4 DESIGN AND DEVELOPMENT REVIEW


At suitable stages, systematic reviews of design and development shall be performed in accordance

with planned arrangements (see 7.3.1)

a) to evaluate the ability of the results of design and development to meet requirements, and

b) to identify any problems and propose necessary actions.

Participants in such reviews shall include representatives of functions concerned with the design

and development stage(s) being reviewed. Records of the results of the reviews and any necessary actions

shall be maintained (see 4.2.4).

EXPLANATION

Do design reviews at one or more milestones of the design and development project, depending on customer

requirements, the size, complexity and risks involved. The purpose of these reviews is to evaluate results

to requirements, check project progress and costs to plan and take actions on any problems

encountered. You must take a multi-disciplinary approach for doing these reviews and keep appropriate

records of issues discussed, actions to be taken, responsibilities and timeline for completion. All design and

development reviews must be included in your design and development plan.

ISO 9001-CLAUSE 7.3.5 DESIGN AND DEVELOPMENT VERIFICATION


Verification shall be performed in accordance with planned arrangements (see 7.3.1) to ensure that the

design and development outputs have met the design and development input requirements. Records of the

results of the verification and any necessary actions shall be maintained (see 4.2.4).

EXPLANATION

Product design Verification includes design reviews, comparing the new design to a similar proven design

if available, performing alternate calculations, performing tests and simulations, reviewing the design

documents before release, etc. Verification is checking product or process to input requirements, whereas

validation is checking product or process is suitable for its intended use does it perform/function in the way

intended by your customer or your organization. Manufacturing process design verification include design

review, process capability studies, testing various process parameters, performing tests and trials, reviewing

the manufacturing process design documents before release, etc.

If you outsource any part of your design and development activity, then you must exercise the same controls

required by clause 7.3 on the outsourced work and the organization doing the work, had it been done

internally.

You must keep records for verification.




Page 59 of 100

ISO 9001-CLAUSE 7.3.6 DESIGN AND DEVELOPMENT VALIDATION


Design and development validation shall be performed in accordance with planned arrangements (see 7.3.1)

to ensure that the resulting product is capable of meeting the requirements for the specified application

or intended use, where known. Wherever practicable, validation shall be completed prior to the delivery

or implementation of the product. Records of the results of validation and any necessary actions shall

be maintained (see 4.2.4).

EXPLANATION

Product and manufacturing process validation includes – design reviews, comparison between customer

requirements and internal development plans, design and development validation against customer

requirements and design and development input requirements, corrective action and lessons learned from

documented process failures and product nonconformities. If you outsource any part of your design and

development activity, then you must exercise the same controls required by clause 7.3 on the outsourced

work and the organization doing the work, had it been done internally. You must keep records for validation

activities.

ISO 9001-CLAUSE 7.3.7 CONTROL OF DESIGN AND DEVELOPMENT

CHANGES


Design and development changes shall be identified and records maintained. The changes shall be

reviewed, verified and validated, as appropriate, and approved before implementation. The review of design

and development changes shall include evaluation of the effect of the changes on constituent parts and

product already delivered. Records of the results of the review of changes and any necessary actions shall

be maintained

EXPLANATION

Make sure your process for design and development changes follow appropriate steps of clause 7.3 ie define

plan, have inputs and outputs, verify and validate to the extent necessary to meet customer requirements

and control product, quality and business risks. Changes may come from internal, customer or regulatory

sources. Get all requests for product or manufacturing process design changes in writing from your

customer.

Impact of the change must be evaluated on materials used, design process, manufacturing process,

characteristics and use of developed product, regulatory compliance, cost etc.

AUDIT CHECKLIST


For Clause 7.3.1:

How are the stages of design planned?

Is planning output updated, as appropriate, as the design and development progresses?




Page 60 of 100

How are the design and development stages determined?

How is design and development review, verification and validation activities determined?

How is responsibilities & authority for design and/or development activities determined?

Are the interfaces between different groups managed to ensure effective communication & clarity of

responsibilities?

Are planning output kept up-to-date?

For Clause 7.3.2:

How are input requirements identified and documented?

Do the design and development input includes functional & performance requirements, applicable

statutory & regulatory requirements, applicable information derived from similar design and Any other

essential requirements?

For Clause 7.3.3:

Where do design outputs approved before issue?

Where do design outputs meet the design/development input requirements?

Where do design outputs provide appropriate information for production & service operations?

Where do design outputs contain or reference product acceptance criteria?

Where do design outputs define the characteristics of the product that are essential to its safe and proper

use?

For Clause 7.3.4:

How often are design and development reviews done? How are all input requirements checked?

At suitable stages, are systematic reviews of design and development conducted to evaluate ability to

fulfill requirements and to identify problems & propose follow-up actions?

Are results of the review and any necessary action of the review recorded?

Do representatives of the functions concerned with the design and development participate in design &

development review?

For Clause 7.3.5:

How is the design verified? When is it verified? Is it documented?

Is design & development verification performed to ensure that the design and development outputs meets

its inputs?

Are the results of the verification and resulting follow-up actions recorded?

For Clause 7.3.6:

How is the design validated? When is it validated? Is it documented?

Is design & development validation performed to confirm that the resulting product is capable of meeting

the requirements for intended use?




Page 61 of 100

Wherever applicable, is validation completed before delivery or implementation of the product?

Are results of validation & subsequent follow-up actions recorded?

For Clause 7.3.7:

How are design changes reviewed? How is impact evaluated? Are Record kept?

Are these identified, documented, reviewed, verified and validated, as appropriate before implementation?

Are there evaluation of the effect of changes on constituent parts and products already delivered?

MANDATORY PROCEDURE

Not applicable

MANDATORY RECORD

For Clause 7.3.1: Not applicable

For Clause 7.3.2: D&D input record for e.g. Design data Input sheet, Customer specification


For Clause 7.3.4: Record of D & D review for e.g. Design Review Records, D&D Minutes of meeting

For Clause 7.3.5: D & D verification for e.g. Adequacy report, D&D plan, and test plan

For Clause 7.3.6: D& D Validation for e.g. Feasibility report, User acceptance test plan, and acceptance

record

For Clause 7.3.7: D& D change for e.g. Design change record, D&D review MOM

EVIDENCE/IMPLEMENTATION DOCUMENT Not mandatory but helps in fulfillment of

requirement:

Procedure for design and development

Checklist for Design Input Adequacy

Design and Development input

List of Design output

Documents are needed for effective planning, operation and control of production activities:-

contracts, technical drawings and specifications, a documented plan for design and development,

work instructions, a documented procedure, etc., combined with unwritten practices, procedures

and methods.

Performance indicators: – include reduction in – design cycle time, development cycle time,

specification errors, omissions, changes, design and development costs, etc., as well as measurable

improvements in products developed.

Design input information (documents): customer contracts, drawings and specifications, your own

organization’s database of previous design and development projects, competitor analysis, industry

standards, feedback from suppliers, field data. contract review, product realization, purchasing, top

management- quality plans, product drawings, operator instructions and other documents used to

make or verify product




Page 62 of 100

ISO 9001-CLAUSE 7.4

ISO 9001-CLAUSE 7.4 PURCHASING

ISO 9001-CLAUSE 7.4.1 PURCHASING PROCESS


The organization shall ensure that purchased product conforms to specified purchase requirements. The

type and extent of control applied to the supplier and the purchased product shall be dependent upon the

effect of the purchased product on subsequent product realization or the final product.

The organization shall evaluate and select suppliers based on their ability to supply product in accordance

with the organization’s requirements. Criteria for selection, evaluation and re-evaluation shall be

established. Records of the results of evaluations and any necessary actions arising from the evaluation

shall be maintained (see 4.2.4).

EXPLANATION

Clause 7.4 covers the requirements to control purchased product, requirements to control suppliers you

buy from, and requirements to control your buying process. Purchased product includes raw materials,

components, subassemblies, supplies, tooling, machinery and equipment, sequencing, sorting, rework,

testing, calibration, maintenance, etc. Note that clause 7.4 requirements apply to items that go into the

product, manufacture the product, check the product or deliver the product; whether paid for or customer

provided.

These may include materials, production equipment, tooling, measuring and test equipment, facilities,

transport vehicles, returnable packaging, intellectual property (drawings, specifications or proprietary

information), product returned for servicing under warranty, product sent for outsourced work etc. You

must have specifications/criteria for purchased product. These specifications may come from your

organization, customer, regulatory bodies, supplier or industry. As documents, these specifications must

be controlled as per clause 4.2.4. Many times the customer may require the use of pre-approved

purchased products and suppliers. The onus is still on you to ensure that purchased product from

customer-designated sources meets all requirements. You must control both, the product you buy, as well

as the supplier you buy from. Your controls must primarily be based on prevention of nonconformities in

both product and supplier performance.

Determine how important the purchased product is to design, manufacture, assemble and maintain your

end product. If you recall from product design input (clause 7.3.2) we considered factors such as targets

for product quality, life, reliability, durability, maintainability, and cost. You must apply similar criteria to

purchased product going into your end product. Categorize your purchased products and services

accordingly. Then determine what controls you need to ensure consistent purchased product quality and

consistent supplier performance. You can then apply different controls for different purchased products.

There are several ways to evaluate your suppliers. Besides product quality, your criteria for supplier

selection and evaluation may include the potential supplier’s financial capability, technical and

manufacturing capability and capacity, reliability, reputation, flexibility to handle changes, support,

service, cost etc. The importance of these criteria will vary according to the items materials or services




Page 63 of 100

you purchase, and so you can apply different criteria to different suppliers. You can categorize your

suppliers accordingly based on these criteria. It might be useful to maintain a list of all qualified suppliers.

In addition to the initial evaluation and approval of suppliers, you are required to carry out ongoing

monitoring and measurement of their performance. Use supplier monitoring indicators to evaluate the

consistency, capability and reliability of their performance for quality, delivery, support, etc. On-time

delivery is very important and disruptions (due to waiting for materials) at your customers or even your

own facility must be avoided. Depending on the risks related to materials supplied and supplier

performance, you might consider requiring some of your key suppliers to comply with some or all of ISO

9001 REQUIREMENTs and perhaps even certification. As per clause 4.1, you must identify your

purchasing processes whether on site or off site. For each process, you must document the controls for

purchased product and suppliers. You must also show the linkage and interaction of purchasing processes

with other processes such as design, manufacturing, tooling maintenance, calibration. Where any of your

controlled suppliers have gone through a significant organizational change you must verify the continuity

and effectiveness of their QMS. You must keep records of all supplier evaluations (whether initial or

periodic), including any corrective actions placed on them for any nonconformities. You must identify

and document all processes addressing this clause as part of your QMS.

For these processes, you must also identify what specific documents, controls and resources are needed

.You could use a documented procedure or other combination of specific practices, procedures, documents

and methods. Look at the risks related to your product, processes and resources in determining the extent

of documented controls you need to have. Performance indicators to measure the effectiveness of

purchasing processes in meeting requirements and achieving quality objectives should focus on measuring

supplier performance and reducing variation in and improving purchasing processes and related use of

resources. Indicators for supplier performance may include reduction of defects in supplied product, scrap,

waste and rework, improvement in on-time delivery, service, cost, etc. Indicators for purchasing process

may include reduction in supplier- quote review cycle time, contract award cycle time, purchase order-entry

errors and omissions, receiving errors & omissions etc.

ISO 9001-CLAUSE 7.4.2 PURCHASING INFORMATION


Purchasing information shall describe the product to be purchased, including, where appropriate,

a) requirements for approval of product, procedures, processes and equipment,

b) requirements for qualification of personnel, and

c) quality management system requirements.

The organization shall ensure the adequacy of specified purchase requirements prior to their

communication to the supplier.

EXPLANATION

Your purchase documents such as purchase order, contract, blanket order, your organization’s supplier

quality manual, etc. must specify your requirements for the purchased product; the suppliers QMS and

any other initial or on-going controls you deem necessary for ensuring consistent supplier performance.

You must define how you ensure the adequacy of these documents before you communicate them to your




Page 64 of 100

supplier. A review of adequacy of purchasing documents may include their completeness, accuracy,

correctness, quantity, timing, cost, approval, etc., by one or more functions; computerized controls, etc. In

larger organizations, this may be a separate process on-site or off-site. In either case, it must be identified

and controlled. While clause 7.4.2 does not specify keeping of records, you must show evidence of

carrying out (issue purchase documents) and review of these documents

ISO 9001-CLAUSE 7.4.3 VERIFICATION OF PURCHASED PRODUCT


The organization shall establish and implement the inspection or other activities necessary for ensuring

that purchased product meets specified purchase requirements. Where the organization or its customer

intends to perform verification at the supplier’s premises, the organization shall state the intended

verification arrangements and method of product release in the purchasing information.

EXPLANATION

Verification of purchased product can range from doing no verification to 100% verification. You have

flexibility in determining the scope of purchased product verification. As indicated earlier in 7.4.1, you

can apply different controls for different suppliers and products depending on your initial supplier

evaluation and their ongoing product quality and delivery performance. In any case these controls must be

included or referenced in your quality or inspection plans. To the extent that you decide to do verification

of purchased product, you also have flexibility in when you do the verification. You can do it on receipt

or at any time prior to use in production. Make sure you appropriately control un-inspected product. This

may include identification and storage to prevent unintended use. Consider using supplier quality plans,

inspection plans, etc., to verify that purchased product meets specified purchase (product and QMS)

requirements. Your inspection process must define and document the acceptance criteria and sampling

plan for product conformity and what measurement tools needed and records needed to show effective

control of purchased product quality and supplier performance.

AUDIT CHECKLIST

For Clause 7.4.1:

From whom the organization can buy materials or services from?

Is there an Approved List of suppliers?

How does a Supplier get on the list? Any new ones added? How do Suppliers stay on the list? Is

performance checked? How often are performance checked?

Are criteria for selection & periodic evaluation defined?

Are results of supplier evaluations & follow-up actions shall be recorded?

Are types & extend of control to be applied to the supplier and purchased product dependent on the effects

on subsequent product realization process or the final product?

For Clause 7.4.2:




Page 65 of 100

How are orders placed to Suppliers? How is this information checked for accuracy?

How do you ensure adequacy of specified purchase requirements prior to their communication to the

supplier?

Do purchasing documents contain information describing the product to be purchased, including where

appropriate requirements for product approval, procedures, processes and equipment, qualification of staff

and QMS requirements?

For Clause 7.4.3:

How the organization does checks that what was received is exactly what was ordered?

Are activities necessary for verification of purchased products established and implemented?

Do the organization ever goes to a Suppliers premises to release a purchase order? Do Customers of

organization ever do this with the Suppliers of organization? If so, how is the Supplier made aware?

MANDATORY PROCEDURE

Not applicable

MANDATORY RECORD

For Clause 7.4.1:

Results of supplier evaluations and any necessary actions arising from the evaluations.

For e.g. Records of supplier evaluations, list of approved suppliers



Evidence/Implementation document Not mandatory but helps in fulfillment of requirement

For Clause 7.4.1:

Procedure for supplier evaluation

Supplier audit checklist

Supplier registration form

For Clause 7.4.2:

Purchase document: Purchase order, Work order, contract, blanket order, your organization’s supplier

quality manual

For Clause 7.4.3:

Inward Inspection report

Supplier quality plans, inspection plans

Consider using supplier quality plans, inspection plans, etc., to verify that purchased product meets

specified purchase (product and QMS) requirements




Page 66 of 100

ISO 9001-CLAUSE 7.5

ISO 9001-CLAUSE 7.5 PRODUCTION AND SERVICE PROVISION

ISO 9001-CLAUSE 7.5.1 CONTROL OF PRODUCTION AND SERVICE

PROVISION


The organization shall plan and carry out production and service provision under controlled conditions.

Controlled conditions shall include, as applicable,

a) the availability of information that describes the characteristics of the product,

b) the availability of work instructions, as necessary,

c) the use of suitable equipment,

d) the availability and use of monitoring and measuring equipment,

e) the implementation of monitoring and measurement, and

f) the implementation of product release, delivery and post-delivery activities.

EXPLANATION

This clause provides a list of control requirements that you may use, if applicable to your business. Identify

and control all production process. Show the interaction of these processes with other processes. Use your

product, project or contract quality plan to control production and service activities. Schedule your

production taking into consideration customer delivery requirements, production capacity and capability,

material availability and usage, personnel availability and usage; storage; etc. Carefully define and

document the interaction of your production scheduling process with your logistics processes such as

inventory management, customer communication, traffic and shipping control, packaging and labeling,

sales and billing. Use quality plans to control your production processes. Quality plans address what has to

be made, how much has to be made, when it has to be made, by whom, in what sequence, how it has to be

made, what production equipment to use, what measurement and monitoring tools to use, what to inspect,

when to inspect, how much to inspect, what to do if problems arise, etc.

Your quality plan must cover all production process steps from receipt of materials, production, packaging,

storage, delivery and even post-delivery activities such as installation or training. Your quality plans are

dynamic and must be updated for the changes in product specifications or process parameters; resources

used; monitoring or measurement requirements, etc. Your quality plans should reference any work

instructions specified for the process steps. Work instructions may be viewed as a subset of your quality

plan and may relate to a specific task or activity of your overall product realization process for e.g. setting

up a machine, performing an inspection, packaging a product, If you determine that work instructions are

needed at specific points in your process, then they must be readily available and relevant i.e. current or

right version. Note that work instructions may exist in many forms such as narrative, graphical, audio,

video, physical display etc. To improve your QMS, it will be very useful to draw a flow chart to link the

flow and interaction of the activities and sub-processes covered by these clauses, e.g. many organizations




Page 67 of 100

overlook reviewing and updating their quality plans for corrective action taken to address a manufacturing

process problem. Production personnel must have timely access to all information relevant to their activities

including specific work instructions if necessary. There may be serious risk to production flow, if such

information is unavailable or untimely. You must identify and document all processes addressing this clause

as part of your QMS For these processes, you must also identify what specific documents are needed for

effective planning, operation and control of production activities. These documents may include – a product

quality plan; work instructions; documented procedure; etc., combined with unwritten practices, procedures

and methods. Look at the risks related to your product, processes and resources in determining the nature

and extent of documented controls you need to have. Performance indicators to measure the effectiveness

of production processes in meeting requirements and achieving quality objectives should focus on reducing

variation in and improving production processes and related use of resources.

Indicators for production processes be product or process related. Product related indicators may include

reduction in defect rates, PPM’s (defective parts per million), scrap rates, waste and rework; improvement

in on time delivery. Production process related indicators may include reduction in set-up time, run rates,

process cycle time, production scheduling and operator errors and omissions etc.

ISO 9001-CLAUSE 7.5.2 VALIDATION OF PROCESSES FOR

PRODUCTION AND SERVICE PROVISION


The organization shall validate any processes for production and service provision where the resulting

output cannot be verified by subsequent monitoring or measurement and, as a consequence, deficiencies

become apparent only after the product is in use or the service has been delivered. Validation shall

demonstrate the ability of these processes to achieve planned results.

The organization shall establish arrangements for these processes including, as applicable,

a) defined criteria for review and approval of the processes,

b) approval of equipment and qualification of personnel,

c) use of specific methods and procedures,

d) requirements for records (see 4.2.4), and

e) revalidation.

EXPLANATION

Validation is usually required where product cannot be verified without damaging or destroying the

product, e.g. some types of welding, heat-treatment, painting, electroplating, rust-proofing, etc. In such

instances, the quality of these activities may only be discovered after use. This would generally not be

acceptable due to safety (e.g. weld) or aesthetic (evidence of rust or dullness of chrome) reasons. In the

case of a service such as pizza delivery within 30 minutes of order placement, if the timeliness of delivery

is not verifiable, then validation would be required. However, most service-oriented businesses (e.g.

delivery; call center) have some form of monitoring during service execution to ensure service quality.

Validation involves conducting capability studies using a combination of resources technology,

equipment, materials, environment, competent personnel, and production and testing methods that

consistently result in a quality product or service.

Document the specific procedures, methods, and combination of resources that achieve this capability,




Page 68 of 100

and keep records of ongoing studies to show that you are maintaining this capability. Validation may also

require customer or regulatory approval of the process. You must keep appropriate records of process

validation showing both the achievement of planned results as well as the ongoing maintenance of such

capability. If you change any part of the proven process capability for e.g. materials, equipment or

personnel, etc., you must revalidate i.e. re-prove the changed process. It is up to each organization to

determine what combination of resources and methods will provide the required consistent process

capability and quality of product or service. Include as appropriate, these validation controls in your

quality plans. If the nature of your product or service is such that it does not require validation and where

product can always be verified by subsequent monitoring or measurement prior to delivery, then you must

clearly state this exclusion to your QMS scope, in your Quality manual.

Performance indicators to measure the effectiveness of processes that validate production processes may

include reduction in defect rates, PPM’s (defective parts per million), validation cycle time, revalidations

etc.

ISO 9001-CLAUSE 7.5.3 IDENTIFICATION AND TRACEABILITY


Where appropriate, the organization shall identify the product by suitable means throughout product

realization.

The organization shall identify the product status with respect to monitoring and measurement

requirements throughout product realization. Where traceability is a requirement, the organization shall

control the unique identification of the product and maintain records (see 4.2.4).

NOTE In some industry sectors, configuration management is a means by which identification and

traceability are maintained.

EXPLANATION

There are three distinct control requirements specified here.

Product identification: It means knowing the identity of yours or customer supplied product from

incoming receipt of materials, raw material storage, use in production, work in progress, finished product

storage, and delivery of product to the customer. Product identification can be controlled using physical

and electronic methods.

Product status: It means knowing the quality status (good or bad) of materials and product through each

of the above stages. Product status can be controlled using physical and electronic methods.

Unique Product Identification: It is not a mandatory requirement under ISO 9001, unless contractually

required by customers or regulatory bodies. In certain industry sectors such as the automotive or aerospace

or pharmaceutical industry, unique product identification is mandatory for safety, regulatory and risk

management reasons. This usually involves keeping detailed records of product manufacturer such as

material, equipment, personnel, processes, production, inspection and test details, etc., for individual

products or production batches. These records help to trouble-shoot product and process problems, resolve

customer complaints, and enables continual improvement of product and process. In many instances, it

also reduces cost, risk and use of resources by narrowing the problem down to a specific cause or instance.




Page 69 of 100

Depending on the product, the OEM may specify the degree of unique identification and traceability

required.

While this clause does not call for a specific documented procedure, these controls may be included in your

product realization processes through your product quality plans, work instructions and other specific

documentation. Examples of product identification and test status include physical tags, bar code labels

linked to computer records; MRP systems tracking specific production runs/lots, automated production

transfer processes, etc. Performance indicators to measure the effectiveness of processes that control

identification and traceability may include reduction in identification errors and omissions; product quality

status errors and omissions; and traceability errors and omissions.

ISO 9001-CLAUSE 7.5.4 CUSTOMER PROPERTY


The organization shall exercise care with customer property while it is under the organization’s control or

being used by the organization. The organization shall identify, verify, protect and safeguard customer

property provided for use or incorporation into the product. If any customer property is lost, damaged or

otherwise found to be unsuitable for use, the organization shall report this to the customer and maintain

records (see 4.2.4).

NOTE Customer property can include intellectual property and personal data.

EXPLANATION

Customer property may include material, production equipment, tooling, measuring and test equipment,

facilities, transport vehicles, returnable packaging, intellectual property such as drawings, specifications

or proprietary information, product returned for servicing under warranty, product sent for outsourced

work, etc.

All customer property is exposed to the risk of being damaged, lost, misused, misplaced, stolen, become

unsuitable or obsolete for use. You must establish controls for each of these risks. Notify the customer in

writing if their property is lost, damaged or otherwise found to be unsuitable such as perishable past its

shelf life for use. Control to minimize the risks to customer property include inventory management,

preservation and storage, identification, status and traceability indicators, maintenance, notification,

traffic flow, authorized use, restricted access, etc. Marking customer property with a unique identification

number that can be traced to a record that provides details of ownership is one of many acceptable

controls.

This clause requires records to be kept of customer property that is lost, damaged or otherwise found to be

unsuitable for use. This implies tracking the storage and use of and quality status, of customer property.

While this clause does not call for a specific documented procedure, these controls may be included in

your product realization processes through your product quality plans, work instructions and other

specific documentation. Many of the controls needed for clause 7.5.3 Identification and traceability and

clause 7.5.5 Preservation of product apply to customer property. The processes, controls and

documentation for these other clauses could be expanded to include customer property.

If the nature of your business does not require the use of any customer property, then you must clearly

state this exclusion to your QMS scope, in your Quality manual.

Performance indicators to measure the effectiveness of processes that control customer property may




Page 70 of 100

include reduction in identification errors and omissions, loss due to damage or unsuitability, scrap, rejects,

etc., as well as increased customer property turnover rates.

ISO 9001-CLAUSE 7.5.5 PRESERVATION OF PRODUCT


The organization shall preserve the product during internal processing and delivery to the intended

destination in order to maintain conformity to requirements. As applicable, preservation shall include

identification, handling, packaging, storage and protection. Preservation shall also apply to the constituent

parts of a product.

EXPLANATION

All raw materials, work in progress, finished product, supplies, customer provided materials or product,

product sent for outsourced work, etc., are subject to risk of being damaged, lost, misused, misplaced,

stolen, become unsuitable ,perishable or obsolete i.e. past shelf life for use. This could occur during

receipt, handling, storage, use in production, and transportation to the customer, etc. These could be

Controlled using identification, status and traceability indicators, inventory cycle counts and condition

evaluation, stock rotation methods such as FIFO, just in time, tracking shelf life, special, controls for

restricted access, handling and storage of hazardous materials, climate and environment, maintenance

procedures, bar codes, training, use of special equipment for handling, condition reports, etc. These

controls may be included in your product realization processes through your product quality plans, work

instructions and other specific documentation. Many of the controls needed for clause 7.5.3 Identification

and traceability apply to preservation of product.

Performance indicators to measure the effectiveness of processes that control preservation of product may

include reduction in obsolete and spoils materials an product (e.g., fresh produce, fruits, or frozen foods),

identification errors and omissions, rejects, waste, scrap, etc., and increase in inventory turnover and

material/product availability, and product safety.

AUDIT CHECKLIST

For Clause 7.5.1:

How are controls applied to the processes to ensure that products & services are supplied to the Customer

correctly?

Are production & service operations controlled through, as applicable availability of information on

characteristics of product?

Are production & service operations controlled through, as applicable availability of work instructions?

Are production & service operations controlled through, as applicable use & maintenance of suitable

equipment?

Are production & service operations controlled through, as applicable implementation of monitoring

activities?

Are production & service operations controlled through, as applicable implementation of defined

processes for release, delivery and post-delivery activities?




Page 71 of 100

Are production & service operations controlled through, as applicable availability & use of measuring &

monitoring devices?

For Clause 7.5.2:

Have any processes whose output cannot be checked? If so, how are these processes controlled?

Where resulting output cannot be verified by subsequent monitoring or measurement, are the production

and service processes validated through as applicable defined criteria for review and approval, approval

of equipment and qualification of personnel use of specific methods & procedures and requirements for

records and re-validations?

Does validation demonstrate the ability of these processes to achieve planned results?

For Clause 7.5.3:

How are items identified? How do you indicate whether products/services are good (or not) to use? Can

traceability information (if asked) be found on what was delivered?

Are various products suitably identified throughout production and service operations?

Are the product status identified w.r.t. measurement & monitoring requirements?

Where traceability is a requirement, are unique identification of product controlled and recorded.

For Clause 7.5.4:

Does the Customer supply any product, property or information? If so, is it checked for suitability?

Are customer property provided for use or incorporation into the product identified, verified, protected &

safeguarded?

If the customer property that is lost, damaged or otherwise unsuitable for use, is this reported to the

customer and recorded?

For Clause 7.5.5:

How is incoming, in-process and final product/ service handled? Stored? How are products/ services

protected?

Are the conformity of product during internal processing and delivery to intended destination preserved?

Does this include identification, handling, packaging, storage and protection of the product and

constituent parts?

MANDATORY PROCEDURE

Not applicable

MANDATORY RECORD


For Clause 7.5.2:

Demonstrate the validation of processes where the resulting output cannot be verified by subsequent

monitoring or measurement for e.g. Schedule of achieved results




Page 72 of 100

For Clause 7.5.3:

The unique identification of the product, where traceability is a requirement for e.g. Equipment register

For Clause 7.5.4:

Customer property that is lost, damaged or otherwise found to be unsuitable for use for e.g. Defective

material report, Delivery note


Evidence/Implementation document Not mandatory but helps in fulfillment of requirement

For Clause 7.5.1:

Documents are needed for effective planning, operation and control of production activities: a product

quality plan, work instructions, production planning, Job Cards, Workmanship Standards, documented

procedure, Breakdown maintenance report, Preventive maintenance report, etc., combined with unwritten

practices, procedures and methods.

For Clause 7.5.2:

Competence Training, External test records, Equipment validation, Test piece records

For Clause 7.5.3:

ID Tags, Barcodes, Unique product ID … etc.

Examples of product identification and test status include physical tags, bar code labels linked to

computer records, MRP systems tracking specific production runs/lots, automated production transfer

processes

For Clause 7.5.4:

List of Customer Property, Control to minimize the risks to customer property include inventory

management, preservation and storage, identification, status and traceability indicators, maintenance,

notification, traffic flow, authorized use, restricted access, etc. Marking customer property with a unique

identification number that can be traced to a record that provides details of ownership is one of many

acceptable controls.

For Clause 7.5.5:

Procedure For Handling, Controls include identification, status and traceability indicators, inventory cycle

counts and condition evaluation, stock rotation methods such as FIFO, just in time, tracking shelf life, MRP

systems for tracking requirements and usage, special, controls for restricted access, handling and storage of

hazardous materials, climate and environment, maintenance procedures, bar codes, training, use of special

equipment for handling, condition reports, etc.




Page 73 of 100

ISO 9001-CLAUSE 7.6

ISO 9001-CLAUSE 7.6 CONTROL OF MONITORING AND MEASURING

EQUIPMENT


The organization shall determine the monitoring and measurement to be undertaken and the monitoring

and measuring equipment needed to provide evidence of conformity of product to determined

requirements.

The organization shall establish processes to ensure that monitoring and measurement can be carried out

and are carried out in a manner that is consistent with the monitoring and measurement requirements.

Where necessary to ensure valid results, measuring equipment shall

a) be calibrated or verified, or both, at specified intervals, or prior to use, against measurement

standards traceable to international or national measurement standards; where no such standards exist, the

basis used for calibration or verification shall be recorded (see 4.2.4);

b) be adjusted or re-adjusted as necessary;

c) have identification in order to determine its calibration status;

d) be safeguarded from adjustments that would invalidate the measurement result;

e) be protected from damage and deterioration during handling, maintenance and storage.

In addition, the organization shall assess and record the validity of the previous measuring results when

the equipment is found not to conform to requirements. The organization shall take appropriate action on

the equipment and any product affected.

Records of the results of calibration and verification shall be maintained (see 4.2.4).

When used in the monitoring and measurement of specified requirements, the ability of computer

software to satisfy the intended application shall be confirmed. This shall be undertaken prior to initial

use and reconfirmed as necessary.

NOTE Confirmation of the ability of computer software to satisfy the intended application would

typically include its verification and configuration management to maintain its suitability for use.

EXPLANATION

Requirements for what needs to be measured and the acceptance criteria may come from the customer,

regulatory, industry and your own organization. Product realization planning must determine the

following what specific product and process characteristics needs to be monitored and measured, the

criteria for product acceptance, the type of Monitoring and Measurement Device needed, frequency i.e. at

what stages of realization to do it, sample size, etc. You must then determine what Monitoring and

Measurement Device is appropriate for each measuring or monitoring requirement. Consideration must be

given to the measurement capability (precision) of the Monitoring and Measurement Device which may

have to be several times greater than the tolerance criteria for product measurement. This would depend

on the industry you are in and the criticality of end use for the product for e.g. the precision requirements

for ball bearings may be much greater than say for cutting cloth to make a shirt. Personnel using Monitoring

and Measurement Device’s must have competence and training in the use of Monitoring and Measurement

Device’s in terms of their function, range and precision of measurement, reliability, use and maintenance.




Page 74 of 100

Monitoring and Measurement Device’s may include measurement and testing tools, equipment, hardware

and software. They may be owned by your organization, your employees or the customer. Monitoring and

Measurement Device’s may be used to verify product as well as to measure process conformity for e.g. a

temperature controller on an oven. Besides Monitoring and Measurement Device’s used for product

conformity, you may need to calibrate and control certain Monitoring and Measurement Device’s used in

related and peripheral processes such as production equipment, tooling, maintenance, etc.

To ensure valid measurement and monitoring results, Monitoring and Measurement Device’s must be

controlled. A process is required, to control the identification of monitoring measurement, selection,

purchase, status, identification, calibration, verification, adjustment or re- adjustment, use, handling,

maintenance and storage, training, handling of nonconforming Monitoring and Measurement Device’s,

etc. You must keep appropriate records to demonstrate effective operation and control of your Monitoring

and Measurement Device processes. These records must include calibration and verification records

traceable to national, international or other benchmark used for calibration.

All Monitoring and Measurement Device’s used for product verification must be capable of being

calibrated, verified or both. Calibration is setting or correcting an Monitoring and Measurement Device,

usually by adjusting it to match or conform to a dependably known and traceable standard for e.g. adjusting

a micrometer or caliper to conform to master blocks traceable to national standards.

Verification is confirming that the Monitoring and Measurement Device is meeting or performing to

acceptable national measurement standards and does not involve any correction or adjustment for e.g.

verifying a ruler or tape measure against a calibrated ruler that has been calibrated to a national standard.

A ruler or tape measure is generally not capable of being calibrated and when it gets out of calibration its

use must be discontinued.

There are Monitoring and Measurement Devices that are capable of being both calibrated and verified for

e.g. a CMM- coordinate measuring machine and may require both to be done in specific situations based

on frequency of use and criticality of measurement. This requirement also applies to the use of computer

software whose capability and calibration status must be established prior to initial use and reconfirmed

(verified) at defined intervals.

You must define the frequency and method of calibration for each type and level i.e. whether used in shop

floor, laboratory or standard of Monitoring and Measurement Device. Your calibration records must

identify what standard you used for calibration and show traceability of the standards you use at your facility

to national or international standards.

In rare circumstances, national or international standards may not exist for calibrating a specific Monitoring

and Measurement Device. In such situations consider using industry, manufacturer or even your own

organizational standard to validate the accuracy and reliability of your Monitoring and Measurement

Device. Consult with your customer if the contractual circumstances require it. Your quality plan must

define the measurement and monitoring required and the type of Monitoring and Measurement Device

needed for it, including the frequency of measurement and acceptance criteria. Depending on the risk and

precision and reliability of measurements needed, you might consider doing statistical studies on

Monitoring and Measurement Device’s referenced in your quality plans. Ensure that personnel performing

such statistical studies are trained and competent to do so.

A multitude of software tools are available to manage and control Monitoring and Measurement Device’s.

There are many acceptable methods to identify Monitoring and Measurement Device’s and their calibration




Page 75 of 100

status. The methods you select must consider the manufacturers recommendations, frequency of use,

environment the Monitoring and Measurement Device is used in, risk in misuse or incorrect tool being

used, etc. Where a monitoring and Measurement Device is found to be out of calibration, you must take

appropriate correction action to contain and re-verify the product affected, to the extent practical. This is in

addition to containing, repair and recalibration of the defective Monitoring and Measurement

Device. Customer or internal engineering changes may result in a change in product measurement,

requirements and/or the Monitoring and Measurement Device to be used. These changes would normally

be reflected in your quality plan.

If you use external calibration services, you are still expected to impose the specific control requirements

of this clause to the external organization. If the nature of your business does not require the use of

Monitoring and Measurement Device’s for e.g. a financial service such as a credit counseling service, then

you must clearly state this exclusion to your QMS scope, in your Quality manual.

Performance indicators such as the monthly trends in the number of out of calibration Monitoring and

Measurement Device’s, or the number of Monitoring and Measurement Device’s past their calibration due

date, number of Monitoring and Measurement Device’s being used and not controlled, reduction in

untrained personnel found using Monitoring and Measurement Device’s, etc. Use these indicators to tighten

and improve the effectiveness of your Monitoring and Measurement Device process. You could use a

product quality plan, documented procedure or other combination of specific practices, procedures,

documents and methods. Look at the risks related to your product, processes and resources in determining

the extent of documented controls you need to have.

AUDIT CHECKLIST

Are the monitoring and measurement to be undertaken determined?

Are the monitoring and measurement devices needed to provide evidence of conformity of product to

determined requirements determined?

Is the measuring equipment calibrated or verified at specified intervals

Is the measuring equipment adjusted or re-adjusted as necessary

Is the measuring equipment identified to enable the calibration status to be determined?

Is the measuring equipment safeguarded from adjustments that would invalidate the measurement result?

Is the measuring equipment protected from damage & deterioration during handling, maintenance &

storage?

Determining how product/service is measured during in-bound process, in-process and out-bound process.

Is there a list of equipment requiring calibration? Compare this list to the measurement points in the

process. Are there any gaps? Does the equipment listed cover at least the Customer specification? Check

a sampling of equipment on the list and verify that is being calibrated.

Are records of equipment calibration & verification maintained?

Who decides the frequency of calibration? Does it ever change?

How is measuring equipment calibrated? For Internal calibration: Is work instructions used? For External

Calibration: Was a PO issued to the calibration service provider?

Any employee owned tools/equipment used? Are they being calibrated?




Page 76 of 100

When a measuring equipment is found not to conform to requirements is the validity of the previous

measuring results assessed and recorded?

When a measuring equipment is found not to conform to requirements are appropriate actions taken on

the equipment and any affected products?

If equipment wasn’t measuring correctly, how long before it was discovered? How much product/service

would have been produced?

Any computer software used to measure the product/service? If yes, how do you know it’s working

properly?

MANDATORY PROCEDURE

Not applicable

MANDATORY RECORD

1) Basis used for calibration or verification of measuring equipment where no international or national

measurement standards exist: e.g. Customer specification, corporate standards.( This is bit tricky

because for all the organization for which I have worked or consulted, I have never come across a

scenario where no national or international measurement was available.

2) Records of the results of calibration and verification shall be maintained:- Record of Measuring and

monitoring equipments, Calibration certificate.

3) Validity of the previous measuring results when the measuring equipment is found not to conform

to requirements

Evidence/ Implementation document Not mandatory but helps in fulfillment of requirement

Inspection equipment list

Calibration stickers

Equipment accuracy

Corrective action report

ISO 9001-CLAUSE 8.1

ISO 9001-CLAUSE 8 MEASUREMENT, ANALYSIS AND IMPROVEMENT

ISO 9001-CLAUSE 8.1 GENERAL


The organization shall plan and implement the monitoring, measurement, analysis and improvement

processes needed

a) to demonstrate conformity to product requirements,

b) to ensure conformity of the quality management system, and

c) to continually improve the effectiveness of the quality management system.




Page 77 of 100

This shall include determination of applicable methods, including statistical techniques, and the extent of

their use.

EXPLANATION

You must plan and implement processes that measure, analyze and improve the health of your QMS. The

focus of these processes must be on product and process conformity and improving QMS effectiveness.

Consider using a variety of methods including statistical techniques. In planning what to track and measure,

let us review the quality objectives we established and all of the performance indicators we established for

each of our QMS processes and activities. You must be careful not to overwhelm your organization with

objectives as this may cause more frustration than positive results. Start with objectives that focus on

meeting customer requirements and then slowly develop meaningful objectives for key processes and risk

prone processes, as initial targets are achieved. Planning of measurement and data analyses processes must

consider the methods and resources such as time, manpower, computer, software, statistical tool, etc.

needed to collect, organize and analyze product and QMS performance data. Measurement involves

physically measuring product characteristics or process parameters against acceptance criteria at predefined

intervals and sampling sizes, using predefined measurement devices. Measurement results may not always

be fully recorded. Use your organizations cross-functional knowledge of customer requirements, product,

technology, manufacturing processes, etc., to determine what statistical methods to use for each process

and to what extent to use them. Include these methods in your quality plan. Statistical methods to verify

product characteristics and process parameters include process capability studies, control charts, Pareto

analysis, and variation analysis.

Define and implement appropriate training and competency requirements for all personnel using statistical

methods, tools and analysis. Monitoring usually involves conducting ongoing periodic checks to determine

whether product characteristics or process parameters are within acceptable limits. The frequency of

monitoring may vary on the risk and reliability of product and processes. Monitoring is also useful in

determining the scope and frequency of product and process measurement. The results of monitoring may

or may not be recorded.

You must identify and document all processes addressing this clause as part of your QMS.

For these processes, you must also identify what specific documents, controls and resources are needed.

You could use a product quality plan, documented procedure or other combination of specific practices,

procedures, documents and methods. Look at the risks related to your product, processes and resources in

determining the extent of documented controls you need to have.

Performance indicators are not needed for this clause as it provides direction for the application of

monitoring and measurement methods and tools for all QMS processes. However the output of monitoring

and measurement methods used within each QMS process provides useful performance indicators for

determining the degree of conformity of product and QMS to requirements and whether the QMS has been

effectively implemented and maintained.

AUDIT CHECKLIST

It can be assessed by auditing the requirement of Clauses 8.2, 8.3, 8.4, 8.5

Are measurement & monitoring activities planned and implemented to demonstrate conformity of the

product

Are measurement & monitoring activities planned and implemented to ensure the conformity to QMS




Page 78 of 100

Are measurement & monitoring activities planned and implemented to continually improve the

effectiveness of the QMS

MANDATORY PROCEDURE

Not applicable

MANDATORY RECORD

Not applicable

EVIDENCE/ IMPLEMENTATION DOCUMENT

Not mandatory but helps in fulfillment of requirement;

Statistical methods to verify product characteristics and process parameters include – process capability

studies, control charts, Pareto analysis, variation analysis (special cause, common cause).

ISO 9001-CLAUSE 8.2

ISO 9001-CLAUSE 8.2 MONITORING AND MEASUREMENT

ISO 9001-CLAUSE 8.2.1 CUSTOMER SATISFACTION


As one of the measurements of the performance of the quality management system, the organization

shall monitor information relating to customer perception as to whether the organization has met

customer requirements. The methods for obtaining and using this information shall be determined.

NOTE Monitoring customer perception can include obtaining input from sources such as customer

satisfaction surveys, customer data on delivered product quality, user opinion surveys, lost business

analysis, compliments, warranty claims and dealer reports.

EXPLANATION

Customers are primarily the end users of your product, but also include intermediaries such as assembler

who may be internal or external and who integrate your product into theirs, and dealers and distributors

who market and sell your product or the integrated product. You need to consider feedback from all these

customers to determine whether or not you have met their specified and perceived requirements.

Customer requirements may relate to the design, manufacture, delivery, servicing and support of product,

QMS, communication and financial requirements, etc. you must have controls to identify and meet these

requirements Customer feedback or satisfaction is the first tool required by this standard to gauge the

health of your QMS. This clause requires you to gather and analyze information as to what extent you met

these requirements, from the customers perspective. What is the customer’s evaluation of your

performance with regard to their requirements?

You must continually gather information about these activities, in a manner capable of being analyzed

and evaluated to determine how well you performed them. There are all kinds of performance indicators

for design, manufacture, delivery, service and support, etc. Gather information on these indicators from

both the customer as well from internal processes. There are many ways to monitor customer satisfaction

feedback both positive as well as negative. These may include customer complaints, direct




Page 79 of 100

communications with customers, questionnaires and surveys, subcontracted collection and analysis of

performance data, reports from consumer organizations, and reports in various media, sector and industry

studies. You are expected to have a process that defines your customer satisfaction indicators, frequency

and method of data collection, summarization, review and evaluation of data, actions to improve,

timeline, responsibility and follow-up. Many customers routinely provide feedback on some or all of the

information indicated above. You must continuously review this customer feedback to ensure you

maintain and improve your customer satisfaction rating. You must monitor trends in customer satisfaction

indicators and use these as a baseline for continual improvement. You should consider both external as

well as internal customer satisfaction. Note that every internal process is either a customer or supplier of

another process. You must identify and document the process addressing this clause as part of your QMS.

For this process, you must also identify what specific documents, controls and resources are needed. You

could use a documented procedure or other combination of specific practices, procedures, documents and

methods. Look at the risks and benefits in determining the extent of documented controls you need to

have.

Performance indicators to measure the effectiveness of processes that control customer satisfaction may

include improvement in customer feedback ratings, reduction in customer complaints, increase in the

number of customers providing feedback, increase in feedback that leads to QMS and product

improvement opportunities.

ISO 9001-CLAUSE 8.2.2 INTERNAL AUDIT


The organization shall conduct internal audits at planned intervals to determine whether the

quality management system

a) conforms to the planned arrangements (see 7.1), to the requirements of this International Standard and

to the quality management system requirements established by the organization, and

b) is effectively implemented and maintained.

An audit programme shall be planned, taking into consideration the status and importance of the

processes and areas to be audited, as well as the results of previous audits. The audit criteria, scope,

frequency and methods shall be defined. The selection of auditors and conduct of audits shall ensure

objectivity and impartiality of the audit process. Auditors shall not audit their own work.

A documented procedure shall be established to define the responsibilities and requirements for planning

and conducting audits, establishing records and reporting results.

Records of the audits and their results shall be maintained (see 4.2.4).

The management responsible for the area being audited shall ensure that any necessary corrections

and corrective actions are taken without undue delay to eliminate detected nonconformities and their

causes.

Follow-up activities shall include the verification of the actions taken and the reporting of verification

results (see 8.5.2).

NOTE See ISO 19011 for guidance.




Page 80 of 100

EXPLANATION

Internal audit is the second important tool required by this standard used to gauge the health of your QMS.

How effective is it in meeting ISO 9001, your own QMS, customer and regulatory requirements. You must

have a documented procedure for your internal audit process.

The scope of your internal audit program must cover the:

Audit of product realization processes to determine conformity of both product and product realization

processes to customer and applicable regulatory requirements.

Audit of the QMS to determine conformity to the ISO 9001 standard.

Audit of the QMS to determine conformity to organizational requirements.

Audit of QMS processes and their interaction to determine if the QMS has been effectively implemented

and maintained.

In determining the time frame for your audit program, you should consider organization size, complexity

of product and processes, health of the QMS, customer, registrar and regulatory requirements, etc. The

most common time frame is six months.

Consider adjusting the audit frequency and perhaps even the audit scope, of specific processes or group of

processes, when:

You experience internal or external nonconformities.

Get customer complaints.

Have critical or high risk processes.

Have frequent or significant changes to processes and product.

Your internal audit program should consider the following:

Input from audited area and related areas

Key customer oriented processes

Process and product performance results and expectations

Opportunities for continual improvement

Feedback from customers

Audit criteria, refers to the specific QMS policies, objectives, ISO requirements, documentation, customer

and regulatory requirements, etc., that the audit is referenced to or conducted against. Audit criteria may

relate to the whole audit program as well as each individual audit.

Audit methods refer to the specific techniques that auditors use to gather objective audit evidence that can

be evaluated to determine conformity to audit criteria. Examples of audit methods include interview of

personnel, observation of activities, review of documents and records, etc.

You must define the minimum qualification requirements for internal auditors. These requirements

include knowledge of QMS processes and their interaction, related QMS controls, customer requirements,

applicable regulatory requirements, the ISO 9001 standard, the audit process and audit techniques.

Internal auditors needs to be trained in the ISO 9001 standard as they generally audit for conformity to

organizational requirements and also for conformity to ISO 9001 REQUIREMENTs. Additionally, the




Page 81 of 100

ISO 19011:2002 Guidelines for quality and environmental auditing says that auditors should have

knowledge of quality management system standards and their application to the organization.

You must have appropriate resources for your annual audit program. These include having sufficient

trained auditors available to conduct scheduled audits, sufficient time to perform audits, availability of

department or process personnel to be audited, time and tools to prepare audit records and reports, etc.

Auditor should be Independence. During the audit Auditors should ensure that the objectivity and

impartiality of the audit is not compromised. Auditors cannot audit their own work. Auditor independence

must be ensured when assigning personnel to specific audits.

Process owners must take timely corrective action on nonconformities found in their area. They should

use the corrective action procedure to determine root cause, take appropriate action and follow-up to

determine if results indicate that the root cause has been eliminated. Audit results must be summarized

and reported for management review. The Management Representative must also report any opportunities

for QMS improvement. The MR must analyze the results of each audit as well as the annual audit

program to determine strengths and weaknesses in QMS processes, interactions, functions, products, etc.,

to identify and prioritize opportunities for improvement. Audit records include annual audit schedule,

audit planning such as criteria, scope, frequency, methods, auditor selection and assignment, etc., auditor

competence and training, audit checklists and forms, audit notes and other evidence gathered, audit

findings, nonconformity reports, audit reports, corrective actions and follow-up of internal audit

nonconformities, analysis of audit program performance indicators and trends, and identified

improvement opportunities.

Performance indicators should be used to measure the effectiveness of your internal audit process and

monitor trends in these indicators, to continually improve your audit program. Performance indicators

may include reducing the number of – late or delayed audits, incomplete audits, incomplete audit records

and late reports, auditor errors, auditee complaints, and use of untrained auditors, etc.

The output of your internal audit program may be used as performance indicators to:

Determine the degree of conformity of the QMS to ISO 9001, customer and regulatory requirements.

Determine the effectiveness of QMS implementation and maintenance.

Determine the degree of conformity of product to contractual and regulatory requirements.

Identify areas of the QMS that need improvement.

ISO 9001-CLAUSE 8.2.3 MONITORING AND MEASUREMENT OF

PROCESSES


The organization shall apply suitable methods for monitoring and, where applicable, measurement of the

quality management system processes. These methods shall demonstrate the ability of the processes to

achieve planned results. When planned results are not achieved, correction and corrective action shall be

taken, as appropriate.

NOTE When determining suitable methods, it is advisable that the organization consider the type and

extent of monitoring or measurement appropriate to each of its processes in relation to their impact on the

conformity to product requirements and on the effectiveness of the quality management system.




Page 82 of 100

EXPLANATION

You must establish methods and indicators to monitor and measure your QMS processes to demonstrate

process capability to achieve planned results and identify opportunities to improve the process. Use your

organizations cross-functional knowledge of customer requirements, product, technology, manufacturing

processes, etc., to determine process monitoring and measuring indicators and controls. Monitoring and

measurement may be done manually or by automated means. Another way to identify useful methods and

indicators is to review what problems could occur or have occurred within a particular process. Monitor

and measure these occurrences and develop process controls to reduce or eliminate them. Problems or

risks can occur with any of the variables in a process for e.g. materials, equipment, facility, methods,

technology, personnel, computer hardware or software, etc. By using fishbone analysis or similar tools,

you can develop very useful monitoring and measuring methods and process performance indicators.

Correction refers to action taken to eliminate a detected nonconformity, i.e. the symptom. Correction

involves the containment, evaluation of the nonconformity and action that may result in rework, re-grade,

and scrap, return of nonconforming material/work to supplier or outsourcer, or acceptance through a

customer concession or deviation permit. Correction differs from corrective action. Corrective action is

action taken to eliminate the cause of a detected nonconformity to prevent recurrence, whereas correction

does not address cause. Managers or personnel responsible for corrective action must be promptly

informed of product and process nonconformities.

You must monitor your processes:

First to determine and establish capability of new processes to conform to requirements.

And secondly, to monitor these processes over time to verify ongoing stability and capability to meet

requirements.

And thirdly to determine and achieve levels of continual improvement

To achieve planned results, control methods used for monitoring and measurement should focus on

achieving the performance indicators we have identified for each QMS process. The monitoring and

measurement techniques, sampling plans, acceptance criteria may be documented or referenced in your

quality plan, or you could use a combination of specific practices, procedures, documents and methods.

Look at the risks and benefits in determining the extent of documented controls you need to

have. Performance indicators are not needed for this clause as it provides direction for the application of

monitoring and measurement performance indicators for all QMS processes. However the output of

monitoring and measurement methods used within each QMS process provides useful performance

indicators for determining the effective implementation and maintenance of QMS processes.

ISO 9001-CLAUSE 8.2.4 MONITORING AND MEASUREMENT OF

PRODUCT


The organization shall monitor and measure the characteristics of the product to verify that

product requirements have been met. This shall be carried out at appropriate stages of the product

realization process in accordance with the planned arrangements (see 7.1). Evidence of conformity with

the acceptance criteria shall be maintained.

Records shall indicate the person(s) authorizing release of product for delivery to the customer (see 4.2.4).




Page 83 of 100

The release of product and delivery of service to the customer shall not proceed until the planned

arrangements (see 7.1) have been satisfactorily completed, unless otherwise approved by a relevant

authority and, where applicable, by the customer.

EXPLANATION

You must identify, monitor and measure product characteristics to verify conformity to requirements.

Product characteristics may be dimensional, functional, performance, reliability, durability,

maintainability, life, cost, etc. Requirements may come from your customer, your own organization,

regulatory and industry sources. You must plan what product characteristic(s) to measure, type of

measurements, what measurement device to use, how often to measure, sample size, acceptance criteria,

and records needed for each product or product type. Use your product quality plan to document these

controls.

Your product, project or contract quality plan must define the stages at which various monitoring and

measurement will be carried out at incoming receipt of materials from suppliers or outsourced work,

storage, internal production processes, finished product, packaging, at time of shipping, and post

installation. Monitoring and measurement may be done by your personnel, subcontracted or outsourced

labor or by the customer. You must ensure that all personnel performing monitoring and measurement of

product are trained and competent.

If you plan on releasing during any stage of production or shipping finished product, where all planned

inspections and measurements to that stage have not been completed, ensure that you obtain prior written

approval/waiver from a relevant internal authority or the customer. Where practical, consider completing

all missed planned inspections and measurements before product delivery. You must identify and

document all product realization processes that may address this clause, as part of your QMS, e.g.

receiving, production, shipping, etc. For such processes, you must also identify what specific documents

are needed for effective planning, operation and control.

You could use a product quality plan, documented procedure or other combination of specific practices,

procedures, documents and methods. Look at the risks related to your product, processes and resources in

determining the extent of documented controls you need to have. Performance indicators to measure

product conformity may include reduction in defect rates, PPM’s (defective parts per million), scrap rates,

waste, rework, improvement in on time delivery, product returns from customer, etc. Performance

indicators to measure the effectiveness of product realization processes in achieving product conformity

include productivity, reduction of cycle time, errors, omissions and failures, etc.

AUDIT CHECKLIST

For Clause 8.2.1:

Are both a proactive and reactive approach used to obtain Customer feedback?

How is feedback obtained from Customers? What is the structure/format that is used? Does it provide

information on how Customers perceive the organization’s performance?

Is more than one method or technique employed?

How often each method is used (frequency)?

How is this information communicated internally?

How is this information used to uncover ways to improve?




Page 84 of 100

For Clause 8.2.2:

Is there a procedure in place for auditing? Does it cover the requirements in ISO 9001 and ISO

19011? How is the audit schedule prepared/approved each year? What approach was used to audit a

process based system?

How were individual processes audited? Was a process auditing technique used? How was this done?

How is effectiveness of the QMS assessed/verified?

What were the results from last Internal/External audits? Were corrective actions implemented? For those

that are closed, how was cause investigated? How were they followed up on and verified?

Any audit findings still open/unresolved? Why?

How are Auditors trained? How is independence of Auditors ensured? How are resource needs identified

and provided, for all areas of the quality management system? Is there only one way to get resources?

For Clause 8.2.3:

Are all identified processes being monitored and measured? Are both product and service processes

covered?

How is monitoring and measurement being done? Are same approach used for each process?

How often is the data collected? Who looks at it? How is it analysed?

Are process targets defined? Do they link to higher level objectives? How is this communicated?

What are the results showing? If process performance is below targets, what actions are taken? Who

decides? Who takes the action?

Did the actions taken work? How do you know they worked? Are there any repeat problems occurring

in the process? How does the organization identify a need to add to the current infrastructure? (i.e. new

buildings or additions, new or replacement process hardware or software, enhanced support services such

as new or upgraded information technology)

For Clause 8.2.4:

Is there a procedure or program or plan in place to monitor and measure the product/service being supplied

to the Customer?

Has the entire plan or procedure been followed? (Check product examples as well as service examples)

Is it consistent in all cases? Is the same approach used for each product or service?

Will the monitoring and measurement methods show whether the product/service has met Customer

requirements?

How often is the data collected? Who looks at it? How is it analysed?

Are there targets defined? How is this communicated?

What are the results showing? If performance is below targets, what actions are taken? Who decides?

Who takes the action?

Did the actions taken work? How do you know they worked? Are there any repeat problems occurring?




Page 85 of 100

MANDATORY PROCEDURE

For Clause 8.2.2: Procedure for Internal audit

MANDATORY RECORD


For Clause 8.2.2: Internal audit report


For Clause 8.2.4: Product acceptance/release report

EVIDENCE/ IMPLEMENTATION DOCUMENT


For Clause 8.2.1:

Customer satisfaction survey

Customer complaints

Analysis of lost business

Warranty claims

Phone in log

Customer satisfaction (feedback) is the first tool.

Customer complaints, direct communications with customers, questionnaires and surveys,

subcontracted collection and analysis of performance data , reports from consumer organizations,

reports in various media, sector and industry studies

For Clause 8.2.2:

Annual audit schedule

Audit findings record

Training records


Audit records include – annual audit schedule, audit planning- (criteria, scope, frequency, methods,

auditor selection and assignment, etc), auditor competence and training, audit checklists and forms,

audit notes and other evidence gathered, audit findings, nonconformity reports, audit reports,

corrective actions and follow-up of internal audit nonconformities, analysis of audit program

performance indicators and trends, and identified improvement opportunities.

For Clause 8.2.3:

Check lists

Process input / output flow

Control charts

fish-bone analysis

Monitoring of Quality objectives

For Clause 8.2.4:

Product acceptance criteria




Page 86 of 100

Drawing inspection

Final release checklist

Sample audit

ISO 9001-CLAUSE 8.3

ISO 9001-CLAUSE 8.3 CONTROL OF NONCONFORMING PRODUCT


The organization shall ensure that product which does not conform to product requirements is identified

and controlled to prevent its unintended use or delivery. A documented procedure shall be established to

define the controls and related responsibilities and authorities for dealing with nonconforming product.

Where applicable, the organization shall deal with nonconforming product by one or more of the

following ways:

a) by taking action to eliminate the detected nonconformity;

b) by authorizing its use, release or acceptance under concession by a relevant authority and,

where applicable, by the customer;

c) by taking action to preclude its original intended use or application;

d) by taking action appropriate to the effects, or potential effects, of the nonconformity when

nonconforming product is detected after delivery or use has started.

When nonconforming product is corrected it shall be subject to re-verification to demonstrate conformity

to the requirements.

Records of the nature of nonconformities and any subsequent actions taken, including concessions

obtained, shall be maintained (see 4.2.4).

EXPLANATION

ISO 9001-Clause 8.3 defines Nonconforming product as product that does not conform to customer

requirements, applicable regulatory requirements or your own organization requirements. The definition

may also apply to nonconforming processes and services. Nonconformities may relate to suppliers and

outsourced work, your own organizational activities or product shipped to customers. Your documented

procedure for nonconforming product must include controls and responsibilities to identify, contain i.e.

prevent further processing or use, keep records of the nature and other details of the nonconformity, notify

appropriate personnel and customer, where appropriate, evaluate what disposition action needs to be

taken, carry out timely disposition, determine policies for release for further processing or shipment to the

customer, obtain customer concessions, rework and re-verification, establish performance indicators to

measure the effectiveness of the control of nonconformance process, etc.

Product or material found with no identification or its quality status is not known, should be treated as

nonconforming product and controlled by the above procedure. If you find that nonconforming product

has been shipped, without a customer concession, you must take appropriate action to reduce the

immediate and consequential effect of the nonconformity. Depending upon the seriousness and scope of

the nonconformity, you might consider taking action to eliminate the nonconformity as well as corrective




Page 87 of 100

action to eliminate the root causes of the nonconformity. While there may be no requirement to notify the

customer, it might be appropriate in specific circumstances to notify the customer and resolve the

situation to your customer’s satisfaction. A similar rationale may be applied where product has been

shipped that does not meet regulatory requirements. Depending upon the seriousness and scope of the

nonconformity, you might consider taking action to eliminate the nonconformity as well as corrective

action to eliminate the root causes of the nonconformity. You need to be aware of any reporting

requirements imposed by regulatory bodies and comply with them.

A concession authorization allows you to ship nonconforming product, under controlled conditions. A

deviation authorization allows you to manufacture product different from the original specification, under

controlled conditions. In both these situations, make sure that you obtain these authorizations in writing

prior to shipping or manufacturing nonconforming product. All product realization processes must show

the interaction with your process for nonconforming product. Performance indicators to measure the

effectiveness of control of nonconforming product may include reduction in cycle time to evaluate and

dispose of nonconforming product, reduced errors in preventing unintended use or delivery, improved

alternate use of nonconforming product and cost recovery, etc.

AUDIT CHECKLIST

Is there a procedure in place to control nonconformances?

What makes a Product/Service nonconforming?

Is a record kept when a product/service nonconformance occurs?

Who initiates the record? Who decides how to resolve nonconformances?

Do you currently have any unresolved nonconforming products/services?

If a nonconforming product is reworked, is it re-checked? How is this done for nonconforming services?

Who has the authority to decide if a nonconformance can be left as is? Has this ever occurred?

Were there any situations in the last 12 months where nonconforming product or service was discovered

after delivery?

Over the past 12 months have there been any returns from Customers (or credits issued)? Any of them

due to a nonconformance? How were they handled?

MANDATORY PROCEDURE

Procedure for control of non-conforming Product

MANDATORY RECORD

Nature of the product nonconformities and any subsequent actions taken, including concessions

obtained for e.g. Non Conformance Record, Concession Record

IMPLEMENTATION DOCUMENT


Non-conforming tags

Segregated hold areas




Page 88 of 100

Non-conforming material report

Disposition (what we do with it)


ISO 9001-CLAUSE 8.4 & CLAUSE 8.5

ISO 9001-CLAUSE 8.4 & CLAUSE 8.5

CLAUSE 8.4 ANALYSIS OF DATA


The organization shall determine, collect and analyze appropriate data to demonstrate the suitability

and effectiveness of the quality management system and to evaluate where continual improvement of

the effectiveness of the quality management system can be made. This shall include data generated as a

result of monitoring and measurement and from other relevant sources.

The analysis of data shall provide information relating to

a) customer satisfaction (see 8.2.1),

b) conformity to product requirements (see 8.2.4),

c) characteristics and trends of processes and products, including opportunities for preventive action (see

8.2.3 and 8.2.4), and

d) suppliers (see 7.4).

EXPLANATION

You must collect and analyze QMS data that relate to the effectiveness and efficiency of products,

services, QMS processes, production output, supplier performance, use of resources, cost of poor quality,

customer satisfaction, etc. Do year over year trend analysis to determine longer-term progress, identify

opportunities for further improvement or prioritize correction action for negative trends. Many

organizations have wonderful systems for collecting data, but do a poor job in sorting, summarizing and

presenting this data for decision-making. You must sort and summarize the data you collect into things

gone right and things gone wrong and present them separately. Management can then focus on continual

improvement of things gone right and take corrective action on things gone wrong. Your process for data

collection and analysis must address the type of data to be collected, how it should be sorted and

classified, use of appropriate information systems and data gathering tools and techniques, assignment of

responsibility and authority to review and act, competency and training in use of tools and data analysis,

that the data is gathered, analyzed and acted upon on a timely basis.

A summary of QMS performance data must be included in your periodic management review. Compare

trends in quality and operational performance against your business plans, competitors and industry

benchmarks, where practical. Focus on key customer-related trends to prioritize prompt solutions to

problems, to determine longer-term planning for performance improvement, and to enhance customer

satisfaction. Performance indicators to measure the effectiveness of processes for data collection and




Page 89 of 100

analysis may include reduction in cycle time to gather and evaluate data, reduction in inaccurate and

incomplete data, increase in improvement opportunities obtained from data analysis, etc.

CLAUSE 8.5 IMPROVEMENT

8.5.1 CONTINUAL IMPROVEMENT


The organization shall continually improve the effectiveness of the quality management system through the

use of the quality policy, quality objectives, audit results, analysis of data, corrective and preventive actions

and management review.

EXPLANATION

The focus of this clause is on continual improvement of the QMS and not on product. Continual

improvement of product is addressed in clause 5.6.3b. & 7.1a. Continual improvement is defined as a

recurring activity to increase the ability to fulfill requirements. The ‘ability to fulfill requirements’ refers

to both conforming as well as nonconforming products/processes. Conforming processes can be further

improved, and nonconforming processes must be improved by taking corrective action to prevent

recurrence. Recurring activity refers to the quality improvements includes quality policy and objectives,

audit results, analyses of data, etc. The continual improvement process can be conducted by:

Significant breakthrough projects that either revise or improve existing processes or lead to new processes.

These are usually done by cross-functional teams outside routine operations (Business Process Re-

engineering).

Small-step ongoing improvement activities conducted by personnel within existing processes (Kaizen

Events).

Use of continual improvement tools includes:

Quality Policy – If you recall clause 5.1 required top management to establish the quality policy and

clause 5.3.e required them to review it for continuing suitability. Changes in product, customer base,

organization ownership, management, technology, QMS standards, etc., may require changes to your

quality policy and objectives. As a tool for continual improvement, it requires top management to review

and understand these changes, make changes, if necessary, to the quality policy and objectives and use

these changes to continue further improvement of the QMS and customer satisfaction.

Audit Results – Results of product, process and QMS audits usually provide many opportunities to

improve QMS effectiveness and efficiency. Opportunities may relate to communications, information

systems, processes, controls, use of resources, technology, etc. The management representative must

report these opportunities to top management as included as part of the management review agenda. They

can also be reported and reviewed at regular operational meetings, etc.

Other Audits – Besides product, process and QMS audits, you might find it very productive to conduct

financial, health and safety, environmental, technology, product profitability, social responsibility,

information and communication systems audits.




Page 90 of 100

In using ‘analyses of data’ as a tool for continual improvement, use the things gone right and things gone

wrong approach to classify your data for decision-making.

Examples of situations which might lead to improvement projects include: machine set-up, die change,

machine changeover times, cycle time, scrap, non-value-added use of floor space, variation in process

parameters, less than 100% first run capability, process averages not centered on target values, testing

requirements not justified by accumulated results, waste of labor and materials, difficult manufacture,

assembly and installation of product, excessive handling and storage, etc.

Useful tools that are often used to continually improve, include: capability studies, design of experiments,

risk analysis, SPC, supplier evaluation, test and measurement technology, theory of constraints, overall

equipment effectiveness, technology, benchmarking, analysis of motion/ergonomics and error-proofing.

Ensure that personnel applying these tools are competent and trained. Performance indicators to measure

the effectiveness of the continual improvement process may include quality objectives being met sooner

than planned, achieving and exceeding business and quality objectives, improved efficiency in use of

resources, cost reduction, improved product quality, etc.

8.5.2 CORRECTIVE ACTION


The organization shall take action to eliminate the causes of nonconformities in order to prevent

recurrence. Corrective actions shall be appropriate to the effects of the nonconformities encountered. A

documented procedure shall be established to define requirements for

a) reviewing nonconformities (including customer complaints),

b) determining the causes of nonconformities,

c) evaluating the need for action to ensure that nonconformities do not recur,

d) determining and implementing action needed,

e) records of the results of action taken (see 4.2.4), and

f) reviewing the effectiveness of the corrective action taken.

EXPLANATION

Corrective action is action taken to eliminate the cause of a detected nonconformity to prevent recurrence,

whereas preventive action is action taken to eliminate the cause of a potential nonconformity or other

undesirable situation, to prevent occurrence.

You must have a documented procedure for your corrective action process which must address the

following control requirements:

Identify detected nonconformities that relate to your products, QMS processes, resources, suppliers and

outsourced work, product shipped to customers, customer complaints, cost of quality reports, and things

gone wrong reports.

Define your process for identifying nonconformities and consider using appropriate problem-solving

tools to determine the underlying root cause(s) of the nonconformity




Page 91 of 100

Problem-solving tools may include analysis of failure mode, capability studies, correlation diagrams,

data collection, fishbone diagram (Ishikawa diagram), histograms, Pareto analysis, probability charts,

stratification of data, graphic representations, etc. Ensure that personnel applying these tools are

competent and trained.

Actions taken to eliminate the cause of nonconformity must flow from your problem-solving activity.

Actions may involve changes to product, process, resources, documentation, controls, etc. or any

combination of these. Conduct follow-up tests to determine whether these actions have indeed eliminated

the cause(s) of the nonconformity and prevented recurrence. You must keep appropriate records of these

actions and follow-up activities. You must monitor your corrective action records on an ongoing basis, for

any recurrence of the nonconformity you took corrective action on. If you found that the problem has

occurred again, then perhaps your analysis of root cause may have been incorrect or incomplete. Keep

appropriate records of all corrective action steps. Ensure timely completion of any open corrective action

or be prepared to provide evidence to justify its continued open status. Make your corrective action records

available on request to customers and provide a summary report for management review. All

nonconformities may not necessarily result in corrective action. Evaluate the significance of

nonconformities in terms of their impact on operating costs, cost of nonconformity and its correction,

product performance, safety, dependability, regulatory requirements, effect on customer’s product and

processes, any other risks, and customer satisfaction. Consider using cross-functional teams in such

decision-making, including the involvement of your organizations designated customer representative.

Performance indicators to measure the effectiveness of the corrective action process may include reduction

in – cycle time for correction actions, problem re-occurrence, open corrective actions, costs, and

improvement in QMS productivity.

8.5.3 PREVENTIVE ACTION


The organization shall determine action to eliminate the causes of potential nonconformities in order to

prevent their occurrence. Preventive actions shall be appropriate to the effects of the potential problems.

A documented procedure shall be established to define requirements for

a) determining potential nonconformities and their causes,

b) evaluating the need for action to prevent occurrence of nonconformities,

c) determining and implementing action needed,

d) records of results of action taken (see 4.2.4), and

e) reviewing the effectiveness of the preventive action taken.

EXPLANATION

Corrective action is action taken to eliminate the cause of a detected nonconformity to prevent recurrence,

whereas preventive action is action taken to eliminate the cause of a potential nonconformity or other

undesirable situation, to prevent occurrence. Sources of information for finding potential QMS

nonconformities include analyses of data, audit results, cost of quality reports, quality records, service

reports, supplier performance, customer satisfaction feedback, management review records, and lessons

learned from past experience, SPC charts and analyses.




Page 92 of 100

You must have a documented procedure for your preventive action process which must address basically

all of the EXPLANATION points and tips covered under the corrective action process. While preventing

potential quality related QMS nonconformities is our focus, it might be very useful to think of preventive

action in a wider context, i.e. the entire business. Think in terms of actions needed to prevent loss of market

share, loss of product profitability, loss due to lack of product diversity, loss of business opportunities due

to lack of capacity, inadequate or older facilities, inadequate or inefficient production equipment,

technology or information systems, loss of key or competent personnel, inadequate business financing,

inadequate staffing, etc. These issues may have far more serious consequences than QMS issues. Consider

a process that involves developing a business plan based on gathering relevant research data on these issues,

use of appropriate risk evaluation and management methods, developing proactive strategies and action,

monitoring and reviewing performance against the business plan. This would constitute the ultimate

preventive action process. Preventive action also includes applying successful corrective action solutions

to other similar products, processes and sites where there may be the potential for the same nonconformity

to occur. Use error-proofing methods across similar products, processes and sites, wherever cost effective

and feasible, to prevent recurrence or avoid occurrence of nonconformity. Performance indicators to

measure the effectiveness of the preventive action process may include reduction in – cycle time for

correction actions, problem re-occurrence, open corrective actions, costs, and improvement in QMS

productivity.

AUDIT CHECKLIST

For Clause 8.4:

What data is collected and how is it done? How is it analysed?

What analysis techniques are used and who decides which to use? How often each method is used

(frequency)?

How often is data analysis done? Who does it?

Is analysis done on: Customer Satisfaction data? Product and Service monitoring and measurement

results? Process/Product/Service trend results? Supplier performance data?

How reliable are the sources of data that are used for the analysis?

Were any actions taken as a result of the analysis? How is feedback obtained from Customers? What is

the structure/format that is used? Does it provide information on how Customers perceive the

organization’s performance?

For Clause 8.5:

Is there any evidence of business performance improvement within the past 12 months?

Is there any evidence of product/service quality improvement within the past 12 months?

Is there any evidence of quality management system improvement within the past 12 months?

What can initiate a Corrective Action (CAR)? How many CAR’s were issued in the last 12 months? How

many were closed (make sure to review how investigation of the causes was done)? How many are still

open (for how long, why are they still open)?




Page 93 of 100

What can initiate a Preventive Action (PAR)? How many PAR’s were issued in the last 12 months? How

many were closed ( make sure to review how investigation of the causes was done )? How many are still

open (for how long, why are they still open)?

MANDATORY PROCEDURE

For Clause 8.5.2: Procedure for Corrective action

For Clause 8.5.3: Procedure for Preventive action

MANDATORY RECORD

For Clause 8.4 : Not applicable

For Clause 8.5.1 : Not applicable

For Clause 8.5.2 : Corrective Action Report

For Clause 8.5.3 : Preventive Action Report

EVIDENCE/IMPLEMENTATION DOCUMENT


For Clause 8.4:

Customer surveys

Non-conformance reports

Supplier evaluation

Internal audits

Trends

For Clause 8.5:

Continual Improvement Register




Page 94 of 100

SECTION II DOCUMENTATION REQUIREMENTS OF ISO 9001:2008




Page 95 of 100

INTRODUCTION TO DOCUMENTATION REQUIREMENTS OF ISO 9001:

2008

Two of the most important objectives of the ISO 9000:2008 standards have been to develop a simplified

set of standards that will be equally applicable to small as well as medium and large organizations, and for

the amount and detail of documentation required to be more relevant to the desired results of the

organization’s process activities.

ISO 9001:2008 Quality management systems – Requirements has achieved these objectives, and the

purpose of this additional guidance is to explain the intent of the new standard with specific regard to

documentation. ISO 9001:2008 allows organization flexibility in the way it chooses to document its quality

management system (QMS). This enables each individual organization to develop the minimum amount of

documentation needed in order to demonstrate the effective planning, operation and control of its processes

and the implementation and continual improvement of the effectiveness of its QMS. It is stressed that ISO

9001 requires and always has required a “Documented quality management system”, and not a “system of

documents”.

WHAT IS A “DOCUMENT” ?

The following are some of the main objectives of an organization’s documentation, independent of whether

or not it has implemented a formal QMS.

Communication of Information: as a tool for information transmission and communication. The type

and extent of the documentation will depend on the nature of the organization’s products and processes,

the degree of formality of communication systems and the level of communication skills within the

organization, and the organizational culture.

Evidence of conformity: provision of evidence that what was planned, has actually been done.

Knowledge sharing: to disseminate and preserve the organization’s experiences. A typical example

would be a technical specification, which can be used as a base for design and development of a new

product.

It must be stressed that, according to ISO 9001:2008 clause 4.2Documentation requirements documents

may be in any form or type of medium, and the definition of “document” in ISO 9000:2005clause

3.7.2 gives the following examples:

Paper

Magnetic

Electronic or optical computer disc

Photograph

Master sample




Page 96 of 100

DOCUMENTATION REQUIREMENTS OF ISO 9001:2008

ISO 9001:2008 clause 4.1 give the documentation requirements of ISO 9001:2008. General requirements

requires an organization to “establish, document, implement, and maintain a quality management system

and continually improve its effectiveness in accordance with the requirements of this International

Standard”

Clause 4.2.1 General explains that the quality management system documentation shall include:

documented statements of a quality policy and quality objectives;

a quality manual

documented procedures required by this International Standard

documents needed by the organization to ensure the effective planning, operation and control of its

processes, and

records required by this International Standard;

The notes after Clause 4.2 make it clear that where the standard specifically requires a “documented

procedure”, the procedure has to be established, documented, implemented and maintained. It also

emphasizes that the extent of the QMS documentation may differ from one organization to another due to:

the size of organization and type of activities;

the complexity of processes and their interactions, and

the competence of personnel.

All the documents that form part of the QMS have to be controlled in accordance with clause 4.2.3 of ISO

9001:2008, or, for the particular case of records, according to clause 4.2.4.

GUIDANCE ON CLAUSE 4.2 OF ISO 9001:2008

The following comments are intended to assist users of ISO 9001:2008 in understanding the intent of the

general documentation requirements of the International Standard.

DOCUMENTED STATEMENTS OF A QUALITY POLICY AND QUALITY OBJECTIVES:

Requirements for the quality policy are defined in clause 5.3 of ISO 9001:2008. The

documented quality policy has to be controlled according to the requirements of clause 4.2.3.

Note Organizations that are revising their quality policy for the first time, or in order to meet the

amended requirements in ISO 9001:2008, should pay particular attention to clause 4.2.3 (c), (d) and (g).

Requirements for quality objectives are defined in clause 5.4.1 of ISO 9001:2008. These

documented quality objectives are also subject to the document control requirements of clause 4.2.3.

QUALITY MANUAL:

Clause 4.2.2 of ISO 9001:2008 specifies the minimum content for a quality manual. The format and

structure of the manual is a decision for each organization, and will depend on the organization’s size,

culture and complexity. Some organizations may choose to use the quality manual for other purposes

besides that of simply documenting the QMS




Page 97 of 100

A small organization may find it appropriate to include the description of its entire QMS within a single

manual, including all the documented procedures required by the standard.

Large, multi-national organizations may need several manuals at the global, national or regional level,

and a more complex hierarchy of documentation.

The quality manual is a document that has to be controlled in accordance with the requirements of clause

4.2.3.

Documented procedures :

ISO 9001:2008 specifically requires the organization to have “documented procedures” for the following

six activities:

CLAUSE 4.2.3 CONTROL OF DOCUMENTS

CLAUSE 4.2.4 CONTROL OF RECORDS

CLAUSE 8.2.2 INTERNAL AUDIT

CLAUSE 8.3 CONTROL OF NONCONFORMING PRODUCT

CLAUSE 8.5.2 CORRECTIVE ACTION

CLAUSE 8.5.3 PREVENTIVE ACTION

These documented procedures have to be controlled in accordance with the requirements of clause 4.2.3

Some organizations may find it convenient to combine the procedure for several activities into a single

documented procedure (for example, corrective action and preventive action). Others may choose to

document a given activity by using more than one documented procedure (for example, internal audits).

Both are acceptable.

Some organizations (particularly larger organizations, or those with more complex processes) may require

additional documented procedures (particularly those relating to product realization processes) to

implement an effective QMS.

Other organizations may require additional procedures, but the size and/or culture of the organization

could enable these to be effectively implemented without necessarily being documented. However, in

order to demonstrate compliance with ISO 9001:2008, the organization has to be able to provide objective

evidence (not necessarily documented) that its QMS has been effectively implemented.

Documents needed by the organization to ensure the effective planning, operation and control of its

processes:

In order for an organization to demonstrate the effective implementation of its QMS, it may be necessary

to develop documents other than documented procedures. However, the only documents specifically

mentioned in ISO 9001:2008 are:

Quality policy (clause 4.2.1.a)

Quality objectives (clause 4.2.1.a)

Quality manual (clause 4.2.1.b)

There are several requirements of ISO 9001:2008 where an organization could add value to its QMS and

demonstrate conformity by the preparation of other documents, even though the standard does not

specifically require them. Examples may include:




Page 98 of 100

Process maps, process flow charts and/or process descriptions

Organization charts

Specifications

Work Instruction

Documents containing internal communications

Production schedules

Approved supplier lists

Test and inspection plans

Quality plans/Project plan/ process plan

All such documents have to be controlled in accordance with the requirements of clause

4.2.3 and/or clause 4.2.4, as applicable

Records:

Examples of records specifically required by ISO 9001:2008 are presented in Table below

Organizations are free to develop other records that may be needed to demonstrate conformity of their

processes, products and quality management system.

Requirements for the control of records are different from those for other documents, and all records have

to be controlled according to those of clause 4.2.4 of ISO 9001:2008.

Records required by ISO 9001:2008

Clause Record required

Clause 5.6.1 Management reviews

Clause 6.2.2 e) Education, training, skills and experience

Clause 7.1 d) Evidence that the realization processes and resulting product fulfil

requirement

Clause 7.2.2 Results of the review of requirements related to the product and

actions arising from the review

Clause 7.3.2 Design and development inputs relating to product requirements

Clause 7.3.4 Results of design and development reviews and any necessary

actions

Clause 7.3.5 Results of design and development verification and any necessary

actions

Clause 7.3.6 Results of design and development validation and any necessary

actions




Page 99 of 100

Clause 7.3.7 Results of the review of design and development changes and any

necessary actions

Clause 7.4.1 Results of supplier evaluations and any necessary actions arising

from the evaluations

Clause 7.5.2 d)

As required by the organization to demonstrate the validation of

processes where the resulting output cannot be verified by

subsequent monitoring or measurement

Clause 7.5.3 The unique identification of the product, where traceability is a

requirement

Clause 7.5.4 Customer property that is lost, damaged or otherwise found to be

unsuitable for use

Clause 7.6 a) Basis used for calibration or verification of measuring equipment

where no international or national measurement standards exist

Clause 7.6 Validity of the previous measuring results when the measuring

equipment is found not to conform to requirements

Clause 7.6 Results of calibration and verification of measuring equipment

Clause 8.2.2 Internal audit results and follow-up actions

Clause 8.2.4 Indication of the person(s) authorizing release of product.

Clause 8.3 Nature of the product nonconformities and any subsequent actions

taken, including concessions obtained

Clause 8.5.2 e) Results of corrective action

Clause 8.5.3 d) Results of preventive action

ORGANIZATIONS PREPARING TO IMPLEMENT A QMS

For organizations that are in the process of implementing a QMS, and wish to meet the documentation

requirements of ISO 9001:2008, the following comments may be useful.

For organizations that are in the process of implementing or have yet to implement a QMS, ISO 9001:2008

emphasizes a process approach. This includes:

determining the processes necessary for the effective implementation of the quality management

system

determining the interactions between these processes.




Page 100 of 100

documenting the processes to the extent necessary to assure their effective operation and control.

(It may be appropriate to document the processes using process maps. It is emphasized, however,

that documented process maps are not a requirement of ISO 9001:2008.)

These processes include the management, resource, product realization and measurement processes that

are relevant to the effective operation of the QMS.

Analysis of the processes should be the driving force for defining the amount of documentation needed

for the quality management system, taking into account the requirements of ISO 9001:2008. It should not

be the documentation that drives the processes.

ORGANIZATIONS WISHING TO ADAPT AN EXISTING QMS

For organizations that currently have a QMS the following comments are intended to assist in understanding

the changes to documentation that may be required or facilitated by the transition to ISO 9001:2008

An organization with an existing QMS should not need to rewrite all of its documentation in order to meet

the requirements of ISO 9001:2008. This is particularly true if an organization has structured its QMS

based on the way it effectively operates, using a process approach. In this case, the existing documentation

may be adequate and can be simply referenced in the revised quality manual.

An organization that has not used a process approach in the past will need to pay particular attention to

the definition of its processes, their sequence and interaction.

An organization may be able to carry out some simplification and/or consolidation of existing documents,

in order to simplify its QMS.

DEMONSTRATING CONFORMITY WITH ISO 9001:2008

For organizations wishing to demonstrate conformity with the requirements of ISO 9001:2008, for the

purposes of certification/registration, contractual, or other reasons, it is important to remember the need to

provide evidence of the effective implementation of the QMS.

Organizations may be able to demonstrate conformity without the need for extensive documentation.

To claim conformity with ISO 9001:2008, the organization has to be able to provide objective evidence

of the effectiveness of its processes and its quality management system. Clause 3.8.1 of ISO

9000:2005 defines “objective evidence” as “data supporting the existence or verity of something” and

notes that “objective evidence may be obtained through observation, measurement, test, or other means.”

Objective evidence does not necessarily depend on the existence of documented procedures, records or

other documents, except where specifically mentioned in ISO 9001:2008. In some cases, (for example,

in clause 7.1(d) Planning of product realization, and clause 8.2.4 Monitoring and measurement of product),

it is up to the organization to determine what records are necessary in order to provide this objective

evidence.

Where the organization has no specific internal procedure for a particular activity, and this is not required

by the standard, (for example, clause 5.6 Management Review), it is acceptable for this activity to be

conducted using as a basis the relevant clause of ISO 9001:2008. In these situations, both internal and

external audits may use the text of ISO 9001:2008 for conformity assessment purposes.
