gmx understanding & implementing iso 9001:2008
TRANSCRIPT
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
PREPARED & EDITED BY: ENG. A. KARAM MALKAWI
GLOBAL MATRIX CONSULTATION CO.
AMMAN-JOR
VERSION 1.0
APRIL 24, 2016
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 1 of 100
SECTION I ................................................................................................................................................................................. 6
IMPLEMENTING ISO 9001:2008 .................................................................................................................................................. 6
STEPS TO IMPLEMENT ISO 9001:2008 ................................................................................................................................... 9
ISO 9001 REQUIREMENTS ........................................................................................................................................................ 15
INTRODUCTION TO ISO 9001 REQUIREMENTS ......................................................................................................................... 17
ISO 9001-CLAUSE 1, 2 AND 3 ................................................................................................................................................... 18
CLAUSE 1 SCOPE................................................................................................................................................................. 18
CLAUSE 1.1 GENERAL .......................................................................................................................................................... 18
ISO 9001-REQUIREMENT ..................................................................................................................................................... 18
EXPLANATION ..................................................................................................................................................................... 18
CLAUSE 1.2 APPLICATION ................................................................................................................................................... 19
ISO 9001-REQUIREMENT ..................................................................................................................................................... 19
EXPLANATION ................................................................................................................................................................ 19
Clause 2 Normative references ............................................................................................................................................. 20
ISO 9001-REQUIREMENT ..................................................................................................................................................... 20
EXPLANATION ................................................................................................................................................................ 20
CLAUSE 3 TERMS AND DEFINITIONS ................................................................................................................................... 20
ISO 9001-REQUIREMENT ..................................................................................................................................................... 20
EXPLANATION ................................................................................................................................................................ 20
ISO 9001-CLAUSE 4.1 .......................................................................................................................................................... 20
4.0 QUALITY MANAGEMENT SYSTEM ................................................................................................................................... 20
EXPLANATION ................................................................................................................................................................ 20
ISO 9001-Clause 4.1 ............................................................................................................................................................ 21
4.1 GENERAL REQUIREMENTS ............................................................................................................................................. 21
ISO 9001 REQUIREMENT ..................................................................................................................................................... 21
EXPLANATION ................................................................................................................................................................ 22
ISO 9001-CLAUSE 4.2 .......................................................................................................................................................... 25
ISO 9001-CLAUSE 4.2 DOCUMENTATION REQUIREMENTS .................................................................................................... 25
4.2.1 GENERAL ................................................................................................................................................................... 25
ISO 9001 REQUIREMENT ..................................................................................................................................................... 25
EXPLANATION ................................................................................................................................................................ 25
4.2.2 QUALITY MANUAL ...................................................................................................................................................... 26
ISO 9001 REQUIREMENT ..................................................................................................................................................... 26
EXPLANATION ................................................................................................................................................................ 26
4.2.3 CONTROL OF DOCUMENTS ......................................................................................................................................... 26
ISO 9001 REQUIREMENT ..................................................................................................................................................... 26
EXPLANATION ................................................................................................................................................................ 27
4.2.4 CONTROL OF RECORDS .............................................................................................................................................. 28
ISO 9001 REQUIREMENT ..................................................................................................................................................... 28
EXPLANATION ................................................................................................................................................................ 28
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 2 of 100
ISO 9001-CLAUSE 5.1, 5.2 & 5.3 .......................................................................................................................................... 30
CLAUSE 5 MANAGEMENT RESPONSIBILITY ........................................................................................................................... 30
ISO 9001-CLAUSE 5.1, 5.2 & 5.3 .......................................................................................................................................... 30
5.1 MANAGEMENT COMMITMENT ........................................................................................................................................ 30
ISO 9001 REQUIREMENT ..................................................................................................................................................... 30
EXPLANATION ................................................................................................................................................................ 31
5.2 CUSTOMER FOCUS ........................................................................................................................................................ 31
ISO 9001 REQUIREMENT ..................................................................................................................................................... 31
EXPLANATION ................................................................................................................................................................ 31
5.3 QUALITY POLICY ........................................................................................................................................................... 32
ISO 9001 REQUIREMENT ..................................................................................................................................................... 32
EXPLANATION ................................................................................................................................................................ 32
ISO 9001-CLAUSE 5.4 .......................................................................................................................................................... 34
ISO 9001-CLAUSE 5.4 PLANNING ......................................................................................................................................... 34
CLAUSE 5.4.1 QUALITY OBJECTIVES .................................................................................................................................... 34
ISO 9001 REQUIREMENT ..................................................................................................................................................... 34
EXPLANATION ................................................................................................................................................................ 34
CLAUSE 5.4.2 QUALITY MANAGEMENT SYSTEM PLANNING ................................................................................................... 36
ISO 9001 REQUIREMENT ..................................................................................................................................................... 36
EXPLANATION ................................................................................................................................................................ 36
ISO 9001-CLAUSE 5.5 .......................................................................................................................................................... 38
ISO 9001-CLAUSE 5.5 RESPONSIBILITY, AUTHORITY AND COMMUNICATION ........................................................................ 38
ISO 9001-CLAUSE 5.5.1 RESPONSIBILITY AND AUTHORITY .................................................................................................. 38
ISO 9001 REQUIREMENT ..................................................................................................................................................... 38
EXPLANATION ................................................................................................................................................................ 38
ISO 9001 REQUIREMENT ..................................................................................................................................................... 39
EXPLANATION ..................................................................................................................................................................... 39
ISO 9001-CLAUSE 5.5.3 INTERNAL COMMUNICATION ........................................................................................................... 40
ISO 9001 REQUIREMENT ..................................................................................................................................................... 40
ISO 9001-CLAUSE 5.6 .......................................................................................................................................................... 42
ISO 9001-CLAUSE 5.6 MANAGEMENT REVIEW ...................................................................................................................... 42
ISO 9001 REQUIREMENT ISO 9001-CLAUSE 5.6.1 GENERAL ................................................................................................. 42
ISO 9001-CLAUSE 5.6.2 REVIEW INPUT .............................................................................. Error! Bookmark not defined.
ISO 9001 REQUIREMENT ..................................................................................................................................................... 42
ISO 9001-CLAUSE 5.6.3 REVIEW OUTPUT ........................................................................... Error! Bookmark not defined.
ISO 9001 REQUIREMENT ..................................................................................................................................................... 42
EXPLANATION ................................................................................................................................................................ 42
ISO 9001-CLAUSE 6 ............................................................................................................................................................ 44
ISO 9001-CLAUSE 6: RESOURCE MANAGEMENT ................................................................................................................... 44
ISO 9001-CLAUSE 6.1 PROVISION OF RESOURCES ............................................................................................................... 44
ISO 9001 REQUIREMENT ..................................................................................................................................................... 44
EXPLANATION ................................................................................................................................................................ 44
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 3 of 100
ISO 9001-CLAUSE 6.2 HUMAN RESOURCES .......................................................................................................................... 45
ISO 9001 REQUIREMENT ..................................................................................................................................................... 45
ISO 9001-CLAUSE 6.2.1 GENERAL ........................................................................................................................................ 45
EXPLANATION ................................................................................................................................................................ 45
ISO 9001-CLAUSE 6.3 INFRASTRUCTURE ............................................................................................................................. 46
ISO 9001 REQUIREMENT ..................................................................................................................................................... 46
ISO 9001-CLAUSE 6.4 WORK ENVIRONMENT ........................................................................................................................ 47
ISO 9001 REQUIREMENT ..................................................................................................................................................... 47
EXPLANATION ................................................................................................................................................................ 47
ISO 9001-CLAUSE 7.1 .......................................................................................................................................................... 49
ISO 9001-CLAUSE 7 PRODUCT REALIZATION ....................................................................................................................... 49
ISO 9001-CLAUSE 7.1 PLANNING OF PRODUCT REALIZATION ............................................................................................... 49
ISO 9001 REQUIREMENT ..................................................................................................................................................... 49
EXPLANATION ................................................................................................................................................................ 49
ISO 9001-CLAUSE 7.2 .......................................................................................................................................................... 51
ISO 9001-CLAUSE 7.2 CUSTOMER-RELATED PROCESSES ...................................................................................................... 51
ISO 9001 REQUIREMENT ISO 9001-Clause 7.2.1 Determination of requirements related to the product ................................... 51
EXPLANATION ................................................................................................................................................................ 52
ISO 9001-CLAUSE 7.3 .......................................................................................................................................................... 55
ISO 9001-CLAUSE 7.3 DESIGN AND DEVELOPMENT .............................................................................................................. 55
ISO 9001-CLAUSE 7.3.1 DESIGN AND DEVELOPMENT PLANNING .......................................................................................... 55
ISO 9001 REQUIREMENT ..................................................................................................................................................... 55
EXPLANATION ................................................................................................................................................................ 55
ISO 9001-CLAUSE 7.3.2 DESIGN AND DEVELOPMENT INPUTS ............................................................................................... 56
ISO 9001 REQUIREMENT ..................................................................................................................................................... 56
EXPLANATION ................................................................................................................................................................ 56
ISO 9001-CLAUSE 7.3.3 DESIGN AND DEVELOPMENT OUTPUTS ............................................................................................ 57
ISO 9001 REQUIREMENT ..................................................................................................................................................... 57
EXPLANATION ................................................................................................................................................................ 57
ISO 9001-CLAUSE 7.3.4 DESIGN AND DEVELOPMENT REVIEW .............................................................................................. 58
ISO 9001 REQUIREMENT ..................................................................................................................................................... 58
EXPLANATION ................................................................................................................................................................ 58
ISO 9001-CLAUSE 7.3.5 DESIGN AND DEVELOPMENT VERIFICATION .................................................................................... 58
ISO 9001 REQUIREMENT ..................................................................................................................................................... 58
EXPLANATION ................................................................................................................................................................ 58
ISO 9001-CLAUSE 7.3.6 DESIGN AND DEVELOPMENT VALIDATION ....................................................................................... 59
ISO 9001 REQUIREMENT ..................................................................................................................................................... 59
EXPLANATION ................................................................................................................................................................ 59
ISO 9001-CLAUSE 7.3.7 CONTROL OF DESIGN AND DEVELOPMENT CHANGES ....................................................................... 59
ISO 9001 REQUIREMENT ..................................................................................................................................................... 59
EXPLANATION ................................................................................................................................................................ 59
ISO 9001-CLAUSE 7.4 .......................................................................................................................................................... 62
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 4 of 100
ISO 9001-CLAUSE 7.4 PURCHASING ..................................................................................................................................... 62
ISO 9001-CLAUSE 7.4.1 PURCHASING PROCESS ................................................................................................................... 62
ISO 9001 REQUIREMENT ..................................................................................................................................................... 62
EXPLANATION ................................................................................................................................................................ 62
ISO 9001-CLAUSE 7.4.2 PURCHASING INFORMATION ........................................................................................................... 63
ISO 9001 REQUIREMENT ..................................................................................................................................................... 63
EXPLANATION ................................................................................................................................................................ 63
ISO 9001-CLAUSE 7.4.3 VERIFICATION OF PURCHASED PRODUCT ........................................................................................ 64
ISO 9001 REQUIREMENT ..................................................................................................................................................... 64
EXPLANATION ................................................................................................................................................................ 64
ISO 9001-CLAUSE 7.5 .......................................................................................................................................................... 66
ISO 9001-CLAUSE 7.5 PRODUCTION AND SERVICE PROVISION ............................................................................................ 66
ISO 9001-CLAUSE 7.5.1 CONTROL OF PRODUCTION AND SERVICE PROVISION ..................................................................... 66
ISO 9001 REQUIREMENT ..................................................................................................................................................... 66
EXPLANATION ................................................................................................................................................................ 66
ISO 9001-CLAUSE 7.5.2 VALIDATION OF PROCESSES FOR PRODUCTION AND SERVICE PROVISION ....................................... 67
ISO 9001 REQUIREMENT ..................................................................................................................................................... 67
EXPLANATION ................................................................................................................................................................ 67
ISO 9001-CLAUSE 7.5.3 IDENTIFICATION AND TRACEABILITY .............................................................................................. 68
ISO 9001 REQUIREMENT ..................................................................................................................................................... 68
EXPLANATION ................................................................................................................................................................ 68
ISO 9001-CLAUSE 7.5.4 CUSTOMER PROPERTY .................................................................................................................... 69
ISO 9001 REQUIREMENT ..................................................................................................................................................... 69
EXPLANATION ................................................................................................................................................................ 69
ISO 9001-CLAUSE 7.5.5 PRESERVATION OF PRODUCT .......................................................................................................... 70
ISO 9001 REQUIREMENT ..................................................................................................................................................... 70
EXPLANATION ................................................................................................................................................................ 70
ISO 9001-CLAUSE 7.6 .......................................................................................................................................................... 73
ISO 9001-CLAUSE 7.6 CONTROL OF MONITORING AND MEASURING EQUIPMENT ................................................................. 73
ISO 9001 REQUIREMENT ..................................................................................................................................................... 73
EXPLANATION ................................................................................................................................................................ 73
ISO 9001-CLAUSE 8.1 .......................................................................................................................................................... 76
ISO 9001-CLAUSE 8 MEASUREMENT, ANALYSIS AND IMPROVEMENT .................................................................................... 76
ISO 9001-CLAUSE 8.1 GENERAL ......................................................................................................................................... 76
ISO 9001 REQUIREMENT ..................................................................................................................................................... 76
EXPLANATION ................................................................................................................................................................ 77
ISO 9001-CLAUSE 8.2 .......................................................................................................................................................... 78
ISO 9001-CLAUSE 8.2 MONITORING AND MEASUREMENT ..................................................................................................... 78
ISO 9001-CLAUSE 8.2.1 CUSTOMER SATISFACTION ............................................................................................................. 78
ISO 9001 REQUIREMENT ..................................................................................................................................................... 78
EXPLANATION ................................................................................................................................................................ 78
ISO 9001-Clause 8.2.2 Internal audit .................................................................................................................................... 79
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 5 of 100
ISO 9001 REQUIREMENT ..................................................................................................................................................... 79
EXPLANATION ................................................................................................................................................................ 80
ISO 9001-CLAUSE 8.2.3 MONITORING AND MEASUREMENT OF PROCESSES .......................................................................... 81
ISO 9001 REQUIREMENT ..................................................................................................................................................... 81
EXPLANATION ................................................................................................................................................................ 82
ISO 9001-CLAUSE 8.2.4 MONITORING AND MEASUREMENT OF PRODUCT ............................................................................. 82
ISO 9001 REQUIREMENT ..................................................................................................................................................... 82
EXPLANATION ................................................................................................................................................................ 83
ISO 9001-CLAUSE 8.3 .......................................................................................................................................................... 86
ISO 9001-CLAUSE 8.3 CONTROL OF NONCONFORMING PRODUCT ........................................................................................ 86
ISO 9001 REQUIREMENT ..................................................................................................................................................... 86
EXPLANATION ................................................................................................................................................................ 86
ISO 9001-CLAUSE 8.4 & CLAUSE 8.5 .................................................................................................................................... 88
ISO 9001-CLAUSE 8.4 & CLAUSE 8.5 .................................................................................................................................... 88
CLAUSE 8.4 ANALYSIS OF DATA .......................................................................................................................................... 88
ISO 9001 REQUIREMENT ..................................................................................................................................................... 88
EXPLANATION ................................................................................................................................................................ 88
CLAUSE 8.5 IMPROVEMENT ................................................................................................................................................. 89
8.5.1 CONTINUAL IMPROVEMENT ........................................................................................................................................ 89
EXPLANATION ..................................................................................................................................................................... 89
8.5.2 Corrective action ......................................................................................................................................................... 90
ISO 9001 REQUIREMENT ..................................................................................................................................................... 90
EXPLANATION ................................................................................................................................................................ 90
8.5.3 PREVENTIVE ACTION .................................................................................................................................................. 91
ISO 9001 REQUIREMENT ..................................................................................................................................................... 91
EXPLANATION ................................................................................................................................................................ 91
SECTION II ............................................................................................................................................................................. 94
DOCUMENTATION REQUIREMENTS OF ISO 9001:2008 .............................................................................................................. 94
Introduction to Documentation Requirements of ISO 9001: 2008 ........................................................................................... 95
What is a “document” .......................................................................................................................................................... 95
Documentation requirements of ISO 9001:2008 .................................................................................................................... 96
Guidance on Clause 4.2 of ISO 9001:2008 ............................................................................................................................ 96
Documented procedures ...................................................................................................................................................... 97
Records .......................................................................................................................................................................... 98
Organizations preparing to implement a QMS ........................................................................................................................ 99
Organizations wishing to adapt an existing QMS .................................................................................................................. 100
Demonstrating conformity with ISO 9001:2008 ................................................................................................................... 100
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 6 of 100
SECTION I
IMPLEMENTING ISO 9001:2008
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 7 of 100
There is no quick step-by-step for implementing ISO9001 according to ISO9001 into any other serious
standard. Many have publicized it, but there are too many steps to do and to go through thoroughly
making the implementation process complicated.
In this approach we claim that all the really needed elements are discussed. What is not needed is not
discussed.
The implementation of a formal management system is best handled as a specific project with a
professional project manager, who should be a key member of the organization’s management team and
having sufficient authority and trust of the personnel involved.
In the ideal situation this person will also be the Management Representative, but skills in project
management are essential. It is important that none of the stages in the flow chart are omitted.
The existing system of management and working practices must be known in some detail, before the
framework of the formal QMS-documentation can be designed. The system is best designed around
existing processes as the development of new systems that require additional resources may simply
delay the implementation process.
The total flow chart for the implementation of the QMS is visualized. On the following pages each step
of the implementation process is described that have to be carried out before moving to the next step.
It is advised to get more people involved in decision making and not to leave the decision to move to the
next step up to one person only. Everybody involved must feel comfortable that a part is under control
and that the organization is ready to move on.
The total implementation process for QMS takes fourteen steps. Communicate with the employees what
has done, what has to be done and when it is expected to be completely implemented. This creates interest
and involvement and will speed-up the process of implementation.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 8 of 100
Implementation flow chart
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 9 of 100
STEPS TO IMPLEMENT ISO 9001:2008
STEP 1: Evaluate the organization’s objectives and targets for implementing ISO9001
The need for a QMS may arise from repeated customer complaints, frequent warranty returns, delayed
deliveries, too high inventories, frequent production hold-ups or a high level of rework or rejection of
products or services.
Also it could be that the need for implementing ISO9001 comes from the market, that is demanding a
certified QMS, or otherwise it is impossible to operate in this market, or supply this dominant customer.
Strong technological driven markets such as the aircraft and automotive business put this demand on their
contractors and subcontractors for cost reasons but also for safety and liability reasons. This third party
certification demonstrates the abilities of the organization to the potential customer.
At this stage, identify the goals and objectives which should be achieved through a QMS, such as an
improved company structure, greater efficiency, better profitability, reliable supplier etc.
Introduce the Eight Quality Management principles to top management and get them motivated and
committed to apply to these principles.
Checklist at this stage:
Check that the management has adopted the 8 leadership principles and is motivated and committed
to apply them.
Communicate the objectives and targets for the implementation of the QMS with all the staff.
STEP 2: Obtain knowledge about the ISO 9000 family and appoint a management
representative
Decide on the responsibilities of the person who will be involved in developing and documenting the
QMS, including the appointment of a management representative who will oversee the implementation
of the QMS. The person made responsible for the process of implementing the QMS should understand
the requirements of ISO 9000 and 9001 and read the contents of ISO 9004.
Checklist at this stage:
Check to see that the management representative should has been appointed at this stage.
Check that the contents and the philosophy of ISO 9000 and 9001 have been made clear and have
been accepted.
STEP 3: Organize the resources
Decide on the responsibilities of the person who will be involved in developing a documenting the QMS,
including the appointment of a management representative who will oversee the implementation of the
QMS. Establishing a project or ISO-team may also prove to be useful to oversee progress and in providing
resources wherever required. The ISO team should consist of involved employees from different levels.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 10 of 100
Some authority can be given by top management to speed up the process.
If within the organization no adequate competence is available, or no resources such as time and
knowledge can be made available, then a consultant should be appointed. Before doing so, it is good to
realize that with subcontracting a part of the implementation process, a part of the knowledge and the
commitment is lost. An organization can learn more and better from its mistakes and own developments,
than from just doing what a consultant is recommending. Prepare a cost estimate and procure and
allocate the resources for this project. Raise commitment from the top management.
Checklist at this stage:
Check that the management has decided upon the individual who will develop the QMS and about
its authority.
At this stage, check that the supporting ISO-team is established and the objectives for the team
should have been made clear.
Check if commitment has been made at this stage to the implementation process, if not, it should
be stopped here.
Don’t continue if there is no support group such as an ISO-team or a similar solution.
Check that the needed resources such as manpower, money and time have been made available to
the Management Representative and the ISO-team.
STEP 4: Raise awareness and provide training:
Raise awareness about QMS requirements amongst all personnel performing activities and tasks that
affect quality. Plan for and provide specific training on how to develop quality manual, procedures and
work instructions. Besides that, it is important to instruct people how to identify and implement
improvement processes and how to audit compliance with the QMS. Appoint a certain number of people
to be the internal auditors and provide sufficient training. The ISO-team and/or the consultant should be
resources for assistance during the training.
Checklist at this stage:
Check that training has been provided to the people involved in the writing of procedures and work
instructions. Make sure that the written documents reflect the actual situation and not the desired
situation.
Check if a number of people have been selected as internal auditors and that the internal auditor
training has been provided.
Check that the ISO-team assist in providing insight into the QMS to the other employees by means
of presentations, newsletters and other ways of communication.
Develop forms that can replace difficult status reporting and provide instruction on how to use
them.
STEP 5: Gap Analysis
Evaluate the gaps between the existing QMS and the requirements of ISO 9001:2008. Prepare how to
bridge these gaps, including the planning for any additional resources required. Gap analysis may be
carried out through self-assessment, by the ISO-team or by an external consultant.
Checklist at this stage:
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 11 of 100
Check that the gap analysis has been carried out and study the outcome.
With this analysis it should be possible to identify the gaps when it is compared with the ISO 9001
QMS
Check that a plan has been developed to bridge the found gaps. Make sure that the plan also contains
a time schedule and that the actions are realistic and can be finished in time.
Check that the results of the gap analysis and the actions to bridge the gaps have been reported to
top management and that management is also committed.
STEP 6: Product realization processes
Review clause 7 of ISO 9000:2008 relating to Product Realization to determine how the
requirements apply or do not apply to the company’s QMS.
The processes covered by this clause include:
Customer related processes.
Design and development.
Production and service provision.
Control of measuring and monitoring devices.
Note that if the company is not responsible for preparing the design of the product, it can exclude
the requirement for design and development from the QMS, as long as the reasoning is mentioned
in the quality manual.
Flow chart each process in detail and discuss these flowcharts with the experts, in another words,
the people that work with these processes.
Draft the framework of the quality management system and identify the supporting documents.
Then develop the QMS documentation.
Checklist at this stage:
Check to see that all the processes have been properly documented.
Have this documentation done by the experts, the people that are responsible for these processes.
Check on the requirements of the standard and exclude the elements that are not applicable to the
organization.
Get the approval from top management for these exclusions
STEP 7: Planning and time frame
In this stage the allocation of the resources for the QMS project should be defined. Prepare a complete
plan including the plan to close the gaps identified in the Gap Analysis, to develop the QMS processes.
In the plan, include activities to be performed, resources required, responsibilities and an estimated
completion time for each activity. Build in check point to assure in time completion.
Clause 4.1 and 7.1 of ISO 9000:2008 provide information that should be used when developing the
plan.
The total time required for each phase (planning, documentation, implementation and evaluation)
depends on the extent of the gaps in the existing QMS.
Communicate the master plan to all staff, but especially the ISO-team and the people involved.
Checklist at this stage:
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 12 of 100
Check that the plan is complete, including the actions to bridge the gaps, a time schedule and the
allocation of the resources such as manpower, money and time.
Check that enough effort has been made to communicate the plan and the result of it to all staff. If
needed provide extra information to key people and the ISO-team.
STEP 8: Draft a Quality manual and develop a Quality Policy
Draft the quality policy for the organization. Get the policy committed by top management.
Make sure that the policy is a strong statement, original and applies to the organization.
In the quality manual:
Include how the QMS applies to the products, processes, locations and departments of the
organization.
Exclude any requirement with justification if applicable.
Refer to or include documented procedures (if available already) for QMS.
Describe the interaction between the processes of the QMS, e.g. the interaction between product
realization processes and other management, measurement and improvement processes.
Checklist at this stage:
Check that there is an adequate policy developed, that top management is committed and it is a
strong statement. Do not continue without this policy statement.
Check that everybody in the organization has seen it, understands it and can repeat it in his/her own
words.
Check that the QMS manual is ready. Don t continue without an approved manual.
Check that the requirements from the standards are fulfilled and that reference is made to at least
six procedures, but no more than that are needed.
Keep it simple.
If there is still not sufficient commitment from top management, don’t continue.
STEP 9: Draft the Documentation, design the QMS and implement it
The implementation has two parts. The implementation of the QMS, and that of the supporting paperwork.
The implementation of the QMS is another way of working. Define the structure and get the people
involved committed to work accordingly. Introduce the quality manual to the top management. Explain
the document structure and how it fits in the QMS. After top management introduction, middle
management should be made aware of the document structure. Top management should be showing that
they are working according to the leadership principles.
After companywide commitment, procedures have to be written. ISO 9000 outlines clearly what has to
be documented. What is not needed can be decided by the organization. In principle the employees that
work with the documents must write these procedures. The procedures should reflect the actual situation,
not the desired one. After the completion and implementation of the procedures, the next level will be the
work instructions. Here the same system applies. Get the experts to describe their work and activities.
Finally a complete documentation set should be available. It should be noted that only six procedures are
required by the standard. Key is that the people involved, work according to these documents. Maintain
the QMS for three months before internal auditing should take place. Correct the QMS where needed.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 13 of 100
Checklist at this stage:
Check that the elements of the standards are implemented in the organization.
Elements such as continual improvement, leadership principles and customer orientation.
Check that all the needed procedures have been developed and that the work instructions have been
written.
Check that the process owners are involved in the development of the work instructions.
STEP 10: Carry out internal audits
During the phase of implementation of some three to six months after the documentation has been written,
the trained auditors should carry out one or two internal audits covering all activities for the QMS, and
concerned management should take corrective action on the audit findings without delay.
Wherever required, revise the manuals, procedures and objectives. After each internal audit, the top
management should review the effectiveness of the system and provide resources for corrective actions
and improvements.
Checklist at this stage:
Check that the responsible people have been trained for the internal auditor function.
Record their training results and data.
Check that internal auditors do not audit their own department or work area.
Check that the results of the internal audits are fed back into the system and lead to improvement
of the QMS, the processes and the documents.
Check that the results of the internal audits are reviewed on top management level and that
appropriate action has been taken.
Check that there is a time schedule for internal audits and that it is maintained.
STEP 11: Conduct a Management Review
It is important in this stage to have a formal management review that shows the commitment of all levels.
The recommendations from this review have to be carried out.
Use the Management Review procedure developed for the organization.
Checklist at this stage:
Check that the result of the management review is functioning well and that all people involved
know what is expected from them. Check the involvement and commitment of the top management.
Check that actions are taken and decisions are made.
Check that the main focus is on the customer s satisfaction.
Check that the decision makers are present.
STEP 12: Pre-assessment. Apply for certification
Carry out a pre-assessment. Correct the QMS and the documentation where needed. Re-assessment can
be done with the help of an external certification body, but also by local consultants or by consultants
from the branch organization. On satisfactory completion of the previous step, and if the company decided
to obtain third party certification, an application for certification should be made to a certification body.
Checklist at this stage:
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 14 of 100
Carry out a pre-assessment to win trust and confidence among the people involved in the
certification process.
Check that actions are taken and decisions are made based on the results of the pre-assessment.
Check that the right partner has been found to carry out the pre-assessment.
Check that a certification body has been approached for the final assessment.
STEP 13: Conduct periodic evaluations and initiate corrective and preventive actions
After certification, the organization should periodically conduct internal audits to review the effectiveness
of the QMS and see how it can be continually improved.
The organization should evaluate periodically if the purpose and goals for which the QMS was
developed are being achieved, including its continual improvement.
It is needed to look at the organization s overall systems performance and then decide when and where
the most effective improvements can be realized. Then objectives have to be set for those improvements
and a periodic evaluation has to be conducted to monitor achievements.
Improvements could be the reduction of cycle time within a process or the reduction of contamination in
a manufacturing process.
Checklist at this stage:
Check that periodically internal audits are planned and conducted.
Check that the non-conformities from the final assessment will be solved as soon as possible.
Check that the organization will review its goals and objectives on a regular basis.
Check that management reviews are planned and conducted periodically
STEP 14: Evaluation
The certification is certainly not the last phase. The people involved need to measure the success of the
implementation of the QMS during the implementation process and by the conclusion of the process.
Measurements should be made against the original aims and goals and the key indicators of an effective
QMS as stated below:
Checklist at this stage:
Check that senior management is fully committed to the QMS and owns the appropriate processes.
Check that the QMS is designed around business processes and not around ISO 9001 or any other
standard.
Check that staff knows how to access the QMS documentation.
Check that visibility of processes and the clarity of the instructions in the QMS documentation set
are clear, concise, readable and understandable. The people involved maintain their own documents
Check that the organizational culture is a culture of opportunities, focused around continual
improvement rather than a person-to-blame culture.
Check that the quality management representative is a key organization person rather than a sideline
person.
Check that internal auditing is seen as adding value and part of the continual improvement of the
QMS.
Ensure that there is continual improvement in system.
Keep up with regular internal audits and Management Reviews.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 15 of 100
ISO 9001 REQUIREMENTS
The ISO 9001 REQUIREMENTs has the following clauses;
0 Introduction to ISO 9001 REQUIREMENTs
1 Scope
1.1 General
1.2 Application
2 Normative references
3 Terms and definitions
4 Quality management system
4.1 General requirements
4.2 Documentation requirements
4.2.1 General
4.2.2 Quality manual
4.2.3 Control of documents
4.2.4 Control of records
5 Management responsibility
5.1 Management commitment
5.2 Customer focus
5.3 Quality policy
5.4 Planning
5.4.1 Quality objectives
5.4.2 Quality management system planning
5.5 Responsibility, authority and communication
5.5.1 Responsibility and authority
5.5.2 Management representative
5.5.3 Internal communication
5.6 Management review
5.6.1 General
5.6.2 Review input
5.6.3 Review output
6 Resource management
6.1 Provision of resources
6.2 Human resources
6.2.1 General
6.2.2 Competence, training and awareness
6.3 Infrastructure
6.4 Work environment
7 Product realization
7.1 Planning of product realization
7.2 Customer-related processes
7.2.1 Determination of requirements related to the product
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 16 of 100
7.2.2 Review of requirements related to the product
7.2.3 Customer communication
7.3 Design and development
7.3.1 Design and development planning
7.3.2 Design and development inputs
7.3.3 Design and development outputs
7.3.4 Design and development review
7.3.5 Design and development verification
7.3.6 Design and development validation
7.3.7 Control of design and development changes
7.4 Purchasing
7.4.1 Purchasing process
7.4.2 Purchasing information
7.4.3 Verification of purchased product
7.5 Production and service provision
7.5.1 Control of production and service provision
7.5.2 Validation of processes for production and service provision
7.5.3 Identification and traceability
7.5.4 Customer property
7.5.5 Preservation of product
7.6 Control of monitoring and measuring equipment
8 Measurement, analysis and improvement
8.1 General
8.2 Monitoring and measurement
8.2.1 Customer satisfaction
8.2.2 Internal audit
8.2.3 Monitoring and measurement of processes
8.2.4 Monitoring and measurement of product
8.3 Control of nonconforming product
8.4 Analysis of data
8.5 Improvement
8.5.1 Continual improvement
8.5.2 Corrective action
8.5.3 Preventive action
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 17 of 100
INTRODUCTION TO ISO 9001 REQUIREMENTS
The implementation of a QMS should be a strategic decision of the organization implementing QMS.
Various factors influence the design and implementation of QMS.
These include – diverse needs and risks of organizations; particular goals and objectives; complexity of
products and services provided; number of and complexity of processes employed; and size and structure
of the organization. As a result of these and other underlying factors, the ISO 9001 standard does not require
uniformity of QMS structure or documentation.
The QMS requirements specified in ISO 9001 are complementary to requirements for product. The standard
specifies requirements for organization’s QMS, whereas requirements for product come from customers
and regulatory authorities. ISO 9001:2008 standard can be used by internal and external parties, including
certification bodies, to assess an organization’s ability to meet customer, regulatory and the organization’s
own requirements. The quality management principles stated in ISO 9000 and ISO 9004 have been taken
into consideration in developing this standard.
The present editions of ISO 9001 and ISO 9004 have been developed as a consistent pair of quality
management system standards, which have been designed to complement each other, but can also be used
independently. Although the two standards have different scopes, they have similar structures in order to
assist their application as a consistent pair.
PLAN - DO - CHECK - ACT (PDCA) – is a very effective tool for business management and the ISO
9001 standard strongly recommends its use. PDCA is a dynamic cycle that can be applied to each of the
organization’s processes, and also to the system of processes as a whole. It may be used to plan, implement,
control and continually improve both product realization and other QMS processes.
Maintenance and continual improvement of QMS processes can be achieved by applying PDCA to
processes at all levels within the organization – from the executive high-level strategic processes, such as
business planning or management review to operational processes such as product realization or calibration.
Plan: Establish the objectives and processes necessary to deliver results in accordance with customer
requirements and the organization’s policies.
Do: Implement the processes
Check: Monitor and check processes and product against policies, objectives and requirements for the
product and report the results
Act: Take actions to continually improve process performance
ISO 9001 specifies requirements for a quality management system that can be used for internal
application by organizations, or for certification, or for contractual purposes. It focuses on the
effectiveness of the quality management system in meeting customer requirements.
ISO 9004 gives guidance on a wider range of objectives of a quality management system than does ISO
9001, particularly for the continual improvement of an organization’s overall efficiency, as well as
effectiveness. ISO 9004 is recommended as a guide for organizations whose top management wishes to
move beyond the requirements of ISO 9001, in pursuit of continual improvement of performance.
However, it is not intended for certification or for contractual purposes.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 18 of 100
This Standard has been aligned with ISO 14001 in order to enhance the compatibility of the two standards
for the benefit of the user community. This Standard does not include requirements specific to other
management systems, such as those particular to environmental management, occupational health and
safety management, financial management or risk management. However, this standard enables an
organization to align or integrate its own quality management system with related management system
requirements.
ISO 9001-CLAUSE 1, 2 AND 3
CLAUSE 1 SCOPE
CLAUSE 1.1 GENERAL
ISO 9001-REQUIREMENT
This International Standard specifies requirements for a quality management system where an
organization
a) needs to demonstrate its ability to consistently provide product that meets customer and
applicable statutory and regulatory requirements, and
b) aims to enhance customer satisfaction through the effective application of the system,
including processes for continual improvement of the system and the assurance of conformity to
customer and applicable statutory and regulatory requirements.
NOTE 1 In this International Standard, the term “product” only applies to:
a) product intended for, or required by, a customer,
b) any intended output resulting from the product realization processes.
NOTE 2 Statutory and regulatory requirements can be expressed as legal requirements.
EXPLANATION
Your organization must meet requirements consistently and enhance customer satisfaction by effective
application of QMS, continual improvement of QMS and providing assurance of conformity to customer
and applicable regulatory requirements which can be expressed as legal requirements .Product means any
product or service which is required by a customer or intended for a customer and can be output of product
realization processes. Ability means that the organization has the capability to determine customer’s needs
and requirements; design and develop product; know-how and capacity to manufacture product; package
product; deliver on time; provide service and support; etc.. Consistency is being able to repeat your
capability within specified parameters for quality as defined by customers, your own organization or
regulatory bodies.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 19 of 100
CLAUSE 1.2 APPLICATION
ISO 9001-REQUIREMENT
All requirements of this International Standard are generic and are intended to be applicable to all
organizations, regardless of type, size and product provided.
Where any requirement(s) of this International Standard cannot be applied due to the nature of an
organization and its product, this can be considered for exclusion.
Where exclusions are made, claims of conformity to this International Standard are not acceptable unless
these exclusions are limited to requirements within Clause 7, and such exclusions do not affect the
organization’s ability, or responsibility, to provide product that meets customer and applicable statutory
and regulatory requirements.
EXPLANATION
All requirements of ISO 9001 are generic and are intended to be applicable to all organisations, regardless
of type, size and product provided. Where any requirements of this standard cannot be applied, due to the
nature of an organisations and its product, this can be considered for exclusion. Where exclusions are made,
claims of conformity to ISO 9001 are not acceptable unless these exclusions are limited to requirements
within clause 7, and such exclusions do not affect the organization’s ability, or responsibility, to provide
product that meets customer and applicable regulatory requirements. This clause requires to state clearly if
any areas of the standard do not apply to the organisations, together with an EXPLANATION of the reason
for this exclusion.
For example, if you do not design product, but only manufacture product from customer provided
specifications, then clause 7.3 Product Design and Development may not be applicable to you. However,
if you buy a complete design and manufacture a product to that design and sell it under your own brand
name, then you must include Product Design and Development in the scope of your QMS. The rationale
here is that if a capability is required or responsibility implied, to meet customer requirements, then that
capability must be included in your QMS. It is your responsibility to perform the required capability
whether you purchase, outsource or do it yourself.
The standard mentioned specifically that in case of exclusions, the organization’s ability will not be
affected to supply a product or service that will meet customer expectations.
If you do make any exclusion and these exclusions affect your ability or responsibility to meet contracted
customer requirements or applicable regulatory requirements, then you cannot claim conformity to ISO
9001. All exclusions, with appropriate justification must be specified in your Quality manual.
Your QMS scope must include – specific products; processes; locations; any exclusions from the ISO 9001
standard with appropriate justification; etc.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 20 of 100
CLAUSE 2 NORMATIVE REFERENCES
ISO 9001-REQUIREMENT
The following referenced documents are indispensable for the application of this document. For
dated references, only the edition cited applies. For undated references, the latest edition of the referenced
document (including any amendments) applies.
ISO 9000:2005, Quality management systems — Fundamentals and vocabulary
EXPLANATION
This clause explains that the Fundamentals and vocabulary given ISO 9000:2005 Quality Management
Systems -fundamentals and vocabulary, apply.
CLAUSE 3 TERMS AND DEFINITIONS
ISO 9001-REQUIREMENT
For the purposes of this document, the terms and definitions given in ISO 9000 apply.
Throughout the text of this International Standard, wherever the term “product” occurs, it can also
mean“service”.
EXPLANATION
ISO 9000:2005 Quality Management Systems -fundamentals and vocabulary, apply. For service industries
or for industries where service is also part of customer requirement, wherever the terms product occurs, it
will also include service provided by the organization
ISO 9001-CLAUSE 4.1
4.0 QUALITY MANAGEMENT SYSTEM
EXPLANATION
The Quality Management System (QMS) is the means by which the organisations should be managed and
controlled. How to do this is entirely up to the top management. However, the system should use processes
to achieve this. Those processes consist of a balance between procedures and competencies. The current
systems for control may already have much of the detail that is needed for the revised standard. There is an
all-embracing requirement to identify the processes, determine their interaction, and ensure that there is
enough information to monitor them and to document them where they are needed to maintain control.
A process is described in the standard as a set of interrelated or interacting activities, which transform inputs
into outputs. Put more simply they are those chains of activities that take place across an organisations and
deliver the organization’s products or services to either internal or external customers. Processes are what
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 21 of 100
need to be done, which needs to do it and what is the result. Either procedures and/ or competencies will
support processes. Procedures and other documents, work instructions etc. define how an activity is required
to be done.
In the past there has been a perception that the standard requires a detailed description of every activity
undertaken by an organisations and this has led to cases of severe over documentation. A quality manual is
needed. The standard allows flexibility in respect of its status and structure. It can be part of the overall
system, and need only contain the scope of the QMS, processes and any related procedures. System
processes need to be detailed. The standard requires control of documents and records per procedure.
ISO 9001-CLAUSE 4.1
4.1 GENERAL REQUIREMENTS
ISO 9001 REQUIREMENT
The organization shall establish, document, implement and maintain a quality management system and
continually improve its effectiveness in accordance with the requirements of this International Standard.
The organization shall;
Determine the processes needed for the quality management system and their application throughout
the organization (see 1.2),
Determine the sequence and interaction of these processes,
Determine criteria and methods needed to ensure that both the operation and control of these processes are
effective,
Ensure the availability of resources and information necessary to support the operation and monitoring
of these processes,
Monitor, measure where applicable, and analyze these processes, and
Implement actions necessary to achieve planned results and continual improvement of these processes.
These processes shall be managed by the organization in accordance with the requirements of
this International Standard.
Where an organization chooses to outsource any process that affects product conformity to requirements,
the organization shall ensure control over such processes. The type and extent of control to be applied to
these outsourced processes shall be defined within the quality management system.
NOTE 1 Processes needed for the quality management system referred to above include processes for
management activities, provision of resources, product realization, measurement, analysis and
improvement.
NOTE 2 an “outsourced process” is a process that the organization needs for its quality management
system and which the organization chooses to have performed by an external party.
NOTE 3 Ensuring control over outsourced processes does not absolve the organization of the
responsibility of conformity to all customer, statutory and regulatory requirements. The type and extent of
control to be applied to the outsourced process can be influenced by factors such as:
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 22 of 100
The potential impact of the outsourced process on the organization’s capability to provide product
that conforms to requirements,
The degree to which the control for the process is shared,
The capability of achieving the necessary control through the application of 7.4.
EXPLANATION
The primary focus of clause 4.1 requirements is to manage and control all your QMS processes including
product realization processes. QMS includes processes for management activities, provision of resources,
product realization, and measurement as part of QMS. Clause 4.1 requires the ‘Process Approach’ to be
used in defining your QMS. Documentation of QMS processes and the need for and detail of specific
process documentation is determined by ISO 9001, customer, regulatory and your own organizational
requirements, complexity of products and processes, effect on quality, risk of customer dissatisfaction,
economic risk, effectiveness and efficiency, competence of personnel. Clause 4.2.1d requires you to have
documents needed to ensure the effective planning, operation and control for QMS processes. Based on
these factors, you must determine what processes need to be documented and how you will document it.
Not all processes need to be documented; however your quality manual must include a description of the
interaction between your QMS processes.
A number of different methods can be used to document processes, such as graphical representations,
written instructions, checklists, flow charts, visual media, or electronic methods, etc. Process flowcharts
or block diagrams can show how policies, objectives, influential factors, job functions, activities,
material, equipment, resources, information, people and decision making interact and/or interrelate in a
logical order. Procedures may be an acceptable way to document processes provided they describe inputs
and outputs, appropriate responsibilities, controls and resources needed to satisfy customer
requirements. Regardless of whether or not you document all of your processes, you must provide
evidence of effective implementation of all your QMS processes. Such evidence does not necessarily
need to be documented.
Clause 4.1c requires you to determine criteria for effective process operation and control. You could
determine criteria to control inputs, outputs and resources used. For example
Raw materials as an input to production would have acceptance criteria that it must meet before it can
be used.
Finished product as an output of the production process must meet acceptance criteria before it can be
shipped to the customer;
The equipment used to transform raw materials into finished product may have set-up and capability
criteria or parameters that it must meet in order to produce conforming product.
These prevention based criteria (controls) must be established for each QMS process. Note that such
controls may also come from the customer, regulatory or industry bodies. Equally important are the
specific methods required for effective operation and control of each process. These may include job
travelers; work instructions; in process inspection sheet; specifications and drawings; SPC charts; set up
checklist; machine manuals; etc. Note these control methods may apply to any or all of inputs, outputs or
conversion activities.
Under 4.1d, resources for QMS processes may include facility, material, equipment, labor, supplies,
utilities etc. Every QMS process will require a different combination of resources. Resource details may
be identified in specifications, production schedules, bill of materials, production travelers or routers,
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 23 of 100
work instructions, etc. Information for QMS processes will vary from process to process and may include
-production schedules, bill of materials, product acceptance and process performance criteria, production
traveler or router, work instructions etc. Use clause 4.2.3 and other relevant clauses to control process
information.
Clause 4.1e requires you to monitor and measure your QMS processes. Clause 8 provides requirements to
plan and implement these controls for monitoring and measuring conformity to process performance
criteria determined in 4.1c above. Ways to monitor and measure QMS processes may include – tracking
against process parameters, goals and objectives, using tools and records such as process check-sheets;
product acceptance criteria; SPC records; production records; maintenance records; labor records, etc.
More details on monitoring and measuring controls are covered in clause 8.
Clause 4.1e requires analysis of QMS processes may be done through a review of measurement and
monitoring records and performance indicators for each process. These reviews must identify
opportunities to improve QMS processes, use of resources and product quality.
Under clause 4.1.f, when process nonconformities occur, then corrective action is required to bring the
QMS process under control. Remember, the corrective action process is not just for product related
nonconformities. Processes must be continually improved through setting of incrementally realistic,
measurable objectives. Planning for continual improvement requires a review of process data, resources
and controls to bring about the desired change.
Clause 4.1a – 4.1.f must be applied to all QMS processes. Note also that many ISO 9001 clauses (e.g.
clause 7.2; 7.4; 7.6; etc.), require specific processes to be established within your QMS, These processes
must also be identified and controlled in your QMS.
Make sure you include all outsourced processes affecting product quality, in the scope of your QMS. An
outsourced process is any value-adding or conversion activity related to your product or service, that is
performed by an external organization such as a subcontractor, sister facility, etc. Note that the external
organization may perform the outsourced activity at their facility or yours. A manufacturing company
may outsource welding, heat treatment or painting of product. A software company may outsource
software development. A bank may outsource check clearing services. You must be able to demonstrate
sufficient controls over outsourced processes to ensure that such processes are performed according to the
relevant requirements of ISO 9001:2008. The nature and scope of such control will depend on the nature
of the outsourced or subcontracted process and the risk involved. Outsourced processes may be
controlled in any number of ways, e.g., providing the vendor with product specifications; your supplier
quality manual that they must meet; asking for inspection and test results or certificates of compliance;
validation of outsourced process; conducting product and QMS audits of your vendor; etc. The
expectation here is that you flow down to your vendor, the relevant ISO 9001 REQUIREMENTs that you
would have to implement, had you performed the process at your own facility.
In systematically applying clause 4.1 requirements to each QMS process, we are intuitively using the
PDCA approach to development of QMS processes.
PLAN will call upon sub-clauses 4.1.a – 4.1e as well as other applicable ISO 9001 clauses as shown
above;
DO is required by 4.1.f as well as other applicable ISO 9001 clauses
CHECK is controlled by 4.1.e as well as other applicable ISO 9001 clauses;
ACT is governed by clause 4.1.e-f as well as clause 8.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 24 of 100
AUDIT CHECKLIST
Does the QMS address all of the requirements within ISO 9001:2008?
Is there evidence that the QMS has been improved over the past year?
Have the processes of the business been identified? How have they been documented? Who
developed/defined them? Are they reviewed?
How do these processes connect or link to each other? Are outputs identified? Is it clear who the customer
is of each process? The owner?
How are the business processes monitored, measured and controlled?
How are improvements identified for these processes?
Are any of these processes (or sub-processes within them) outsourced to other organizations who carry
them out? If so, how are they identified and how are they controlled? Have any outsourced processes been
the root cause of problems either internal or external?
MANDATORY PROCEDURE Not applicable
Mandatory record: Nor applicable
Process map or process flow chart (part of quality manual)
EVIDENCE / IMPLEMENTATION DOCUMENT Not mandatory but helps in fulfillment of
requirement
Different methods used to document processes: Quality manual, Graphical representations, written
instructions, checklists, flow charts, visual media, or electronic methods. Process flowcharts or block
diagrams can show how policies, objectives, influential factors, job functions, activities, material,
equipment, resources, information, people and decision making interact and/or interrelate in a logical
order.
Methods for effective operation and control of processes: Process flowcharts, block diagrams, job
travelers, work instructions, in process inspection sheet, specifications and drawings, SPC charts, set up
checklist, machine manuals.
Resources for QMS processes may include – facility, material, equipment, labor, supplies, utilities,
Resource details may be identified in specifications, production schedules, bill of materials, production
travelers or routers, work instructions, etc.
Information for QMS processes will vary from process to process and may include – production
schedules, bill of materials, product acceptance and process performance criteria, production traveler or
router, work instructions,
Ways to monitor and measure QMS processes may include – tracking against process parameters, goals
and objectives, using tools and records such as process check-sheets, product acceptance criteria, SPC
records, production records, maintenance records, labor records, etc.
Outsourced processes may be controlled in any number of ways, e.g., providing the vendors with
product specifications, your supplier quality manual that they must meet, asking for inspection and test
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 25 of 100
results or certificates of compliance, validation of outsourced process, conducting product and QMS
audits of your vendors, etc.
ISO 9001-CLAUSE 4.2
ISO 9001-CLAUSE 4.2 DOCUMENTATION REQUIREMENTS
4.2.1 GENERAL
ISO 9001 REQUIREMENT
The quality management system documentation shall include
a) Documented statements of a quality policy and quality objectives,
b) A quality manual,
c) Documented procedures and records required by this International Standard, and
d) Documents, including records, determined by the organization to be necessary to ensure the
effective planning, operation and control of its processes.
NOTE 1 where the term “documented procedure” appears within this International Standard, this means
that the procedure is established, documented, implemented and maintained. A single document may
address the requirements for one or more procedures. A requirement for a documented procedure may be
covered by more than one document.
NOTE 2 the extent of the quality management system documentation can differ from one organization to
another due to
a) the size of organization and type of activities,
b) the complexity of processes and their interactions, and
c) the competence of personnel.
NOTE 3 the documentation can be in any form or type of medium.
EXPLANATION
Clause 4.2.1 specifies all the different types of documentation needed for your QMS. The need to have
additional documentation beyond those specified in this standard may depend upon – customer; regulatory
and your own organizational requirements. Other factors to consider may include complexity of products
and processes, effect on quality, risk of customer dissatisfaction, economic risk, effectiveness and
efficiency, competence of personnel. Clause 4.2.1d requires you to have documents needed to ensure the
effective planning, operation and control for QMS processes. Each organization must determine what
documentation is needed to achieve this based upon complexity of products and processes, effect on quality,
risk of customer dissatisfaction, economic risk, effectiveness and efficiency, competence of personnel.
You must have documented statements of your quality policy and objectives. A procedure is a specific way
to perform an activity or process, and it may or may not be written. If it is established, documented,
implemented and maintained, it is called a documented procedure. A document is information that is written
or recorded on some medium such as paper or computer. A document may specify requirements for e.g. a
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 26 of 100
drawing or technical specification, may provide direction for e.g. quality plan, or show results or evidence
of activities performed for e.g. records.
4.2.2 QUALITY MANUAL
ISO 9001 REQUIREMENT
the organization shall establish and maintain a quality manual that includes
a) The scope of the quality management system, including details of and justification for any
exclusions (see 1.2),
b) The documented procedures established for the quality management system, or reference to them, and
c) A description of the interaction between the processes of the quality management system.
EXPLANATION
The quality manual is a special type of document that describes your QMS. Besides describing your
QMS, your quality manual could provide information on organizational background and capabilities. It
may be used by customers, regulatory bodies, suppliers and company personnel for a variety of purposes.
There are many acceptable ways to document your quality manual. You must define the scope of your
QMS in your quality manual. Your QMS scope should include facilities (manufacturing and support
locations), products, processes, Quality Management and other standards, etc. Customers will want to
know the extent of your capabilities and the Registrar will want to determine the time and effort needed to
audit your organization.
Provide details of any clause exclusions from your scope, and justification for it. You must justify all
exclusions and remember, exclusions can only be made from clause 7.Your quality manual must include a
description of the interaction of your QMS processes.
You have flexibility in whether or not to include your procedures and lower level documentation with your
quality manual or organize them in some other fashion. You may include all or some of your procedures in
your Quality Manual or reference them to your Quality Manual. Keep a listing or index at the front or back
of your Manual showing the complete list of your procedures whether included or referenced.
As a controlled document, the quality manual is subject to all of the controls in clause 4.2.3.
4.2.3 CONTROL OF DOCUMENTS
ISO 9001 REQUIREMENT
Documents required by the quality management system shall be controlled. Records are a special type
of document and shall be controlled according to the requirements given in 4.2.4.
A documented procedure shall be established to define the controls needed
a) to approve documents for adequacy prior to issue,
b) to review and update as necessary and re-approve documents,
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 27 of 100
c) to ensure that changes and the current revision status of documents are identified,
d) to ensure that relevant versions of applicable documents are available at points of use,
e) to ensure that documents remain legible and readily identifiable,
f) to ensure that documents of external origin determined by the org to be necessary for the planning and
operation of the quality management system are identified and their distribution controlled, and
g) to prevent the unintended use of obsolete documents, and to apply suitable identification to them if they
are retained for any purpose.
EXPLANATION
A document is information that is written or recorded on some medium such as paper or computer. Clause
4.2.1 tells you what documents you must include in your QMS. All documents that you determine under
clause 4.2.1 to be needed for your QMS processes must be controlled. This clause 4.2.3 provides
requirements on how these documents must be controlled. Documents outside the QMS need not be subject
to these controls. This clause requires you to have a documented procedure. Ensure that your procedure
specifically addresses each of the control requirements, in terms of who, what when, where and how as
applicable. Your procedure must address new and old as well as internal and external documents used by
the QMS. You must approve all new QMS documentation prior to issue. Some degree of checking,
examination or assessment is inherent in ‘approval for adequacy’. You must periodically determine if any
updating or revisions of any QMS documentation is needed, and if they are changed, they must be re-
approved for adequacy.
The frequency of this review, responsibility and method must be defined in your procedure. This will be
determined by events within your organization and how mature or recent your QMS is. Auditors will
explore this if they find that your documents have not changed in years, while the nature of your business
has changed significantly. Identify changes made to documents so users know exactly what has changed.
There are many ways of doing this on printed as well as computerized documents. Have a method for
revision control such as a revision log and master-list of documents which identifies the current revision
status. Again, there are other ways of doing this as well.
Not all documents need to be available everywhere within your organization. You must determine what
document is applicable (i.e. needed to assure product or process quality) to a specific process or activity
and make the relevant version of that document available to that activity, e.g. providing current packaging
and shipping work instructions to the shipping department.
Once you determine that certain documents need to be made available at various locations, implement some
form of distribution control. There are many ways to do this. One way would be to keep a distribution log.
Documents can take a beating in very harsh environments (covered in oil, dust, acid eaten, weather-beaten,
etc.) to the point of being illegible. You must regularly review the condition of frequently used hard copy
documents to determine whether they need to be replaced. Documents must also be readily identifiable as
to its purpose and scope. A simple heading may suffice, (e.g. In-process Inspection Sheet). Computerized
documents are sometimes given file names that don’t identify its contents and this might require numerous
files to be opened before you find the right one. Identification also implies effective filing for timely
retrieval, whether manual or computerized. A frequent nonconformity is not being able to retrieve a
document or record because of poor filing procedures. External documents (such as customer drawings or
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 28 of 100
supplier material/part specifications) must be identified. There are many ways to do this. One way would
be to keep a manual or computer list of these documents. Determine who needs these documents and have
some form of distribution control. Don’t overlook supplier, regulatory or industry documents. Apply
applicable controls to these as well.
Obsolete documents can cause many problems if not controlled. There are many ways to do this. One way
would be to provide computerized documents in read-only mode and make only the current version
accessible at workstation computer screens. Obsolete hard copy documents can be removed through
distribution control. Ensure your procedure a covers methods to disallow unauthorized and unapproved or
incorrect documents from being created, used or distributed.
If documents are archived, make sure that all such documents are properly identified, indexed and filed,
and preferably have controlled or restricted access to them. Nonconformities against the document control
process are one of the most frequent audit findings. Develop appropriate performance indicators to
demonstrate effective implementation of your document control process. Examples include – number of
obsolete or unauthorized documents found being used; number of unauthorized changes found; number of
instances documents were not available at points of use; etc. Track trends in these indicators and use this
information to tighten your controls and continually improve your document control process. Use the
PDCA to plan, implement, measure and improve your document control process.
4.2.4 CONTROL OF RECORDS
ISO 9001 REQUIREMENT
Records established to provide evidence of conformity to requirements and of the effective operation of
the quality management system shall be controlled.
The organization shall establish a documented procedure to define the controls needed for the
identification, storage, protection, retrieval, retention and disposition of records.
Records shall remain legible, readily identifiable and retrievable.
EXPLANATION
A record is a special type of document that provides written evidence of results achieved or activity
performed (e.g. an inspection record). Records provide one of the strongest forms of evidence of
maintaining and demonstrating the effectiveness of your QMS. Ensure that your documented procedure
for control of QMS records addresses each of the control requirements specified in this clause, in terms of
who, what when, where and how. These controls apply to all QMS records whether they are hard copy or
computerized.
ISO 9001 calls for many records. Some records are specified, while others are implied. The onus is on you
to demonstrate or provide evidence (records) of conformity to requirements, whether the specific clauses
ask for records or not. Requirements for records may originate from the customer, regulatory, industry, or
within your organization. Ensure you maintain records to conform to all of these as applicable. Records
may also come from suppliers and vendors. All these records are subject to the above controls. The
comments under document control regarding legibility, being identifiable and retrievable apply equally to
QMS records.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 29 of 100
Readily identifiable – relates to easily determining the purpose and scope of the record, e.g. an inspection
record for a product at final inspection. The design of QMS records must prevent confusion or ambiguity
in the completion and use of records. Records must be written legibly to be useful. Also make sure that they
are not exposed to unauthorized change or alteration. For the duration that they are kept, store records in
locations and mediums that will protect against unauthorized access and environmental damage – (covered
in oil, dust, acid eaten, weather-beaten, etc.). Regularly review the condition of records. The indexing and
filing of records (hardcopy or computer) must ensure easy retrieval. Keep a listing of all the different
categories of records and define the retention times associated with each category (inspection and test; sales
and purchasing; management review; calibration; training; etc.). Retention times are typically determined
by customer, regulatory, industry or organizational requirements and policies.
Records must eventually be disposed-off once past their defined retention times. Disposition could range
from permanent destruction of records to permanent storage in a secure onsite or off-site archive. The intent
here is to remove the risk of inadvertent use and availability for current activities and unauthorized access.
Depending upon the industry, specific records may be kept indefinitely.
Nonconformities against the process for control of records arise frequently. Develop appropriate
performance indicators to demonstrate effective implementation of your record control process. Examples
of indicators could include – number of instances of inability to retrieve records; amount of time spent
looking for records; number of instances of incomplete records; number of instances of damaged records
found; etc. Track trends in these indicators and use this information to tighten your controls and continually
improve your record control process. Use the PDCA to plan, implement, measure and improve your process
for record control.
AUDIT CHECKLIST
An audit checklist should cover these areas:
Does the documented Quality Management System (QMS) include a Quality Policy, Quality Objectives,
Quality Manual, Procedures, Work Instructions and Records?
How does the Quality Manual address the ISO requirements? Does it show the exclusions which are not
applicable? Does it have the all the procedures or reference of Procedures?
Does it covers the mandatory 6 Procedures and 19 Records, as required by ISO 9001 STD?
How QMS are controlled documents identified? (Master List?)
Are personnel using up-to-date “instructional” QMS documents?
How these QMS documents are kept current? What triggers a review?
How was the last new QMS document issued? How was the last change or revision handled? Who
approved these changes?
How are new/ changed QMS documents communicated? Was any training done?
Is there a list of QMS records that are controlled? Verify through sampling that they exist, are legible, are
retained, and kept in a secure/safe location. Look at both electronic and paper records.
MANDATORY PROCEDURE
Clause 4.2.1: Not applicable
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 30 of 100
Clause 4.2.2: Quality Manual
Clause 4.2.3: Procedure for control of Document
Clause 4.2.4: Procedure for control of Records.
Mandatory record: Not applicable
Clause 4.2.1: Not applicable
Clause 4.2.2: Not applicable
Clause 4.2.3: Not applicable
Clause 4.2.4: Not applicable
EVIDENCE/IMPLEMENTATION DOCUMENT Not mandatory but helps in fulfillment of
requirement;
Clause 4.2.1:
A document may specify requirements (e.g. a drawing or technical specification), provide direction (e.g.
quality plan), or show results or evidence of activities performed (e.g. records).
Clause 4.2.2: Quality Manual
Have a method for revision control such as a revision log and master-list of documents which identifies the
current revision status. Distribution log for distribution control, in process inspection sheet-readily
identifiable.
Some of the documents for external control may be standards such as ISO standards or Engineering
specification and also customer drawing
Master list of operating procedures, Master list of Work Instruction, Master list of Quality Manual.
ISO 9001-CLAUSE 5.1, 5.2 & 5.3
CLAUSE 5 MANAGEMENT RESPONSIBILITY
ISO 9001-CLAUSE 5.1, 5.2 & 5.3
5.1 MANAGEMENT COMMITMENT
ISO 9001 REQUIREMENT
Top management shall provide evidence of its commitment to the development and implementation of
the quality management system and continually improving its effectiveness by
communicating to the organization the importance of meeting customer as well as statutory and
regulatory requirements,
establishing the quality policy,
ensuring that quality objectives are established,
conducting management reviews, and
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 31 of 100
ensuring the availability of resources.
EXPLANATION
It is the responsibility of top management to provide leadership and direction for quality management within
the organization. They must establish strategic quality management policies, directives and objectives
consistent with the purpose and capabilities of the organization. They must establish the organizational
structure and internal environment that motivates personnel to achieve the organization’s quality
management goals and objectives. They must provide adequate resources to develop, implement, maintain
and improve the QMS. They must periodically review QMS performance to determine it suitability,
adequacy and effectiveness.
Auditors are expected to review documents and records showing top managements role in planning and
implementing the processes that apply clause 5 requirements. The processes within your organization that
perform these activities must be identified. These processes would typically include – business planning,
quality planning, management review, internal communication, organization structure etc. Top
management would be the process owner of all these processes. Top management must communicate
regularly to the organization on the importance of meeting customer and regulatory requirements. The
communication process should define what needs to be communicated, to whom, the methods used.
The frequency and the means for determining communication effectiveness. Top management may
communicate in any number of ways including meetings, documented policies, memos, directives, email
etc. Effectiveness may be measured by asking – how much of the planned activities did we get done? Or to
what extent did we achieve planned results? Clause 5.1 does not require a ‘documented’ procedure.
However, you must identify and document for e.g. process map, process flow diagram etc. the processes
for business planning; quality planning; management review; internal communication; organization
structure; etc. as part of your QMS. You must also identify what specific documents are needed for effective
planning, operation and control of these processes. These documents may include a documented procedure,
business plan, statement of policies and objectives etc. Look at the risks related to your business, products,
processes and resources in determining the nature and extent of documented controls you need to have for
this clause. Where some of clause 5 activities are performed off-site (e.g. at head-office), your QMS must
identify the off-site processes within your QMS and ensure that such processes comply with ISO 9001
REQUIREMENTs. The expectation is to flow down to the off-site facility, the relevant ISO 9001
REQUIREMENTs that you would have to implement, had you carried out the process at your own facility.
5.2 CUSTOMER FOCUS
ISO 9001 REQUIREMENT
Top management shall ensure that customer requirements are determined and are met with the aim of
enhancing customer satisfaction (see 7.2.1 and 8.2.1).
EXPLANATION
Organizations depend on their customers. So it is important that customer relationships be effectively
managed. Accordingly, you must understand current and future needs of customers; you must meet their
requirements and strive to exceed their expectations. To ensure this you must understand your customer’s
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 32 of 100
specific needs and requirements in terms of products, price, delivery communication, service and support.
You must have an effective communication process between your customer and your organization, for
discussion, review, timing, action and responsibility on the above issues. You must have an effective
process for communication and review of the above requirements to relevant personnel or departments
within your own organization. It is top management role to provide the leadership and commitment of time
and resources to ensure this happens. Auditors will look for evidence of this. Clause 7.2.1 gets further into
the details of understanding and processing customer requirements. Clause 8.2.1 sets requirements for
monitoring and measuring customer satisfaction. Clause 5.2 provides the top management’s overall
responsibility for customer relationship management, while clause 7.2.1 provides the front end and clause
8.2.1 provides the back end, of the underlying and detailed activities of customer relationship management.
The requirements of clause 5.2 – customer focus can be included the following processes – business
planning; communications; sales and marketing; and customer satisfaction feedback; etc. You must also
identify what specific documents may be needed for effective planning, operation and control of these
processes. Examples of such documents may include a business plan, statement of customer related policies
and objectives etc.
5.3 QUALITY POLICY
ISO 9001 REQUIREMENT
Top management shall ensure that the quality policy
is appropriate to the purpose of the organization,
includes a commitment to comply with requirements and continually improve the effectiveness of the
quality management system,
provides a framework for establishing and reviewing quality objectives,
is communicated and understood within the organization, and e) is reviewed for continuing suitability.
EXPLANATION
Developing a QMS must be a strategic business decision and therefore top management must provide the
necessary direction and leadership, starting with establishing the quality policy and objectives. Your quality
policy provides top management’s vision on quality management for the organization. It provides the
organization with focused direction, i.e. high level goals and objectives for quality management. Your
quality policy must be consistent with the scope of your QMS and other business, management and
organizational strategies within the organization. Clause 4.1.a requires that you document your quality
policy and clause 5.3.c requires that you specify your commitment to ‘meet requirements’ and ‘continually
improve the effectiveness of your QMS’. Clause 1 specifies requirements for the scope of your QMS. The
wording of the quality policy should preferably specify what requirements are being complied with
customer, regulatory, ISO 9001, etc. It must also clearly state your commitment to continually improve the
effectiveness of the QMS. it may also include other complementary and important policies for business
growth, product or manufacturing technology, workforce competence, business flexibility, etc. What you
state in your quality policy must lead to establishing quality objectives, e.g. if you state in your quality
policy that you will “meet customer requirements”, then from this, you might derive customer focused
objectives for – product defects; customer complaints and returns; on time delivery, etc. Similarly, for the
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 33 of 100
phrase -“meet ISO 9001 REQUIREMENTs”; from this you might derive process objectives for effectively
using ISO 9001 REQUIREMENTs to manage, control and improve all of your QMS processes. Check out
the process performance indicators suggested in our coverage of clause 4.2.3 and 4.2.4. Stating that you
will continually improve the effectiveness of your QMS in your quality policy – can lead to a number of
objectives, as your QMS is comprised of many processes and you could have one or more objectives for
each process. Therefore, each statement in your quality policy may result in one or more quality objectives.
These quality objectives do not need to be stated in your quality policy, but top management must clearly
be involved in providing direction, establishing and reviewing these objectives. Your internal
communication process should cover how the quality policy is communicated throughout the organization.
There are many ways of doing this. Personnel must understand the importance and impact of the quality
policy on the work they do. Your quality policy may be documented in your quality manual or as an
independent document or both. The quality policy is not written in stone. It must be reviewed periodically
by top management, for significant changes in your organization, e.g. management, ownership, relocation,
product, shift in customer base, etc. Such changes may result in changes to the quality policy. The
establishment of the quality policy should be part of the business planning or QMS planning processes. A
review of the quality policy for continuing suitability should be part of your management review process.
As a quality document, the quality policy is also controlled by 4.2.3 control of documents.
AUDIT CHECKLIST
An audit checklist should cover these areas:
Check for evidence of how top management shows its commitment to:
Communicating to the organization the importance of meeting customer as well as statutory and
regulatory requirements,
Establishing the quality policy,
Ensuring that quality objectives are established,
Conducting management reviews, and
Ensuring the availability of resources.
Look for how its made clear how a Customer requirement is translated into action, how the Quality
Policy is communicated regularly, how Quality Objectives are established and by whom, that
reviews are held regularly on the status of business operations, finally how resources are allocated
to the functional areas.
For Clause 5.2, review Customer Satisfaction data that is being collected. Is the data showing that
satisfaction levels are increasing? Have any actions been taken to improve how Customers perceive you?
For Clause 5.3, check the Quality Policy to see if it satisfies Clause 5.3 a, b and c? Through interviews
with personnel, determine if they can tell you what the Quality Policy means in their words? Who reviews
the Quality Policy, how is it done, and how often does this review occur?
When was the last time the Quality Policy was revised and how were the revisions communicated to all
personnel?
MANDATORY PROCEDURE
Clause 5.1: Not applicable
Clause 5.2: Not applicable
Clause 5.3: Not applicable
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 34 of 100
MANDATORY RECORD:
Clause 5.1: Not applicable
Clause 5.2: Not applicable
Clause 5.3: Not applicable
EVIDENCE/ IMPLEMENTATION DOCUMENT NOT MANDATORY BUT HELPS
IN FULFILLMENT OF REQUIREMENT;
Clause 5.1:
Role in planning and implementing the processes- business planning, quality planning, management
review, internal communication, organization structure
Documents for the processes: process map, process flow diagram, a documented procedure, business plan,
statement of policies and objectives
Communicate- meetings, documented policies, memos, directives, email
Clause 5.2:
Process for customer focus: business planning, communications, sales and marketing, and customer
satisfaction feedback
Documents needed for effective planning, operation and control of these processes: – a documented
procedure, business plan, statement of customer related policies and objectives
Clause 5.3:
Documented statement of Quality Policy
ISO 9001-CLAUSE 5.4
ISO 9001-CLAUSE 5.4 PLANNING
CLAUSE 5.4.1 QUALITY OBJECTIVES
ISO 9001 REQUIREMENT
Top management shall ensure that quality objectives, including those needed to meet requirements for
product (see 7.1 a), are established at relevant functions and levels within the organization. The quality
objectives shall be measurable and consistent with the quality policy.
EXPLANATION
The purpose of quality objectives is to determine conformity to (customer and regulatory) requirements,
and effective deployment and improvement of the QMS. Clause 4.1e requires you to measure and analyze
QMS processes and clause 7.1 requires objectives for product. Clause 4.2.1a requires you to document it.
Clause 8.2.3 and 8.2.4 require you to monitor and measure and evaluate results to your planned objectives.
This clause 5.4.1 sets out specific requirements for planning of quality objectives.Top management must
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 35 of 100
provide the leadership, organization and resources to deploy and achieve planned quality
objectives. Quality policy provides the framework for establishing quality objectives in order to be
consistent with it and provided examples of such consistency. In this clause, top management must ensure
that specific quality objectives are established. Quality objectives is used to measure the performance of
products, processes, customer satisfaction, suppliers, use of resources and the overall performance and
effectiveness of the QMS. Quality objectives may be established for all QMS processes.
Examples of quality objectives:
Product – reduction in defect rates, PPM’s (defective parts per million), scrap rates, rework; improvement
in on time delivery (see clause 7.1a).
Process – objectives generally focus on improving process productivity through the elimination or
reduction of variation and waste in process – inputs, outputs, conversion activity and related use of
resources.
Monitor and improve process – productivity, reduction of cycle time, errors, omissions and failures; etc.
Examples could include objectives for – set-up time, run rates, process cycle time, etc.
Customers – reduction in # of complaints, improvement in customer satisfaction rating, on time delivery,
service, support, etc.
Suppliers – material defects, on time delivery, no of complaints with supplier.
Resources includes facility, equipment, labor, etc.- objectives could be established based on availability,
capability, maintenance, personnel competency, absenteeism, production rates; efficiency; safety; etc.
For the QMS – customer satisfaction feedback, internal audit results, # of improvement opportunities; etc.
Quality objectives may be set at various functional levels of the organization – top management,
departments, processes, functional groups, work cells, project teams, individuals, etc. It would be useful
to cover these levels as they add value and contribute to customer or organizational objectives. Employees
at all of these levels must be made aware of the importance of and how they must contribute to the
achievement of these objectives.
Quality objectives must be measurable. Measurement can be done quantitatively or qualitatively.
Quantitative measures are generally more objective in determining whether conformity or effectiveness
has been achieved. In some situations, the use of qualitative measurements may be appropriate. Objectives
based on yes/no criteria, (e.g. – develop new product by March 2006), are also acceptable.
These quality objectives must be deployed and measured and top management must conduct an effective
review of the measurement results. These measurement results must also be used for corrective action and
continual improvement. The quality objectives must be achieved within a defined time period to ensure
accountability. This could be determined by your customer, your management, your head office,
regulatory bodies, etc. Your business or quality planning process must establish these time periods and
include the communication of objectives and timelines to those responsible for achieving them. Quality
objectives may be documented in any or all of these documents such as quality manual, QMS processes,
procedures, quality plans etc. The establishment of quality objectives should be part of the business
planning or QMS planning processes. A review of the quality objectives should be part of your
management review process. As a quality document, your documented statement of objectives must be
controlled by 4.2.3 control of documents. You must be careful not to overwhelm your organization with
too many objectives as this may cause more frustration than positive results. Start with objectives that
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 36 of 100
focus on meeting customer requirements and then slowly develop meaningful objectives for key processes
and risk prone processes, as initial targets are achieved.
CLAUSE 5.4.2 QUALITY MANAGEMENT SYSTEM PLANNING
ISO 9001 REQUIREMENT
Top management shall ensure that
a) the planning of the quality management system is carried out in order to meet the requirements given
in 4.1,as well as the quality objectives, and
b) the integrity of the quality management system is maintained when changes to the quality
management system are planned and implemented.
EXPLANATION
It is the responsibility of top management to provide direction, authorization and, resources and review
for QMS planning. When developing your QMS process controls for determining customer
requirements, design, development, manufacture, delivery and customer support, you must focus on
meeting customer and regulatory requirements as well as the planned QMS objectives established in
clause 5.4.1. QMS planning requires you to identify all your QMS processes and describe their sequence
and interaction. The criteria and methods for planning, operation and control of these processes come
from the rest of the ISO requirements as well as your customer and your own organization.
The continuity and effectiveness of your QMS must be substantially maintained in the event of
significant changes in your QMS or organization, e.g. management, ownership, relocation, technology,
product, shift in customer base, etc. Changes must be carefully planned so as not to disrupt your
organizations ongoing capability and responsibility to effectively meet customer and regulatory
requirements. In such instances, change control would require:
careful planning of the nature and timeline for the changes;
determining the impact or outcome of such changes;
ensuring adequate resources are available to implement the change;
top management authorization
change deployment and follow-up
Review of the QMS by top management after changes are effected.
QMS planning could be a part of business planning or treated as an independent process depending on
organizational structure and responsibilities. The management representative typically facilitates QMS
planning with the various process owners. The process owners must take responsibility for
implementation, maintenance and improvement of their processes. The management representative may
provide training and technical assistance as needed. Top management through business planning must
provide leadership, resources and review of QMS performance. Performance indicators to demonstrate
effective QMS planning could include – achievement of quality objectives; improved customer
satisfaction ratings; reduced number and seriousness of internal/external audit non conformities.
AUDIT CHECKLIST
An audit checklist should cover these areas:
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 37 of 100
For Clause 5.4.1:-
Do Quality Objectives exist? Are they written down?
Do they relate/connect directly to your products/services?
Are they measurable? Are they being measured? Reported?
Does top management ensure that quality objectives are established at relevant functions and levels with
the organisations?
Are the quality objectives measureable and consistent with the quality policy?
Are quality objectives established to ensure that product requirements met?
For Clause 5.4.2:-
How are the QMS/ processes planned out?
Does the top management ensure that QMS planning is carried out in order to meet requirements given in
section 4.1, as well as the quality objectives?
Does the top management ensure that integrity of the QMS is maintained when changes to the QMS are
planned & implemented?
Is the output of this planning documented?
Are there plans in place to achieve the Quality Objectives? Are the plans documented?
Are changes to the QMS implemented in a controlled manner? (As a result of trying to achieve Quality
Objectives, have Customer complaints gone up? Returns or credits risen? More non-conforming products
or services produced? On-time Delivery performance gone down?)
MANDATORY PROCEDURE
Clause 5.4.1: Not applicable
Clause 5.4.2: Not applicable
Mandatory record:
Clause 5.4.1: Not applicable
Clause 5.4.2: Not applicable
Evidence/ Implementation document (Not mandatory but helps in fulfillment of requirement):
Clause 5.4.1: Documented statement of Quality objectives
Example of Quality objective includes
Product – reduction in defect rates, PPM’s (defective parts per million), scrap rates, rework;
improvement in on time delivery
Process – objectives generally focus on improving process productivity through the elimination or
reduction of variation and waste in process – inputs, outputs, conversion activity and related use of
resources. Objectives may be used to monitor and improve process – productivity; reduction of cycle
time, errors, omissions and failures; etc.
Examples could include objectives for – set-up time; run rates; process cycle time; etc.
Customers – reduction in # of complaints; improvement in customer satisfaction rating; on time
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 38 of 100
delivery; service; support, etc, Suppliers – material defects; on time delivery; # of complaints with
supplier.
Resources – (includes facility; equipment; labor; etc.) – objectives could be established based on
availability; capability; maintenance; personnel competency, absenteeism; production rates; efficiency;
safety; etc.
For the QMS – customer satisfaction feedback; internal audit results; # of improvement opportunities;
etc.
Clause 5.4.2:
EVIDENCE could include – achievement of quality objectives; improved customer satisfaction ratings;
reduced number and seriousness of internal/external audit nonconformities.
ISO 9001-CLAUSE 5.5
ISO 9001-CLAUSE 5.5 RESPONSIBILITY, AUTHORITY AND
COMMUNICATION
ISO 9001-CLAUSE 5.5.1 RESPONSIBILITY AND AUTHORITY
ISO 9001 REQUIREMENT
Top management shall ensure that responsibilities and authorities are defined and communicated within
the Organization.
EXPLANATION
Top management must establish the organization necessary to deploy the QMS. It must define the
structure, hierarchy and lines of reporting. Additionally, it must ensure that duties, responsibilities and
authority of all personnel are defined and communicated. All personnel must be clear on their duties,
responsibilities and authority in meeting customer and regulatory requirements. Organization charts, job
descriptions, Standard operating procedures, work instructions, etc., are some of the many ways that top
management may use to define and document this. These must be communicated and deployed, as
applicable, throughout the organization. Orientation training, appointment postings, training on
procedures and work instructions, etc., are some of the many ways in accomplishing this.
The organization structure and lines of reporting; responsibility and authority of managerial functions and
departments may be established by top management and the responsibilities and authorities for the rest of
the organization may be established by the HR function working with various process owners. Again, this
would depend on the size, complexity and culture of the organization. The effective planning, operation
and control of internal communication processes may be demonstrated through the performance indicators.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 39 of 100
ISO 9001-CLAUSE 5.5.2 MANAGEMENT REPRESENTATIVE
ISO 9001 REQUIREMENT
Top management shall appoint a member of the organization’s management who, irrespective of
other responsibilities, shall have responsibility and authority that includes
a) ensuring that processes needed for the quality management system are established, implemented
and maintained,
b) reporting to top management on the performance of the quality management system and any need
for improvement, and
c) ensuring the promotion of awareness of customer requirements throughout the organization.
NOTE The responsibility of a management representative can include liaison with external parties on
matters relating to the quality management system.
EXPLANATION
A member of management, who has sufficient authority to effectively carry out QMS
responsibilities should be appointed as the MR of the organization. The MR’s role is to facilitate,
motivate and promote the deployment of QMS requirements throughout the organization, through
guidance, training, teamwork and assistance. In carrying out QMS responsibilities, the MR may need to
communicate, delegate, empower, report, oversee and interact with individuals at all levels internal and
external to the organization. Irrespective of other responsibilities” means that the MR may wear other
hats and the MR hat does not have to be the primary one. Regardless, once appointed as the MR, the
individual must effectively perform all QMS responsibilities specified in this sub-clause. Much of this
can be done through having access to appropriate resources and through delegation. Top management
may show evidence of the appointment of the MR through an appointment posting, attendance at QMS
review meetings, provision of support, authorization and resources to QMS activities.
Since quality is the responsibility of the entire organization, the role of the MR is to assist process owners
in developing their processes according to the requirements of ISO 9001 relevant to their process. For
example the purchasing, production or warehousing processes must also know how to control
nonconforming product (clause 8.3); take corrective action (clause 8.5.2) or control their records (clause
4.2.4); etc.
Reporting to top management on QMS performance may take place at management review meetings or
other meetings. The information for the report will come from the results of the measurement and
monitoring requirements specified in clause 8 (e.g. internal audits and customer satisfaction feedback,
etc.). The MR must delegate and facilitate the compilation of this information from all the process
owners. The report must include any recommendation to improve the QMS based on the MR’s review of
all QMS measurement and monitoring data. It would be appropriate to discuss and obtain agreement with
affected process owners. ISO 9001 focuses heavily on meeting customer and regulatory requirements and
enhancing customer satisfaction. The MR must likewise promote this focus through all processes that are
directly and even indirectly involved in achieving this. There are many ways of doing this including the
use of training, cross-functional teams, customer focused project teams, project milestone reviews,
designated customer representative, interfaces with the customer, customer specifications, customer
product specific work instructions, etc.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 40 of 100
The MR’s activities must be included in quality planning, management review and communication
processes.
Overall QMS performance indicators may be used to determine how well the MR has performed the
responsibilities.
ISO 9001-CLAUSE 5.5.3 INTERNAL COMMUNICATION
ISO 9001 REQUIREMENT
Top management shall ensure that appropriate communication processes are established within
the organization and that communication takes place regarding the effectiveness of the quality
management system.
EXPLANATION
Communications is a complex and difficult activity. Problems may arise due to incomplete, ambiguous
or inaccurate information being transmitted; transmission to the wrong person, too late or at the wrong
time; use of inappropriate or unreliable media, etc. Communication problems are probably the most
common cause of QMS nonconformities. Tracking some of the more serious communication issues
could serve as useful performance indicators to determine and improve communication process
effectiveness. Clause 4.1 control of processes requires you to determine the sequence and interaction of
QMS processes. Each process requires inputs to flow from one process and outputs to flow to another
process. There is a continuous (communication) flow regarding tangible (materials and product) and
intangible (information) inputs and outputs taking place within your organization.
Top management must plan for internal and external communication methods and resources at the high
level using the business planning process and deploy these methods though the information technology,
logistic and HR processes.
Each process owner must identify the methods of communication such as computer, documents, telephone,
meetings, directives, visual, etc.
use and determine whether these methods are appropriate and are they effective for the purpose intended?
– (do they prevent non-conformities from arising due to the reasons mentioned above?). Process owners
should provide feedback on communications effectiveness to the processes providing and controlling such
resources. Communication by the MR on the effectiveness of the QMS must not only take place at the top
management level but also at appropriate levels within the organization. If everyone is responsible for
quality, then all process owners as well as their personnel are entitled to receive periodic feedback on their
areas of responsibility. ISO 9001 clauses that specify communication requirements include- 4.1.d; 5.1.a;
5.3.d; 5.5.1; 5.5.2.b; etc.
AUDIT CHECKLIST
For Sub-clause 5.5.1:
Are the responsibilities & authority for various functions defined & communicated to facilitate effective
quality mgmt?
Do Organization Charts/Job Descriptions exist? Are they current and accurate? Cover all personnel
identified in the QMS?
How do we publish, or make available, this information?
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 41 of 100
For sub-Clause 5.5.2:
Is a management representative appointed by top management to ensure the processes of the QMS are
established, implemented and maintained?
Is Management Representative identified? How? Shown on Organization Chart?
Are responsibilities of Management Representative identified? How do they maintain the QMS?
How do MR report on QMS performance to the Top Management? How do they find improvements?
How do MR promote awareness of customer requirements throughout the organization?
How do MR liaise with external parties on matters relating to the QMS?
For sub-Clause 5.5.3:
Are the processes of the QMS and their effectiveness communicated between various levels and functions
within the organization?
How is information circulated or distributed to personnel regarding business operating performance? Is it
systematic? Regular meetings?
Do report distribution lists exist? (Check people shown on distribution lists and confirm they receive the
reports)
MANDATORY PROCEDURE
Clause 5.5.1: Not applicable
Clause 5.5.2: Not applicable
Clause 5.5.3: Not applicable
Mandatory record:
Clause 5.5.1: Not applicable
Clause 5.5.2: Not applicable
Clause 5.5.3: Not applicable
Evidence/Implementation document (Not mandatory but helps in fulfillment of requirement):
Clause 5.5.1:
Clarity on their duties, responsibilities and authority: Organization charts, job descriptions, procedures,
work instructions, Orientation packages, appointment postings, sign-off on job descriptions, training on
procedures and work instructions, etc.
Documentation of control methods could include technical manuals, training provided, signage,
computer system etc.
Organization chart (can be part of Quality Manual)
Job Description (can be a separate document or part of Quality Manual)
Clause 5.5.2:
Enhancing customer satisfaction: the use of training, cross-functional teams, customer focused project
teams, project milestone reviews, designated customer representative, electronic interfaces with the
customer, customer specifications, customer product specific work instructions.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 42 of 100
Job Description of Management Responsibility (can be a separate document or part of Quality Manual)
Management Review Record
Clause 5.5.3:
Minutes of Meeting
ISO 9001-CLAUSE 5.6
ISO 9001-CLAUSE 5.6 MANAGEMENT REVIEW
ISO 9001 REQUIREMENT
ISO 9001-CLAUSE 5.6.1 GENERAL
Top management shall review the organization’s quality management system, at planned intervals, to
ensure its continuing suitability, adequacy and effectiveness. This review shall include assessing
opportunities for improvement and the need for changes to the quality management system, including the
quality policy and quality objectives.
Records from management reviews shall be maintained (see 4.2.4).
ISO 9001-CLAUSE 6.5.2 REVIEW INPUT
ISO 9001 REQUIREMENT
The input to management review shall include information on a) results of audits, b) customer feedback, c) process performance and product conformity, d) status of preventive and corrective actions, e) follow-up actions from previous management reviews, f) changes that could affect the quality management system, and g) recommendations for improvement.
ISO 9001-CLAUSE 5.6.3 REVIEW OUTPUT
ISO 9001 REQUIREMENT
The output from the management review shall include any decisions and actions related to a) improvement of the effectiveness of the quality management system and its processes, b) improvement of product related to customer requirements, and c) resource needs.
EXPLANATION
The purpose of conducting management reviews of the QMS is to gauge the health of the QMS. The review
must determine QMS suitability, adequacy and effectiveness. Are the QMS resources and controls that
were planned and implemented suitable and adequate for the QMS to be effective in achieving customer
and regulatory requirements; and in achieving quality objectives? Are changes needed to improve product,
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 43 of 100
processes and use of resources? It would be logical to have a process for management review as it has
specific requirements for management review inputs, value-adding review activities and outputs. The
process should address the frequency, schedule, quorum and agenda for review meetings to be attended by
top management. For the management review process itself to be effective, top management must plan the
review all agenda items with some regularity and take timely action to change or improve any part of it,
including the quality policy and objectives. To avoid problems on frequency and scope of review, an
effective way would be incorporate QMS agenda items into regular monthly or quarterly operational
meetings.
Management review input should preferably be in summary form, showing QMS and operational
performance measured against the business and quality plans, customer and regulatory objectives and goals.
Appropriate actions must result from such reviews.
Review decisions and actions must relate to improving products and processes or even creating new ones,
providing more resources or perhaps improving the efficiency of existing resources, improving QMS
controls, policies and objectives, improving overall QMS effectiveness and customer satisfaction.
Responsibilities and timelines should accompany these decisions and actions. The performance of these
actions must be followed up at subsequent management review meetings. Performance indicators to
measure the effectiveness of the management review process could include – achievement of quality
objectives and improvement in customer satisfaction rating. Clause 5.6 does not require a ‘documented’
procedure. However, you must identify and document the management review process as part of your QMS.
You must also identify what specific documents are needed for effective planning, operation and control of
this process. These documents may include – a documented procedure, review schedule, agenda and action
forms etc., combined with unwritten practices, procedures and methods. Management review records must
include topics discussed, decisions, responsibilities for corrective or improvement actions and related
timelines, provision of resources, and follow-up actions from previous management reviews.
AUDIT CHECKLIST
Is there a review of the QMS by top mgmt at planned intervals to ensure its continuing suitability,
adequacy and effectiveness?
How many top management meetings are considered “Management Review”? How often do they occur?
Who attends the Management review meeting? Meeting results recorded?
Does the review include assessing opportunities / recommendations for improvements of the QMS & its
processes?
Does the review include assessing opportunities / recommendations for improvements of product related
to customer requirements?
Does the review include assessing need to change the QMS, including quality policy & objectives?
Does the review include review of audit results & customer feedback?
Does the review include process performance & product conformance?
Does the review include status of corrective & preventive actions?
Does the review include follow-up actions from earlier review meetings?
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 44 of 100
Does the review include changes that could affect the QMS?
Does the review include resource needs for QMS implementation & improvement?
Does the review include the results of the management review recorded?
MANDATORY PROCEDURE
Not applicable
MANDATORY RECORD
Management review record
Implementation document (Not mandatory but helps in fulfillment of requirement):
Procedure for management review
Monitoring of Quality objective
Management Review Agenda and Minutes
ISO 9001-CLAUSE 6
ISO 9001-CLAUSE 6: RESOURCE MANAGEMENT
ISO 9001-CLAUSE 6.1 PROVISION OF RESOURCES
ISO 9001 REQUIREMENT
The organization shall determine and provide the resources needed
a) to implement and maintain the quality management system and continually improve its effectiveness,
and
b) to enhance customer satisfaction by meeting customer requirements.
EXPLANATION
Top management has the responsibility to ensure the availability of resources to develop and maintain your
QMS. Clause 6.1 requires you to determine the nature and availability of such resources. This is typically
done through business and quality planning. Having adequate resources is vital to ensure product
conformity or satisfy customer requirements – e.g. having adequate personnel, materials and equipment to
ensure timely production and delivery of product. Use business planning (clause 5.1), quality management
planning (clause 5.4) and planning for QMS processes (clause 4.1), to identify and determine the nature of
resource needs of QMS each process and plan for its availability. The actual amount of resources needed
may vary day to day and over time. This is one reason why top management must review QMS performance
regularly. Consider developing performance indicators for each major category of resources used, (e.g.
machinery and equipment; human resources; facility and environment; transport; communication systems;
etc.) to determine the effective use of such resources.
Where the resource planning process is performed off-site (e.g. at head-office), your QMS must include the
off-site processes within your QMS and ensure that such processes comply with ISO 9001
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 45 of 100
REQUIREMENTs. Evidence of the off-site facility’s compliance may include – a copy of their ISO 9001
certification; results of their internal audits to ISO 9001; auditing the outsourced facility; etc.
The expectation is to flow down to the off-site facility, the relevant ISO 9001 REQUIREMENTs that you
would have to implement, had you carried out the process at your own facility.
ISO 9001-CLAUSE 6.2 HUMAN RESOURCES
ISO 9001 REQUIREMENT
ISO 9001-CLAUSE 6.2.1 GENERAL
Personnel performing work affecting conformity to product requirements shall be competent on the basis
of appropriate education, training, skills and experience.
NOTE Conformity to product requirements can be affected directly or indirectly by personnel performing
any task within the quality management system.
ISO 9001-CLAUSE 6.2.2 COMPETENCE, TRAINING AND AWARENESS
The organization shall
a) determine the necessary competence for personnel performing work affecting conformity to
product requirements,
b) where applicable, provide training or take other actions to achieve the necessary competence,
c) evaluate the effectiveness of the actions taken,
d) ensure that its personnel are aware of the relevance and importance of their activities and how
they contribute to the achievement of the quality objectives, and
e) maintain appropriate records of education, training, skills and experience (see 4.2.4).
EXPLANATION
Top management is responsible for ensuring the availability of resources which includes HR. Clause 5.5.1
requires top management to define the organization and its responsibilities and authorities. Clause 6.1
required that adequate resources including HR be determined and provided. And here in clause 6.2 the
specific requirements for controlling HR are defined. Planning for HR process controls must include
determining competency criteria, skills evaluation, identification of training needs, types of training,
provision of training, how training effectiveness is evaluated, methods to communicate awareness of the
importance of quality requirements and meeting quality objectives, to all employees. Although training may
end up being the best solution, don’t overlook other actions, such as, changing processes, improving
procedures, rotating jobs, outsourcing, or recruiting fully training people. Criteria for competency must be
developed based on appropriate education, skills, training and experience for activities, tasks, functions and
processes. The level and detail of such qualifications, skills, training and experience will depend upon the
complexity of product, process, technology and customer and regulatory requirements. It is up to your
organization to determine the necessary criteria for the various functions and activities affecting product
and QMS based on these factors. A “Skills Matrix” is a useful tool used by organizations to determine and
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 46 of 100
manage the competency levels required by different activities and functions. Organizations undergo
significant changes through growth or decline, acquisitions, new technology and new products and
processes, Also, many organizations are now outsourcing their production labor to save on payroll costs
and benefits. Labor related nonconformities can easily arise in such cases. Planning for your HR process
must ensure that contract and agency personnel performing work affecting product quality have adequate
competency and training. Appropriate records must be kept of such training.
Quality awareness must be focused on meeting customer and regulatory requirements. The process to
promote quality awareness may include the use of methods such as – cross-functional teams, involvement
in quality planning, quality circles, improvement suggestions, product workshops, zero defect programs,
product review checklist etc. QMS personnel must be motivated to achieve the organizations quality
objectives. The process to motivate employees may include the use of methods such as – employee
recognition awards, ongoing training programs, performance reviews, employee surveys, poster campaigns
etc.
You must determine and keep appropriate records of education, training, skills and experience. These
records must demonstrate the effective operation of HR process controls. Performance indicators to
measure the effectiveness of the HR process in determining competency and training needs of the
workforce, could include – employee turnover, employee complaints, number of instances unqualified
personnel were found performing QMS activity, number of instances competency criteria were not met and
number of instances no training or competency records maintained; etc.
ISO 9001-CLAUSE 6.3 INFRASTRUCTURE
ISO 9001 REQUIREMENT
The organization shall determine, provide and maintain the infrastructure needed to achieve conformity
to product requirements. Infrastructure includes, as applicable,
a) Buildings, workspace and associated utilities,
b) process equipment (both hardware and software), and
c) supporting services (such as transport, communication or information systems).
EXPLANATION
Planning for the types of infrastructure resources needed for your business may include facility,
production equipment, IT equipment and software, laboratory, packaging, dies, molds, tooling, jigs,
fixtures, storage, transportation, communication, office, materials, labor, utilities and supplies, etc.
The key strategic business factors to be considered for infrastructure planning include future needs,
current availability and capacity, cushion for growth, contingency planning, linkage to current and future
product programs. This planning may be done through business planning (clause 5.1); quality
management planning (5.4) and planning for QMS processes Clause 4.1). The actual deployment of such
resources may be determined by each process owner.
You are required to maintain your infrastructure. Your planned preventive maintenance program should
include controls for schedule and timing, availability and training of personnel, types and scope of
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 47 of 100
maintenance, maintenance and competency/training records, tracking to maintenance objectives, use,
storage and control of spare parts, control of any maintenance outsourcing etc.
ISO 9001-CLAUSE 6.4 WORK ENVIRONMENT
ISO 9001 REQUIREMENT
The organization shall determine and manage the work environment needed to achieve conformity to
product requirements.
NOTE The term “work environment” relates to those conditions under which work is performed including
physical, environmental and other factors (such as noise, temperature, humidity, lighting or weather).
EXPLANATION
Work environment include controls for ergonomics, personnel safety and facility conditions that are
conducive to achieving product quality. Some of the factors to consider in determining and managing the
work environment include ergonomics (worker movement; fatigue; manual effort and loads, etc.),
workplace location, heat, light, humidity, airflow, noise, vibration, hygiene, cleanliness, pollution, adequate
facilities (lockers, lunchroom, cafeteria, washrooms etc); health and safety regulations; cleanliness of
premises; etc. the extent to which the above environmental factors may apply to any organization will vary
based on size, risk and other considerations. The focus should be employee safety, welfare and product
conformity. Performance indicators to measure the effectiveness of processes that determine and control
the effective use of infrastructure may include equipment maintenance – uptime / downtime; productivity
– equipment and workforce; accident and safety incidents; non-value added use of floor space; excessive
handling and storage; number of instances specific resources were not available or delayed;
AUDIT CHECKLIST
For Clause 6.1:
How are resource needs identified and provided, for all areas of the quality management system?
Are resources determined and provided for implementing, maintaining and improving the processes of
the quality management system?
Are resources determined and provided for enhancing customer satisfaction by meeting customer
requirements?
Are resources directed towards improving the effectiveness of the quality management system? How?
(Obtain examples)
How have resources been provided to “enhance” Customer satisfaction levels? (Obtain examples)
Keep in mind that to audit Clause 6.1 you need an overall perspective of the entire QMS in order to make
an informed assessment here.
For Clause 6.2:
Are personnel assigned responsibilities defined in the QMS competent on the basis of applicable
education, training, skills/qualifications and experience?
Are competency needs for personnel performing activities affecting quality identified?
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 48 of 100
Are training provided to satisfy the competency needs?
Is effectiveness of training provided evaluated?
Are appropriate records of education, experience, skills/qualifications and training maintained?
How do you ensure that a person is competent in their job? How is this checked? How often does this
check occur?
How are competency gaps identified? How are gaps closed?
How do you know that the action that was taken actually closed the gap?
How are employees advised on how they can individually contribute to achieving any of the Quality
Objectives?
For Clause 6.3:
How does the organization identify a need to add to the current infrastructure? (i.e. new buildings or
additions, new or replacement process hardware or software, enhanced support services such as new
or upgraded information technology)
Is there a capital expenditure budget process? What has been done to the infrastructure in the past 12
months? Once the proper infrastructure is in place, how is it maintained?
Any Customers orders being affected by lack of a proper infrastructure?
For Clause 6.4:
How are employees provided with a suitable work environment for supplying the products and services
being offered by the company?
Are work areas properly controlled for lighting and climate conditions?
Are work areas organized and provide safe working conditions?
MANDATORY PROCEDURE
Not applicable
MANDATORY RECORD
For Clause 6.1: Not applicable
For Clause 6.2: List of employees showing records of education, training, skills and experience
For Clause 6.3: Not applicable
For Clause 6.4: Not applicable
Implementation document (Not mandatory but helps in fulfillment of requirement)
For Clause 6.1:
List of employees showing records of education, training, skills and experience
Competency Matrix
For Clause 6.2:
Competency Matrix
Induction training record
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 49 of 100
Training record
Training needs
Skills matrix
For Clause 6.3:
Site layout plan
Equipment list
Transport list
For Clause 6.4:
Accident record
Housekeeping record
ISO 9001-CLAUSE 7.1
ISO 9001-CLAUSE 7 PRODUCT REALIZATION
ISO 9001-CLAUSE 7.1 PLANNING OF PRODUCT REALIZATION
ISO 9001 REQUIREMENT
The organization shall plan and develop the processes needed for product realization. Planning of
product realization shall be consistent with the requirements of the other processes of the quality
management system (see 4.1).
In planning product realization, the organization shall determine the following, as appropriate:
a) quality objectives and requirements for the product;
b) the need to establish processes and documents, and to provide resources specific to the product;
c) required verification, validation, monitoring, measurement, inspection and test activities specific to
the product and the criteria for product acceptance;
d) records needed to provide evidence that the realization processes and resulting product meet
requirements (see 4.2.4).
The output of this planning shall be in a form suitable for the organization’s method of operations.
NOTE 1 A document specifying the processes of the quality management system (including the product
realization processes) and the resources to be applied to a specific product, project or contract can be
referred to as a quality plan.
NOTE 2 the organization may also apply the requirements given in 7.3 to the development of product
realization processes.
EXPLANATION
Clause 7.1 is essentially a repeat of clause 4.1, but applied specifically to product realization processes.
The focus is on controls governing the making of product to meet customer requirements and all the QMS
processes that, directly or indirectly, make this happen. Product realization processes may include
customer related processes (sales and marketing), design and development, production, shipping,
receiving, packaging, measurement and monitoring of product and processes, etc., whether performed
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 50 of 100
onsite or off-site. Some of the support processes that come to bear on product realization include
document control, record control, human resources, infrastructure provision and maintenance, IT,
purchasing and materials management, laboratory services and control of monitoring and measuring
devices, business planning etc. The output of product realization planning may be implemented in many
different ways. It does not necessarily have to be all in one document, but may sometimes include several
documents such drawings, machine set-up, inspection criteria, process sheets etc. These must be readily
available to those performing realization processes.
You may also consider using specific product, contract or project quality plans to accomplish this. Your
quality plans should include the processes needed, process sequence and control parameters, specific
resources needed to make, verify and deliver product, product acceptance criteria and quality objectives,
product and process monitoring and measurement controls, plans to control and correct any product or
process nonconformities, reference to support processes, documents needed such as work instructions or
engineering specifications, etc. and details of records to be kept. Focus on defect prevention in planning
the controls for product realization. The notes to 7.1 also permit you to use other project management
tools or clause 7.3 product design and development requirements to plan for product realization processes.
Quality objectives may include defect rates, scrap rates, etc. Requirements or criteria for the product may
include physical properties, dimensional, functional, etc., and their related measurements, tolerances and
acceptance levels.
In many instances, depending on the nature of the product, the customer may specify objectives and
requirements and criteria for the product realization processes as well. You must identify and document
all processes addressing this clause as part of your QMS. For these processes, you must also identify what
specific documents are needed for effective planning, operation and control of production
processes. These documents may include contracts, specifications, orders, product quality plans, work
instructions, a documented procedure etc., combined with unwritten practices, procedures and
methods. Look at the risks related to your product, processes and resources in determining the nature and
extent of documented controls you need to have. Where any of the product realization processes are done
off-site (e.g. at head-office), your QMS must include the off-site processes within your QMS and ensure
that such processes comply with ISO 9001 requirements. The expectation is to flow down to the off-site
facility, the relevant ISO 9001 REQUIREMENTs that you would have to implement, had you carried out
the process at your own facility. Performance indicators to measure the effectiveness of product
realization in meeting requirements and achieving quality objectives will be specific to each realization
process and focus on reducing variation and waste in realization processes and related use of
resources. Objectives may be used to monitor and improve process productivity, reduction of cycle time,
errors, omissions and failures etc. You must also consider indicators to measure product performance
such as – reduction in defect rates, PPM’s (defective parts per million), scrap rates, waste and rework,
improvement in on time delivery, product returns from customers etc.
AUDIT CHECKLIST
Are the processes needed for product realization planned, developed and documented in a quality plan?
Are the following determined in the quality plan, as appropriate:
1) Quality objectives for product, project or contract
2) Need to establish processes / documents
3) Need to provide resources / facilities
4) Required verification, validation, monitoring, inspection, test activities & criteria for acceptance
5) Records to provide evidence of conformity to established processes & product requirements?
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 51 of 100
Interview those employees responsible for launching new products, services and processes. Get answers
to these questions:
1. is there a plan on how existing products/services will be produced or supplied? Is there a flowchart of
the main steps?
2. Is a plan in place for introducing: New products? New services? New contracts? New processes?
New projects? New locations? New computer systems?
3. Any examples of these “new” activities in the past 12 months? If so, was a plan followed? Is a
checklist used? How was implementation of all the critical steps managed?
4. How is the transition from “new” to “normal operations” managed?
5. How are new processes monitored and measured? How are any new records identified? What is the
result/output of any planning activities?
MANDATORY PROCEDURE
Not applicable
MANDATORY RECORD
records needed to provide evidence that the realization processes and resulting product meet
requirements. This is bit tricky and can be done in number of ways depending on the type of organization.
For e.g. in manufacturing process it can be done in the following steps
1) Understanding customer requirement- Contract review or order details
2) Converting requirement into plan- Quality plan, Process plan
3) evidence of product meeting requirement-Pre dispatch inspection report
4) evidence of process meeting requirement- in process inspection report
EVIDENCE/IMPLEMENTATION DOCUMENT
Not mandatory but helps in fulfillment of requirement
Output of product realization planning: drawings, machine set-up, inspection criteria, process sheets,
work instructions or engineering specifications, Objectives may be used to monitor and improve process –
productivity, reduction of cycle time, errors, omissions and failures, etc.
ISO 9001-CLAUSE 7.2
ISO 9001-CLAUSE 7.2 CUSTOMER-RELATED PROCESSES
ISO 9001-CLAUSE 7.2.1 DETERMINATION OF REQUIREMENTS
RELATED TO THE PRODUCT
ISO 9001 REQUIREMENT The organization shall determine a) requirements specified by the customer, including the requirements for delivery and post-delivery activities, b) requirements not stated by the customer but necessary for specified or intended use, where known, c) statutory and regulatory requirements applicable to the product, and
d) any additional requirements considered necessary by the organization.
NOTE Post-delivery activities include, for example, actions under warranty provisions, contractual
obligations such as maintenance services, and supplementary services such as recycling or final disposal.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 52 of 100
ISO 9001-CLAUSE 7.2.2 REVIEW OF REQUIREMENTS RELATED TO
THE PRODUCT
ISO 9001 REQUIREMENT
The organization shall review the requirements related to the product. This review shall be conducted prior
to the organization’s commitment to supply a product to the customer (e.g. submission of tenders,
acceptance of contracts or orders, acceptance of changes to contracts or orders) and shall ensure that
a) product requirements are defined,
b) contract or order requirements differing from those previously expressed are resolved, and
c) the organization has the ability to meet the defined requirements. Records of the results of the review
and actions arising from the review shall be maintained (see 4.2.4).
Where the customer provides no documented statement of requirement, the customer requirements shall
be confirmed by the organization before acceptance. Where product requirements are changed, the
organization shall ensure that relevant documents are amended and that relevant personnel are made aware
of the changed requirements.
NOTE In some situations, such as internet sales, a formal review is impractical for each order. Instead the
review can cover relevant product information such as catalogues or advertising material.
ISO 9001-CLAUSE 7.2.3 CUSTOMER COMMUNICATION
The organization shall determine and implement effective arrangements for communicating with
customers in relation to
a) Product information,
b) inquiries, contracts or order handling, including amendments, and
c) customer feedback, including customer complaints.
EXPLANATION
Customer related processes must include controls for determining customer and regulatory requirements, a
review of such requirements, and communication with the customer. Customer requirements extend beyond
product specifications and may include on-time delivery, packaging, labeling, mode of delivery,
documentation, communications, QMS requirements, after sales servicing, etc. Many of these requirements
may also come from regulatory, industry or from within your own organization. Depending on the product
or service, you must determine if any industry or regulatory requirement is applicable on product
characteristics or process parameters that affect the product’s safety or compliance with regulatory
requirements. You must consider all laws and regulatory requirements that may affect your product,
materials, labor, production processes, your facility and work environment, etc. Where some or all of the
processes – for determining customer requirements; for contract review and customer communication; etc.,
are done offsite, then you must show the linkages and interaction of these offsite activities with your on-
site QMS processes. The nature of requirements review may be different for different types of product or
services. Your review records must show the basis of review. Make sure you do your due diligence and risk
analysis before you commit to contractual arrangements. I have seen many companies get into serious
financial trouble, for taking on products transferred from another supplier, because they did not assess all
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 53 of 100
the risks. Manufacturing risk analysis is an assessment of your organization’s capacity and capability to
effectively and efficiently provide the customer specified deliverables. Risk analysis should include timing,
resources, development costs and investments, potential for, and effects of, possible failures in processes,
including suppliers. You should also consider financial and profitability risk. Sometimes it may take a few
months to receive an order or contract from the customer, after you have sent them your quotation. Your
review process must ensure that you compare the customer’s order or contract with your latest quotation,
and resolve any differences (accept or re-negotiate), before you accept the order or contract. Your customer
relations management process must include a sub-process for change control and must include – a review
of the change either from customer or internal from organization and its impact on fit, form, functionality,
other processes, financial, delivery, etc. Have a process for change control. For significant issues or
changes, obtain customer approval in writing for any waivers or changes of contractual or QMS
requirements. Customer communications may take many forms such as software and interfaces for design
and development, logistics, customer satisfaction feedback, etc. You must ensure that personnel at all levels
have the competency and training to use these communications media and tools. You must identify and
document all processes addressing this clause as part of your QMS. For these processes, you must also
identify what specific documents are needed for effective planning, operation and control of production
activities. These documents may include – contracts, specifications, orders, product quality plans, work
instruction, a documented procedure etc., combined with unwritten practices, procedures and
methods. Look at the risks related to your product, processes and resources in determining the nature and
extent of documented controls you need to have. Performance indicators to measure the effectiveness of
customer-related processes in meeting requirements and achieving quality objectives should focus on
reducing variation in and improving these processes and related use of resources. Indicators may include
reduction in quote cycle time, pre and post-award review cycle time, order-entry errors and omissions etc.,
and improvement in conversion ratio (i.e. ratio of contracts/orders awarded to quotes).
AUDIT CHECKLIST
For Clause 7.2.1:
How are Customer requirements determined? Any specification being provided?
What are the requirements specified by the customer, including delivery and post-delivery activities?
What are the requirements not specified by the customer but necessary for intended or specified use?
What are the statutory, regulatory requirements and any other requirements determined by the
organisations?
For Clause 7.2.2:
How are product and service requirements adequately defined/documented?
Are quotes/proposals reviewed prior to issue? Are they checked against subsequent orders that are
received? Can orders be received verbally?
Does the organisations has the ability to meet the defined requirements?
How are requirements reviewed to ensure they can be met? Who does the review?
Are the results of the product/contract review and subsequent follow-up actions recorded?
Are customer requirements confirmed, if the customer provides no documented requirements?
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 54 of 100
How are Contract or order requirements that differ from those previously expressed resolved?
Where product/contract requirements are changed, does the organisations ensure that relevant
documentation is amended? Relevant personnel are made aware of the changed requirements?
For Clause 7.2.3:
How is product/service information provided to Customers?
How are inquiries handled? Placing of orders? Changes to orders?
How can Customers provide feedback? Is there a process to handle it?
Does the organisations identify and implement arrangement for communication with the customers
relating to product information, Inquiries, contract or order handling, including amendments and
Customer feedback, including customer complaints.
MANDATORY PROCEDURE
Not applicable
MANDATORY RECORD
Records of the results of the review and actions arising from the review shall be maintained-Contract
Review
EVIDENCE/ IMPLEMENTATION DOCUMENT Not mandatory but helps in fulfillment of
requirement.
For Clause 7.2.1:
Customer requirements extend beyond product specifications and include – on-time delivery, packaging,
labeling, mode of delivery, documentation, communications, QMS requirements, after sales servicing, etc.
Documents are needed for effective planning, operation and control of production activities: contracts,
specifications, orders, product quality plans, work instructions, a documented procedure, etc., combined
with unwritten practices, procedures and methods.
For Clause 7.2.2:
Evidence of review of customer requirement may include Minutes of meeting of contract review, procedure
for contract review, Verbal Communication form, Order Acknowledgment, Proforma Invoice, Invoice
Excise, Quotation form, Product Catalogs etc.
For Clause 7.2.3:
Customer communications – management representative, computerized interfaces and software for product
(EDI, CAD), Customer provided software and interfaces for design and development, logistics, customer
satisfaction feedback.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 55 of 100
ISO 9001-CLAUSE 7.3
ISO 9001-CLAUSE 7.3 DESIGN AND DEVELOPMENT
ISO 9001-CLAUSE 7.3.1 DESIGN AND DEVELOPMENT PLANNING
ISO 9001 REQUIREMENT
The organization shall plan and control the design and development of product.
During the design and development planning, the organization shall determine
a) the design and development stages,
b) the review, verification and validation that are appropriate to each design and development stage, and
c) the responsibilities and authorities for design and development.
The organization shall manage the interfaces between different groups involved in design and
development to ensure effective communication and clear assignment of responsibility.
Planning output shall be updated, as appropriate, as the design and development progresses.
NOTE Design and development review, verification and validation have distinct purposes. They can be
conducted and recorded separately or in any combination, as suitable for the product and the organization.
EXPLANATION
You must include product design and development in your QMS scope if you contract or convey the
perception that you design product, regardless whether you buy, outsource or actually do design and
development. The scope of your design and development activity must consider all aspects of the product
and product realization processes to ensure its conformity to requirements. This includes product
identification, handling, packaging, storage and protection during internal processing and delivery to the
customer. Product design and development sometimes results in new manufacturing processes or changes
to existing manufacturing processes. This clause is equally applicable for designing and developing
manufacturing processes. Product design and development planning must focus on error prevention
rather than detection in product quality as well as product realization processes.
You must have an overall plan for your design project. Your plan must specify the design and
development stages, activities and tasks, responsibilities, timeline and resources, specific tests,
validations, and reviews, and outcomes. There are many tools available for planning ranging from a
simple checklist to complex software. The degree and details of planning may vary according to size and
length of contract or project, complexity, risk, product life, customer and regulatory requirements, past
experience with similar product, etc. You have flexibility in determining the scope of the stages, review,
verification and validation required for your product design and development projects.
Your plan must be dynamic and updated as requirements and circumstances change. You must track
progress against your plan at regular intervals or project milestones and update the plan as activity
progresses. Your design and development plan must include methods to communicate information,
responsibilities, results, discussions, reviews and resources. You must take a multi-disciplinary approach
that includes as needed, other functions (besides design) such as quality, engineering, purchasing, sales,
tooling, production, etc. Your plan must clearly identify these other functions and their specific role and
responsibilities regarding the project. Consider including customer and supplier personnel at appropriate
stages to do work and review results or progress.
A multi-disciplinary approach applies collective and relevant knowledge and skills of these different
functions to carry out or review design and development activities. The design and development project
plan serves as both a document and a record as it is updated for completion for various activities. Where
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 56 of 100
some or all of clause 7.3 design and development activities are done offsite, then you must show the
linkages and interaction of these offsite activities with your on-site QMS processes.
You must identify and document all processes addressing this clause as part of you. For these processes,
you must also identify what specific documents are needed for effective planning, operation and control
of production activities these documents may include contracts, technical drawings and specifications, a
documented plan for design and development, work instructions, a documented procedure etc., combined
with unwritten practices, procedures and methods. Look at the risks related to your product, processes and
resources in determining the nature and extent of documented controls you need to have. Many
organizations use various software tools to document their product or process design and development
plans. If the nature of your business does not require you to design and develop product (e.g. you
manufacture strictly from customer provided engineering drawings and specifications), then you must
clearly state this exclusion to your QMS scope, in your quality manual. Performance indicators (to
measure the effectiveness of design and development processes in meeting requirements and achieving
quality objectives) should focus on reducing variation in and improving these processes and related use of
resources. Indicators may include reduction in design cycle time, development cycle time, specification
errors, omissions, changes, design and development costs etc., as well as measurable improvements in
products developed.
ISO 9001-CLAUSE 7.3.2 DESIGN AND DEVELOPMENT INPUTS
ISO 9001 REQUIREMENT
Inputs relating to product requirements shall be determined and records maintained (see 4.2.4). These
inputs shall include
a) functional and performance requirements,
b) applicable statutory and regulatory requirements,
c) where applicable, information derived from previous similar designs, and
d) other requirements essential for design and development.
The inputs shall be reviewed for adequacy. Requirements shall be complete, unambiguous and not in
conflict with each other.
EXPLANATION
You must identify, document and review design inputs requirements for function, performance, safety,
regulatory, quality, reliability, durability, life, timing, maintainability, cost, identification, traceability,
packaging, special or safety characteristics from the customer or regulatory body, and other requirements
essential to the product. You must have a process that should be part of your design and
development plan to identify, document, review , deploy and use design input information such as
documents coming from various sources such as customer contracts, drawings and specifications, your
own organization’s database of previous design and development projects, competitor analysis, industry
standards, feedback from suppliers, field data.
Design and Development usually requires the input and involvement of many other functions and
processes such as contract review, product realization, purchasing, top management etc. within the
organization and your process must manage this interaction by defining responsibilities and means of
communications. Inclusion of these controls in your design and development plan is one of many
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 57 of 100
effective ways to achieve this. Such a multi-disciplinary approach has the benefit of applying the
collective and relevant knowledge and skills of these different functions to carry out or review design and
development activities.
You must identify and include any special and safety characteristics in your process control documents
such as quality plans, product drawings, operator instructions and other documents used to make or verify
product. Note that special requirements can also include process parameters such as temperature, timing,
concentrations, etc. You must review all input requirements, review design and development progress,
verify product design and validate developed product at various stages of your design and development
process. The nature, frequency and scope of these controls must be defined in your design and
development plan or other document. You must carry out these controls according to your plan and keep
appropriate records.
ISO 9001-CLAUSE 7.3.3 DESIGN AND DEVELOPMENT OUTPUTS
ISO 9001 REQUIREMENT
The outputs of design and development shall be in a form suitable for verification against the design
and development input and shall be approved prior to release.
Design and development outputs shall
a) meet the input requirements for design and development,
b) provide appropriate information for purchasing, production and service provision,
c) contain or reference product acceptance criteria, and
d) specify the characteristics of the product that are essential for its safe and proper use.
NOTE Information for production and service provision can include details for the preservation of
product.
EXPLANATION
Design and development output may be product or documentation or both. Product may be prototype or
finished product and documentation could be a computerized or hardcopy drawing or specification. Check
design and development output against the input requirements specified in 7.3.2, before you use it any
further. Provide appropriate design and development output information to:
Purchasing material or service specifications
Production output such as product specifications, special characteristics, drawings, diagnostics, etc.
Service output such as product specifications; performance reliability and maintenance criteria.
Initially, this information may be used for trials and validation, before being firmed up. Many documents
are created from the design and development output stage such as drawings, quality plans, work
instructions, etc. These documents must be controlled as per clause 4.2.3 such as approval, revision control,
distribution, etc.
Where any sophisticated design and development tools such as AutoCAD are used requiring specific
competency or training, ensure you provide and keep appropriate records of competency and training of
personnel performing design and development activities and use of these tools.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 58 of 100
ISO 9001-CLAUSE 7.3.4 DESIGN AND DEVELOPMENT REVIEW
ISO 9001 REQUIREMENT
At suitable stages, systematic reviews of design and development shall be performed in accordance
with planned arrangements (see 7.3.1)
a) to evaluate the ability of the results of design and development to meet requirements, and
b) to identify any problems and propose necessary actions.
Participants in such reviews shall include representatives of functions concerned with the design
and development stage(s) being reviewed. Records of the results of the reviews and any necessary actions
shall be maintained (see 4.2.4).
EXPLANATION
Do design reviews at one or more milestones of the design and development project, depending on customer
requirements, the size, complexity and risks involved. The purpose of these reviews is to evaluate results
to requirements, check project progress and costs to plan and take actions on any problems
encountered. You must take a multi-disciplinary approach for doing these reviews and keep appropriate
records of issues discussed, actions to be taken, responsibilities and timeline for completion. All design and
development reviews must be included in your design and development plan.
ISO 9001-CLAUSE 7.3.5 DESIGN AND DEVELOPMENT VERIFICATION
ISO 9001 REQUIREMENT
Verification shall be performed in accordance with planned arrangements (see 7.3.1) to ensure that the
design and development outputs have met the design and development input requirements. Records of the
results of the verification and any necessary actions shall be maintained (see 4.2.4).
EXPLANATION
Product design Verification includes design reviews, comparing the new design to a similar proven design
if available, performing alternate calculations, performing tests and simulations, reviewing the design
documents before release, etc. Verification is checking product or process to input requirements, whereas
validation is checking product or process is suitable for its intended use does it perform/function in the way
intended by your customer or your organization. Manufacturing process design verification include design
review, process capability studies, testing various process parameters, performing tests and trials, reviewing
the manufacturing process design documents before release, etc.
If you outsource any part of your design and development activity, then you must exercise the same controls
required by clause 7.3 on the outsourced work and the organization doing the work, had it been done
internally.
You must keep records for verification.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 59 of 100
ISO 9001-CLAUSE 7.3.6 DESIGN AND DEVELOPMENT VALIDATION
ISO 9001 REQUIREMENT
Design and development validation shall be performed in accordance with planned arrangements (see 7.3.1)
to ensure that the resulting product is capable of meeting the requirements for the specified application
or intended use, where known. Wherever practicable, validation shall be completed prior to the delivery
or implementation of the product. Records of the results of validation and any necessary actions shall
be maintained (see 4.2.4).
EXPLANATION
Product and manufacturing process validation includes – design reviews, comparison between customer
requirements and internal development plans, design and development validation against customer
requirements and design and development input requirements, corrective action and lessons learned from
documented process failures and product nonconformities. If you outsource any part of your design and
development activity, then you must exercise the same controls required by clause 7.3 on the outsourced
work and the organization doing the work, had it been done internally. You must keep records for validation
activities.
ISO 9001-CLAUSE 7.3.7 CONTROL OF DESIGN AND DEVELOPMENT
CHANGES
ISO 9001 REQUIREMENT
Design and development changes shall be identified and records maintained. The changes shall be
reviewed, verified and validated, as appropriate, and approved before implementation. The review of design
and development changes shall include evaluation of the effect of the changes on constituent parts and
product already delivered. Records of the results of the review of changes and any necessary actions shall
be maintained
EXPLANATION
Make sure your process for design and development changes follow appropriate steps of clause 7.3 ie define
plan, have inputs and outputs, verify and validate to the extent necessary to meet customer requirements
and control product, quality and business risks. Changes may come from internal, customer or regulatory
sources. Get all requests for product or manufacturing process design changes in writing from your
customer.
Impact of the change must be evaluated on materials used, design process, manufacturing process,
characteristics and use of developed product, regulatory compliance, cost etc.
AUDIT CHECKLIST
An audit checklist should cover these areas:
For Clause 7.3.1:
How are the stages of design planned?
Is planning output updated, as appropriate, as the design and development progresses?
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 60 of 100
How are the design and development stages determined?
How is design and development review, verification and validation activities determined?
How is responsibilities & authority for design and/or development activities determined?
Are the interfaces between different groups managed to ensure effective communication & clarity of
responsibilities?
Are planning output kept up-to-date?
For Clause 7.3.2:
How are input requirements identified and documented?
Do the design and development input includes functional & performance requirements, applicable
statutory & regulatory requirements, applicable information derived from similar design and Any other
essential requirements?
For Clause 7.3.3:
Where do design outputs approved before issue?
Where do design outputs meet the design/development input requirements?
Where do design outputs provide appropriate information for production & service operations?
Where do design outputs contain or reference product acceptance criteria?
Where do design outputs define the characteristics of the product that are essential to its safe and proper
use?
For Clause 7.3.4:
How often are design and development reviews done? How are all input requirements checked?
At suitable stages, are systematic reviews of design and development conducted to evaluate ability to
fulfill requirements and to identify problems & propose follow-up actions?
Are results of the review and any necessary action of the review recorded?
Do representatives of the functions concerned with the design and development participate in design &
development review?
For Clause 7.3.5:
How is the design verified? When is it verified? Is it documented?
Is design & development verification performed to ensure that the design and development outputs meets
its inputs?
Are the results of the verification and resulting follow-up actions recorded?
For Clause 7.3.6:
How is the design validated? When is it validated? Is it documented?
Is design & development validation performed to confirm that the resulting product is capable of meeting
the requirements for intended use?
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 61 of 100
Wherever applicable, is validation completed before delivery or implementation of the product?
Are results of validation & subsequent follow-up actions recorded?
For Clause 7.3.7:
How are design changes reviewed? How is impact evaluated? Are Record kept?
Are these identified, documented, reviewed, verified and validated, as appropriate before implementation?
Are there evaluation of the effect of changes on constituent parts and products already delivered?
MANDATORY PROCEDURE
Not applicable
MANDATORY RECORD
For Clause 7.3.1: Not applicable
For Clause 7.3.2: D&D input record for e.g. Design data Input sheet, Customer specification
For Clause 7.3.3: Not applicable
For Clause 7.3.4: Record of D & D review for e.g. Design Review Records, D&D Minutes of meeting
For Clause 7.3.5: D & D verification for e.g. Adequacy report, D&D plan, and test plan
For Clause 7.3.6: D& D Validation for e.g. Feasibility report, User acceptance test plan, and acceptance
record
For Clause 7.3.7: D& D change for e.g. Design change record, D&D review MOM
EVIDENCE/IMPLEMENTATION DOCUMENT Not mandatory but helps in fulfillment of
requirement:
Procedure for design and development
Checklist for Design Input Adequacy
Design and Development input
List of Design output
Documents are needed for effective planning, operation and control of production activities:-
contracts, technical drawings and specifications, a documented plan for design and development,
work instructions, a documented procedure, etc., combined with unwritten practices, procedures
and methods.
Performance indicators: – include reduction in – design cycle time, development cycle time,
specification errors, omissions, changes, design and development costs, etc., as well as measurable
improvements in products developed.
Design input information (documents): customer contracts, drawings and specifications, your own
organization’s database of previous design and development projects, competitor analysis, industry
standards, feedback from suppliers, field data. contract review, product realization, purchasing, top
management- quality plans, product drawings, operator instructions and other documents used to
make or verify product
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 62 of 100
ISO 9001-CLAUSE 7.4
ISO 9001-CLAUSE 7.4 PURCHASING
ISO 9001-CLAUSE 7.4.1 PURCHASING PROCESS
ISO 9001 REQUIREMENT
The organization shall ensure that purchased product conforms to specified purchase requirements. The
type and extent of control applied to the supplier and the purchased product shall be dependent upon the
effect of the purchased product on subsequent product realization or the final product.
The organization shall evaluate and select suppliers based on their ability to supply product in accordance
with the organization’s requirements. Criteria for selection, evaluation and re-evaluation shall be
established. Records of the results of evaluations and any necessary actions arising from the evaluation
shall be maintained (see 4.2.4).
EXPLANATION
Clause 7.4 covers the requirements to control purchased product, requirements to control suppliers you
buy from, and requirements to control your buying process. Purchased product includes raw materials,
components, subassemblies, supplies, tooling, machinery and equipment, sequencing, sorting, rework,
testing, calibration, maintenance, etc. Note that clause 7.4 requirements apply to items that go into the
product, manufacture the product, check the product or deliver the product; whether paid for or customer
provided.
These may include materials, production equipment, tooling, measuring and test equipment, facilities,
transport vehicles, returnable packaging, intellectual property (drawings, specifications or proprietary
information), product returned for servicing under warranty, product sent for outsourced work etc. You
must have specifications/criteria for purchased product. These specifications may come from your
organization, customer, regulatory bodies, supplier or industry. As documents, these specifications must
be controlled as per clause 4.2.4. Many times the customer may require the use of pre-approved
purchased products and suppliers. The onus is still on you to ensure that purchased product from
customer-designated sources meets all requirements. You must control both, the product you buy, as well
as the supplier you buy from. Your controls must primarily be based on prevention of nonconformities in
both product and supplier performance.
Determine how important the purchased product is to design, manufacture, assemble and maintain your
end product. If you recall from product design input (clause 7.3.2) we considered factors such as targets
for product quality, life, reliability, durability, maintainability, and cost. You must apply similar criteria to
purchased product going into your end product. Categorize your purchased products and services
accordingly. Then determine what controls you need to ensure consistent purchased product quality and
consistent supplier performance. You can then apply different controls for different purchased products.
There are several ways to evaluate your suppliers. Besides product quality, your criteria for supplier
selection and evaluation may include the potential supplier’s financial capability, technical and
manufacturing capability and capacity, reliability, reputation, flexibility to handle changes, support,
service, cost etc. The importance of these criteria will vary according to the items materials or services
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 63 of 100
you purchase, and so you can apply different criteria to different suppliers. You can categorize your
suppliers accordingly based on these criteria. It might be useful to maintain a list of all qualified suppliers.
In addition to the initial evaluation and approval of suppliers, you are required to carry out ongoing
monitoring and measurement of their performance. Use supplier monitoring indicators to evaluate the
consistency, capability and reliability of their performance for quality, delivery, support, etc. On-time
delivery is very important and disruptions (due to waiting for materials) at your customers or even your
own facility must be avoided. Depending on the risks related to materials supplied and supplier
performance, you might consider requiring some of your key suppliers to comply with some or all of ISO
9001 REQUIREMENTs and perhaps even certification. As per clause 4.1, you must identify your
purchasing processes whether on site or off site. For each process, you must document the controls for
purchased product and suppliers. You must also show the linkage and interaction of purchasing processes
with other processes such as design, manufacturing, tooling maintenance, calibration. Where any of your
controlled suppliers have gone through a significant organizational change you must verify the continuity
and effectiveness of their QMS. You must keep records of all supplier evaluations (whether initial or
periodic), including any corrective actions placed on them for any nonconformities. You must identify
and document all processes addressing this clause as part of your QMS.
For these processes, you must also identify what specific documents, controls and resources are needed
.You could use a documented procedure or other combination of specific practices, procedures, documents
and methods. Look at the risks related to your product, processes and resources in determining the extent
of documented controls you need to have. Performance indicators to measure the effectiveness of
purchasing processes in meeting requirements and achieving quality objectives should focus on measuring
supplier performance and reducing variation in and improving purchasing processes and related use of
resources. Indicators for supplier performance may include reduction of defects in supplied product, scrap,
waste and rework, improvement in on-time delivery, service, cost, etc. Indicators for purchasing process
may include reduction in supplier- quote review cycle time, contract award cycle time, purchase order-entry
errors and omissions, receiving errors & omissions etc.
ISO 9001-CLAUSE 7.4.2 PURCHASING INFORMATION
ISO 9001 REQUIREMENT
Purchasing information shall describe the product to be purchased, including, where appropriate,
a) requirements for approval of product, procedures, processes and equipment,
b) requirements for qualification of personnel, and
c) quality management system requirements.
The organization shall ensure the adequacy of specified purchase requirements prior to their
communication to the supplier.
EXPLANATION
Your purchase documents such as purchase order, contract, blanket order, your organization’s supplier
quality manual, etc. must specify your requirements for the purchased product; the suppliers QMS and
any other initial or on-going controls you deem necessary for ensuring consistent supplier performance.
You must define how you ensure the adequacy of these documents before you communicate them to your
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 64 of 100
supplier. A review of adequacy of purchasing documents may include their completeness, accuracy,
correctness, quantity, timing, cost, approval, etc., by one or more functions; computerized controls, etc. In
larger organizations, this may be a separate process on-site or off-site. In either case, it must be identified
and controlled. While clause 7.4.2 does not specify keeping of records, you must show evidence of
carrying out (issue purchase documents) and review of these documents
ISO 9001-CLAUSE 7.4.3 VERIFICATION OF PURCHASED PRODUCT
ISO 9001 REQUIREMENT
The organization shall establish and implement the inspection or other activities necessary for ensuring
that purchased product meets specified purchase requirements. Where the organization or its customer
intends to perform verification at the supplier’s premises, the organization shall state the intended
verification arrangements and method of product release in the purchasing information.
EXPLANATION
Verification of purchased product can range from doing no verification to 100% verification. You have
flexibility in determining the scope of purchased product verification. As indicated earlier in 7.4.1, you
can apply different controls for different suppliers and products depending on your initial supplier
evaluation and their ongoing product quality and delivery performance. In any case these controls must be
included or referenced in your quality or inspection plans. To the extent that you decide to do verification
of purchased product, you also have flexibility in when you do the verification. You can do it on receipt
or at any time prior to use in production. Make sure you appropriately control un-inspected product. This
may include identification and storage to prevent unintended use. Consider using supplier quality plans,
inspection plans, etc., to verify that purchased product meets specified purchase (product and QMS)
requirements. Your inspection process must define and document the acceptance criteria and sampling
plan for product conformity and what measurement tools needed and records needed to show effective
control of purchased product quality and supplier performance.
AUDIT CHECKLIST
For Clause 7.4.1:
From whom the organization can buy materials or services from?
Is there an Approved List of suppliers?
How does a Supplier get on the list? Any new ones added? How do Suppliers stay on the list? Is
performance checked? How often are performance checked?
Are criteria for selection & periodic evaluation defined?
Are results of supplier evaluations & follow-up actions shall be recorded?
Are types & extend of control to be applied to the supplier and purchased product dependent on the effects
on subsequent product realization process or the final product?
For Clause 7.4.2:
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 65 of 100
How are orders placed to Suppliers? How is this information checked for accuracy?
How do you ensure adequacy of specified purchase requirements prior to their communication to the
supplier?
Do purchasing documents contain information describing the product to be purchased, including where
appropriate requirements for product approval, procedures, processes and equipment, qualification of staff
and QMS requirements?
For Clause 7.4.3:
How the organization does checks that what was received is exactly what was ordered?
Are activities necessary for verification of purchased products established and implemented?
Do the organization ever goes to a Suppliers premises to release a purchase order? Do Customers of
organization ever do this with the Suppliers of organization? If so, how is the Supplier made aware?
MANDATORY PROCEDURE
Not applicable
MANDATORY RECORD
For Clause 7.4.1:
Results of supplier evaluations and any necessary actions arising from the evaluations.
For e.g. Records of supplier evaluations, list of approved suppliers
For Clause 7.4.2: Not applicable
For Clause 7.4.3: Not applicable
Evidence/Implementation document Not mandatory but helps in fulfillment of requirement
For Clause 7.4.1:
Procedure for supplier evaluation
Supplier audit checklist
Supplier registration form
For Clause 7.4.2:
Purchase document: Purchase order, Work order, contract, blanket order, your organization’s supplier
quality manual
For Clause 7.4.3:
Inward Inspection report
Supplier quality plans, inspection plans
Consider using supplier quality plans, inspection plans, etc., to verify that purchased product meets
specified purchase (product and QMS) requirements
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 66 of 100
ISO 9001-CLAUSE 7.5
ISO 9001-CLAUSE 7.5 PRODUCTION AND SERVICE PROVISION
ISO 9001-CLAUSE 7.5.1 CONTROL OF PRODUCTION AND SERVICE
PROVISION
ISO 9001 REQUIREMENT
The organization shall plan and carry out production and service provision under controlled conditions.
Controlled conditions shall include, as applicable,
a) the availability of information that describes the characteristics of the product,
b) the availability of work instructions, as necessary,
c) the use of suitable equipment,
d) the availability and use of monitoring and measuring equipment,
e) the implementation of monitoring and measurement, and
f) the implementation of product release, delivery and post-delivery activities.
EXPLANATION
This clause provides a list of control requirements that you may use, if applicable to your business. Identify
and control all production process. Show the interaction of these processes with other processes. Use your
product, project or contract quality plan to control production and service activities. Schedule your
production taking into consideration customer delivery requirements, production capacity and capability,
material availability and usage, personnel availability and usage; storage; etc. Carefully define and
document the interaction of your production scheduling process with your logistics processes such as
inventory management, customer communication, traffic and shipping control, packaging and labeling,
sales and billing. Use quality plans to control your production processes. Quality plans address what has to
be made, how much has to be made, when it has to be made, by whom, in what sequence, how it has to be
made, what production equipment to use, what measurement and monitoring tools to use, what to inspect,
when to inspect, how much to inspect, what to do if problems arise, etc.
Your quality plan must cover all production process steps from receipt of materials, production, packaging,
storage, delivery and even post-delivery activities such as installation or training. Your quality plans are
dynamic and must be updated for the changes in product specifications or process parameters; resources
used; monitoring or measurement requirements, etc. Your quality plans should reference any work
instructions specified for the process steps. Work instructions may be viewed as a subset of your quality
plan and may relate to a specific task or activity of your overall product realization process for e.g. setting
up a machine, performing an inspection, packaging a product, If you determine that work instructions are
needed at specific points in your process, then they must be readily available and relevant i.e. current or
right version. Note that work instructions may exist in many forms such as narrative, graphical, audio,
video, physical display etc. To improve your QMS, it will be very useful to draw a flow chart to link the
flow and interaction of the activities and sub-processes covered by these clauses, e.g. many organizations
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 67 of 100
overlook reviewing and updating their quality plans for corrective action taken to address a manufacturing
process problem. Production personnel must have timely access to all information relevant to their activities
including specific work instructions if necessary. There may be serious risk to production flow, if such
information is unavailable or untimely. You must identify and document all processes addressing this clause
as part of your QMS For these processes, you must also identify what specific documents are needed for
effective planning, operation and control of production activities. These documents may include – a product
quality plan; work instructions; documented procedure; etc., combined with unwritten practices, procedures
and methods. Look at the risks related to your product, processes and resources in determining the nature
and extent of documented controls you need to have. Performance indicators to measure the effectiveness
of production processes in meeting requirements and achieving quality objectives should focus on reducing
variation in and improving production processes and related use of resources.
Indicators for production processes be product or process related. Product related indicators may include
reduction in defect rates, PPM’s (defective parts per million), scrap rates, waste and rework; improvement
in on time delivery. Production process related indicators may include reduction in set-up time, run rates,
process cycle time, production scheduling and operator errors and omissions etc.
ISO 9001-CLAUSE 7.5.2 VALIDATION OF PROCESSES FOR
PRODUCTION AND SERVICE PROVISION
ISO 9001 REQUIREMENT
The organization shall validate any processes for production and service provision where the resulting
output cannot be verified by subsequent monitoring or measurement and, as a consequence, deficiencies
become apparent only after the product is in use or the service has been delivered. Validation shall
demonstrate the ability of these processes to achieve planned results.
The organization shall establish arrangements for these processes including, as applicable,
a) defined criteria for review and approval of the processes,
b) approval of equipment and qualification of personnel,
c) use of specific methods and procedures,
d) requirements for records (see 4.2.4), and
e) revalidation.
EXPLANATION
Validation is usually required where product cannot be verified without damaging or destroying the
product, e.g. some types of welding, heat-treatment, painting, electroplating, rust-proofing, etc. In such
instances, the quality of these activities may only be discovered after use. This would generally not be
acceptable due to safety (e.g. weld) or aesthetic (evidence of rust or dullness of chrome) reasons. In the
case of a service such as pizza delivery within 30 minutes of order placement, if the timeliness of delivery
is not verifiable, then validation would be required. However, most service-oriented businesses (e.g.
delivery; call center) have some form of monitoring during service execution to ensure service quality.
Validation involves conducting capability studies using a combination of resources technology,
equipment, materials, environment, competent personnel, and production and testing methods that
consistently result in a quality product or service.
Document the specific procedures, methods, and combination of resources that achieve this capability,
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 68 of 100
and keep records of ongoing studies to show that you are maintaining this capability. Validation may also
require customer or regulatory approval of the process. You must keep appropriate records of process
validation showing both the achievement of planned results as well as the ongoing maintenance of such
capability. If you change any part of the proven process capability for e.g. materials, equipment or
personnel, etc., you must revalidate i.e. re-prove the changed process. It is up to each organization to
determine what combination of resources and methods will provide the required consistent process
capability and quality of product or service. Include as appropriate, these validation controls in your
quality plans. If the nature of your product or service is such that it does not require validation and where
product can always be verified by subsequent monitoring or measurement prior to delivery, then you must
clearly state this exclusion to your QMS scope, in your Quality manual.
Performance indicators to measure the effectiveness of processes that validate production processes may
include reduction in defect rates, PPM’s (defective parts per million), validation cycle time, revalidations
etc.
ISO 9001-CLAUSE 7.5.3 IDENTIFICATION AND TRACEABILITY
ISO 9001 REQUIREMENT
Where appropriate, the organization shall identify the product by suitable means throughout product
realization.
The organization shall identify the product status with respect to monitoring and measurement
requirements throughout product realization. Where traceability is a requirement, the organization shall
control the unique identification of the product and maintain records (see 4.2.4).
NOTE In some industry sectors, configuration management is a means by which identification and
traceability are maintained.
EXPLANATION
There are three distinct control requirements specified here.
Product identification: It means knowing the identity of yours or customer supplied product from
incoming receipt of materials, raw material storage, use in production, work in progress, finished product
storage, and delivery of product to the customer. Product identification can be controlled using physical
and electronic methods.
Product status: It means knowing the quality status (good or bad) of materials and product through each
of the above stages. Product status can be controlled using physical and electronic methods.
Unique Product Identification: It is not a mandatory requirement under ISO 9001, unless contractually
required by customers or regulatory bodies. In certain industry sectors such as the automotive or aerospace
or pharmaceutical industry, unique product identification is mandatory for safety, regulatory and risk
management reasons. This usually involves keeping detailed records of product manufacturer such as
material, equipment, personnel, processes, production, inspection and test details, etc., for individual
products or production batches. These records help to trouble-shoot product and process problems, resolve
customer complaints, and enables continual improvement of product and process. In many instances, it
also reduces cost, risk and use of resources by narrowing the problem down to a specific cause or instance.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 69 of 100
Depending on the product, the OEM may specify the degree of unique identification and traceability
required.
While this clause does not call for a specific documented procedure, these controls may be included in your
product realization processes through your product quality plans, work instructions and other specific
documentation. Examples of product identification and test status include physical tags, bar code labels
linked to computer records; MRP systems tracking specific production runs/lots, automated production
transfer processes, etc. Performance indicators to measure the effectiveness of processes that control
identification and traceability may include reduction in identification errors and omissions; product quality
status errors and omissions; and traceability errors and omissions.
ISO 9001-CLAUSE 7.5.4 CUSTOMER PROPERTY
ISO 9001 REQUIREMENT
The organization shall exercise care with customer property while it is under the organization’s control or
being used by the organization. The organization shall identify, verify, protect and safeguard customer
property provided for use or incorporation into the product. If any customer property is lost, damaged or
otherwise found to be unsuitable for use, the organization shall report this to the customer and maintain
records (see 4.2.4).
NOTE Customer property can include intellectual property and personal data.
EXPLANATION
Customer property may include material, production equipment, tooling, measuring and test equipment,
facilities, transport vehicles, returnable packaging, intellectual property such as drawings, specifications
or proprietary information, product returned for servicing under warranty, product sent for outsourced
work, etc.
All customer property is exposed to the risk of being damaged, lost, misused, misplaced, stolen, become
unsuitable or obsolete for use. You must establish controls for each of these risks. Notify the customer in
writing if their property is lost, damaged or otherwise found to be unsuitable such as perishable past its
shelf life for use. Control to minimize the risks to customer property include inventory management,
preservation and storage, identification, status and traceability indicators, maintenance, notification,
traffic flow, authorized use, restricted access, etc. Marking customer property with a unique identification
number that can be traced to a record that provides details of ownership is one of many acceptable
controls.
This clause requires records to be kept of customer property that is lost, damaged or otherwise found to be
unsuitable for use. This implies tracking the storage and use of and quality status, of customer property.
While this clause does not call for a specific documented procedure, these controls may be included in
your product realization processes through your product quality plans, work instructions and other
specific documentation. Many of the controls needed for clause 7.5.3 Identification and traceability and
clause 7.5.5 Preservation of product apply to customer property. The processes, controls and
documentation for these other clauses could be expanded to include customer property.
If the nature of your business does not require the use of any customer property, then you must clearly
state this exclusion to your QMS scope, in your Quality manual.
Performance indicators to measure the effectiveness of processes that control customer property may
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 70 of 100
include reduction in identification errors and omissions, loss due to damage or unsuitability, scrap, rejects,
etc., as well as increased customer property turnover rates.
ISO 9001-CLAUSE 7.5.5 PRESERVATION OF PRODUCT
ISO 9001 REQUIREMENT
The organization shall preserve the product during internal processing and delivery to the intended
destination in order to maintain conformity to requirements. As applicable, preservation shall include
identification, handling, packaging, storage and protection. Preservation shall also apply to the constituent
parts of a product.
EXPLANATION
All raw materials, work in progress, finished product, supplies, customer provided materials or product,
product sent for outsourced work, etc., are subject to risk of being damaged, lost, misused, misplaced,
stolen, become unsuitable ,perishable or obsolete i.e. past shelf life for use. This could occur during
receipt, handling, storage, use in production, and transportation to the customer, etc. These could be
Controlled using identification, status and traceability indicators, inventory cycle counts and condition
evaluation, stock rotation methods such as FIFO, just in time, tracking shelf life, special, controls for
restricted access, handling and storage of hazardous materials, climate and environment, maintenance
procedures, bar codes, training, use of special equipment for handling, condition reports, etc. These
controls may be included in your product realization processes through your product quality plans, work
instructions and other specific documentation. Many of the controls needed for clause 7.5.3 Identification
and traceability apply to preservation of product.
Performance indicators to measure the effectiveness of processes that control preservation of product may
include reduction in obsolete and spoils materials an product (e.g., fresh produce, fruits, or frozen foods),
identification errors and omissions, rejects, waste, scrap, etc., and increase in inventory turnover and
material/product availability, and product safety.
AUDIT CHECKLIST
For Clause 7.5.1:
How are controls applied to the processes to ensure that products & services are supplied to the Customer
correctly?
Are production & service operations controlled through, as applicable availability of information on
characteristics of product?
Are production & service operations controlled through, as applicable availability of work instructions?
Are production & service operations controlled through, as applicable use & maintenance of suitable
equipment?
Are production & service operations controlled through, as applicable implementation of monitoring
activities?
Are production & service operations controlled through, as applicable implementation of defined
processes for release, delivery and post-delivery activities?
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 71 of 100
Are production & service operations controlled through, as applicable availability & use of measuring &
monitoring devices?
For Clause 7.5.2:
Have any processes whose output cannot be checked? If so, how are these processes controlled?
Where resulting output cannot be verified by subsequent monitoring or measurement, are the production
and service processes validated through as applicable defined criteria for review and approval, approval
of equipment and qualification of personnel use of specific methods & procedures and requirements for
records and re-validations?
Does validation demonstrate the ability of these processes to achieve planned results?
For Clause 7.5.3:
How are items identified? How do you indicate whether products/services are good (or not) to use? Can
traceability information (if asked) be found on what was delivered?
Are various products suitably identified throughout production and service operations?
Are the product status identified w.r.t. measurement & monitoring requirements?
Where traceability is a requirement, are unique identification of product controlled and recorded.
For Clause 7.5.4:
Does the Customer supply any product, property or information? If so, is it checked for suitability?
Are customer property provided for use or incorporation into the product identified, verified, protected &
safeguarded?
If the customer property that is lost, damaged or otherwise unsuitable for use, is this reported to the
customer and recorded?
For Clause 7.5.5:
How is incoming, in-process and final product/ service handled? Stored? How are products/ services
protected?
Are the conformity of product during internal processing and delivery to intended destination preserved?
Does this include identification, handling, packaging, storage and protection of the product and
constituent parts?
MANDATORY PROCEDURE
Not applicable
MANDATORY RECORD
For Clause 7.5.1: Not applicable
For Clause 7.5.2:
Demonstrate the validation of processes where the resulting output cannot be verified by subsequent
monitoring or measurement for e.g. Schedule of achieved results
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 72 of 100
For Clause 7.5.3:
The unique identification of the product, where traceability is a requirement for e.g. Equipment register
For Clause 7.5.4:
Customer property that is lost, damaged or otherwise found to be unsuitable for use for e.g. Defective
material report, Delivery note
For Clause 7.5.5: Not applicable
Evidence/Implementation document Not mandatory but helps in fulfillment of requirement
For Clause 7.5.1:
Documents are needed for effective planning, operation and control of production activities: a product
quality plan, work instructions, production planning, Job Cards, Workmanship Standards, documented
procedure, Breakdown maintenance report, Preventive maintenance report, etc., combined with unwritten
practices, procedures and methods.
For Clause 7.5.2:
Competence Training, External test records, Equipment validation, Test piece records
For Clause 7.5.3:
ID Tags, Barcodes, Unique product ID … etc.
Examples of product identification and test status include physical tags, bar code labels linked to
computer records, MRP systems tracking specific production runs/lots, automated production transfer
processes
For Clause 7.5.4:
List of Customer Property, Control to minimize the risks to customer property include inventory
management, preservation and storage, identification, status and traceability indicators, maintenance,
notification, traffic flow, authorized use, restricted access, etc. Marking customer property with a unique
identification number that can be traced to a record that provides details of ownership is one of many
acceptable controls.
For Clause 7.5.5:
Procedure For Handling, Controls include identification, status and traceability indicators, inventory cycle
counts and condition evaluation, stock rotation methods such as FIFO, just in time, tracking shelf life, MRP
systems for tracking requirements and usage, special, controls for restricted access, handling and storage of
hazardous materials, climate and environment, maintenance procedures, bar codes, training, use of special
equipment for handling, condition reports, etc.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 73 of 100
ISO 9001-CLAUSE 7.6
ISO 9001-CLAUSE 7.6 CONTROL OF MONITORING AND MEASURING
EQUIPMENT
ISO 9001 REQUIREMENT
The organization shall determine the monitoring and measurement to be undertaken and the monitoring
and measuring equipment needed to provide evidence of conformity of product to determined
requirements.
The organization shall establish processes to ensure that monitoring and measurement can be carried out
and are carried out in a manner that is consistent with the monitoring and measurement requirements.
Where necessary to ensure valid results, measuring equipment shall
a) be calibrated or verified, or both, at specified intervals, or prior to use, against measurement
standards traceable to international or national measurement standards; where no such standards exist, the
basis used for calibration or verification shall be recorded (see 4.2.4);
b) be adjusted or re-adjusted as necessary;
c) have identification in order to determine its calibration status;
d) be safeguarded from adjustments that would invalidate the measurement result;
e) be protected from damage and deterioration during handling, maintenance and storage.
In addition, the organization shall assess and record the validity of the previous measuring results when
the equipment is found not to conform to requirements. The organization shall take appropriate action on
the equipment and any product affected.
Records of the results of calibration and verification shall be maintained (see 4.2.4).
When used in the monitoring and measurement of specified requirements, the ability of computer
software to satisfy the intended application shall be confirmed. This shall be undertaken prior to initial
use and reconfirmed as necessary.
NOTE Confirmation of the ability of computer software to satisfy the intended application would
typically include its verification and configuration management to maintain its suitability for use.
EXPLANATION
Requirements for what needs to be measured and the acceptance criteria may come from the customer,
regulatory, industry and your own organization. Product realization planning must determine the
following what specific product and process characteristics needs to be monitored and measured, the
criteria for product acceptance, the type of Monitoring and Measurement Device needed, frequency i.e. at
what stages of realization to do it, sample size, etc. You must then determine what Monitoring and
Measurement Device is appropriate for each measuring or monitoring requirement. Consideration must be
given to the measurement capability (precision) of the Monitoring and Measurement Device which may
have to be several times greater than the tolerance criteria for product measurement. This would depend
on the industry you are in and the criticality of end use for the product for e.g. the precision requirements
for ball bearings may be much greater than say for cutting cloth to make a shirt. Personnel using Monitoring
and Measurement Device’s must have competence and training in the use of Monitoring and Measurement
Device’s in terms of their function, range and precision of measurement, reliability, use and maintenance.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 74 of 100
Monitoring and Measurement Device’s may include measurement and testing tools, equipment, hardware
and software. They may be owned by your organization, your employees or the customer. Monitoring and
Measurement Device’s may be used to verify product as well as to measure process conformity for e.g. a
temperature controller on an oven. Besides Monitoring and Measurement Device’s used for product
conformity, you may need to calibrate and control certain Monitoring and Measurement Device’s used in
related and peripheral processes such as production equipment, tooling, maintenance, etc.
To ensure valid measurement and monitoring results, Monitoring and Measurement Device’s must be
controlled. A process is required, to control the identification of monitoring measurement, selection,
purchase, status, identification, calibration, verification, adjustment or re- adjustment, use, handling,
maintenance and storage, training, handling of nonconforming Monitoring and Measurement Device’s,
etc. You must keep appropriate records to demonstrate effective operation and control of your Monitoring
and Measurement Device processes. These records must include calibration and verification records
traceable to national, international or other benchmark used for calibration.
All Monitoring and Measurement Device’s used for product verification must be capable of being
calibrated, verified or both. Calibration is setting or correcting an Monitoring and Measurement Device,
usually by adjusting it to match or conform to a dependably known and traceable standard for e.g. adjusting
a micrometer or caliper to conform to master blocks traceable to national standards.
Verification is confirming that the Monitoring and Measurement Device is meeting or performing to
acceptable national measurement standards and does not involve any correction or adjustment for e.g.
verifying a ruler or tape measure against a calibrated ruler that has been calibrated to a national standard.
A ruler or tape measure is generally not capable of being calibrated and when it gets out of calibration its
use must be discontinued.
There are Monitoring and Measurement Devices that are capable of being both calibrated and verified for
e.g. a CMM- coordinate measuring machine and may require both to be done in specific situations based
on frequency of use and criticality of measurement. This requirement also applies to the use of computer
software whose capability and calibration status must be established prior to initial use and reconfirmed
(verified) at defined intervals.
You must define the frequency and method of calibration for each type and level i.e. whether used in shop
floor, laboratory or standard of Monitoring and Measurement Device. Your calibration records must
identify what standard you used for calibration and show traceability of the standards you use at your facility
to national or international standards.
In rare circumstances, national or international standards may not exist for calibrating a specific Monitoring
and Measurement Device. In such situations consider using industry, manufacturer or even your own
organizational standard to validate the accuracy and reliability of your Monitoring and Measurement
Device. Consult with your customer if the contractual circumstances require it. Your quality plan must
define the measurement and monitoring required and the type of Monitoring and Measurement Device
needed for it, including the frequency of measurement and acceptance criteria. Depending on the risk and
precision and reliability of measurements needed, you might consider doing statistical studies on
Monitoring and Measurement Device’s referenced in your quality plans. Ensure that personnel performing
such statistical studies are trained and competent to do so.
A multitude of software tools are available to manage and control Monitoring and Measurement Device’s.
There are many acceptable methods to identify Monitoring and Measurement Device’s and their calibration
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 75 of 100
status. The methods you select must consider the manufacturers recommendations, frequency of use,
environment the Monitoring and Measurement Device is used in, risk in misuse or incorrect tool being
used, etc. Where a monitoring and Measurement Device is found to be out of calibration, you must take
appropriate correction action to contain and re-verify the product affected, to the extent practical. This is in
addition to containing, repair and recalibration of the defective Monitoring and Measurement
Device. Customer or internal engineering changes may result in a change in product measurement,
requirements and/or the Monitoring and Measurement Device to be used. These changes would normally
be reflected in your quality plan.
If you use external calibration services, you are still expected to impose the specific control requirements
of this clause to the external organization. If the nature of your business does not require the use of
Monitoring and Measurement Device’s for e.g. a financial service such as a credit counseling service, then
you must clearly state this exclusion to your QMS scope, in your Quality manual.
Performance indicators such as the monthly trends in the number of out of calibration Monitoring and
Measurement Device’s, or the number of Monitoring and Measurement Device’s past their calibration due
date, number of Monitoring and Measurement Device’s being used and not controlled, reduction in
untrained personnel found using Monitoring and Measurement Device’s, etc. Use these indicators to tighten
and improve the effectiveness of your Monitoring and Measurement Device process. You could use a
product quality plan, documented procedure or other combination of specific practices, procedures,
documents and methods. Look at the risks related to your product, processes and resources in determining
the extent of documented controls you need to have.
AUDIT CHECKLIST
Are the monitoring and measurement to be undertaken determined?
Are the monitoring and measurement devices needed to provide evidence of conformity of product to
determined requirements determined?
Is the measuring equipment calibrated or verified at specified intervals
Is the measuring equipment adjusted or re-adjusted as necessary
Is the measuring equipment identified to enable the calibration status to be determined?
Is the measuring equipment safeguarded from adjustments that would invalidate the measurement result?
Is the measuring equipment protected from damage & deterioration during handling, maintenance &
storage?
Determining how product/service is measured during in-bound process, in-process and out-bound process.
Is there a list of equipment requiring calibration? Compare this list to the measurement points in the
process. Are there any gaps? Does the equipment listed cover at least the Customer specification? Check
a sampling of equipment on the list and verify that is being calibrated.
Are records of equipment calibration & verification maintained?
Who decides the frequency of calibration? Does it ever change?
How is measuring equipment calibrated? For Internal calibration: Is work instructions used? For External
Calibration: Was a PO issued to the calibration service provider?
Any employee owned tools/equipment used? Are they being calibrated?
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 76 of 100
When a measuring equipment is found not to conform to requirements is the validity of the previous
measuring results assessed and recorded?
When a measuring equipment is found not to conform to requirements are appropriate actions taken on
the equipment and any affected products?
If equipment wasn’t measuring correctly, how long before it was discovered? How much product/service
would have been produced?
Any computer software used to measure the product/service? If yes, how do you know it’s working
properly?
MANDATORY PROCEDURE
Not applicable
MANDATORY RECORD
1) Basis used for calibration or verification of measuring equipment where no international or national
measurement standards exist: e.g. Customer specification, corporate standards.( This is bit tricky
because for all the organization for which I have worked or consulted, I have never come across a
scenario where no national or international measurement was available.
2) Records of the results of calibration and verification shall be maintained:- Record of Measuring and
monitoring equipments, Calibration certificate.
3) Validity of the previous measuring results when the measuring equipment is found not to conform
to requirements
Evidence/ Implementation document Not mandatory but helps in fulfillment of requirement
Inspection equipment list
Calibration stickers
Equipment accuracy
Corrective action report
ISO 9001-CLAUSE 8.1
ISO 9001-CLAUSE 8 MEASUREMENT, ANALYSIS AND IMPROVEMENT
ISO 9001-CLAUSE 8.1 GENERAL
ISO 9001 REQUIREMENT
The organization shall plan and implement the monitoring, measurement, analysis and improvement
processes needed
a) to demonstrate conformity to product requirements,
b) to ensure conformity of the quality management system, and
c) to continually improve the effectiveness of the quality management system.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 77 of 100
This shall include determination of applicable methods, including statistical techniques, and the extent of
their use.
EXPLANATION
You must plan and implement processes that measure, analyze and improve the health of your QMS. The
focus of these processes must be on product and process conformity and improving QMS effectiveness.
Consider using a variety of methods including statistical techniques. In planning what to track and measure,
let us review the quality objectives we established and all of the performance indicators we established for
each of our QMS processes and activities. You must be careful not to overwhelm your organization with
objectives as this may cause more frustration than positive results. Start with objectives that focus on
meeting customer requirements and then slowly develop meaningful objectives for key processes and risk
prone processes, as initial targets are achieved. Planning of measurement and data analyses processes must
consider the methods and resources such as time, manpower, computer, software, statistical tool, etc.
needed to collect, organize and analyze product and QMS performance data. Measurement involves
physically measuring product characteristics or process parameters against acceptance criteria at predefined
intervals and sampling sizes, using predefined measurement devices. Measurement results may not always
be fully recorded. Use your organizations cross-functional knowledge of customer requirements, product,
technology, manufacturing processes, etc., to determine what statistical methods to use for each process
and to what extent to use them. Include these methods in your quality plan. Statistical methods to verify
product characteristics and process parameters include process capability studies, control charts, Pareto
analysis, and variation analysis.
Define and implement appropriate training and competency requirements for all personnel using statistical
methods, tools and analysis. Monitoring usually involves conducting ongoing periodic checks to determine
whether product characteristics or process parameters are within acceptable limits. The frequency of
monitoring may vary on the risk and reliability of product and processes. Monitoring is also useful in
determining the scope and frequency of product and process measurement. The results of monitoring may
or may not be recorded.
You must identify and document all processes addressing this clause as part of your QMS.
For these processes, you must also identify what specific documents, controls and resources are needed.
You could use a product quality plan, documented procedure or other combination of specific practices,
procedures, documents and methods. Look at the risks related to your product, processes and resources in
determining the extent of documented controls you need to have.
Performance indicators are not needed for this clause as it provides direction for the application of
monitoring and measurement methods and tools for all QMS processes. However the output of monitoring
and measurement methods used within each QMS process provides useful performance indicators for
determining the degree of conformity of product and QMS to requirements and whether the QMS has been
effectively implemented and maintained.
AUDIT CHECKLIST
It can be assessed by auditing the requirement of Clauses 8.2, 8.3, 8.4, 8.5
Are measurement & monitoring activities planned and implemented to demonstrate conformity of the
product
Are measurement & monitoring activities planned and implemented to ensure the conformity to QMS
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 78 of 100
Are measurement & monitoring activities planned and implemented to continually improve the
effectiveness of the QMS
MANDATORY PROCEDURE
Not applicable
MANDATORY RECORD
Not applicable
EVIDENCE/ IMPLEMENTATION DOCUMENT
Not mandatory but helps in fulfillment of requirement;
Statistical methods to verify product characteristics and process parameters include – process capability
studies, control charts, Pareto analysis, variation analysis (special cause, common cause).
ISO 9001-CLAUSE 8.2
ISO 9001-CLAUSE 8.2 MONITORING AND MEASUREMENT
ISO 9001-CLAUSE 8.2.1 CUSTOMER SATISFACTION
ISO 9001 REQUIREMENT
As one of the measurements of the performance of the quality management system, the organization
shall monitor information relating to customer perception as to whether the organization has met
customer requirements. The methods for obtaining and using this information shall be determined.
NOTE Monitoring customer perception can include obtaining input from sources such as customer
satisfaction surveys, customer data on delivered product quality, user opinion surveys, lost business
analysis, compliments, warranty claims and dealer reports.
EXPLANATION
Customers are primarily the end users of your product, but also include intermediaries such as assembler
who may be internal or external and who integrate your product into theirs, and dealers and distributors
who market and sell your product or the integrated product. You need to consider feedback from all these
customers to determine whether or not you have met their specified and perceived requirements.
Customer requirements may relate to the design, manufacture, delivery, servicing and support of product,
QMS, communication and financial requirements, etc. you must have controls to identify and meet these
requirements Customer feedback or satisfaction is the first tool required by this standard to gauge the
health of your QMS. This clause requires you to gather and analyze information as to what extent you met
these requirements, from the customers perspective. What is the customer’s evaluation of your
performance with regard to their requirements?
You must continually gather information about these activities, in a manner capable of being analyzed
and evaluated to determine how well you performed them. There are all kinds of performance indicators
for design, manufacture, delivery, service and support, etc. Gather information on these indicators from
both the customer as well from internal processes. There are many ways to monitor customer satisfaction
feedback both positive as well as negative. These may include customer complaints, direct
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 79 of 100
communications with customers, questionnaires and surveys, subcontracted collection and analysis of
performance data, reports from consumer organizations, and reports in various media, sector and industry
studies. You are expected to have a process that defines your customer satisfaction indicators, frequency
and method of data collection, summarization, review and evaluation of data, actions to improve,
timeline, responsibility and follow-up. Many customers routinely provide feedback on some or all of the
information indicated above. You must continuously review this customer feedback to ensure you
maintain and improve your customer satisfaction rating. You must monitor trends in customer satisfaction
indicators and use these as a baseline for continual improvement. You should consider both external as
well as internal customer satisfaction. Note that every internal process is either a customer or supplier of
another process. You must identify and document the process addressing this clause as part of your QMS.
For this process, you must also identify what specific documents, controls and resources are needed. You
could use a documented procedure or other combination of specific practices, procedures, documents and
methods. Look at the risks and benefits in determining the extent of documented controls you need to
have.
Performance indicators to measure the effectiveness of processes that control customer satisfaction may
include improvement in customer feedback ratings, reduction in customer complaints, increase in the
number of customers providing feedback, increase in feedback that leads to QMS and product
improvement opportunities.
ISO 9001-CLAUSE 8.2.2 INTERNAL AUDIT
ISO 9001 REQUIREMENT
The organization shall conduct internal audits at planned intervals to determine whether the
quality management system
a) conforms to the planned arrangements (see 7.1), to the requirements of this International Standard and
to the quality management system requirements established by the organization, and
b) is effectively implemented and maintained.
An audit programme shall be planned, taking into consideration the status and importance of the
processes and areas to be audited, as well as the results of previous audits. The audit criteria, scope,
frequency and methods shall be defined. The selection of auditors and conduct of audits shall ensure
objectivity and impartiality of the audit process. Auditors shall not audit their own work.
A documented procedure shall be established to define the responsibilities and requirements for planning
and conducting audits, establishing records and reporting results.
Records of the audits and their results shall be maintained (see 4.2.4).
The management responsible for the area being audited shall ensure that any necessary corrections
and corrective actions are taken without undue delay to eliminate detected nonconformities and their
causes.
Follow-up activities shall include the verification of the actions taken and the reporting of verification
results (see 8.5.2).
NOTE See ISO 19011 for guidance.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 80 of 100
EXPLANATION
Internal audit is the second important tool required by this standard used to gauge the health of your QMS.
How effective is it in meeting ISO 9001, your own QMS, customer and regulatory requirements. You must
have a documented procedure for your internal audit process.
The scope of your internal audit program must cover the:
Audit of product realization processes to determine conformity of both product and product realization
processes to customer and applicable regulatory requirements.
Audit of the QMS to determine conformity to the ISO 9001 standard.
Audit of the QMS to determine conformity to organizational requirements.
Audit of QMS processes and their interaction to determine if the QMS has been effectively implemented
and maintained.
In determining the time frame for your audit program, you should consider organization size, complexity
of product and processes, health of the QMS, customer, registrar and regulatory requirements, etc. The
most common time frame is six months.
Consider adjusting the audit frequency and perhaps even the audit scope, of specific processes or group of
processes, when:
You experience internal or external nonconformities.
Get customer complaints.
Have critical or high risk processes.
Have frequent or significant changes to processes and product.
Your internal audit program should consider the following:
Input from audited area and related areas
Key customer oriented processes
Process and product performance results and expectations
Opportunities for continual improvement
Feedback from customers
Audit criteria, refers to the specific QMS policies, objectives, ISO requirements, documentation, customer
and regulatory requirements, etc., that the audit is referenced to or conducted against. Audit criteria may
relate to the whole audit program as well as each individual audit.
Audit methods refer to the specific techniques that auditors use to gather objective audit evidence that can
be evaluated to determine conformity to audit criteria. Examples of audit methods include interview of
personnel, observation of activities, review of documents and records, etc.
You must define the minimum qualification requirements for internal auditors. These requirements
include knowledge of QMS processes and their interaction, related QMS controls, customer requirements,
applicable regulatory requirements, the ISO 9001 standard, the audit process and audit techniques.
Internal auditors needs to be trained in the ISO 9001 standard as they generally audit for conformity to
organizational requirements and also for conformity to ISO 9001 REQUIREMENTs. Additionally, the
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 81 of 100
ISO 19011:2002 Guidelines for quality and environmental auditing says that auditors should have
knowledge of quality management system standards and their application to the organization.
You must have appropriate resources for your annual audit program. These include having sufficient
trained auditors available to conduct scheduled audits, sufficient time to perform audits, availability of
department or process personnel to be audited, time and tools to prepare audit records and reports, etc.
Auditor should be Independence. During the audit Auditors should ensure that the objectivity and
impartiality of the audit is not compromised. Auditors cannot audit their own work. Auditor independence
must be ensured when assigning personnel to specific audits.
Process owners must take timely corrective action on nonconformities found in their area. They should
use the corrective action procedure to determine root cause, take appropriate action and follow-up to
determine if results indicate that the root cause has been eliminated. Audit results must be summarized
and reported for management review. The Management Representative must also report any opportunities
for QMS improvement. The MR must analyze the results of each audit as well as the annual audit
program to determine strengths and weaknesses in QMS processes, interactions, functions, products, etc.,
to identify and prioritize opportunities for improvement. Audit records include annual audit schedule,
audit planning such as criteria, scope, frequency, methods, auditor selection and assignment, etc., auditor
competence and training, audit checklists and forms, audit notes and other evidence gathered, audit
findings, nonconformity reports, audit reports, corrective actions and follow-up of internal audit
nonconformities, analysis of audit program performance indicators and trends, and identified
improvement opportunities.
Performance indicators should be used to measure the effectiveness of your internal audit process and
monitor trends in these indicators, to continually improve your audit program. Performance indicators
may include reducing the number of – late or delayed audits, incomplete audits, incomplete audit records
and late reports, auditor errors, auditee complaints, and use of untrained auditors, etc.
The output of your internal audit program may be used as performance indicators to:
Determine the degree of conformity of the QMS to ISO 9001, customer and regulatory requirements.
Determine the effectiveness of QMS implementation and maintenance.
Determine the degree of conformity of product to contractual and regulatory requirements.
Identify areas of the QMS that need improvement.
ISO 9001-CLAUSE 8.2.3 MONITORING AND MEASUREMENT OF
PROCESSES
ISO 9001 REQUIREMENT
The organization shall apply suitable methods for monitoring and, where applicable, measurement of the
quality management system processes. These methods shall demonstrate the ability of the processes to
achieve planned results. When planned results are not achieved, correction and corrective action shall be
taken, as appropriate.
NOTE When determining suitable methods, it is advisable that the organization consider the type and
extent of monitoring or measurement appropriate to each of its processes in relation to their impact on the
conformity to product requirements and on the effectiveness of the quality management system.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 82 of 100
EXPLANATION
You must establish methods and indicators to monitor and measure your QMS processes to demonstrate
process capability to achieve planned results and identify opportunities to improve the process. Use your
organizations cross-functional knowledge of customer requirements, product, technology, manufacturing
processes, etc., to determine process monitoring and measuring indicators and controls. Monitoring and
measurement may be done manually or by automated means. Another way to identify useful methods and
indicators is to review what problems could occur or have occurred within a particular process. Monitor
and measure these occurrences and develop process controls to reduce or eliminate them. Problems or
risks can occur with any of the variables in a process for e.g. materials, equipment, facility, methods,
technology, personnel, computer hardware or software, etc. By using fishbone analysis or similar tools,
you can develop very useful monitoring and measuring methods and process performance indicators.
Correction refers to action taken to eliminate a detected nonconformity, i.e. the symptom. Correction
involves the containment, evaluation of the nonconformity and action that may result in rework, re-grade,
and scrap, return of nonconforming material/work to supplier or outsourcer, or acceptance through a
customer concession or deviation permit. Correction differs from corrective action. Corrective action is
action taken to eliminate the cause of a detected nonconformity to prevent recurrence, whereas correction
does not address cause. Managers or personnel responsible for corrective action must be promptly
informed of product and process nonconformities.
You must monitor your processes:
First to determine and establish capability of new processes to conform to requirements.
And secondly, to monitor these processes over time to verify ongoing stability and capability to meet
requirements.
And thirdly to determine and achieve levels of continual improvement
To achieve planned results, control methods used for monitoring and measurement should focus on
achieving the performance indicators we have identified for each QMS process. The monitoring and
measurement techniques, sampling plans, acceptance criteria may be documented or referenced in your
quality plan, or you could use a combination of specific practices, procedures, documents and methods.
Look at the risks and benefits in determining the extent of documented controls you need to
have. Performance indicators are not needed for this clause as it provides direction for the application of
monitoring and measurement performance indicators for all QMS processes. However the output of
monitoring and measurement methods used within each QMS process provides useful performance
indicators for determining the effective implementation and maintenance of QMS processes.
ISO 9001-CLAUSE 8.2.4 MONITORING AND MEASUREMENT OF
PRODUCT
ISO 9001 REQUIREMENT
The organization shall monitor and measure the characteristics of the product to verify that
product requirements have been met. This shall be carried out at appropriate stages of the product
realization process in accordance with the planned arrangements (see 7.1). Evidence of conformity with
the acceptance criteria shall be maintained.
Records shall indicate the person(s) authorizing release of product for delivery to the customer (see 4.2.4).
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 83 of 100
The release of product and delivery of service to the customer shall not proceed until the planned
arrangements (see 7.1) have been satisfactorily completed, unless otherwise approved by a relevant
authority and, where applicable, by the customer.
EXPLANATION
You must identify, monitor and measure product characteristics to verify conformity to requirements.
Product characteristics may be dimensional, functional, performance, reliability, durability,
maintainability, life, cost, etc. Requirements may come from your customer, your own organization,
regulatory and industry sources. You must plan what product characteristic(s) to measure, type of
measurements, what measurement device to use, how often to measure, sample size, acceptance criteria,
and records needed for each product or product type. Use your product quality plan to document these
controls.
Your product, project or contract quality plan must define the stages at which various monitoring and
measurement will be carried out at incoming receipt of materials from suppliers or outsourced work,
storage, internal production processes, finished product, packaging, at time of shipping, and post
installation. Monitoring and measurement may be done by your personnel, subcontracted or outsourced
labor or by the customer. You must ensure that all personnel performing monitoring and measurement of
product are trained and competent.
If you plan on releasing during any stage of production or shipping finished product, where all planned
inspections and measurements to that stage have not been completed, ensure that you obtain prior written
approval/waiver from a relevant internal authority or the customer. Where practical, consider completing
all missed planned inspections and measurements before product delivery. You must identify and
document all product realization processes that may address this clause, as part of your QMS, e.g.
receiving, production, shipping, etc. For such processes, you must also identify what specific documents
are needed for effective planning, operation and control.
You could use a product quality plan, documented procedure or other combination of specific practices,
procedures, documents and methods. Look at the risks related to your product, processes and resources in
determining the extent of documented controls you need to have. Performance indicators to measure
product conformity may include reduction in defect rates, PPM’s (defective parts per million), scrap rates,
waste, rework, improvement in on time delivery, product returns from customer, etc. Performance
indicators to measure the effectiveness of product realization processes in achieving product conformity
include productivity, reduction of cycle time, errors, omissions and failures, etc.
AUDIT CHECKLIST
For Clause 8.2.1:
Are both a proactive and reactive approach used to obtain Customer feedback?
How is feedback obtained from Customers? What is the structure/format that is used? Does it provide
information on how Customers perceive the organization’s performance?
Is more than one method or technique employed?
How often each method is used (frequency)?
How is this information communicated internally?
How is this information used to uncover ways to improve?
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 84 of 100
For Clause 8.2.2:
Is there a procedure in place for auditing? Does it cover the requirements in ISO 9001 and ISO
19011? How is the audit schedule prepared/approved each year? What approach was used to audit a
process based system?
How were individual processes audited? Was a process auditing technique used? How was this done?
How is effectiveness of the QMS assessed/verified?
What were the results from last Internal/External audits? Were corrective actions implemented? For those
that are closed, how was cause investigated? How were they followed up on and verified?
Any audit findings still open/unresolved? Why?
How are Auditors trained? How is independence of Auditors ensured? How are resource needs identified
and provided, for all areas of the quality management system? Is there only one way to get resources?
For Clause 8.2.3:
Are all identified processes being monitored and measured? Are both product and service processes
covered?
How is monitoring and measurement being done? Are same approach used for each process?
How often is the data collected? Who looks at it? How is it analysed?
Are process targets defined? Do they link to higher level objectives? How is this communicated?
What are the results showing? If process performance is below targets, what actions are taken? Who
decides? Who takes the action?
Did the actions taken work? How do you know they worked? Are there any repeat problems occurring
in the process? How does the organization identify a need to add to the current infrastructure? (i.e. new
buildings or additions, new or replacement process hardware or software, enhanced support services such
as new or upgraded information technology)
For Clause 8.2.4:
Is there a procedure or program or plan in place to monitor and measure the product/service being supplied
to the Customer?
Has the entire plan or procedure been followed? (Check product examples as well as service examples)
Is it consistent in all cases? Is the same approach used for each product or service?
Will the monitoring and measurement methods show whether the product/service has met Customer
requirements?
How often is the data collected? Who looks at it? How is it analysed?
Are there targets defined? How is this communicated?
What are the results showing? If performance is below targets, what actions are taken? Who decides?
Who takes the action?
Did the actions taken work? How do you know they worked? Are there any repeat problems occurring?
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 85 of 100
MANDATORY PROCEDURE
For Clause 8.2.2: Procedure for Internal audit
MANDATORY RECORD
For Clause 8.2.1: Not applicable
For Clause 8.2.2: Internal audit report
For Clause 8.2.3: Not applicable
For Clause 8.2.4: Product acceptance/release report
EVIDENCE/ IMPLEMENTATION DOCUMENT
Not mandatory but helps in fulfillment of requirement
For Clause 8.2.1:
Customer satisfaction survey
Customer complaints
Analysis of lost business
Warranty claims
Phone in log
Customer satisfaction (feedback) is the first tool.
Customer complaints, direct communications with customers, questionnaires and surveys,
subcontracted collection and analysis of performance data , reports from consumer organizations,
reports in various media, sector and industry studies
For Clause 8.2.2:
Annual audit schedule
Audit findings record
Training records
Corrective action report
Audit records include – annual audit schedule, audit planning- (criteria, scope, frequency, methods,
auditor selection and assignment, etc), auditor competence and training, audit checklists and forms,
audit notes and other evidence gathered, audit findings, nonconformity reports, audit reports,
corrective actions and follow-up of internal audit nonconformities, analysis of audit program
performance indicators and trends, and identified improvement opportunities.
For Clause 8.2.3:
Check lists
Process input / output flow
Control charts
fish-bone analysis
Monitoring of Quality objectives
For Clause 8.2.4:
Product acceptance criteria
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 86 of 100
Drawing inspection
Final release checklist
Sample audit
ISO 9001-CLAUSE 8.3
ISO 9001-CLAUSE 8.3 CONTROL OF NONCONFORMING PRODUCT
ISO 9001 REQUIREMENT
The organization shall ensure that product which does not conform to product requirements is identified
and controlled to prevent its unintended use or delivery. A documented procedure shall be established to
define the controls and related responsibilities and authorities for dealing with nonconforming product.
Where applicable, the organization shall deal with nonconforming product by one or more of the
following ways:
a) by taking action to eliminate the detected nonconformity;
b) by authorizing its use, release or acceptance under concession by a relevant authority and,
where applicable, by the customer;
c) by taking action to preclude its original intended use or application;
d) by taking action appropriate to the effects, or potential effects, of the nonconformity when
nonconforming product is detected after delivery or use has started.
When nonconforming product is corrected it shall be subject to re-verification to demonstrate conformity
to the requirements.
Records of the nature of nonconformities and any subsequent actions taken, including concessions
obtained, shall be maintained (see 4.2.4).
EXPLANATION
ISO 9001-Clause 8.3 defines Nonconforming product as product that does not conform to customer
requirements, applicable regulatory requirements or your own organization requirements. The definition
may also apply to nonconforming processes and services. Nonconformities may relate to suppliers and
outsourced work, your own organizational activities or product shipped to customers. Your documented
procedure for nonconforming product must include controls and responsibilities to identify, contain i.e.
prevent further processing or use, keep records of the nature and other details of the nonconformity, notify
appropriate personnel and customer, where appropriate, evaluate what disposition action needs to be
taken, carry out timely disposition, determine policies for release for further processing or shipment to the
customer, obtain customer concessions, rework and re-verification, establish performance indicators to
measure the effectiveness of the control of nonconformance process, etc.
Product or material found with no identification or its quality status is not known, should be treated as
nonconforming product and controlled by the above procedure. If you find that nonconforming product
has been shipped, without a customer concession, you must take appropriate action to reduce the
immediate and consequential effect of the nonconformity. Depending upon the seriousness and scope of
the nonconformity, you might consider taking action to eliminate the nonconformity as well as corrective
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 87 of 100
action to eliminate the root causes of the nonconformity. While there may be no requirement to notify the
customer, it might be appropriate in specific circumstances to notify the customer and resolve the
situation to your customer’s satisfaction. A similar rationale may be applied where product has been
shipped that does not meet regulatory requirements. Depending upon the seriousness and scope of the
nonconformity, you might consider taking action to eliminate the nonconformity as well as corrective
action to eliminate the root causes of the nonconformity. You need to be aware of any reporting
requirements imposed by regulatory bodies and comply with them.
A concession authorization allows you to ship nonconforming product, under controlled conditions. A
deviation authorization allows you to manufacture product different from the original specification, under
controlled conditions. In both these situations, make sure that you obtain these authorizations in writing
prior to shipping or manufacturing nonconforming product. All product realization processes must show
the interaction with your process for nonconforming product. Performance indicators to measure the
effectiveness of control of nonconforming product may include reduction in cycle time to evaluate and
dispose of nonconforming product, reduced errors in preventing unintended use or delivery, improved
alternate use of nonconforming product and cost recovery, etc.
AUDIT CHECKLIST
Is there a procedure in place to control nonconformances?
What makes a Product/Service nonconforming?
Is a record kept when a product/service nonconformance occurs?
Who initiates the record? Who decides how to resolve nonconformances?
Do you currently have any unresolved nonconforming products/services?
If a nonconforming product is reworked, is it re-checked? How is this done for nonconforming services?
Who has the authority to decide if a nonconformance can be left as is? Has this ever occurred?
Were there any situations in the last 12 months where nonconforming product or service was discovered
after delivery?
Over the past 12 months have there been any returns from Customers (or credits issued)? Any of them
due to a nonconformance? How were they handled?
MANDATORY PROCEDURE
Procedure for control of non-conforming Product
MANDATORY RECORD
Nature of the product nonconformities and any subsequent actions taken, including concessions
obtained for e.g. Non Conformance Record, Concession Record
IMPLEMENTATION DOCUMENT
Not mandatory but helps in fulfillment of requirement
Non-conforming tags
Segregated hold areas
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 88 of 100
Non-conforming material report
Disposition (what we do with it)
Corrective action report
ISO 9001-CLAUSE 8.4 & CLAUSE 8.5
ISO 9001-CLAUSE 8.4 & CLAUSE 8.5
CLAUSE 8.4 ANALYSIS OF DATA
ISO 9001 REQUIREMENT
The organization shall determine, collect and analyze appropriate data to demonstrate the suitability
and effectiveness of the quality management system and to evaluate where continual improvement of
the effectiveness of the quality management system can be made. This shall include data generated as a
result of monitoring and measurement and from other relevant sources.
The analysis of data shall provide information relating to
a) customer satisfaction (see 8.2.1),
b) conformity to product requirements (see 8.2.4),
c) characteristics and trends of processes and products, including opportunities for preventive action (see
8.2.3 and 8.2.4), and
d) suppliers (see 7.4).
EXPLANATION
You must collect and analyze QMS data that relate to the effectiveness and efficiency of products,
services, QMS processes, production output, supplier performance, use of resources, cost of poor quality,
customer satisfaction, etc. Do year over year trend analysis to determine longer-term progress, identify
opportunities for further improvement or prioritize correction action for negative trends. Many
organizations have wonderful systems for collecting data, but do a poor job in sorting, summarizing and
presenting this data for decision-making. You must sort and summarize the data you collect into things
gone right and things gone wrong and present them separately. Management can then focus on continual
improvement of things gone right and take corrective action on things gone wrong. Your process for data
collection and analysis must address the type of data to be collected, how it should be sorted and
classified, use of appropriate information systems and data gathering tools and techniques, assignment of
responsibility and authority to review and act, competency and training in use of tools and data analysis,
that the data is gathered, analyzed and acted upon on a timely basis.
A summary of QMS performance data must be included in your periodic management review. Compare
trends in quality and operational performance against your business plans, competitors and industry
benchmarks, where practical. Focus on key customer-related trends to prioritize prompt solutions to
problems, to determine longer-term planning for performance improvement, and to enhance customer
satisfaction. Performance indicators to measure the effectiveness of processes for data collection and
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 89 of 100
analysis may include reduction in cycle time to gather and evaluate data, reduction in inaccurate and
incomplete data, increase in improvement opportunities obtained from data analysis, etc.
CLAUSE 8.5 IMPROVEMENT
8.5.1 CONTINUAL IMPROVEMENT
ISO 9001 REQUIREMENT
The organization shall continually improve the effectiveness of the quality management system through the
use of the quality policy, quality objectives, audit results, analysis of data, corrective and preventive actions
and management review.
EXPLANATION
The focus of this clause is on continual improvement of the QMS and not on product. Continual
improvement of product is addressed in clause 5.6.3b. & 7.1a. Continual improvement is defined as a
recurring activity to increase the ability to fulfill requirements. The ‘ability to fulfill requirements’ refers
to both conforming as well as nonconforming products/processes. Conforming processes can be further
improved, and nonconforming processes must be improved by taking corrective action to prevent
recurrence. Recurring activity refers to the quality improvements includes quality policy and objectives,
audit results, analyses of data, etc. The continual improvement process can be conducted by:
Significant breakthrough projects that either revise or improve existing processes or lead to new processes.
These are usually done by cross-functional teams outside routine operations (Business Process Re-
engineering).
Small-step ongoing improvement activities conducted by personnel within existing processes (Kaizen
Events).
Use of continual improvement tools includes:
Quality Policy – If you recall clause 5.1 required top management to establish the quality policy and
clause 5.3.e required them to review it for continuing suitability. Changes in product, customer base,
organization ownership, management, technology, QMS standards, etc., may require changes to your
quality policy and objectives. As a tool for continual improvement, it requires top management to review
and understand these changes, make changes, if necessary, to the quality policy and objectives and use
these changes to continue further improvement of the QMS and customer satisfaction.
Audit Results – Results of product, process and QMS audits usually provide many opportunities to
improve QMS effectiveness and efficiency. Opportunities may relate to communications, information
systems, processes, controls, use of resources, technology, etc. The management representative must
report these opportunities to top management as included as part of the management review agenda. They
can also be reported and reviewed at regular operational meetings, etc.
Other Audits – Besides product, process and QMS audits, you might find it very productive to conduct
financial, health and safety, environmental, technology, product profitability, social responsibility,
information and communication systems audits.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 90 of 100
In using ‘analyses of data’ as a tool for continual improvement, use the things gone right and things gone
wrong approach to classify your data for decision-making.
Examples of situations which might lead to improvement projects include: machine set-up, die change,
machine changeover times, cycle time, scrap, non-value-added use of floor space, variation in process
parameters, less than 100% first run capability, process averages not centered on target values, testing
requirements not justified by accumulated results, waste of labor and materials, difficult manufacture,
assembly and installation of product, excessive handling and storage, etc.
Useful tools that are often used to continually improve, include: capability studies, design of experiments,
risk analysis, SPC, supplier evaluation, test and measurement technology, theory of constraints, overall
equipment effectiveness, technology, benchmarking, analysis of motion/ergonomics and error-proofing.
Ensure that personnel applying these tools are competent and trained. Performance indicators to measure
the effectiveness of the continual improvement process may include quality objectives being met sooner
than planned, achieving and exceeding business and quality objectives, improved efficiency in use of
resources, cost reduction, improved product quality, etc.
8.5.2 CORRECTIVE ACTION
ISO 9001 REQUIREMENT
The organization shall take action to eliminate the causes of nonconformities in order to prevent
recurrence. Corrective actions shall be appropriate to the effects of the nonconformities encountered. A
documented procedure shall be established to define requirements for
a) reviewing nonconformities (including customer complaints),
b) determining the causes of nonconformities,
c) evaluating the need for action to ensure that nonconformities do not recur,
d) determining and implementing action needed,
e) records of the results of action taken (see 4.2.4), and
f) reviewing the effectiveness of the corrective action taken.
EXPLANATION
Corrective action is action taken to eliminate the cause of a detected nonconformity to prevent recurrence,
whereas preventive action is action taken to eliminate the cause of a potential nonconformity or other
undesirable situation, to prevent occurrence.
You must have a documented procedure for your corrective action process which must address the
following control requirements:
Identify detected nonconformities that relate to your products, QMS processes, resources, suppliers and
outsourced work, product shipped to customers, customer complaints, cost of quality reports, and things
gone wrong reports.
Define your process for identifying nonconformities and consider using appropriate problem-solving
tools to determine the underlying root cause(s) of the nonconformity
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 91 of 100
Problem-solving tools may include analysis of failure mode, capability studies, correlation diagrams,
data collection, fishbone diagram (Ishikawa diagram), histograms, Pareto analysis, probability charts,
stratification of data, graphic representations, etc. Ensure that personnel applying these tools are
competent and trained.
Actions taken to eliminate the cause of nonconformity must flow from your problem-solving activity.
Actions may involve changes to product, process, resources, documentation, controls, etc. or any
combination of these. Conduct follow-up tests to determine whether these actions have indeed eliminated
the cause(s) of the nonconformity and prevented recurrence. You must keep appropriate records of these
actions and follow-up activities. You must monitor your corrective action records on an ongoing basis, for
any recurrence of the nonconformity you took corrective action on. If you found that the problem has
occurred again, then perhaps your analysis of root cause may have been incorrect or incomplete. Keep
appropriate records of all corrective action steps. Ensure timely completion of any open corrective action
or be prepared to provide evidence to justify its continued open status. Make your corrective action records
available on request to customers and provide a summary report for management review. All
nonconformities may not necessarily result in corrective action. Evaluate the significance of
nonconformities in terms of their impact on operating costs, cost of nonconformity and its correction,
product performance, safety, dependability, regulatory requirements, effect on customer’s product and
processes, any other risks, and customer satisfaction. Consider using cross-functional teams in such
decision-making, including the involvement of your organizations designated customer representative.
Performance indicators to measure the effectiveness of the corrective action process may include reduction
in – cycle time for correction actions, problem re-occurrence, open corrective actions, costs, and
improvement in QMS productivity.
8.5.3 PREVENTIVE ACTION
ISO 9001 REQUIREMENT
The organization shall determine action to eliminate the causes of potential nonconformities in order to
prevent their occurrence. Preventive actions shall be appropriate to the effects of the potential problems.
A documented procedure shall be established to define requirements for
a) determining potential nonconformities and their causes,
b) evaluating the need for action to prevent occurrence of nonconformities,
c) determining and implementing action needed,
d) records of results of action taken (see 4.2.4), and
e) reviewing the effectiveness of the preventive action taken.
EXPLANATION
Corrective action is action taken to eliminate the cause of a detected nonconformity to prevent recurrence,
whereas preventive action is action taken to eliminate the cause of a potential nonconformity or other
undesirable situation, to prevent occurrence. Sources of information for finding potential QMS
nonconformities include analyses of data, audit results, cost of quality reports, quality records, service
reports, supplier performance, customer satisfaction feedback, management review records, and lessons
learned from past experience, SPC charts and analyses.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 92 of 100
You must have a documented procedure for your preventive action process which must address basically
all of the EXPLANATION points and tips covered under the corrective action process. While preventing
potential quality related QMS nonconformities is our focus, it might be very useful to think of preventive
action in a wider context, i.e. the entire business. Think in terms of actions needed to prevent loss of market
share, loss of product profitability, loss due to lack of product diversity, loss of business opportunities due
to lack of capacity, inadequate or older facilities, inadequate or inefficient production equipment,
technology or information systems, loss of key or competent personnel, inadequate business financing,
inadequate staffing, etc. These issues may have far more serious consequences than QMS issues. Consider
a process that involves developing a business plan based on gathering relevant research data on these issues,
use of appropriate risk evaluation and management methods, developing proactive strategies and action,
monitoring and reviewing performance against the business plan. This would constitute the ultimate
preventive action process. Preventive action also includes applying successful corrective action solutions
to other similar products, processes and sites where there may be the potential for the same nonconformity
to occur. Use error-proofing methods across similar products, processes and sites, wherever cost effective
and feasible, to prevent recurrence or avoid occurrence of nonconformity. Performance indicators to
measure the effectiveness of the preventive action process may include reduction in – cycle time for
correction actions, problem re-occurrence, open corrective actions, costs, and improvement in QMS
productivity.
AUDIT CHECKLIST
For Clause 8.4:
What data is collected and how is it done? How is it analysed?
What analysis techniques are used and who decides which to use? How often each method is used
(frequency)?
How often is data analysis done? Who does it?
Is analysis done on: Customer Satisfaction data? Product and Service monitoring and measurement
results? Process/Product/Service trend results? Supplier performance data?
How reliable are the sources of data that are used for the analysis?
Were any actions taken as a result of the analysis? How is feedback obtained from Customers? What is
the structure/format that is used? Does it provide information on how Customers perceive the
organization’s performance?
For Clause 8.5:
Is there any evidence of business performance improvement within the past 12 months?
Is there any evidence of product/service quality improvement within the past 12 months?
Is there any evidence of quality management system improvement within the past 12 months?
What can initiate a Corrective Action (CAR)? How many CAR’s were issued in the last 12 months? How
many were closed (make sure to review how investigation of the causes was done)? How many are still
open (for how long, why are they still open)?
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 93 of 100
What can initiate a Preventive Action (PAR)? How many PAR’s were issued in the last 12 months? How
many were closed ( make sure to review how investigation of the causes was done )? How many are still
open (for how long, why are they still open)?
MANDATORY PROCEDURE
For Clause 8.5.2: Procedure for Corrective action
For Clause 8.5.3: Procedure for Preventive action
MANDATORY RECORD
For Clause 8.4 : Not applicable
For Clause 8.5.1 : Not applicable
For Clause 8.5.2 : Corrective Action Report
For Clause 8.5.3 : Preventive Action Report
EVIDENCE/IMPLEMENTATION DOCUMENT
Not mandatory but helps in fulfillment of requirement
For Clause 8.4:
Customer surveys
Non-conformance reports
Supplier evaluation
Internal audits
Trends
For Clause 8.5:
Continual Improvement Register
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 94 of 100
SECTION II DOCUMENTATION REQUIREMENTS OF ISO 9001:2008
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 95 of 100
INTRODUCTION TO DOCUMENTATION REQUIREMENTS OF ISO 9001:
2008
Two of the most important objectives of the ISO 9000:2008 standards have been to develop a simplified
set of standards that will be equally applicable to small as well as medium and large organizations, and for
the amount and detail of documentation required to be more relevant to the desired results of the
organization’s process activities.
ISO 9001:2008 Quality management systems – Requirements has achieved these objectives, and the
purpose of this additional guidance is to explain the intent of the new standard with specific regard to
documentation. ISO 9001:2008 allows organization flexibility in the way it chooses to document its quality
management system (QMS). This enables each individual organization to develop the minimum amount of
documentation needed in order to demonstrate the effective planning, operation and control of its processes
and the implementation and continual improvement of the effectiveness of its QMS. It is stressed that ISO
9001 requires and always has required a “Documented quality management system”, and not a “system of
documents”.
WHAT IS A “DOCUMENT” ?
The following are some of the main objectives of an organization’s documentation, independent of whether
or not it has implemented a formal QMS.
Communication of Information: as a tool for information transmission and communication. The type
and extent of the documentation will depend on the nature of the organization’s products and processes,
the degree of formality of communication systems and the level of communication skills within the
organization, and the organizational culture.
Evidence of conformity: provision of evidence that what was planned, has actually been done.
Knowledge sharing: to disseminate and preserve the organization’s experiences. A typical example
would be a technical specification, which can be used as a base for design and development of a new
product.
It must be stressed that, according to ISO 9001:2008 clause 4.2Documentation requirements documents
may be in any form or type of medium, and the definition of “document” in ISO 9000:2005clause
3.7.2 gives the following examples:
Paper
Magnetic
Electronic or optical computer disc
Photograph
Master sample
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 96 of 100
DOCUMENTATION REQUIREMENTS OF ISO 9001:2008
ISO 9001:2008 clause 4.1 give the documentation requirements of ISO 9001:2008. General requirements
requires an organization to “establish, document, implement, and maintain a quality management system
and continually improve its effectiveness in accordance with the requirements of this International
Standard”
Clause 4.2.1 General explains that the quality management system documentation shall include:
documented statements of a quality policy and quality objectives;
a quality manual
documented procedures required by this International Standard
documents needed by the organization to ensure the effective planning, operation and control of its
processes, and
records required by this International Standard;
The notes after Clause 4.2 make it clear that where the standard specifically requires a “documented
procedure”, the procedure has to be established, documented, implemented and maintained. It also
emphasizes that the extent of the QMS documentation may differ from one organization to another due to:
the size of organization and type of activities;
the complexity of processes and their interactions, and
the competence of personnel.
All the documents that form part of the QMS have to be controlled in accordance with clause 4.2.3 of ISO
9001:2008, or, for the particular case of records, according to clause 4.2.4.
GUIDANCE ON CLAUSE 4.2 OF ISO 9001:2008
The following comments are intended to assist users of ISO 9001:2008 in understanding the intent of the
general documentation requirements of the International Standard.
DOCUMENTED STATEMENTS OF A QUALITY POLICY AND QUALITY OBJECTIVES:
Requirements for the quality policy are defined in clause 5.3 of ISO 9001:2008. The
documented quality policy has to be controlled according to the requirements of clause 4.2.3.
Note Organizations that are revising their quality policy for the first time, or in order to meet the
amended requirements in ISO 9001:2008, should pay particular attention to clause 4.2.3 (c), (d) and (g).
Requirements for quality objectives are defined in clause 5.4.1 of ISO 9001:2008. These
documented quality objectives are also subject to the document control requirements of clause 4.2.3.
QUALITY MANUAL:
Clause 4.2.2 of ISO 9001:2008 specifies the minimum content for a quality manual. The format and
structure of the manual is a decision for each organization, and will depend on the organization’s size,
culture and complexity. Some organizations may choose to use the quality manual for other purposes
besides that of simply documenting the QMS
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 97 of 100
A small organization may find it appropriate to include the description of its entire QMS within a single
manual, including all the documented procedures required by the standard.
Large, multi-national organizations may need several manuals at the global, national or regional level,
and a more complex hierarchy of documentation.
The quality manual is a document that has to be controlled in accordance with the requirements of clause
4.2.3.
Documented procedures :
ISO 9001:2008 specifically requires the organization to have “documented procedures” for the following
six activities:
CLAUSE 4.2.3 CONTROL OF DOCUMENTS
CLAUSE 4.2.4 CONTROL OF RECORDS
CLAUSE 8.2.2 INTERNAL AUDIT
CLAUSE 8.3 CONTROL OF NONCONFORMING PRODUCT
CLAUSE 8.5.2 CORRECTIVE ACTION
CLAUSE 8.5.3 PREVENTIVE ACTION
These documented procedures have to be controlled in accordance with the requirements of clause 4.2.3
Some organizations may find it convenient to combine the procedure for several activities into a single
documented procedure (for example, corrective action and preventive action). Others may choose to
document a given activity by using more than one documented procedure (for example, internal audits).
Both are acceptable.
Some organizations (particularly larger organizations, or those with more complex processes) may require
additional documented procedures (particularly those relating to product realization processes) to
implement an effective QMS.
Other organizations may require additional procedures, but the size and/or culture of the organization
could enable these to be effectively implemented without necessarily being documented. However, in
order to demonstrate compliance with ISO 9001:2008, the organization has to be able to provide objective
evidence (not necessarily documented) that its QMS has been effectively implemented.
Documents needed by the organization to ensure the effective planning, operation and control of its
processes:
In order for an organization to demonstrate the effective implementation of its QMS, it may be necessary
to develop documents other than documented procedures. However, the only documents specifically
mentioned in ISO 9001:2008 are:
Quality policy (clause 4.2.1.a)
Quality objectives (clause 4.2.1.a)
Quality manual (clause 4.2.1.b)
There are several requirements of ISO 9001:2008 where an organization could add value to its QMS and
demonstrate conformity by the preparation of other documents, even though the standard does not
specifically require them. Examples may include:
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 98 of 100
Process maps, process flow charts and/or process descriptions
Organization charts
Specifications
Work Instruction
Documents containing internal communications
Production schedules
Approved supplier lists
Test and inspection plans
Quality plans/Project plan/ process plan
All such documents have to be controlled in accordance with the requirements of clause
4.2.3 and/or clause 4.2.4, as applicable
Records:
Examples of records specifically required by ISO 9001:2008 are presented in Table below
Organizations are free to develop other records that may be needed to demonstrate conformity of their
processes, products and quality management system.
Requirements for the control of records are different from those for other documents, and all records have
to be controlled according to those of clause 4.2.4 of ISO 9001:2008.
Records required by ISO 9001:2008
Clause Record required
Clause 5.6.1 Management reviews
Clause 6.2.2 e) Education, training, skills and experience
Clause 7.1 d) Evidence that the realization processes and resulting product fulfil
requirement
Clause 7.2.2 Results of the review of requirements related to the product and
actions arising from the review
Clause 7.3.2 Design and development inputs relating to product requirements
Clause 7.3.4 Results of design and development reviews and any necessary
actions
Clause 7.3.5 Results of design and development verification and any necessary
actions
Clause 7.3.6 Results of design and development validation and any necessary
actions
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 99 of 100
Clause 7.3.7 Results of the review of design and development changes and any
necessary actions
Clause 7.4.1 Results of supplier evaluations and any necessary actions arising
from the evaluations
Clause 7.5.2 d)
As required by the organization to demonstrate the validation of
processes where the resulting output cannot be verified by
subsequent monitoring or measurement
Clause 7.5.3 The unique identification of the product, where traceability is a
requirement
Clause 7.5.4 Customer property that is lost, damaged or otherwise found to be
unsuitable for use
Clause 7.6 a) Basis used for calibration or verification of measuring equipment
where no international or national measurement standards exist
Clause 7.6 Validity of the previous measuring results when the measuring
equipment is found not to conform to requirements
Clause 7.6 Results of calibration and verification of measuring equipment
Clause 8.2.2 Internal audit results and follow-up actions
Clause 8.2.4 Indication of the person(s) authorizing release of product.
Clause 8.3 Nature of the product nonconformities and any subsequent actions
taken, including concessions obtained
Clause 8.5.2 e) Results of corrective action
Clause 8.5.3 d) Results of preventive action
ORGANIZATIONS PREPARING TO IMPLEMENT A QMS
For organizations that are in the process of implementing a QMS, and wish to meet the documentation
requirements of ISO 9001:2008, the following comments may be useful.
For organizations that are in the process of implementing or have yet to implement a QMS, ISO 9001:2008
emphasizes a process approach. This includes:
determining the processes necessary for the effective implementation of the quality management
system
determining the interactions between these processes.
UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008
Global Matrix Consultations Mob. +962 78-1-501-940 Email. [email protected]
Page 100 of 100
documenting the processes to the extent necessary to assure their effective operation and control.
(It may be appropriate to document the processes using process maps. It is emphasized, however,
that documented process maps are not a requirement of ISO 9001:2008.)
These processes include the management, resource, product realization and measurement processes that
are relevant to the effective operation of the QMS.
Analysis of the processes should be the driving force for defining the amount of documentation needed
for the quality management system, taking into account the requirements of ISO 9001:2008. It should not
be the documentation that drives the processes.
ORGANIZATIONS WISHING TO ADAPT AN EXISTING QMS
For organizations that currently have a QMS the following comments are intended to assist in understanding
the changes to documentation that may be required or facilitated by the transition to ISO 9001:2008
An organization with an existing QMS should not need to rewrite all of its documentation in order to meet
the requirements of ISO 9001:2008. This is particularly true if an organization has structured its QMS
based on the way it effectively operates, using a process approach. In this case, the existing documentation
may be adequate and can be simply referenced in the revised quality manual.
An organization that has not used a process approach in the past will need to pay particular attention to
the definition of its processes, their sequence and interaction.
An organization may be able to carry out some simplification and/or consolidation of existing documents,
in order to simplify its QMS.
DEMONSTRATING CONFORMITY WITH ISO 9001:2008
For organizations wishing to demonstrate conformity with the requirements of ISO 9001:2008, for the
purposes of certification/registration, contractual, or other reasons, it is important to remember the need to
provide evidence of the effective implementation of the QMS.
Organizations may be able to demonstrate conformity without the need for extensive documentation.
To claim conformity with ISO 9001:2008, the organization has to be able to provide objective evidence
of the effectiveness of its processes and its quality management system. Clause 3.8.1 of ISO
9000:2005 defines “objective evidence” as “data supporting the existence or verity of something” and
notes that “objective evidence may be obtained through observation, measurement, test, or other means.”
Objective evidence does not necessarily depend on the existence of documented procedures, records or
other documents, except where specifically mentioned in ISO 9001:2008. In some cases, (for example,
in clause 7.1(d) Planning of product realization, and clause 8.2.4 Monitoring and measurement of product),
it is up to the organization to determine what records are necessary in order to provide this objective
evidence.
Where the organization has no specific internal procedure for a particular activity, and this is not required
by the standard, (for example, clause 5.6 Management Review), it is acceptable for this activity to be
conducted using as a basis the relevant clause of ISO 9001:2008. In these situations, both internal and
external audits may use the text of ISO 9001:2008 for conformity assessment purposes.