ISO 9001:2015 - Quality Digest

ISO 9001:2015Revision RefresherDavid MuilIntertekVP Business DevelopmentNovember 17, 2016

Agenda Introduction ISO 9000 Background ISO 9001:2008 in Retrospect The Key Changes What Companies Do NotHave to Do2

ISO 9000Background3

ISO 9001 Series Background19942000Revisions1987200820154

Revision Background – ISO 9001 The last major revision took place in 2000; ISO 9001:2000 made a radical change in thinking; Similarly to ISO 9001:2015; The concept of process management placed at the heart of the standard; Continual process improvement and customer satisfaction were alsomade explicit.5

ISO9001:2008 inRetrospect6

ISO Survey 20147

ISO 9001:2008 Documentation requirements werethe main focus; Mandatory documented proceduresrequired are numerous ‘Process approach’ is expected bythe standard but not clearly definedso not understood in the businessworld Performance Monitoring. We nowneed to use all that wonderful datawe have collected.8

KeyChanges9

ISO 9001:2015Key Changes in Concept & Philosophies Reinforced Process approach Risk-based thinking Flexibility in documenting themanagement system “Enhanced” stakeholderperspective Interested Parties and Boundariesnow to be well understood Business metrics to fit our keyprocesses.10

Key Changes in Structure – ISO 9001Requirements set out in Sections 4-10The business related standard followsthe same cycle as plan do check andact.11

Adoption of Annex XL HLS in ISO 900112

QMS: Change in Concepts and Philosophies ISO 9001:2015 is based on 7 management principles Mutually beneficial supplier relationships becomes RelationshipManagement; Continual improvement becomes Improvement Suppliers are Interested Parties Process Approach-leadership driven. Not just the quality guyanymore. It is a business system run by management! Risk base thinking It’s commonplace in our jobs and daily lives (i.e. driving, visiting a city whenabroad, hiring someone, making an investment, etc.); External and internal risks endanger the achievement of goals and objectives For this reason the concept of risk and risk-based thinking go throughout theentire process approach (risk related requirements throughout the QMSstandard).13

Principle 1 – Primary Customer Focus and ExpectedOutcomesThe primary focus of a QMSis to meet customerrequirements and to striveto exceed customerexpectations;14

Principle 2 – Leadership Leaders at all levels establish unity ofpurpose and direction and createconditions in which people areengaged in achieving the objectives ofthe organization Leadership must take accountabilityfor the effectiveness of themanagement systems. Leadership expectations have beenraised with respect to participation andpromotion on the systems.15

Leadership Clause 5 now entitled “Leadership” Top management is now required to take a more active involvementin the quality management system. Stronger emphasis on the overallaccountability of top management for the effectiveness of themanagement system. The figure of management representative no longer explicitlymentioned. In the absence of specific requirement for a managementrepresentative, the organization may choose a structure of assigningresponsibilities as appropriate to ensure relevant responsibilities andauthorities are assigned.16

Principle 3 – Engagement of PeopleIt is essential for the organization thatall people are competent, empoweredand engaged in delivering value andthe intended outcomes.Competent, empowered and engagedpeople throughout the organizationenhance its capability to create value.17

Organizational KnowledgeISO 9001:2015 also contains a newrequirement aimed at ensuring thatorganizations take steps to captureand preserve knowledge andlearning, which is necessary for theeffective operation of their processesand for ensuring the conformity oftheir products and service.The bar is now raised fordemonstration of awareness.18

Principle 4 – Process ApproachConsistent and predictable results areachieved more effectively andefficiently when activities areunderstood and managed asinterrelated processes that function asa coherent system.Establishing, implementing, controllingand maintaining the processes inaccordance with established criteria arerequired to meet management systemrequirements.19

Process Approach - QMS Section 5.1.1 requirestop management tomake sure that QMS isintegrated intobusiness processes. The “processapproach” is now more“explicit” in section 4.420

An example of a process which includes risks and regulatoryrequirements and associated customer requirements.Infrastructure- (processequipment, software andhardware, supporting services)Process flow:Inputs:Human Resources-(education,knowledge, skills, training andexperience)OutputsRegulatory RequirementsExternal and Internal Requirementsimpacting processProcess Monitoring(measurements, key performanceindicators, trends, action plans forimprovement, linkage to BP)Risks associated with the processDocumentation-(process maps,procedures, standards, instructions,methods, forms):21

Principle 5 – ImprovementSuccessful organizations havean ongoing focus onimprovement.”Organizations need to reviewdata analyze make decisionsto continually improveCannot improve what you donot measure.Sections 9 PerformanceEvaluation and 10Improvement work hand inhand in improving anorganization22

Principle 5 – ImprovementSection 9 Performance Evaluation Monitor measure and act Determine when and how often data isto be analyzed and evaluated todetermine effectiveness Customer Satisfaction-determine howthis is measured by the organization. Management Review, Internal Auditcorrective action Note: Metrics should be two-fold. Effective metrics tell us if we aremeeting the goal Efficient metrics tell us what it iscosting to reach the goal BOTH ARE NEEDED23

Principle 5 – ImprovementSection 10 Improvement Opportunities for improvement tobe identified to enhance: customer satisfaction Products, services and futureneeds Reducing undesired effects (riskmitigation) Corrective action-root cause andeffective corrective action The organization shall continuallyimprove the qms Determine as an output ofmanagement review the analysisof data and where action isneeded to drive improvement24

Principle 6 – Evidence-Based Decision MakingDecisions based on theanalysis and evaluationof data and informationare more likely toproduce desired results.More focus on evaluatingtrends and changes inQMS.25

Risk and Preventive Action Preventive action has beenremoved from ISO 9001:2015. Covered by the risk-basedthinking concepts in the Planningsection and other clauses of thestandards. The standards themselves havebecome risk-based, preventivetools.26

Risk-Based thinking Risk is often formulated as a combination of an event’s consequences andlikelihood of occurrence (and detection of precursors in some methodologies) Quantitative or qualitative approach, or a blend ISO 9001:2015 requires a systematic approach to risk When selecting methodology the organization should consider the effects offailures, for example: failing jet engine vs scratch on the exterior front of a washing machine Impacts of releases to the environment: onto the ground in an industrial park vs.air emissions upwind of a school.27

Risk and Opportunity Certain risks can lead to a positive deviation and be seen as aopportunity All risks managed adequately through the QMS/EMS represent an overallopportunity for the organization Examples of a risk-based approach would be the FMEA (failure modeeffects analysis). Key is risks are identified as required throughout the standard andactions taken to mitigate the risk and continually improve.28

Principle 7 – Relationship ManagementFor sustained success,organizations manage theirrelationships with interested parties,such as customers, suppliers,regulatory agencies, andcommunities.29

Cl. 4.2.2 Understanding the Interested PartiesIdentification and analysis of interested parties30

Context of the Organization A whole new clause 4 requires now the organization to consider it’spurpose and its context, and to determine the scope of itsmanagement system; 4.1 Understanding the Organization and its Context and; 4.2 Understanding the Needs and Expectations of Interested Parties. Various well-established methodologies can be employed: SWOT,PEST, SOAR, Porter’s 5 forces analysis, Value chain analysis31

Changed Terms - QMS ISO 9001:2015 has replaced “product” with “goods and services”; All products can actually be considered as a service or better, a solution to thecustomer (buying a smartphone, the customer is actually after thecommunication services ) “Purchasing” and “outsourcing” are now replaced by “externally providedproducts and services”. Clause 8.4 Control of Externally Provided Productsand Services addresses all forms of external provision. The organization is required to take a risk-based approach to determine thetype and extent of controls appropriate to each external provider and allexternally provided products and services32

Documentation Requirements ISO 9001:2015 contains general requirements for documented information,with no required documented manual, documented procedures or records. 'Documented information' now replaces both documents and records Document control and record control requirements no longer exist; howeversimilar control requirements apply to the documented information. No mandatory procedures are required by the revised standards. Moreflexibility is afforded organization with respect to determining the extent ofdocumented information needed to ensure processes are effectivelycontrolled.33

Mandatory Documented Information inISO 9001:201534

WhatCompaniesDo Not Haveto Do35

Changes Clients Do Not Need to Make Organizations do not need to remove their management representatives.While there is no requirement in ISO 9001:2015 for a managementrepresentative, this does not prevent organizations from choosing to retainthis role if they so wish. Be aware, however, that some of the dutiestraditionally assigned to the management representative by topmanagement will need to be assumed directly by top management. Organizations do not need to throw out their Quality Manuals andDocumented Procedures. While ISO 9001:2015 sets out no requirement fororganizations to hold either a Quality Manual or Documented Procedures, ifthis documentation is in place, needed and working well, there is no needfor it to be withdrawn.36

Changes Clients Do Not Need to Make Organizations do not need to renumber existing documentation tocorrespond to the new clause references. Whether organizations choose tocarry out a renumbering exercise may depend upon whether the benefitsgained from renumbering will exceed the effort involved in making thechanges. However, references need to be made in conformance with thestandards. Organizations do not need to restructure their management systems tofollow the sequence of requirements as set out in the ISO standards.Providing all of the requirements contained are met, the organization'ssystem will be conformant. Again, however, there must be properreferences to related processes.37

Changes Clients Do Not Need to Make Organizations do not need to Refresh existing documentation to use thenew terms and definitions contained within the ISO standards. Once again,organizations are free to make the judgment as to whether this effort wouldbe worthwhile. If organizations are more comfortable using their ownterminology, e.g. “records” instead of “documented information”, or“supplier” rather than “external provider” then this is perfectly acceptable38