ISO Revisions - BSI Group

ISO 9001 - Quality Management System - Transition GuideClause 5: LeadershipClause 6: PlanningThis clause places requirements on “top management” which is theperson or group of people who directs and controls the organizationat the highest level. It is no longer the responsibility of an individualor to have a “Management Representative” who is responsible for theQMS. There is an increased emphasis on people “owning” the QMSrather than one individual. The purpose of these requirements is todemonstrate leadership and commitment by leading from the top.Planning has always been a familiar element of ISO 9001, but nowthere is an increased focus on ensuring that it is considered withClause 4.1 ‘context of the organization’ and Clause 4.2 ‘interestedparties’.Top management now have greater involvement in the managementsystem and must ensure that the requirements of it are integratedinto the organization’s processes and that the policy and objectivesare compatible with the strategic direction of the organization. Thequality policy should be a living document, at the heart of theorganization. To ensure this, top management are accountable andhave a responsibility to ensure the QMS is made available,communicated, maintained and understood by all parties.There is also a greater focus on top management to enhancecustomer satisfaction by identifying and addressing risks andopportunities that could affect this. Top management need todemonstrate consistent customer focus by showing how they meetcustomer requirements, regulatory and statutory requirements, andalso how the organization maintains enhanced customersatisfaction.In the same context, they need to have a grasp of the organizationsinternal strengths and weaknesses and how these could have animpact to deliver products or services. This will strengthen theconcept of business process management. In addition, topmanagement need to demonstrate an understanding of the key risksassociated with each process and the approach taken to manage,reduce or transfer the risk .Finally, the clause places requirements on top management toassign QMS relevant responsibilities and authorities , but mustremain accountable for the effectiveness of the QMS.6The first part of this clause concerns risk assessment whilst thesecond part is concerned with risk treatment. When determiningactions to identify risks and opportunities these need to beproportionate to the potential impact they may have on theconformity of products and services. Opportunities could forexample include new product launches, geographical expansion, newpartnerships, or new technologies.The organization will need to plan actions to address both risks andopportunities, how to integrate and implement the actions into itsmanagement system processes and evaluate the effectiveness ofthese actions. Actions must be monitored, managed andcommunicated across the organization.Another key element of this clause is the need to establishmeasurable quality objectives. This clause retains some of therequirements contained in Clause 5.4 of the 2008 version but ismore specific. Quality objectives now need to be consistent with thequality policy, relevant to the conformity of products and services aswell as enhancing customer satisfaction.The last part of the clause considers planning of changes whichmust be done in a planned and systemic manner. There is a need toidentify the potential consequences of changes, determine who isinvolved, when changes are to take place, what resource needs to beallocated.

bsigroup.comClause 7: SupportClause 7 ensures there are the right resources, people andinfrastructure to meet the organizational goals. It requires anorganization to determine and provide the necessary resources toestablish, implement, maintain and continually improve the QMS.Simply expressed, this is a very powerful requirement covering allQMS resource needs and now covers both internal and externalresources.Clause 7.1 builds on Clauses 6.1, 6.2, 6.3 and 7.6 from 2008 andsplits into 5 sub-clauses. There are additional requirements to meetapplicable statutory and regulatory requirements. The sub-clausescontinues to cover requirements for infrastructure and environmentfor the operation of processes. Monitoring and measuring has beenchanged to include resources, such as personnel or training.Organizational knowledge is a new requirement which deals withwith requirements for competence, awareness, and communicationof the QMS. Personnel must not only be aware of the quality policy,but they must also understand how they contribute to it and whatthe implications of not conforming are.There is a key requirement to maintain the knowledge held by anorganization to ensure conformity of products and services. Thiscould include the knowledge held by an individual as well as forexample, the intellectual property of an organization. Organizationsare required to examine whether the current knowledge they have issufficient when planning changes and whether any additionalknowledge is required.Finally there are the requirements for “documented information”. Thisis a new term, which replaces the references in the 2008 standardto “documents” and “records”. Organizations need to determine thelevel of documented information necessary to control the QMS. Thiswill differ between organizations due to size and complexity. In linewith the increased importance of information security inorganizations, there is also greater emphasis on controlling accessto documented information such as use of passwords. Organizationsshould also have systems in place to provide a back-up should ITsystems crash.Clause 8: OperationThis clause deals with the execution of the plans and processes thatenable the organization to meet customer requirements and designproducts and services. It includes much of what was previously referredto in Clause 7 of the 2008 version, but there is greater emphasis on thecontrol of processes especially planned changes and review of theconsequences of unintended changes, and mitigating any adverseeffects as necessary.The Clauses continue to cover ‘Requirements for products and services’which remains largely unchanged from the 2008 version. However, itnow requires communication with regards to contingency actionswhere required and also the treatment of customer property. A newrequirement for communicating with ‘potential’ customers is alsoincluded, useful for bringing new offerings or solutions to the market.There are more explicit requirements in terms of the standards or codesof practice that the organization has committed to implement; internaland external resource needs for the design and development ofproducts and services and finally the potential consequences of failuredue to the nature of products and services.There is also a new clause which covers post-delivery activities. Thiscould include activities such as maintenance programmes or workcarried out under warranty, and activities covering final disposal orrecycling of the product. When determining the extent of these activitiesorganizations must consider the risks associated with a product orservice, customer requirements, customer feedback, and any statutoryrequirements.Clause 9: Performance evaluationPerformance evaluation covers many of the areas previously featured inClause 8 of the 2008 version.Requirements for monitoring, measurement, analysis and evaluation arecovered and you will need to consider what needs to be measured, methodsemployed, when data should be analysed and reported on and at whatintervals. Documented information that provides evidence of this must beretained.There is now an emphasis on directly seeking out information that relatesto how customers view the organization. Organizations must actively seekout information on customer perception. This can be achieved in a numberof ways including satisfaction surveys, analysis of market share, and throughcomplaints logged. There is now an explicit requirement that organizationsmust show how the analysis and evaluation of this data is used, especiallywith regards to the need for improvements to the QMS.Internal audits must also be conducted and this is largely unchanged fromthose in the 2008 version. There are additional requirements relating todefining the ‘audit criteria’ and ensuring the results of the audits are reportedto ‘relevant’ management’.Management reviews are still required but there are additional requirementsincluding the consideration of changes in external and internal issues thatare relevant to the QMS. Documented information must be retained asevidence ofmanagement reviews.The revised version of the standard acknowledges the trend towardsgreater use of subcontractors and outsourcing. This is demonstrated bythe requirement to establish criteria for monitoring the performance ofthese parties in addition to keeping records used to establish selectioncriteria.7

ISO 9001 - Quality Management System - Transition GuideClause 10: ImprovementThis clause starts with a new section that organizations shoulddetermine and identify opportunities for improvement such asimproved processes to enhance customer satisfaction. There is alsoa need to actively look for opportunities to improve processes,products and services, and the QMS, especially with future customerrequirements in mind.Due to the new way of handling preventive actions, there are nopreventive action requirements in this clause. However, there aresome new corrective action requirements. The first is to react to thenonconformities and take action, as applicable, to control andcorrect the nonconformities and deal with the consequences. Thesecond is to determine whether similar nonconformities exists orcould potentially occur.The requirement for continual improvement has been extended tocover the suitability and adequacy of the QMS as well as itseffectiveness, but it no longer specifies how an organization achievesthis.Major differences in terminology betweenISO 9001:2008 and ISO 9001:2015ISO 9001:2008ISO 9001:2015ProductsProducts and servicesExclusionsNot used – see Clause A.5 for clarification ofapplicabilityManagement representative Not usedDocumentation, qualitymanual, documentedprocedures, recordsDocumented informationWork environmentEnvironment for the operation of processesMonitoring and measuring Monitoring and

Comparing ISO 9001:2015 with ISO 9001:2008 ISO 9001:2015 is based on Annex SL – the new high level structure. This is a common framework for all ISO management systems. This helps to keep consistency, align different management system standards, offer matching sub-clauses against the top level structure and apply common