The Similarity between ISO 9001 and BS 7799-2
BS 7799-2:2002 is a specification for an Information Security Management System (ISMS). It is shortly to be upgraded to the status of a full
International Standard, and published as ISO/IEC 27001. The normative part of this standard has four sections and an annex . The requirements of the four sections are associated with the PDCA cycle. The annex defines all the controls that must be considered for generating the SOA. Thus the structure of BS 7799-2:2002, as will be ISO/IEC 27001, can be simply described as:
A PDCA framework;
An SOA.
ISO 9001:2000 is a specification for a Quality Management System (QMS). The normative part of this standard has five normative sections,
numbered 4 – 8. All of these requirements must be met in order to claim conformance with the standard, save for section 7 (Product Realisation),
where the standard states in paragraph 1.2 “Where exclusions are made, claims of conformity to this International Standard are not acceptable unless
these exclusions are limited to requirements within clause 7, an such exclusions do not affect the organisation’s ability, or responsibility, to provide
product that meets customer and applicable regulatory requirements”.
In Table 2 we relate the requirements of sections 4, 5, 6 and 8 to the PDCA framework. We treat section 7 as an SOA.
The BS 7799-2:2002 standard gives instruction on how the controls documented in BS 7799-2 Annex A are to be determined as being applicable or nonapplicable. In particular, if the control is applicable it must be justified in terms of the results of a risk assessment.
The controls listed in Section 7 of ISO 9001 may be excluded with justification. Thus, Section 7 of ISO 9001 may be treated in exactly the same manner as BS 7799-2 Annex A provided that applicable quality controls are also justified by
reference to a risk assessment. Conversely for an integrated MS, information security controls that are declared to be non-applicable should also be
justified as not applicable by reference to a risk assessment, in order to bring the two standards into line. Interestingly, this requirement was present in
BS 7799-2:1999 but was dropped in the 2002 revision.
The amalgamation of these two approaches in an integrated MS should not be seen as a disadvantage. The justification of non-applicable information security controls greatly simplifies the task of determining, given a change of threat or
business practice, whether a non-applicable control has now become applicable. The justification of Product Realisation controls by way of a reference to a risk assessment serves to remind us that, for many organisations, quality controls are not uniform across the whole organisation but are commensurate with the degree of risk involved.
For example, in the software business, a fixed price assignment with tight timescales to produce a bespoke software system has a greater risk than a
time and materials contract to supply programming staff, and the quality controls applied to management planning and reporting of the two projects would be very different.
Friday, October 9, 2009
BACKGROUND TO THE ISO 9001:2008 REVISION PROCESS
BACKGROUND TO THE ISO 9001:2008 REVISION PROCESS
In order to assist organizations to have a full understanding of the new ISO 9001:2008, it may be useful to have an insight on the revision process, how this revision reflects the inputs received from users of the standard, and the consideration given to benefits and impacts during its development.
Prior to the commencement of a revision (or amendment)to a management system standard, ISO/Guide 72:2001 Guidelines for the justification and development of management system standards recommends that a Justification Study” is prepared to present a case for the proposed project and that it outlines details of the data and inputs used to support its arguments. In relation to the development of ISO 9001:2008 user needs were identified from the following:
- the results of a formal “Systematic Review on ISO 9001:2000 that was performed by the members of ISO/TC 176/SC2 during 2003-2004
- feedback from the ISO/TC 176/Working Group on Interpretations,
- the results of an extensive worldwide “User Feedback Survey on ISO 9001 and ISO 9004″ by ISO/TC 176/SC 2/WG 18 and similar national surveys.
The key focuses of the ISO 9001:2008 amendment were to enhance the clarity of ISO 9001:2000 and to enhance its compatibility with ISO 14001:2004.
A tool for assessing the impacts versus benefits for proposed changes was created to assist the drafters of the amendment in deciding which changes should be included, and to assist in the verification of drafts against the identified user needs. The following decision making principles were applied:1) No changes with high impact would be incorporated into the standard;
2) Changes with medium impact would only be incorporated when they provided a correspondingly medium or high benefit to users of the standard;
3) Even where a change was low impact, it had to be justified by the benefits it delivered to users, before being incorporated.
The changes incorporated in this ISO 9001:2008 edition were classified in terms of impact into the following categorie
- No changes or minimum changes on user documents, including records
- No changes or minimum changes to existing processes of the organization
- No additional training required or minimal training required
- No effects on current certifications
The benefits identified for the ISO 9001:2008 edition fall into the following categories:
- Provides clarity
- Increases compatibility with ISO 14001.- Maintains consistency with ISO 9000 family of standards.
-
Improves translatability.
In order to assist organizations to have a full understanding of the new ISO 9001:2008, it may be useful to have an insight on the revision process, how this revision reflects the inputs received from users of the standard, and the consideration given to benefits and impacts during its development.
Prior to the commencement of a revision (or amendment)to a management system standard, ISO/Guide 72:2001 Guidelines for the justification and development of management system standards recommends that a Justification Study” is prepared to present a case for the proposed project and that it outlines details of the data and inputs used to support its arguments. In relation to the development of ISO 9001:2008 user needs were identified from the following:
- the results of a formal “Systematic Review on ISO 9001:2000 that was performed by the members of ISO/TC 176/SC2 during 2003-2004
- feedback from the ISO/TC 176/Working Group on Interpretations,
- the results of an extensive worldwide “User Feedback Survey on ISO 9001 and ISO 9004″ by ISO/TC 176/SC 2/WG 18 and similar national surveys.
The key focuses of the ISO 9001:2008 amendment were to enhance the clarity of ISO 9001:2000 and to enhance its compatibility with ISO 14001:2004.
A tool for assessing the impacts versus benefits for proposed changes was created to assist the drafters of the amendment in deciding which changes should be included, and to assist in the verification of drafts against the identified user needs. The following decision making principles were applied:1) No changes with high impact would be incorporated into the standard;
2) Changes with medium impact would only be incorporated when they provided a correspondingly medium or high benefit to users of the standard;
3) Even where a change was low impact, it had to be justified by the benefits it delivered to users, before being incorporated.
The changes incorporated in this ISO 9001:2008 edition were classified in terms of impact into the following categorie
- No changes or minimum changes on user documents, including records
- No changes or minimum changes to existing processes of the organization
- No additional training required or minimal training required
- No effects on current certifications
The benefits identified for the ISO 9001:2008 edition fall into the following categories:
- Provides clarity
- Increases compatibility with ISO 14001.- Maintains consistency with ISO 9000 family of standards.
-
Improves translatability.
Summaries of changes to ISO 14001
Summaries of changes to ISO 14001
ISO 14001 year 2004 changes are consider having some effect on EMS ISO 14001, the changes require reviewing the EMS and taking action for transition (information is under control of TC 207). Considering the most relevant changes in advancing / transition to ISO 14001 2004 standard includes (an overview for transition / implementation):
Clause 4.1, Scope – requires defining the scope of the EMS (environmental management system) linking to the organizations activities, products, and services (and processes). First consider defining the scope of the EMS within the “boundaries” of products, services, activities, and processes as these relate [for ISO 9001:2000 organizations consider requirement 4.1, and organizations implementing ISO 14001 may be helpful reading ISO 9001:2000 clause 4.1]. The previous indicates an overview on how the EMS fulfills ISO 14001 2004 [some thoughts are internal auditing, management system review providing that these link].
Clause 4.2, Policy – The scope of the EMS and its policy must be consistent. The requirements for the policy remains about the same, now explicitly indicating that must be developed by top management, and other explicit terms in tune with the 1996 version.
Clause 4.3.1, Environmental Aspects Identification – Changes involve in assisting to clarifying statements from 1996 version and the change of the “or” for “and” (within the scope of the EMS); “… products and services…” Control and influence are now mutually exclusive, whilst introducing planned and new developments… new and modified activities… Considering identifying significant aspects must occur from development, implementation, and maintaining the EMS (see 4.1). Information on environmental aspects needs be in documentation format.
To a more assertive statement, “… over which it can be expected to have…” changes to the following “…those which it can influence.”
Clause 4.3.2, Legal and Other Requirements – The wording changes to “legal” in better addressing context to different world regions. Consideration must be given with changes to clause 4.1, for development, implementation, and maintaining the EMS.
Clause 4.3.3 – No significant change.
Clause 4.3.4 – No significant change.
Clause 4.4.1 , Resources, Roles, Responsibility and Authority, please note that this is a new title. This title reflects the importance and relevancy of each term to the EMS. Some minor wording changes include from “…provide…” to “…ensure the availability…” Do not forget that this will require reviewing auditing, planning, and responding to emergencies.
Clause 4.4.2, Competence, Training and Awareness – Whilst using the same
terms in the title notice the change in sequence. This change reflects the expected order of importance of the terms-subjects. Also consider that introduces a new phrase that broadens the individuals within an EMS; “…persons working for, or on behalf of …” Combining these previous two sentences, provides for the organization to include not only relevancy to significant environmental aspects but as well extending to those working for or in behalf of the organization . (Note: also consider that training provider and supporting services are inclusive to 4.4.6).
Clause 4.4.3, Communication – In specifically addressing the European Requirements (EMAR / EMAS), if the organization decides communicating externally the environmental aspects (environmental performance), ISO 14001:2004 address this issue. This is strictly on a volunteer globally, realizing that within the European Union is require.
Clause 4.4.4, Environmental Management System Documentation – in pursuit
of continuing compatibility with ISO 9001:2000 the term applied is “Documentation.”
Thereof, consider this clause also in the light of ISO 9001:2000 when integrating
EMS and QMS. The EMS documentation and records must be those to ascertain
objective evidence on the effectiveness of implementing the policy, planning, and
execution (including improving), control of operations, verification, and control,
improving, and reviewing the EMS.
Clause 4.4.5, Document Control – Again, changing the title and wording reflects
compatibility with ISO 9001:2000. Other than compatibility between QMS ISO
9001:2000 and EMS ISO 14001:2004 there are no significant changes.
4.4.6, Operational Control – No significant change.
4.4.7, Emergency Preparedness and Response – The structure changes by
placing some of its already content in bullets to emphasize each as pointer for the organization to address.
4.5.1, Monitoring and Measurement – Best to see new clause 4.5.2.
4.5.2, Evaluation of Legal Compliance – This is a new clause
[Note: addressing the concern of many government entities / authorities on
their responsibility on environmental and social issues and EMS ISO 14001 1996].
This is construe as the most impacting change to ISO 14001 2004 – this “new” clause brings the last paragraph of 4.5.1 as a separate clause. This clause brings the importance of periodically reviewing legal requirements / compliance under which the organization ascribes. It implies provision of records to demonstrate that this review occurs. This requires that the EMS be review to address the requirements of this “new” clause.
4.5.3, Non Conformance, Corrective and Preventive Action – Includes clarifications ascertaining that prevention (measures or potential of non conformity)and corrective action are two occurring events (which may be mutually inclusive).
Thereof, “action to eliminate the causes of potential non conformities to prevent their occurrence” can lead to changes in your EMS procedures.
4.5.4, Records – States that organizations need records to demonstrate
implementation of procedures and achieving results. These must demonstrate complying with the EMS (procedures and results). Whilst record retention times are not specifically required, record retention needs being specified (consider legal requirements and contractual agreements such that provide a demonstrable sustainable EMS).
4.5.5, Environmental Management System Audit – Whilst there are no wording changes, auditing must be reviewed in the light and effect of other changes (such as 4.5.1, 4.4.2).
4.6, Management Review – The wording provides (more direct) compatibility with ISO 9001:2000, which includes inputs and outputs for reviewing the EMS. Addition includes reviewing for improving the EMS (from target and not merely objectives).
The advent of ISO 14001:2004 shall not require additional training, unless otherwise the organization decides for a short review presentation or an “IMS” (integrated management systems,” integration of management systems such as ILO-OSH, OSH.MS, OSHAS 18001, ISO 9001 and variants with ISO 14001.) It will require reviewing the EMS by management, (perhaps a gap analysis), acting on any changes, inclusive to auditing against ISO 14001:2004 before transition.
ISO 14001 year 2004 changes are consider having some effect on EMS ISO 14001, the changes require reviewing the EMS and taking action for transition (information is under control of TC 207). Considering the most relevant changes in advancing / transition to ISO 14001 2004 standard includes (an overview for transition / implementation):
Clause 4.1, Scope – requires defining the scope of the EMS (environmental management system) linking to the organizations activities, products, and services (and processes). First consider defining the scope of the EMS within the “boundaries” of products, services, activities, and processes as these relate [for ISO 9001:2000 organizations consider requirement 4.1, and organizations implementing ISO 14001 may be helpful reading ISO 9001:2000 clause 4.1]. The previous indicates an overview on how the EMS fulfills ISO 14001 2004 [some thoughts are internal auditing, management system review providing that these link].
Clause 4.2, Policy – The scope of the EMS and its policy must be consistent. The requirements for the policy remains about the same, now explicitly indicating that must be developed by top management, and other explicit terms in tune with the 1996 version.
Clause 4.3.1, Environmental Aspects Identification – Changes involve in assisting to clarifying statements from 1996 version and the change of the “or” for “and” (within the scope of the EMS); “… products and services…” Control and influence are now mutually exclusive, whilst introducing planned and new developments… new and modified activities… Considering identifying significant aspects must occur from development, implementation, and maintaining the EMS (see 4.1). Information on environmental aspects needs be in documentation format.
To a more assertive statement, “… over which it can be expected to have…” changes to the following “…those which it can influence.”
Clause 4.3.2, Legal and Other Requirements – The wording changes to “legal” in better addressing context to different world regions. Consideration must be given with changes to clause 4.1, for development, implementation, and maintaining the EMS.
Clause 4.3.3 – No significant change.
Clause 4.3.4 – No significant change.
Clause 4.4.1 , Resources, Roles, Responsibility and Authority, please note that this is a new title. This title reflects the importance and relevancy of each term to the EMS. Some minor wording changes include from “…provide…” to “…ensure the availability…” Do not forget that this will require reviewing auditing, planning, and responding to emergencies.
Clause 4.4.2, Competence, Training and Awareness – Whilst using the same
terms in the title notice the change in sequence. This change reflects the expected order of importance of the terms-subjects. Also consider that introduces a new phrase that broadens the individuals within an EMS; “…persons working for, or on behalf of …” Combining these previous two sentences, provides for the organization to include not only relevancy to significant environmental aspects but as well extending to those working for or in behalf of the organization . (Note: also consider that training provider and supporting services are inclusive to 4.4.6).
Clause 4.4.3, Communication – In specifically addressing the European Requirements (EMAR / EMAS), if the organization decides communicating externally the environmental aspects (environmental performance), ISO 14001:2004 address this issue. This is strictly on a volunteer globally, realizing that within the European Union is require.
Clause 4.4.4, Environmental Management System Documentation – in pursuit
of continuing compatibility with ISO 9001:2000 the term applied is “Documentation.”
Thereof, consider this clause also in the light of ISO 9001:2000 when integrating
EMS and QMS. The EMS documentation and records must be those to ascertain
objective evidence on the effectiveness of implementing the policy, planning, and
execution (including improving), control of operations, verification, and control,
improving, and reviewing the EMS.
Clause 4.4.5, Document Control – Again, changing the title and wording reflects
compatibility with ISO 9001:2000. Other than compatibility between QMS ISO
9001:2000 and EMS ISO 14001:2004 there are no significant changes.
4.4.6, Operational Control – No significant change.
4.4.7, Emergency Preparedness and Response – The structure changes by
placing some of its already content in bullets to emphasize each as pointer for the organization to address.
4.5.1, Monitoring and Measurement – Best to see new clause 4.5.2.
4.5.2, Evaluation of Legal Compliance – This is a new clause
[Note: addressing the concern of many government entities / authorities on
their responsibility on environmental and social issues and EMS ISO 14001 1996].
This is construe as the most impacting change to ISO 14001 2004 – this “new” clause brings the last paragraph of 4.5.1 as a separate clause. This clause brings the importance of periodically reviewing legal requirements / compliance under which the organization ascribes. It implies provision of records to demonstrate that this review occurs. This requires that the EMS be review to address the requirements of this “new” clause.
4.5.3, Non Conformance, Corrective and Preventive Action – Includes clarifications ascertaining that prevention (measures or potential of non conformity)and corrective action are two occurring events (which may be mutually inclusive).
Thereof, “action to eliminate the causes of potential non conformities to prevent their occurrence” can lead to changes in your EMS procedures.
4.5.4, Records – States that organizations need records to demonstrate
implementation of procedures and achieving results. These must demonstrate complying with the EMS (procedures and results). Whilst record retention times are not specifically required, record retention needs being specified (consider legal requirements and contractual agreements such that provide a demonstrable sustainable EMS).
4.5.5, Environmental Management System Audit – Whilst there are no wording changes, auditing must be reviewed in the light and effect of other changes (such as 4.5.1, 4.4.2).
4.6, Management Review – The wording provides (more direct) compatibility with ISO 9001:2000, which includes inputs and outputs for reviewing the EMS. Addition includes reviewing for improving the EMS (from target and not merely objectives).
The advent of ISO 14001:2004 shall not require additional training, unless otherwise the organization decides for a short review presentation or an “IMS” (integrated management systems,” integration of management systems such as ILO-OSH, OSH.MS, OSHAS 18001, ISO 9001 and variants with ISO 14001.) It will require reviewing the EMS by management, (perhaps a gap analysis), acting on any changes, inclusive to auditing against ISO 14001:2004 before transition.
Concept of quality – historical background
Concept Of Quality – Historical Background
The concept of quality as we think of it now first emerged out of the Industrial Revolution. Previously goods had been made from start to finish by the same person or team of people, with handcrafting and tweaking the product to meet ‘quality criteria’. Mass production brought huge teams of people together to work on specific stages of production where one person would not necessarily complete a product from start to finish. In the late 1800s pioneers such as Frederick Winslow Taylor and Henry Ford recognized the limitations of the methods being used in mass production at the time and the subsequent varying quality of output. Taylor established Quality Departments to oversee the quality of production and rectifying of errors, and Ford emphasized standardization of design and component standards to ensure a standard product was produced. Management of quality was the responsibility of the Quality department and was implemented by Inspection of product output to ‘catch’ defects. Application of statistical control came later as a result of World War production methods. Quality management systems are the outgrowth of work done by W. Edwards Deming, a statistician, after whom the Deming Prize for quality is named.
Quality, as a profession and the managerial process associated with the quality function, was introduced during the second-half of the 20th century, and has evolved since then. Over this period, few other disciplines have seen as many changes as the quality profession.
The quality profession grew from simple control, to engineering, to systems engineering. Quality control activities were predominant in the 1940s, 950s, and 1960s. The 1970s were an era of quality engineering and the 1990s saw quality systems as an emerging field. Like medicine, accounting, and engineering, quality has achieved status as a recognized profession.
The concept of quality as we think of it now first emerged out of the Industrial Revolution. Previously goods had been made from start to finish by the same person or team of people, with handcrafting and tweaking the product to meet ‘quality criteria’. Mass production brought huge teams of people together to work on specific stages of production where one person would not necessarily complete a product from start to finish. In the late 1800s pioneers such as Frederick Winslow Taylor and Henry Ford recognized the limitations of the methods being used in mass production at the time and the subsequent varying quality of output. Taylor established Quality Departments to oversee the quality of production and rectifying of errors, and Ford emphasized standardization of design and component standards to ensure a standard product was produced. Management of quality was the responsibility of the Quality department and was implemented by Inspection of product output to ‘catch’ defects. Application of statistical control came later as a result of World War production methods. Quality management systems are the outgrowth of work done by W. Edwards Deming, a statistician, after whom the Deming Prize for quality is named.
Quality, as a profession and the managerial process associated with the quality function, was introduced during the second-half of the 20th century, and has evolved since then. Over this period, few other disciplines have seen as many changes as the quality profession.
The quality profession grew from simple control, to engineering, to systems engineering. Quality control activities were predominant in the 1940s, 950s, and 1960s. The 1970s were an era of quality engineering and the 1990s saw quality systems as an emerging field. Like medicine, accounting, and engineering, quality has achieved status as a recognized profession.
Five Steps to Implementing ISO 14001:2004
ISO 14001 provides a logical, common-sense approach for
businesses to adopt. To start it is recommended to carry out an
environmental review of the business and the Annex to the Standard
provides guidance on the approach required. The Standard then
requires a management system to be developed that addresses the
key environmental issues that were identified by the review as being
relevant to the business, through a rational programme of control and
continual improvement.
There are five key steps to ISO 14001 EMS implementation, and
subsequent operation which are clearly laid out in just three pages of
text.
The five key steps are:
1. Environmental Policy
2. Planning
3. Implementation and Operation
4. Checking and Corrective Action
5. Management Review
Step 1. Environmental Policy
The company or organisation must write an environmental policy
statement which is relevant to the business activities and approved by
top management. Their full commitment is essential if environmental
management is to work. The ISO 14001 Standard clearly sets out
what to cover in the policy. Often a one page document is sufficient.
Produce a first issue and expect to amend it several times before
assessment and registration as knowledge grows in the company.
Step 2. Planning
Plan what the EMS is to address.
Environmental aspects
First make lists of the environmental aspects (issues) that are relevant
to the business. The environmental review mentioned earlier should
provide most of this information and the Annex to ISO 14001 provides
guidance on the format for doing this.
Consider the inputs, outputs and processes/activities of the business in
relation to;
a) emissions to air
b) releases to water
c) waste management
d) contamination of land
e) use of raw materials and natural resources
f) other local environmental and community issues
Consider both site (direct) and offsite (ie. indirect) aspects that you
control or have influence over (such as suppliers) and in relation to
normal operations, shut-down and start-up conditions and reasonably
foreseeable and emergencies situations.
A simple written procedure is then required to determine which of the
aspects identified are really or probably significant (important) and
training needs, outline the key stages of the project and dates that will
lead to the target achievement).
Gradually apply environmental management programme thinking to
such things as the introduction of new products, new or improved
processes and other key activities of the business. In particular,
ensure existing projects become environmental management projects
where there is a significant environmental impact involved, so that the
EMS becomes company wide. This is a frequent oversight found
during ISO 14001 assessments. The EMS must cover the whole
business – like a net thrown over the whole business and for example
including such things as engineering and maintenance
Step 3. Implementation and Operation
Structure and responsibility
Appoint one or more people, depending on the size of the business, to
have authority and responsibility for implementing and maintaining the
EMS and provide sufficient resources. (It’s worth monitoring costs
carefully and benchmarking these against key consumption figures so
that improvements delivered by the EMS become apparent).
Training, awareness and competence
Implement a procedure to provide environmental training appropriate
to identified needs for management, the general workforce, project
teams and key plant operators. This can have far reaching benefits
on employee motivation. The workforce is usually very supportive of
moves to achieve genuine environmental improvement. Every
company has its share of cynics but even some of these can be won
over with time. Training will vary from a general briefing for the
workforce to detailed environmental auditor training.
Communication
Implement procedures to establish a system of internal and external
communication to receive environmental information and respond to it
and to circulate new information to people that need to know. This will
include: new legislation, information from suppliers, customers and
neighbours and communications both with employees and for
employees about progress with the EMS. This process can often
generate worthwhile ideas from employees themselves for future
environmental improvements.
Environmental management system documentation
The EMS itself needs to be documented with a manual, procedures
and work instructions but keep it brief and simple. The Standard
clearly states where procedures are required. Eleven system
procedures are required to maintain the EMS, plus operating work
instructions but if you already have ISO 9000, this will cover most of six
of the procedures required and a quality system can certainly be
expanded to cover ISO 14001 as well. Cross reference the EMS
manual to other environmental and quality documents to link the EMS
and to integrate it with existing business practices.
Operational control
Implement additional operating procedures (work instructions) to
control the identified significant (important) aspects of production
processes and other activities. Some of these will already exist but
may need a ‘bit of polish’. Don’t forget significant aspects that relate to
goods and services from suppliers and contractors.
Emergency preparedness and response
Implement procedures to address reasonably foreseeable
emergencies and to minimise their impact should they occur. (eg. Fire,
major spillages of hazardous materials, explosion risks etc.)
Step 4. Checking and Corrective Action
Monitoring and measurement
Implement procedures to monitor and measure the progress of
projects against the targets which have been set, the performance of
processes against the written criteria using calibrated equipment (verify
monitoring records) and regularly check (audit) the company’s
compliance with legislation that has been identified as relevant to your
business. The most effective way of doing this is through regular
progress meetings.
Nonconformance and corrective and preventive action
Implement procedures to enable appropriate corrective and
subsequent preventive action to be taken where breaches of the EMS
occur (eg. process control problems, delays in project process, noncompliance
with legislation, incidents etc.).
Records
Implement procedures to keep records generated by the
environmental management system. The Annex to the Standard
suggests those that are likely to be required.
Environmental management system audit
Implement a procedure to carry out audits of each part of the EMS and
company activities and operations to verify both compliance with the
EMS and with ISO 14001. Audit results must be reported to top
management . A typical audit cycle is one year but more critical
activities will require auditing more frequently.
Step 5. Management Review
At regular intervals (typically annual), top management must conduct
through meetings and record minutes of a review of the EMS, to
determine that it is still appropriate and effective or to make changes
where necessary. Top management will need to consider audit
results, project progress, changing circumstances and the requirement
of ISO 14001 for continual improvement, through setting and achieving
further environmental targets.
businesses to adopt. To start it is recommended to carry out an
environmental review of the business and the Annex to the Standard
provides guidance on the approach required. The Standard then
requires a management system to be developed that addresses the
key environmental issues that were identified by the review as being
relevant to the business, through a rational programme of control and
continual improvement.
There are five key steps to ISO 14001 EMS implementation, and
subsequent operation which are clearly laid out in just three pages of
text.
The five key steps are:
1. Environmental Policy
2. Planning
3. Implementation and Operation
4. Checking and Corrective Action
5. Management Review
Step 1. Environmental Policy
The company or organisation must write an environmental policy
statement which is relevant to the business activities and approved by
top management. Their full commitment is essential if environmental
management is to work. The ISO 14001 Standard clearly sets out
what to cover in the policy. Often a one page document is sufficient.
Produce a first issue and expect to amend it several times before
assessment and registration as knowledge grows in the company.
Step 2. Planning
Plan what the EMS is to address.
Environmental aspects
First make lists of the environmental aspects (issues) that are relevant
to the business. The environmental review mentioned earlier should
provide most of this information and the Annex to ISO 14001 provides
guidance on the format for doing this.
Consider the inputs, outputs and processes/activities of the business in
relation to;
a) emissions to air
b) releases to water
c) waste management
d) contamination of land
e) use of raw materials and natural resources
f) other local environmental and community issues
Consider both site (direct) and offsite (ie. indirect) aspects that you
control or have influence over (such as suppliers) and in relation to
normal operations, shut-down and start-up conditions and reasonably
foreseeable and emergencies situations.
A simple written procedure is then required to determine which of the
aspects identified are really or probably significant (important) and
training needs, outline the key stages of the project and dates that will
lead to the target achievement).
Gradually apply environmental management programme thinking to
such things as the introduction of new products, new or improved
processes and other key activities of the business. In particular,
ensure existing projects become environmental management projects
where there is a significant environmental impact involved, so that the
EMS becomes company wide. This is a frequent oversight found
during ISO 14001 assessments. The EMS must cover the whole
business – like a net thrown over the whole business and for example
including such things as engineering and maintenance
Step 3. Implementation and Operation
Structure and responsibility
Appoint one or more people, depending on the size of the business, to
have authority and responsibility for implementing and maintaining the
EMS and provide sufficient resources. (It’s worth monitoring costs
carefully and benchmarking these against key consumption figures so
that improvements delivered by the EMS become apparent).
Training, awareness and competence
Implement a procedure to provide environmental training appropriate
to identified needs for management, the general workforce, project
teams and key plant operators. This can have far reaching benefits
on employee motivation. The workforce is usually very supportive of
moves to achieve genuine environmental improvement. Every
company has its share of cynics but even some of these can be won
over with time. Training will vary from a general briefing for the
workforce to detailed environmental auditor training.
Communication
Implement procedures to establish a system of internal and external
communication to receive environmental information and respond to it
and to circulate new information to people that need to know. This will
include: new legislation, information from suppliers, customers and
neighbours and communications both with employees and for
employees about progress with the EMS. This process can often
generate worthwhile ideas from employees themselves for future
environmental improvements.
Environmental management system documentation
The EMS itself needs to be documented with a manual, procedures
and work instructions but keep it brief and simple. The Standard
clearly states where procedures are required. Eleven system
procedures are required to maintain the EMS, plus operating work
instructions but if you already have ISO 9000, this will cover most of six
of the procedures required and a quality system can certainly be
expanded to cover ISO 14001 as well. Cross reference the EMS
manual to other environmental and quality documents to link the EMS
and to integrate it with existing business practices.
Operational control
Implement additional operating procedures (work instructions) to
control the identified significant (important) aspects of production
processes and other activities. Some of these will already exist but
may need a ‘bit of polish’. Don’t forget significant aspects that relate to
goods and services from suppliers and contractors.
Emergency preparedness and response
Implement procedures to address reasonably foreseeable
emergencies and to minimise their impact should they occur. (eg. Fire,
major spillages of hazardous materials, explosion risks etc.)
Step 4. Checking and Corrective Action
Monitoring and measurement
Implement procedures to monitor and measure the progress of
projects against the targets which have been set, the performance of
processes against the written criteria using calibrated equipment (verify
monitoring records) and regularly check (audit) the company’s
compliance with legislation that has been identified as relevant to your
business. The most effective way of doing this is through regular
progress meetings.
Nonconformance and corrective and preventive action
Implement procedures to enable appropriate corrective and
subsequent preventive action to be taken where breaches of the EMS
occur (eg. process control problems, delays in project process, noncompliance
with legislation, incidents etc.).
Records
Implement procedures to keep records generated by the
environmental management system. The Annex to the Standard
suggests those that are likely to be required.
Environmental management system audit
Implement a procedure to carry out audits of each part of the EMS and
company activities and operations to verify both compliance with the
EMS and with ISO 14001. Audit results must be reported to top
management . A typical audit cycle is one year but more critical
activities will require auditing more frequently.
Step 5. Management Review
At regular intervals (typically annual), top management must conduct
through meetings and record minutes of a review of the EMS, to
determine that it is still appropriate and effective or to make changes
where necessary. Top management will need to consider audit
results, project progress, changing circumstances and the requirement
of ISO 14001 for continual improvement, through setting and achieving
further environmental targets.
ISO 9001:2008 Requirements – QMS
ISO 9001:2008 Requirements – Quality Management System
Establish, document, implement, and maintain a quality management system. Continually improve its effectiveness in accordance with ISO 9001 requirements. Implement the system to:? Determine processes needed for the quality management system (and their application throughout the organization)? Determine process sequence and interaction? Determine criteria and methods for process operation and control? Ensure resources and supporting information are available? Monitor, measure where applicable, and analyze these processes? Implement actions to achieve planned results and continual process improvementManage these processes in accordance with ISO 9001 requirements. Define the type and extent of control applied to any outsourced processes that affect product conformity to requirements.NOTE 1: Processes needed for the quality management system include the processes for management activities (see 5), provision of resources (see 6), product realization (see 7), and measurement, analysis, and improvement (see 8).NOTE 2: An outsourced process is a process the organization needs for its quality management system, and which the organization chooses to have performed by an external party.NOTE 3: Ensuring control over outsourced processes does not absolve your organization of the responsibility to conform to all customer, statutory, and regulatory requirements. The type and extent of control applied to an outsourced process can be influenced by factors such as:? Potential impact of the outsourced process on your organization’s capability to provide product that conforms to requirements? Degree to which the control for the process is shared? Capability of achieving the necessary control through the application of 7.4
Establish, document, implement, and maintain a quality management system. Continually improve its effectiveness in accordance with ISO 9001 requirements. Implement the system to:? Determine processes needed for the quality management system (and their application throughout the organization)? Determine process sequence and interaction? Determine criteria and methods for process operation and control? Ensure resources and supporting information are available? Monitor, measure where applicable, and analyze these processes? Implement actions to achieve planned results and continual process improvementManage these processes in accordance with ISO 9001 requirements. Define the type and extent of control applied to any outsourced processes that affect product conformity to requirements.NOTE 1: Processes needed for the quality management system include the processes for management activities (see 5), provision of resources (see 6), product realization (see 7), and measurement, analysis, and improvement (see 8).NOTE 2: An outsourced process is a process the organization needs for its quality management system, and which the organization chooses to have performed by an external party.NOTE 3: Ensuring control over outsourced processes does not absolve your organization of the responsibility to conform to all customer, statutory, and regulatory requirements. The type and extent of control applied to an outsourced process can be influenced by factors such as:? Potential impact of the outsourced process on your organization’s capability to provide product that conforms to requirements? Degree to which the control for the process is shared? Capability of achieving the necessary control through the application of 7.4
ISO 9001:2008 Requirements – Documentation Requirements
ISO 9001:2008 Requirements – Documentation Requirements
Include in the quality management system documentation:? Documented statements of a quality policy and quality objectives? A quality manual? Documented procedures and records required by ISO 9001? Documents and records determined by the organization to be necessary for the effective planning, operation, and control of its processesNOTE 1: Where “documented procedure” appears within the Standard, this means that the procedure is established, documented, implemented, and maintained. A single document may address the requirements for one or more procedures. A requirement for a documented procedure may be covered by more than one document.NOTE 2: The extent of the quality management system documentation can differ from one organization to another due to:? Size of the organization and type of activities? Complexity of processes and their interactions? Competence of personnelNOTE 3: The documentation can be in any form or type of medium.4.2.2 Quality ManualEstablish and maintain a quality manual with:? Scope of the quality management system? Details and justification for any exclusions? Procedures or references to the procedures? Description of interaction between processes4.2.3 Control of DocumentsControl the documents required by the quality management system. Records are a special type of document and must be controlled as required by clause 4.2.4.
Establish a documented procedure to:? Approve documents for adequacy prior to issue? Review, update as necessary, and re-approve documents? Identify the changes and current document revision status? Make relevant documents available at points of use? Ensure the documents remain legible and readily identifiable? Identify external documents and control their distribution? Prevent obsolete documents from unintended use? Apply suitable identification if obsolete documents are retained4.2.4 Control of RecordsEstablish and control records as evidence of conformity to requirements and to demonstrate the effective operation of the quality management system.Establish a documented procedure to define the controls needed for record:? Identification? Storage? Protection? Retrieval? Retention? DispositionKeep records legible, readily identifiable, and retrievable.
Include in the quality management system documentation:? Documented statements of a quality policy and quality objectives? A quality manual? Documented procedures and records required by ISO 9001? Documents and records determined by the organization to be necessary for the effective planning, operation, and control of its processesNOTE 1: Where “documented procedure” appears within the Standard, this means that the procedure is established, documented, implemented, and maintained. A single document may address the requirements for one or more procedures. A requirement for a documented procedure may be covered by more than one document.NOTE 2: The extent of the quality management system documentation can differ from one organization to another due to:? Size of the organization and type of activities? Complexity of processes and their interactions? Competence of personnelNOTE 3: The documentation can be in any form or type of medium.4.2.2 Quality ManualEstablish and maintain a quality manual with:? Scope of the quality management system? Details and justification for any exclusions? Procedures or references to the procedures? Description of interaction between processes4.2.3 Control of DocumentsControl the documents required by the quality management system. Records are a special type of document and must be controlled as required by clause 4.2.4.
Establish a documented procedure to:? Approve documents for adequacy prior to issue? Review, update as necessary, and re-approve documents? Identify the changes and current document revision status? Make relevant documents available at points of use? Ensure the documents remain legible and readily identifiable? Identify external documents and control their distribution? Prevent obsolete documents from unintended use? Apply suitable identification if obsolete documents are retained4.2.4 Control of RecordsEstablish and control records as evidence of conformity to requirements and to demonstrate the effective operation of the quality management system.Establish a documented procedure to define the controls needed for record:? Identification? Storage? Protection? Retrieval? Retention? DispositionKeep records legible, readily identifiable, and retrievable.
ISO 9001:2008 Requirements – Management Responsibility
ISO 9001:2008 Requirements - Management Responsibility
All requirements in clause 5 are the responsibility of top management.5.1 Management CommitmentProvide evidence of management commitment to develop and implement the quality management system, as well as, continually improve its effectiveness by:? Expressing the importance of meeting requirements? Establishing the quality policy and quality objectives? Conducting management reviews? Ensuring the availability of necessary resources
5.2 Customer FocusEnsure customer requirements are determined and met in order to improve customer satisfaction.5.3 Quality PolicyEnsure the quality policy is:? Appropriate to the purpose of the organization? Focused on meeting requirements and continual improvement? Used as a framework for quality objectives? Communicated and understood at appropriate levels? Reviewed for continuing suitability5.4 Planning5.4.1 Quality ObjectivesEnsure quality objectives, including those needed to meet product requirements, are established at the relevant functions and levels within the organization. Ensure quality objectives are measurable and consistent with the quality policy.5.4.2 Quality Management System PlanningEnsure that planning for the quality management system:? Meets the general requirements (4.1), as well as, quality objectives (5.4.1)? Maintains the system integrity when changes are planned and implemented5.5 Responsibility, Authority, and Communication5.5.1 Responsibility and AuthorityEnsure responsibilities and authorities are defined and communicated within the organization.
5.5.2 Management RepresentativeAppoint a member of your management who, irrespective of other duties, has the responsibility and authority to:? Ensure the needed processes are established, implemented, and maintained? Report to top management on quality management system performance? Report to top management on any need for improvement? Ensuring the promotion of awareness of customer requirementsNOTE: The responsibility of a management representative can include being the liaison with external parties on matters relating to the quality management system.5.5.3 Internal CommunicationEnsure the appropriate communication processes are established and carried out within the organization regarding the effectiveness of the system.5.6 Management Review5.6.1 GeneralReview the quality management system at planned intervals to:? Ensure a suitable, adequate, and effective system? Assess possible opportunities for improvement? Evaluate the need for any changes to the system? Consider the need for changes to the quality policy and objectivesMaintain records of the management reviews.5.6.2 Review InputInputs for management review must include information on:? Results of audits? Customer feedback? Process performance and product conformity? Status of preventive and corrective actions? Follow-up actions from earlier reviews? Changes that could affect the quality system? Recommendations for improvement
5.6.3 Review OutputOutputs from the management review must include any decisions and actions related to:? Improvement of the effectiveness of the quality management system and its processes? Improvement of product related to customer requirements? Resource needs
All requirements in clause 5 are the responsibility of top management.5.1 Management CommitmentProvide evidence of management commitment to develop and implement the quality management system, as well as, continually improve its effectiveness by:? Expressing the importance of meeting requirements? Establishing the quality policy and quality objectives? Conducting management reviews? Ensuring the availability of necessary resources
5.2 Customer FocusEnsure customer requirements are determined and met in order to improve customer satisfaction.5.3 Quality PolicyEnsure the quality policy is:? Appropriate to the purpose of the organization? Focused on meeting requirements and continual improvement? Used as a framework for quality objectives? Communicated and understood at appropriate levels? Reviewed for continuing suitability5.4 Planning5.4.1 Quality ObjectivesEnsure quality objectives, including those needed to meet product requirements, are established at the relevant functions and levels within the organization. Ensure quality objectives are measurable and consistent with the quality policy.5.4.2 Quality Management System PlanningEnsure that planning for the quality management system:? Meets the general requirements (4.1), as well as, quality objectives (5.4.1)? Maintains the system integrity when changes are planned and implemented5.5 Responsibility, Authority, and Communication5.5.1 Responsibility and AuthorityEnsure responsibilities and authorities are defined and communicated within the organization.
5.5.2 Management RepresentativeAppoint a member of your management who, irrespective of other duties, has the responsibility and authority to:? Ensure the needed processes are established, implemented, and maintained? Report to top management on quality management system performance? Report to top management on any need for improvement? Ensuring the promotion of awareness of customer requirementsNOTE: The responsibility of a management representative can include being the liaison with external parties on matters relating to the quality management system.5.5.3 Internal CommunicationEnsure the appropriate communication processes are established and carried out within the organization regarding the effectiveness of the system.5.6 Management Review5.6.1 GeneralReview the quality management system at planned intervals to:? Ensure a suitable, adequate, and effective system? Assess possible opportunities for improvement? Evaluate the need for any changes to the system? Consider the need for changes to the quality policy and objectivesMaintain records of the management reviews.5.6.2 Review InputInputs for management review must include information on:? Results of audits? Customer feedback? Process performance and product conformity? Status of preventive and corrective actions? Follow-up actions from earlier reviews? Changes that could affect the quality system? Recommendations for improvement
5.6.3 Review OutputOutputs from the management review must include any decisions and actions related to:? Improvement of the effectiveness of the quality management system and its processes? Improvement of product related to customer requirements? Resource needs
ISO 9001:2008 Requirements – Resource Management
ISO 9001:2008 Requirements – Resource Management
6.1 Provision of ResourcesDetermine and provide the resources necessary to:? Implement and maintain the quality management system? Continually improve the effectiveness of the system? Enhance customer satisfaction by meeting customer requirements6.2 Human Resources6.2.1 GeneralEnsure people performing work affecting conformity to product requirements are competent based on the appropriate education, training, skills, and experience.NOTE: Conformity to product requirements can be affected directly, or indirectly, by personnel performing any task within the quality management system.6.2.2 Competence, Training, and AwarenessThe organization must:? Determine the competency needs for personnel? Provide training (or take other actions) to achieve the necessary competence? Evaluate the effectiveness of the actions taken? Inform employees of the relevance and importance of their activities? Ensure they know their contribution to achieving quality objectives? Maintain education, training, skill, and experience records
6.3 InfrastructureDetermine, provide, and maintain the necessary infrastructure to achieve product conformity. Infrastructure includes, as applicable:? Buildings, workspace, and associated utilities? Process equipment (both hardware and software)? Supporting services (such as transport, communication, or information systems)6.4 Work EnvironmentDetermine and manage the work environment needed to achieve product conformity.NOTE: The term “work environment” relates to those conditions under which work is performed, including physical, environmental, and other factors such as noise, temperature, humidity, lighting, or weather.
6.1 Provision of ResourcesDetermine and provide the resources necessary to:? Implement and maintain the quality management system? Continually improve the effectiveness of the system? Enhance customer satisfaction by meeting customer requirements6.2 Human Resources6.2.1 GeneralEnsure people performing work affecting conformity to product requirements are competent based on the appropriate education, training, skills, and experience.NOTE: Conformity to product requirements can be affected directly, or indirectly, by personnel performing any task within the quality management system.6.2.2 Competence, Training, and AwarenessThe organization must:? Determine the competency needs for personnel? Provide training (or take other actions) to achieve the necessary competence? Evaluate the effectiveness of the actions taken? Inform employees of the relevance and importance of their activities? Ensure they know their contribution to achieving quality objectives? Maintain education, training, skill, and experience records
6.3 InfrastructureDetermine, provide, and maintain the necessary infrastructure to achieve product conformity. Infrastructure includes, as applicable:? Buildings, workspace, and associated utilities? Process equipment (both hardware and software)? Supporting services (such as transport, communication, or information systems)6.4 Work EnvironmentDetermine and manage the work environment needed to achieve product conformity.NOTE: The term “work environment” relates to those conditions under which work is performed, including physical, environmental, and other factors such as noise, temperature, humidity, lighting, or weather.
ISO 9001:2008 FAQ
ISO 9001:2008 FAQ
What Is The ISO 9001: 2008 Standard?
The latest edition of the ISO 9001 standard ISO 9001: 2008, Quality Management Systems – Requirements, was officially published by (ISO) the International Organization for Standardization on November 14, 2008. It is the fourth edition of the ISO 9001 standard since it was first published in 1987.
Who Is Responsible For Revising The standards?
The ISO Technical Committee no.176, Sub-committee no.2 (ISO/TC 176/SC 2) is responsible for the revision process in collaboration with consensus among quality and industry experts nominated by ISO Member bodies, and representing all interested parties.
Does ISO 9001:2008 Have Additional Requirements Beyond ISO 9001:2000 ?
This latest (4th) edition of ISO 9001 contains no new requirements compared to the (3rd) year 2000 edition, which it replaces. What it does is provide clarification to the existing requirements of ISO 9001:2000 based on eight years’ experience of worldwide implementing of the standard and introduces changes intended to improve consistency with the environmental management system standard, ISO 14001:2004.
The clarifications and changes in ISO 9001:2008 represents fine-tuning, rather than a thorough overhaul. It focuses on changes that organizations might make to better comply with the spirit of the standard without adding, deleting, or altering its requirements. The changes are minor in nature and address such issues as the need to clarify, provide greater consistency, resolve perceived ambiguities, and improve compatibility with ISO 14001. The numbering system and the structure of the standard remain unchanged. As a result, the new standard looks much like the old standard.
ISO has grouped the changes incorporated in this ISO 9001:2008 edition into the following categories:- No changes or minimum changes on user documents, including records- No changes or minimum changes to existing QMS processes- No additional training required or minimal training required- No effects on current certifications
In contrast, the 3rd edition, ISO 9001:2000 published in 2000, represented a major overhaul of the standard, including new requirements and a sharpened customer focus, reflecting developments in quality management and experience gained since the publication of the initial version.
Then Why Was It Necessary To Introduce This Revision?All ISO standards – currently more than 17 400 – are periodically reviewed. To ensure that ISO standards are maintained at the state of the art, ISO has a rule requiring them to be periodically reviewed and a decision taken to confirm, withdraw or revise the documents. The review process must be initiated within 3 years of publication of a standard. The review considers several factors such as technological evolution, new methods and materials, new quality and safety requirements, or questions of interpretation and application.
The review of ISO 9001 resulting in the 2008 edition was carried out by subcommittee SC 2 of ISO/TC 176. This subcommittee, which is responsible for the ISO 9000 family, unites expertise from 80 participating countries and 19 international or regional organizations, plus other technical committees.
This review has a number of inputs that help it:
A global user questionnaire/survey
A market Justification Study
Suggestions arising from the ISO/TC 176 interpretation process
Opportunities for increased compatibility with ISO 14001
The need for greater clarity, ease of use, and improved translation
Current trends – keeping up with recent developments in management system practices.
How Does The New ISO 9001 Edition Affect Existing ISO 9001 QMS’s?
As organizations start looking at ISO 9001:2008, they will wonder to what extent the changes might affect them. To a large extent, the new standard will not result in significant change to existing quality management systems (QMS).
ISO/TC 176 was careful in not making change for change sake. In the case of editorial changes, this was especially true. This could have lead to a false impression that there was a change in requirements, carrying greater significance than was intended. In those instances, when the committee members couldn’t come to a consensus in determining if a change added or deleted a requirement, they opted to retain the existing text. They decided it was better to err on the side of caution rather than to contribute to any misunderstanding in the marketplace.
The changes that have been incorporated into this edition of the ISO 9001 standard include changes that should lead to a better understanding across a broader range of product types, including service organizations; use of deliberate wording to minimize the potential for incorrect user interpretation; and reflect nuances of similar concepts. Lastly, some of the changes to specific clauses were made based on the 2004 International User Feedback Survey. This survey was conducted after the publication of ISO 9001:2000 and had invited respondents to identify areas they most wanted to see improved.
What Is The ISO 9001: 2008 Standard?
The latest edition of the ISO 9001 standard ISO 9001: 2008, Quality Management Systems – Requirements, was officially published by (ISO) the International Organization for Standardization on November 14, 2008. It is the fourth edition of the ISO 9001 standard since it was first published in 1987.
Who Is Responsible For Revising The standards?
The ISO Technical Committee no.176, Sub-committee no.2 (ISO/TC 176/SC 2) is responsible for the revision process in collaboration with consensus among quality and industry experts nominated by ISO Member bodies, and representing all interested parties.
Does ISO 9001:2008 Have Additional Requirements Beyond ISO 9001:2000 ?
This latest (4th) edition of ISO 9001 contains no new requirements compared to the (3rd) year 2000 edition, which it replaces. What it does is provide clarification to the existing requirements of ISO 9001:2000 based on eight years’ experience of worldwide implementing of the standard and introduces changes intended to improve consistency with the environmental management system standard, ISO 14001:2004.
The clarifications and changes in ISO 9001:2008 represents fine-tuning, rather than a thorough overhaul. It focuses on changes that organizations might make to better comply with the spirit of the standard without adding, deleting, or altering its requirements. The changes are minor in nature and address such issues as the need to clarify, provide greater consistency, resolve perceived ambiguities, and improve compatibility with ISO 14001. The numbering system and the structure of the standard remain unchanged. As a result, the new standard looks much like the old standard.
ISO has grouped the changes incorporated in this ISO 9001:2008 edition into the following categories:- No changes or minimum changes on user documents, including records- No changes or minimum changes to existing QMS processes- No additional training required or minimal training required- No effects on current certifications
In contrast, the 3rd edition, ISO 9001:2000 published in 2000, represented a major overhaul of the standard, including new requirements and a sharpened customer focus, reflecting developments in quality management and experience gained since the publication of the initial version.
Then Why Was It Necessary To Introduce This Revision?All ISO standards – currently more than 17 400 – are periodically reviewed. To ensure that ISO standards are maintained at the state of the art, ISO has a rule requiring them to be periodically reviewed and a decision taken to confirm, withdraw or revise the documents. The review process must be initiated within 3 years of publication of a standard. The review considers several factors such as technological evolution, new methods and materials, new quality and safety requirements, or questions of interpretation and application.
The review of ISO 9001 resulting in the 2008 edition was carried out by subcommittee SC 2 of ISO/TC 176. This subcommittee, which is responsible for the ISO 9000 family, unites expertise from 80 participating countries and 19 international or regional organizations, plus other technical committees.
This review has a number of inputs that help it:
A global user questionnaire/survey
A market Justification Study
Suggestions arising from the ISO/TC 176 interpretation process
Opportunities for increased compatibility with ISO 14001
The need for greater clarity, ease of use, and improved translation
Current trends – keeping up with recent developments in management system practices.
How Does The New ISO 9001 Edition Affect Existing ISO 9001 QMS’s?
As organizations start looking at ISO 9001:2008, they will wonder to what extent the changes might affect them. To a large extent, the new standard will not result in significant change to existing quality management systems (QMS).
ISO/TC 176 was careful in not making change for change sake. In the case of editorial changes, this was especially true. This could have lead to a false impression that there was a change in requirements, carrying greater significance than was intended. In those instances, when the committee members couldn’t come to a consensus in determining if a change added or deleted a requirement, they opted to retain the existing text. They decided it was better to err on the side of caution rather than to contribute to any misunderstanding in the marketplace.
The changes that have been incorporated into this edition of the ISO 9001 standard include changes that should lead to a better understanding across a broader range of product types, including service organizations; use of deliberate wording to minimize the potential for incorrect user interpretation; and reflect nuances of similar concepts. Lastly, some of the changes to specific clauses were made based on the 2004 International User Feedback Survey. This survey was conducted after the publication of ISO 9001:2000 and had invited respondents to identify areas they most wanted to see improved.
Update on ISO 9001:2008
Update on ISO 9001:2008
Following a recent meeting of ISO’s Technical Committee TC176 in Helsinki, Finland, from June
11 – 15t, 2007, publication of the new version of ISO 9001 has been brought forward from 2009
and is now scheduled to be published in October 2008. Experts representing over 70 ISO member
bodies, met to discuss the comments received during circulation of the Committee Draft (”CD”) of
the new standard, and concluded that in view of the very limited changes being proposed, the draft
is now sufficiently mature to progress directly to the DIS (Draft International Standard).
The main changes being introduced into the new standard are as follows:
Clause 0.2 (Process approach)
Text added to emphasize the importance of processes being capable of achieving desired outputs
Clause 1.1 (Scope)
Clarification that “product” also includes intermediate product
Explanation regarding statutory, regulatory and legal requirements
Clause 4.1 (General requirements)
Notes added to explain more about outsourcing
Types of control that may be applied to outsourced processes
Relationship to clause 7.4 (Purchasing)
Clarification that outsourced processes are still responsibility of the organization and must be
included in the quality management system
Clause 4.2.1 (Documentation)
Clarification that QMS documentation also includes records
Documents required by the standard may be combined
ISO 9001 requirements may be covered by more than one documented procedure
Clause 4.2.3 (Document control)
Clarification that only external documents relevant to the QMS need to be controlled
Clause 4.2.4 (Records control)
Editorial changes only (better alignment with ISO 14001)
Clause 5.5.2 (Management rep)
Clarifies that this must be a member of the organization’s own management
Clause 6.2.1 (Human resources)
Clarification that competence requirements are relevant for any personnel who are involved in the
operation of the quality management system
Clause 6.3 (Infrastructure)
Includes information systems as example
Clause 6.4 (Work environment)
Clarifies that this includes conditions under which work is performed and includes, for example
physical, environmental and other factors such as noise, temperature, humidity, lighting, or weather
Clause 7.2.1 (Customer related processes)
Clarifies that post-delivery activities may include:
- Actions under warranty provisions
- Contractual obligations such as maintenance services
- Supplementary services such as recycling or final disposal
Clause 7.3.1 (Design & development planning)
Clarifies that design and development review, verification and validation have distinct purposes
These may be conducted and recorded separately or in any combination as suitable for the product
and the organization
Clause 7.3.3(Design & development outputs)
Clarifies that information needed for production and service provision includes preservation of the product
Clause 7.5.4 (Customer property)
Explains that both intellectual property and personal data should be considered as customer property
Clause 7.6 (Now retitled Control of Monitoring and Measuring equipment)
Explanatory notes added regarding the use of computer software: “Confirmation of the ability of computer software to satisfy the intended application would typically include its verification and configuration management to maintain its suitability for use.”
Clause 8.2.1 (Customer satisfaction)
Note added to explain that monitoring of customer perception may include input from sources such as customer satisfaction surveys, customer data on delivered product quality, user opinion surveys, lost business analysis, compliments, and dealer reports
Clause 8.2.3 (Monitoring / Measurement of process)
Note added to clarify that when deciding on appropriate methods, the organization should consider impact on the conformity to product requirements and on the effectiveness of the quality management system.
Following a recent meeting of ISO’s Technical Committee TC176 in Helsinki, Finland, from June
11 – 15t, 2007, publication of the new version of ISO 9001 has been brought forward from 2009
and is now scheduled to be published in October 2008. Experts representing over 70 ISO member
bodies, met to discuss the comments received during circulation of the Committee Draft (”CD”) of
the new standard, and concluded that in view of the very limited changes being proposed, the draft
is now sufficiently mature to progress directly to the DIS (Draft International Standard).
The main changes being introduced into the new standard are as follows:
Clause 0.2 (Process approach)
Text added to emphasize the importance of processes being capable of achieving desired outputs
Clause 1.1 (Scope)
Clarification that “product” also includes intermediate product
Explanation regarding statutory, regulatory and legal requirements
Clause 4.1 (General requirements)
Notes added to explain more about outsourcing
Types of control that may be applied to outsourced processes
Relationship to clause 7.4 (Purchasing)
Clarification that outsourced processes are still responsibility of the organization and must be
included in the quality management system
Clause 4.2.1 (Documentation)
Clarification that QMS documentation also includes records
Documents required by the standard may be combined
ISO 9001 requirements may be covered by more than one documented procedure
Clause 4.2.3 (Document control)
Clarification that only external documents relevant to the QMS need to be controlled
Clause 4.2.4 (Records control)
Editorial changes only (better alignment with ISO 14001)
Clause 5.5.2 (Management rep)
Clarifies that this must be a member of the organization’s own management
Clause 6.2.1 (Human resources)
Clarification that competence requirements are relevant for any personnel who are involved in the
operation of the quality management system
Clause 6.3 (Infrastructure)
Includes information systems as example
Clause 6.4 (Work environment)
Clarifies that this includes conditions under which work is performed and includes, for example
physical, environmental and other factors such as noise, temperature, humidity, lighting, or weather
Clause 7.2.1 (Customer related processes)
Clarifies that post-delivery activities may include:
- Actions under warranty provisions
- Contractual obligations such as maintenance services
- Supplementary services such as recycling or final disposal
Clause 7.3.1 (Design & development planning)
Clarifies that design and development review, verification and validation have distinct purposes
These may be conducted and recorded separately or in any combination as suitable for the product
and the organization
Clause 7.3.3(Design & development outputs)
Clarifies that information needed for production and service provision includes preservation of the product
Clause 7.5.4 (Customer property)
Explains that both intellectual property and personal data should be considered as customer property
Clause 7.6 (Now retitled Control of Monitoring and Measuring equipment)
Explanatory notes added regarding the use of computer software: “Confirmation of the ability of computer software to satisfy the intended application would typically include its verification and configuration management to maintain its suitability for use.”
Clause 8.2.1 (Customer satisfaction)
Note added to explain that monitoring of customer perception may include input from sources such as customer satisfaction surveys, customer data on delivered product quality, user opinion surveys, lost business analysis, compliments, and dealer reports
Clause 8.2.3 (Monitoring / Measurement of process)
Note added to clarify that when deciding on appropriate methods, the organization should consider impact on the conformity to product requirements and on the effectiveness of the quality management system.
Validity of certifications to ISO 9001:2000
One year after the publication of ISO 9001:2008 all accredited certifications issued (new certifications or re-certifications) shall be to ISO 9001:2008.Twenty four months after publication by ISO of ISO 9001:2008, any existingcertification issued to ISO 9001:2000 shall not be valid.
Organisations that are already certified to ISO 9001:2000 should contacttheir certification/registration bodies (CB/RB) to agree a programme for analysing the clarifications in ISO 9001:2008 in relation to their individual quality management systems and for upgrading their certificates.Certified organizations should bear in mind that ISO 9001:2000 certificateshave the same status as new ISO 9001:2008 certificates during the co-existence period. (i.e. Your current ISO 9001:2000 certificate will be valid up to 13th November 2010).Organizations in the process of certification to ISO 9001:2000 should change to using ISO 9001:2008 and apply for certification to it.New users should start by using ISO 9001:2008.
Organisations that are already certified to ISO 9001:2000 should contacttheir certification/registration bodies (CB/RB) to agree a programme for analysing the clarifications in ISO 9001:2008 in relation to their individual quality management systems and for upgrading their certificates.Certified organizations should bear in mind that ISO 9001:2000 certificateshave the same status as new ISO 9001:2008 certificates during the co-existence period. (i.e. Your current ISO 9001:2000 certificate will be valid up to 13th November 2010).Organizations in the process of certification to ISO 9001:2000 should change to using ISO 9001:2008 and apply for certification to it.New users should start by using ISO 9001:2008.
ISO 9001 Standards – Document Repository
ISO 9001 Standards - Document Repository
All QMS and product realization documents can be stored electronically within the computerize Document Management System like ISO 9001 Document Control Sytem. This provides a set of category and sub-category headings that enable users to drill down intothe different levels of the documentation category tree.QMS documents are created and maintained within a top level category entitled “ISO 9001 Quality Management System (QMS)“. Documents in this category follow a 4-tier approach:• Quality Manual – company scope and process interactions within the QMS• Quality Procedures – responsibilities, controls and activities within the QMS that effect customer service• Records – objective evidence to demonstrate our goal in achieving customer satisfaction• Forms & Reports to support the QMS processesProduct realization documents are stored in categories corresponding to Products, Projects and Departments. Each document is unique, but can be accessed from multiple categories.Documents created within the FablessSemi Inc CogniDox system are assigned a unique identifier using the format “PO-NNNNNN-XX”; where the “PO” prefix identifies them as FablessSemi Inc documents, the “NNNNNN” is an automatically generated and uniquely assigned numerical ID, and the “XX” suffix indicates the document type.All Fabless Semi Inc personnel are responsible for creating document part numbers and uploading documents to an appropriate category. Selected users with additional system privileges are responsible for creating and maintaining document categories.
All QMS and product realization documents can be stored electronically within the computerize Document Management System like ISO 9001 Document Control Sytem. This provides a set of category and sub-category headings that enable users to drill down intothe different levels of the documentation category tree.QMS documents are created and maintained within a top level category entitled “ISO 9001 Quality Management System (QMS)“. Documents in this category follow a 4-tier approach:• Quality Manual – company scope and process interactions within the QMS• Quality Procedures – responsibilities, controls and activities within the QMS that effect customer service• Records – objective evidence to demonstrate our goal in achieving customer satisfaction• Forms & Reports to support the QMS processesProduct realization documents are stored in categories corresponding to Products, Projects and Departments. Each document is unique, but can be accessed from multiple categories.Documents created within the FablessSemi Inc CogniDox system are assigned a unique identifier using the format “PO-NNNNNN-XX”; where the “PO” prefix identifies them as FablessSemi Inc documents, the “NNNNNN” is an automatically generated and uniquely assigned numerical ID, and the “XX” suffix indicates the document type.All Fabless Semi Inc personnel are responsible for creating document part numbers and uploading documents to an appropriate category. Selected users with additional system privileges are responsible for creating and maintaining document categories.
Useful Aids to Implement ISO 9001 Standards
Useful Aids To Implement ISO 9001 Standards
Many companies implement ISO 9001 without using all the available tools. As a result, some companies may not fully optimize their implementation. This issue could be manifested as confusion over terms, misunderstanding about requirements, and perplexity concerning intention.ISO, the International Organization for Standardization, based in Geneva Switzerland issues thousands of standards, but we limit our scope to ISO 9001:2008 and its immediate “family”.This includes ISO 9000:2005 and ISO 9004:20002. ISO 9001 is a general industry standard for quality management, but ISO also issues industry specific standards. Many of these standards, such as ISO 13485 for medical devices, are based on ISO 9001 and can also utilize these available tools.
In addition to the information discussed below, ISO also issues standards related to specific activities that may arises in a quality management system. The following lists these supporting documents.
Automotive ISO/TS 16949:2002Education IWA 2:2007Energy PC 242, ISO 50001Food safety ISO 22000:2005Information security ISO/IEC 27001:2005Health care IWA 1:2005Local government IWA 4:2005Medical devices ISO 13485:2003Petroleum and gas ISO 29001:2003Ship recycling ISO/PAS 30000:2008Supply chain security ISO 28000:2007
Many companies implement ISO 9001 without using all the available tools. As a result, some companies may not fully optimize their implementation. This issue could be manifested as confusion over terms, misunderstanding about requirements, and perplexity concerning intention.ISO, the International Organization for Standardization, based in Geneva Switzerland issues thousands of standards, but we limit our scope to ISO 9001:2008 and its immediate “family”.This includes ISO 9000:2005 and ISO 9004:20002. ISO 9001 is a general industry standard for quality management, but ISO also issues industry specific standards. Many of these standards, such as ISO 13485 for medical devices, are based on ISO 9001 and can also utilize these available tools.
In addition to the information discussed below, ISO also issues standards related to specific activities that may arises in a quality management system. The following lists these supporting documents.
Automotive ISO/TS 16949:2002Education IWA 2:2007Energy PC 242, ISO 50001Food safety ISO 22000:2005Information security ISO/IEC 27001:2005Health care IWA 1:2005Local government IWA 4:2005Medical devices ISO 13485:2003Petroleum and gas ISO 29001:2003Ship recycling ISO/PAS 30000:2008Supply chain security ISO 28000:2007
Process Approach In ISO 9001 Standards
Process Approach In ISO 9001 Standards
The process approach was introduced into ISO 9001 with the year 2000 version of the standards.Prior versions used an element approach. The document Guidance on the concept and use of the process approach for management systems describes to process approach and offers an implementation paradigm.1. Identification of processes of the organization1.1. Define the purpose of the organization1.2. Define the policies and objectives of the organization1.3. Determine the processes in the organization1.4. Determine the sequence of the processes1.5. Define process ownership1.6. Define process documentation2. Planning of a process2.1. Define the activities within the process2.2. Define the monitoring and measurement requirements2.3. Define the resources needed
2.4. Verify the process and its activities against its planned objectives3. Implementation and measurement of the process4. Analysis of the process5. Corrective action and improvement of the process ImplementationThis document explains the process used to evaluate changes to the 2008 version. In particular, it explains the revision process and illustrates the impact vs. benefit analysis used to evaluate potential changes.In addition to the guidance documents, ISO maintains a web site with “official interpretations” of ISO 9001. Currently, these interpretations only include ISO 9001:2000, but, because the changes to the 2008 version were limited, they are valuable.Consider a common question. An organization needs a documented procedure for preventive action (8.5.3), and must keep records of the results of preventive action (8.5.3.d). One of the interpretation requests asks, “Does sub-clause 8.5.3 a) require organizations to demonstrate, with objective evidence in the form of records, that they have undertaken actions to determine the existence of ‘potential nonconformities and their causes’?” The answer is “No”.Auditing PracticesThe ISO 9001 Auditing Practices Group maintains a website9 with guidance and information on auditing ISO 9001 quality management systems. It is an informal group of quality management system (QMS) experts, auditors, and practitioners drawn from the ISO Technical Committee 176 Quality Management and Quality Assurance (ISO/TC 176) and the International Accreditation Forum (IAF).The website, primarily aimed at QMS auditors, consultants, and quality practitioners, is an online source of papers and presentations on auditing a QMS and reflect the process based approach.The website contains almost forty guidance documents with practical advice ranging from “How to audit top management processes” to “The role and value of the audit checklist”.
The process approach was introduced into ISO 9001 with the year 2000 version of the standards.Prior versions used an element approach. The document Guidance on the concept and use of the process approach for management systems describes to process approach and offers an implementation paradigm.1. Identification of processes of the organization1.1. Define the purpose of the organization1.2. Define the policies and objectives of the organization1.3. Determine the processes in the organization1.4. Determine the sequence of the processes1.5. Define process ownership1.6. Define process documentation2. Planning of a process2.1. Define the activities within the process2.2. Define the monitoring and measurement requirements2.3. Define the resources needed
2.4. Verify the process and its activities against its planned objectives3. Implementation and measurement of the process4. Analysis of the process5. Corrective action and improvement of the process ImplementationThis document explains the process used to evaluate changes to the 2008 version. In particular, it explains the revision process and illustrates the impact vs. benefit analysis used to evaluate potential changes.In addition to the guidance documents, ISO maintains a web site with “official interpretations” of ISO 9001. Currently, these interpretations only include ISO 9001:2000, but, because the changes to the 2008 version were limited, they are valuable.Consider a common question. An organization needs a documented procedure for preventive action (8.5.3), and must keep records of the results of preventive action (8.5.3.d). One of the interpretation requests asks, “Does sub-clause 8.5.3 a) require organizations to demonstrate, with objective evidence in the form of records, that they have undertaken actions to determine the existence of ‘potential nonconformities and their causes’?” The answer is “No”.Auditing PracticesThe ISO 9001 Auditing Practices Group maintains a website9 with guidance and information on auditing ISO 9001 quality management systems. It is an informal group of quality management system (QMS) experts, auditors, and practitioners drawn from the ISO Technical Committee 176 Quality Management and Quality Assurance (ISO/TC 176) and the International Accreditation Forum (IAF).The website, primarily aimed at QMS auditors, consultants, and quality practitioners, is an online source of papers and presentations on auditing a QMS and reflect the process based approach.The website contains almost forty guidance documents with practical advice ranging from “How to audit top management processes” to “The role and value of the audit checklist”.
Subscribe to:
Posts (Atom)