PART 3 - STRUCTURE AND CONTENT OF THE STANDARD
General
You should read ISO 9000:2000 before ISO 9001:2000 so that you can understand the concepts and meaning of the terms used in the standard. The new standard has models that can be used to illustrate the concepts of the standard's structure and to help in the understanding of how the standard should be used. ISO 9004:2000 contains the requirements of ISO 9001:2000 in order to help the user to understand how to use the standard.
Main Elements of the Standard
The main elements of ISO 9001:2000 are outlined below and cross-referenced to the relevant Clause of the standard.
Introduction [Clause 0]
The introduction includes a process model and an explanation of how to interpret it. It also places emphasis on the customer, addressing customer satisfaction. It emphasises that the adoption of a formal management system is a strategic decision of the organisation. There is an explanation of the relationship between ISO 9001:2000 and ISO 9004:2000. It also covers compatibility with ISO 14000:1996. The introduction explains that the standard does not address other areas such as finance and health and safety.
Scope [Clause 1]
The standard gives a clear indication of its process nature and that:
- you need to take into account the regulatory requirements of your products
- you need to have processes in place for continual improvement.
"Application" requires you to state clearly if any areas of the standard do not apply to your organisation, together with an explanation of the reasons for this.
See Part 4 of this document for a more detailed explanation of scope.
Normative Reference [Clause 2]
This clause states that the definitions of ISO 9000:2000 apply.
Terms and Definitions [Clause 3]
The three parties involved in the requirements are clearly shown. The terminology has been brought into line with general usage in industry and commerce.
Quality Management System [qms] [Clause 4]
The qms is the means by which you manage and control your organisation. How you do this is entirely up to you. However, your system should use processes to achieve this. Those processes should consist of a balance between procedures and competencies.
Your current systems for control may already have much of the detail that is needed for the revised standard. There is an all embracing requirement for you to identify your processes, determine their interaction, ensure that there is enough information to monitor them and to document them where they are needed to maintain control.
A process is described in the standard as a 'set of interrelated or interacting activities which transform inputs into outputs'. Put more simply they are those chains of activities that take place across an organisation and deliver the organisation's products or services to either internal or external customers.
Processes are what needs to be done, who needs to do it and what is the result. Either procedures and/or competencies will support processes. Procedures and other documents [work/operating instructions, etc.] define how an activity is required to be done.
In the past there has been a perception that the standard requires a detailed description of every activity undertaken by an organisation and this had led to cases of severe over-documentation. See Part 5 - Implementing the Quality Management System, for guidance on the extent to which the details of activities should be specified.
You need a Quality Manual. The standard allows flexibility in respect of its status and structure. It can be part of the overall system, and need only contain the scope of the qms, processes and any related procedures. You need to detail system processes. See the qms requirements in Clause 4.
The standard requires control of records and documents.
Management Responsibility [Clause 5]
You need to be aware of the role played by the "top management" of the organisation. ISO 9000:2000 section 3.2.7 defines "top management" as:
"person or group of people who direct and control an organisation at the highest level".
There is a requirement for "top management" to show a commitment to the development and improvement of the qms. It can demonstrate its commitment through leadership and active participation. The top management also needs to ensure that it understands and meets the regulatory and legal requirements with respect to the products and services it supplies. The organisation has to determine the customer's needs and expectations for their organisation. This is aimed not only at individual customers but also at the market in which the organisation operates.
Planning [Clause 5.4]
Objectives are the targets that you set yourself to achieve your policies. To meet your objectives you need to plan the actions you take. This clause clarifies the requirement for objectives and includes continual improvement. Planning includes the use of resources, how processes are used and the requirement to maintain the system whilst the organisation is undergoing change.
Responsibility, authority and communication [Clause 5.5]
For your management system to operate effectively you need to have control over how it is administered. This is achieved through:
- Responsibility and authority, which includes the communication of responsibility and authority.
- A management representative who plays a pivotal role in the running and organisation of the system.
- Internal communications, covering the need for there to be managed communication within the organisation.
Management Review [Clause 5.6]
The need for the "top management" to review the qms is pivotal. This is the route for review and action in respect of continual improvement. Management Review is one of the vehicles by which top management will become actively involved in the system and demonstrate their commitment and control. Management Review shows the inputs and outputs required.
Resource Management [Clause 6]
The requirements of this clause cover training needs, training itself, infrastructure and the work environment. There are also requirements dealing with competencies of personnel and the evaluation of training effectiveness, together with staff awareness of the relevance and importance of their role and how it contributes to the achievement of the organisations' objectives. The clause requires you to identify and provide company infrastructure. You need to take into account the working environment for personnel and product to ensure that the product conforms to customer requirements. For further guidance on this subject see clause 6.4 of ISO 9004:2000.
Product Realisation [Clause 7]
"Product Realisation" is the process of making a product and/or delivering a service.
Planning of realisation process [Clause 7.1]
The planning requirements relate to objectives concerning the product, project or contract. You need to determine what processes you require and how you will control them for the realisation of the product or service provided. The clause refers to objectives and how the processes will help you to meet them. Note the sub paragraphs a-d, as these lay down the requirements for what should be taken into account when planning the processes. Also note the reference made to the development of the processes and note 2 which suggests that the requirements of design may be used to develop the processes needed for the product or service.
Customer related processes [Clause 7.2]
This clause includes specific requirements concerned with taking into account legal and regulatory requirements relating to the product or service provided. An implied need is one where the customer does not specify a requirement but the organisation knows that the requirement is needed to satisfy the customer and also comply with regulatory or legal requirements.
For example, ordering a meal in a restaurant involves a number of implied needs. If you order soup. it is not normal for you to specify that the soup be served in a bowl. However, if it is not, then it will be difficult to eat. This is an implied need. Also, all food prepared for public consumption in the UK has to be in accordance with the Food Safety Act. This is a statutory implied need. The standard requires that the known or intended use of the product or service is determined before the order is accepted. There is also a specific requirement for clear communications between the organisation and the customer.
Design and/or development [Clause 7.3]
This clause provides a comprehensive description of design and/or development requirements. It covers both design to customer specifications and off-the-shelf designs. It is as applicable to design of services as it is to design of products. It requires you to plan activities, agree inputs and for outputs to meet the inputs. The design should be reviewed against the inputs and verified as it progresses. Once the design is complete its validation is required to ensure that it meets the input requirements regardless of whether or not the output is a tangible product or a service. Also, design changes require a control system.
Purchasing [Clause 7.4]
This clause deals with purchasing in relation to the selection of suppliers. It requires you to exercise control over suppliers in proportion to the effect that a purchased product has upon the final product to the customer. It also requires you to evaluate your suppliers both initially and periodically. Purchasing information is a requirement as is verification of purchased product.
Production and service provision [Clause 7.5]
This clause sets out the requirements for the actual production of the product and/or providing the service. It requires the product and/or service to be provided under controlled conditions and lists a number of conditions that may be applicable, e.g. availability of work instructions and necessary equipment. It also covers the situation where the final product and/or service cannot be checked or tested without damage or where problems may arise only after the product and/or service has been taken into use. To ensure that the product and/or service is delivered as planned, the processes involved should be validated to maximise confidence in the output.
The identification of products is covered but it should be noted that traceability is only necessary if it is a stated requirement e.g. contractual. If the product is required to be monitored and measured during production, its status is to be capable of identification.
An organisation shall have procedures to manage customer property whilst under its control and the product or its constituent parts are to be protected within the organisation and during delivery.
Control of measuring and monitoring devices [Clause 7.6]
This clause explains the monitoring devices that you can use to control processes. It also deals with the validation of software.
Measurement Analysis and Improvement [Clause 8]
General [Clause 8.1]
This clause requires you to plan how you will measure and monitor systems, processes and products. It also refers to the statistical techniques you may use in measurement and monitoring.
Measurement and Monitoring [Clause 8.2]
The standard contains a customer satisfaction requirement. You need to have a way of measuring customer perception of your company and thus customer confidence. When you have this information you can consider actions for improvement.
The requirement for internal audits includes a consideration of the results of previous audits. It is made clear that auditors should not audit their own work.
You should have methods for measuring your processes to check that they are capable of ensuring that the product or service meets requirements, both stated and implied.
Control of non-conformity [Clause 8.3]
A non-conformity is anything that does not conform to what has been specified. The last paragraph of this clause deals with the detection of a non-conformity after the product has been released or delivered.
Analysis of data [Clause 8.4]
Analysis of data is an important aspect of the system. It requires all the information from the measurement section to be brought together with a view to effecting improvement.
Improvement [Clause 8.5]
Continual improvement looks for the improvement of the qms. It requires you to plan improvement systems and to take into account many other activities, that you can use in the improvement process. Typically, these will be the results from the analysis of data. Corrective action requirements include development of the means to stop a problem from happening again. Preventive action requirements include ways to stop problems arising in the first place. It is the proactive analysis of the processes, whereas corrective action is the re-action to problems when they arise. Preventive action can be achieved by an assessment of the risk of something going wrong.
Continuous/Continual Improvement
The above diagrams illustrate the differences between "Continuous" and "Continual" improvement. Continual improvement is a step-by-step process of carrying out improvements and then looking to see how effective they have been.
You need to look at your organisation's overall systems performance and decide when and where you can make the most effective improvements. You then need to set objectives for those improvements and conduct periodic evaluation to monitor achievement.
Improvements may be the reduction of cycle time within a process or the economic effectiveness and improvement of changes to the systems.
Annexes A and B
Please note these annexes can be used for the comparison between the new standard and ISO 14001:1996 and ISO 9001:1994 respectively.
© This document is copyright ABCB/CQI/FSB. It may be freely distributed provided that it is not altered in any way, and this notice appears on all pages.