Your Guide to Implementing ISO 9001

Benefits of Implementation

The benefits of implementing a Quality Management System which is compliant with ISO 9001 can be far-reaching. Simply adopting a process approach to operations can immediately highlight areas for improvement. Documenting processes in a meaningful way can also help with communicating quality actions and strategy to people at all levels. Inductions and training are linked directly to business objectives and people within the organization are clear on their contribution to overall performance and success.

Adopting a customer focus adds value for customers and is likely to enhance their satisfaction and loyalty. Repeat business is less costly to achieve than new business so it pays to keep your current customers happy.

Not only can a Quality Management System (QMS) enhance your customers’ satisfaction, it will also have a positive impact on your reputation. Being able to demonstrate a formal commitment to quality is often a pre-requisite for formal tendering procedures, in particular for public sector contracts. Having a certified QMS can open doors to a range of contract opportunities and therefore potentially boost your revenue and market share.

Implementing a QMS can also help you to be more efficient. Using resources, this includes people, materials, time, money and external partners and suppliers, as effectively and efficiently as possible has a direct positive impact on profitability.

Involving the people within your business fosters deeper engagement with operations. This can lead to reduced
turnover of staff, better productivity, enhanced trust and collaboration and a skilled and happy workforce.

Consistent and predictable outcomes lead to greater understanding of capability and capacity. Understanding
organizational capability and capacity can help you to manage growth and the associated risks.

Focusing on root cause analysis when investigating problems ensures solutions are robust and improvements are effective. Ongoing monitoring and measuring provides evidence of the effectiveness of processes and can demonstrate the effectiveness of previous decisions and actions. (Remember the quality principle of evidence-based decision-making.)

A QMS also helps you to manage your supply chain. Encouraging strong, effective communication between
parties ensures expectations and requirements are clear before everyone is committed. This leads to improvement opportunities for mutual benefit.

Risk Based Thinking/Audits

Audits are a systematic, evidence-based, process approach to evaluation of your Quality Management System. They are undertaken internally and externally to verify the effectiveness of the QMS. Audits are a brilliant example of how risk-based thinking is adopted within quality management.

1ST PARTY AUDITS - INTERNAL AUDITS

Internal audits are a great opportunity for learning within your organization. They provide time to focus on a particular process or department in order to truly assess its performance. The purpose of an internal audit is to ensure adherence to policies, procedures and processes as determined by you, the organization, and to confirm compliance with the requirements of ISO 9001.

AUDIT PLANNING

Devising an audit schedule can sound like a complicated exercise. Depending on the scale and complexity of your operations, you may schedule internal audits anywhere from every month to once a year. There’s more detail on this in section 9 – performance evaluation.

RISK-BASED THINKING

The best way to consider frequency of audits is to look at the risks involved in the process or business area to be audited. Any process which is high risk, either because it has a high potential to go wrong or because the consequences would be severe if it did go wrong, then you will want to audit that process more frequently than a low risk process.

How you assess risk is entirely up to you. ISO 9001 doesn’t dictate any particular method of risk assessment or risk management. You may wish to review ISO 31000 for more information on risk management.
 
2ND PARTY - EXTERNAL AUDITS

Second party audits are usually carried out by customers or by others on their behalf, or you may carry them out on your external providers. 2nd party audits can also be carried out by regulators or any other external party that has a formal interest in an organization.

You may have little control over the timing and frequency of these audits, however establishing your own QMS will ensure you are well prepared for their arrival.

3RD PARTY - CERTIFICATION AUDITS

Third party audits are carried out by external bodies, usually UKAS accredited certification bodies such as NQA.
The certification body will assess conformance to the ISO 9001:2015 standard. This involves a representative of the certification body visiting the organization and assessing the relevant system and its processes. Maintaining certification also involves periodic reassessments.

Certification demonstrates to customers that you have a commitment to quality.

Process Based Thinking/Audits

A process is the transformation of inputs to outputs, which takes place as a series of steps or activities which result in the planned objective(s). Often the output of one process becomes an input to another subsequent process. Very few processes operate in isolation from any other.
 
“Process: set of interrelated or interacting activities that use inputs to deliver an intended result.” ISO 9000:2015 Fundamentals and Vocabulary

Even an audit has a process approach. It begins with identifying the scope and criteria, establishes a clear course of action to achieve the outcome and has a defined output (the audit report). Using the process approach to auditing also ensures the correct time and skills are allocated to the audit. This makes it an effective evaluation of the performance of the QMS.

“Consistent and predictable results are achieved more effectively and efficiently when activities are understood and managed as interrelated processes that function as a coherent system.”

ISO 9000:2015 FUNDAMENTALS AND VOCABULARY 

Understanding how processes interrelate and produce results can help you to identify opportunities for improvement and thus optimise overall performance. This also applies where processes, or parts of processes, are outsourced.

Understanding exactly how this affects or could affect the outcome and communicating this clearly to the business partner (providing the outsourced product or service) ensures clarity and accountability in the process.
The final process step is to review the outcome of the audit and ensure the information obtained is put to good use. A formal Management Review is the opportunity to reflect on the performance of the QMS and to make decisions on how and where to improve. The Management Review process is covered in more depth in Section 9 – performance evaluation.

Section 1: Scope

A Quality Management System is primarily intended to enhance customer satisfaction. It does this through the application of the processes determined by you as necessary for your operations, as well as the processes determined by the standard as necessary for continuous improvement. A QMS aims to assure conformity to customer requirements and applicable legal requirements.

The intention is for all requirements (clauses) of the standard to be applicable irrespective of the size and nature of the organization implementing the QMS. Whether you provide a product or a service, or a combination of both.

There are times when certain clauses may become not- applicable. For example, where you do not carry out any design and development activities or where measurement traceability, or any subsequent calibration of equipment, is not part of your product or service. These have previously been referred to as ‘exclusions’ however the expectation here is that a justification will be made as to why the clause is deemed to be not-applicable rather than simply being excluded from the QMS.

Section 2: Normative References

‘Normative references’ simply means any other documents which are referenced within the management system standard. In the case of ISO 9001:2015, there are many references made to ISO 9000:2015 – Quality management systems - Fundamentals and vocabulary.

This document explains the key concepts and defines the core terminology used in ISO 9001:2015. Whilst it is not mandatory to purchase ISO 9000:2015 alongside ISO 9001:2015, it can be valuable in fully understanding the purpose of a QMS and in creation and implementation of your unique system.

There is an assumption throughout the standard that each term used is understood according to its definition described in ISO 9000:2015.

Section 3: Terms and Definitions

The terms and definitions used in ISO 9001:2015 are taken directly from ISO 9000:2015 – Quality management systems - Fundamentals and vocabulary.

The key terms used throughout the standard are:

‘Product’ – this is the result of a process and may include services or advice. This is essentially what you provide to a customer.

‘Process’ – is a set of interrelated or interacting activities which uses inputs to deliver outputs. Processes are how you operate on a daily basis.

‘Interested party’ – is a person or organization that can affect, be affected by or perceive themselves to be affected by your decisions or activities.

‘Risk’ – is the effect of uncertainty. This can apply to any area of operations not just financial risks.

‘Risk-based thinking’ – is about planning your objectives and actions taking into account the known risks and their potential effects. The ideal situation is to minimise the likelihood or impact of unwanted outcomes.

‘Objective’ – is the result to be achieved. Objectives must be SMART – Specific, Measurable, Achievable, Realistic and Timely.

‘External provider’ – is any provider of external processes, products or services. This includes not only your direct suppliers of materials but also anyone to whom you outsource processes or parts
of processes. For example, an outsourced customer contact service.

‘Documented information’ – is any document, record or other information which is necessary for the operation of processes or is required by the quality management system. It can include photographs, diagrams, videos, process maps, standard operating procedures and can be on any medium i.e. paper or electronic.

‘Audit’ – is a systematic evaluation of whether or not processes are adhered to and whether or not those processes meet the requirements of the standard.

‘Preventive action’ – is action taken to prevent a potential non-conformity or other undesired effect. This is usually a big part of the planning process and is helped along by activities such as process mapping, SWOT analysis and risk assessment.

‘Corrective action’ – is action taken to correct a mistake, or non-conformity, and to deal with any consequences. It should also prevent recurrence of the issue or any other potential issues.

When you write your quality management system documentation, you don’t have to use these exact terms. However, it does help to clarify the meaning and intention if you can define the terms you have used. Providing a glossary within your system documentation may be useful.

Section 4: Context of the Organizations

Quality management principles have always intended to have a holistic approach to customer focus. Quality control generally only checks what has been done. Quality assurance aims to ensure what has been done is right first time.

Quality management uses the principles detailed above in the introduction to provide a ‘bigger picture’ view of business operations in order to ensure quality is built in from the start and in all areas, not just production or service delivery. Understanding the purpose and strategic direction of your organization is key to being able to establish the customer requirements and resource requirements to achieve your business objectives.

WHAT IS 'CONTEXT'?

The introduction of a formal analysis of business context has been a challenge for many organizations when implementing ISO 9001:2015. Firstly, understanding what the standard means by ‘context’ and secondly working out how to evidence this for an auditor.

So, to approach the first issue... what is context? In respect of ISO 9001:2015, context refers to a range of factors including:

In short, context describes who you are, what you do, who you do it for, why you do it and where you do it. Whatever ‘it’ is. It could be making a product or providing a service, or a combination of both.

FACTORS AFFECTING THE CONTEXT OF THE ORGANIZATION CAN BE INTERNAL OR EXTERNAL


EVIDENCING CONTEXT ANALYSIS TO AN AUDITOR

ISO 9001:2105 does not specify that your consideration of context must be documented. Your auditor will expect to find some evidence of consideration, much of which will be through documentation such as meeting minutes or business plans. However, there is no requirement for you to provide a specific document in respect of clause 4. The rest of the auditor’s assessment will be established through conversation and observation.

If you do wish to document your consideration of this clause, a SWOT analysis is often a great way of establishing internal and external context. When you pay focused attention to your Strengths, Weaknesses, Opportunities and Threats, you have a clear understanding of where positive action can be taken.

You may have heard of a PESTLE analysis:

• Political
• Economic
• Social
• Technological
• Legal
• Environmental

Carrying out a PESTLE analysis for your organization (as described above) could be an effective way to evidence your consideration of external context. It may also bring up issues you hadn’t previously considered. External issues can often fall outside of your control as an organization.
 
Understanding these issues and their potential impact on your operations contributes to a thorough assessment of risks and opportunities. Do you know what you would do if your landlord suddenly served you notice to leave your premises? How would a change in legal requirements affect your overheads? What are your competitors doing and should you also be doing the same (or better)?

INTERESTED PARTIES​

An interested party is pretty much anyone who is affected, can be affected or can perceive themselves to be affected by an action or omission of your organization. If you’ve carried out a thorough analysis of internal and external context, your interested parties are likely to be already quite obvious. They will include shareholders, landlord, regulators, customers, employees and competitors and may extend to the general public and the environment depending on the nature of your business.

You don’t have to try to understand or satisfy their every whim. That wouldn’t be very practical! You simply have to determine which of their needs and expectations are relevant to your quality management system. What are their key expectations of you and your products/services? How can you incorporate these into your processes and monitoring to ensure optimum performance?

SCOPE OF THE MANAGEMENT SYSTEM​

The scope of your management system refers to the physical and / or geographical site within which your operations take place, the products/services included in the QMS, the relevant parties and any areas which you have determined to be not applicable. Your scope statement must be maintained as documented information.

Your scope statement may look something like this:

“Joe Bloggs and Co provide <products / services> for <customers> in <industry>. The quality management system is designed to incorporate all operations at our site in <town/city> with all clauses of ISO 9001:2015 determined as applicable.”

Section 5: Leadership

Previous editions of ISO 9001 referred to Management. ISO 9001:2015 talks about Leadership. Leadership in this context means active involvement with the QMS, aligning its objectives with overall business strategy and promoting the adoption of risk-based thinking, the process approach and evidence-based decision-making.

These are not actions which can be delegated. An external auditor will expect to discuss leadership with those who manage the organization at the highest level (i.e. your ‘top management’).

DEMONSTRATING LEADERSHIP​

Leadership is a term open to interpretation. Leadership in terms of your quality management system refers to promoting the system, the process approach and risk-based thinking.

Ensuring quality objectives are compatible with the strategic direction of the organization. Providing the right resources to achieve these objectives. Communicating the importance of the QMS and engaging and supporting people within the organization to contribute effectively to the QMS. ISO 9001:2015 also refers to leadership at all levels within an organization. This means allowing experts within your organization to develop and demonstrate their own leadership abilities.

The primary focus of ISO 9001 is customer satisfaction. As such, top management are also expected to demonstrate leadership and commitment to customer focus. Carrying out the assessment of context described above helps to ensure all relevant customer and legal requirements are considered and maintained.

SETTING POLICY

A key action in terms of leadership is to set a quality policy which supports the achievement of your objectives. This might include how you select suppliers or partners, how you recruit and train your staff, how you monitor and measure process performance and how you ensure all applicable requirements are satisfied. Your quality policy will also include a commitment to the continual improvement of your quality management system.

ROLES AND RESPONSIBILITIES

ISO 9001:2015 doesn’t specify a requirement for a nominated quality representative. The expectation is that quality activities will form part of the day-to-day activities for most people within the organization. It may help to review your existing job descriptions to ensure these activities are included along with details of where the role has responsibility and / or authority relating to the QMS.

Of course, it makes sense to nominate someone, or a small team of people, to be the main point of contact for the QMS. It certainly makes life easier for an external auditor to have a clear point of contact. However, this is by no means an opportunity for the commitment to be diluted. The point of contact must have suitable authority to manage the system and make continual improvements as determined by the top management.

Section 6: Planning

Clause 6 is all about planning. If you’re not a natural planner, this can seem quite daunting! Effectively, this is the ‘preventive action’ that you may have heard referred to in previous versions of ISO 9001. The difference in this most recent update is its promotion to much nearer the beginning of the standard (it used to be tacked on to the end, like an afterthought).

If you’ve been thorough in your assessment of context and the needs and expectations of interested parties, then the potential risks and opportunities will likely have made themselves quite apparent. You’re looking to answer the following questions:

• What are we trying to achieve?
• What could stop us from achieving our objectives?
• How will we address these issues?
• How can risks be turned into opportunities?
• How can opportunities help us to improve?
• Who will be responsible for actions?
• When will we need to take action by?
• How will we know whether our actions were effective?

ACTION STATIONS!

Addressing risks and opportunities and achieving your quality objectives require an action plan.

Objectives need to be:

• Measurable

• Aligned with your quality policy

• Relevant to the conformity of your products / services

Quality objectives also need to take account of the requirements which you identified in your analysis of interested parties (i.e. they need to meet customer requirements as well as legal / regulatory requirements).

Quality objectives must be communicated and they must be updated as necessary. This is an area where you are expected to maintain documented information.

An effective way to communicate quality objectives is to include them in induction training, display them around your site or electronically via an intranet or similar, incorporate them into supplier contracts (if it’s appropriate to share them outside of your organization).

Your action plan should include:

• What will be done

• What resources will be required (to the best of your understanding at the time)

• Who will be responsible for the actions

• When actions will be completed

• How results will be evaluated

Putting these into a simple matrix can help to clarify the objectives, however if you already record this type of information somewhere else, there is no need for you to duplicate.

MANAGING CHANGE

When you’ve put so much time and effort into all this planning, it would be a shame for an inadvertent change to mess it all up!

In light of this, clause 6.3 expects that any changes that you determine are necessary to the quality management system are carried out in a planned manner. This should take into account the extent of the changes deemed necessary, the potential impact on the existing system, how you will resource the changes and any effect this may have on current roles, responsibilities and authorities.

Section 7: Support

Clause 7 concerns itself with resources. This applies to people, infrastructure and environment as much as physical resources, materials, tools etc. There is also a renewed focus on knowledge as a significant resource within your organization. When planning your quality objectives, a major consideration will be the current capacity and capability of your resources as well as those you may need to source from external suppliers / partners.

PEOPLE

Simply, do you have the right people with the necessary skills / attributes in appropriate roles? If you’re currently missing some specific skills, how do you plan to address this? Will you recruit or will you outsource? If you’re outsourcing, how will you communicate your requirements to your supplier / partner? (more on this later in this section).

INFRASTRUCTURE

This includes determining, providing and maintaining the premises, hardware, software, transportation, storage, technology etc that are needed to carry out your business operations. Ensuring you can cope with customer demands can be helped by the work you did to address clause 4 and clause 6.

ENVIRONMENT

This isn’t referring to the great outdoors. This means providing an environment that is suitable for what you are trying to achieve. Whether that is a factory, office, studio or any other type of working space, make sure you have the right atmosphere to enable you and your employees to operate effectively. Adequate heat, light, airflow, hygiene, noise levels etc all contribute to an effective working environment.

This can also include addressing some of the softer elements such as employee wellbeing, stress-reduction, clear lines of reporting, employee appraisals, rewards systems etc).