Understanding ISO 9001-Part 2In the previous post, we tried to describe what ISO 9001:2015 stands for.
In continuation of this article, let us look at how to implement some of the clauses.
Clause 4: Context of the Organization
An organization’s context involves its “operating environment.” The context must be determined both within the organization and external to the organization. This part is about understanding the organization’s purpose – the essence of the organization, the management system, and who the stakeholders are. It describes how to set up the management system and requires a broader understanding of the situation and needs of the business. It establishes the context of the QMS and how the business strategy supports this. The ‘context of the organization’ is the clause that underpins the rest of the standard. It gives an organization the opportunity to identify and understand the factors and parties in their environment that support the quality management system. To establish the context means to define the external and internal factors that the organizations must consider when they manage risks. An organization’s external context includes its outside stakeholders, its local operating environment, as well as any external factors that influence the selection of its objectives (goals and targets) or its ability to meet its goals. An organization’s internal context includes its internal stakeholders, its approach to governance, its contractual relationships with its customers, and its capabilities and culture. Firstly, the organization will need to determine external and internal issues that are relevant to its purpose, i.e., what are the relevant issues, both inside and out, that have an impact on what the organization does, or that would affect its ability to achieve the intended outcomes of its management system. It should be noted that the term “issue” covers not only problems which would have been the subject of preventive action in previous standards, but also important topics for the management system to address, such as any market assurance and governance goals that the organization might set. Secondly, an organization will also need to identify the “interested parties” that are relevant to their QMS. These groups could include shareholders, employees, customers, suppliers, and even pressure groups and regulatory bodies. Each organization will identify its own unique set of “interested parties” and over time these may change in line with the strategic direction of the organization. Next, the scope of the QMS must be determined. This could include the whole of the organization or specifically identified functions. Any outsourced functions or processes will also need to be considered in the organization’s scope if they are relevant to the QMS. The final requirement of Clause 4 is to establish, implement, maintain, and continually improve the QMS in accordance with the requirements of the standard. This requires the adoption of a process approach and although every organization will be different, documented information such as process diagrams or written procedures could be used to support this.
There are two new clauses relating to the context of the organization, 4.1 Understanding the organization and its context and 4.2 Understanding the needs and expectations of interested parties. Together these clauses require the organization to determine the issues and requirements that can impact the planning of the quality management system. Interested parties cannot go beyond the scope of ISO 9001. There is no requirement to go beyond interested parties that are relevant to the quality management system. Consider the impact on the organization’s ability to consistently provide products and services that meet customer and applicable statutory and regulatory requirements or the organization’s aim to enhance customer satisfaction. Organizations can go beyond the minimum requirements to determine additional needs and expectations for interested parties that would not be “relevant” at the discretion of the organization and should be clear in the quality management system.
4.1 Understanding the organization and its context.
This requirement requires a greater union between the QMS and wider business planning activities. it requires organizations to ascertain, monitor, and review both internal and external issues that are relevant to its purpose and strategic direction, and have the ability to impact the QMS and its intended results. The organization should determine external and internal issues for the organization relevant to its purpose, strategic planning, and which affect the organization’s ability to achieve its objectives. The Organization should monitor and review the information about external and internal issues. Management Review required the monitoring of external and internal issues. The organization must consider issues related to values, culture knowledge, and performance of the organization for the understanding of internal issues. The organization must consider issues related to arising from the legal, technological, competitive, market, cultural, social, and economic environments, whether international, national, regional, or local for the understanding of external context. The internal context may include, but is not limited to:
Product and service offerings
Governance, organizational structure, roles, and accountability.
Regulatory requirements
Policies and goals, and the strategies that are in place to achieve them.
Assets like facilities, property, equipment, and technology
Capabilities understood in terms of resources and knowledge like capital, time, people, processes, systems, and technologies.
Information systems, information flows, and decision-making processes (both formal and informal).
Relationships of the staff/volunteers/members and the perceptions and values of their internal stakeholders including suppliers and partners.
Organization’s culture.
Standards, guidelines, and models adopted by the organization and
Form and extent of the organization’s contractual relationships.
The external context’s micro-environment consists of the organization’s immediate operations and how they affect its performance and decision-making. Some of the micro-environmental context factors
Customers – Organizations must attract and retain customers by offering products services that meet their needs along with providing excellent customer service
Employees/Members/Volunteers – There must be the availability of people with the motivation to remain as contributing members of the organization and develop the skills necessary to provide a competitive edge
Suppliers – Suppliers provide organizations with the resources they need to carry out their activities. If a supplier provides bad service, this affects the way the organization operates. Close supplier relationships are an effective way to remain competitive and secure the resources needed
Investors – All organizations require investment to grow. They may borrow the money from a bank or have people invest in their work. Relationships with investors need to be managed carefully as problems can detrimentally affect the long-term success of the organization
Media – Positive media attention can bring success to the organization by maintaining its reputational strength. Managing the media (including the presence in social media) is a challenge.
Competitors – Members of the organization need to have a sense of belonging. Can the organization offer benefits that are better than those offered by the competitors? Is there a strong value proposition? Competitor analysis and monitoring are crucial if an organization is to maintain or improve its position in the competitive landscape of the community. The organization must always be aware of its competitor’s activities. The landscape can change quickly.
4.2 Understanding the needs and expectations of interested parties.
A broadening of scope beyond just customers. Requires the organization to determine “the relevant requirements” of “relevant interested parties” e.g. a person or organization that can affect, be affected by, or perceive themselves to be affected by a decision or activity.
The organization shall determine relevant interested parties and requirements of relevant interested parties. Interested parties include Customers, Partners, Persons in the organization, External providers. Relevant interested parties to be considered are those that potentially could impact the organization’s ability to provide products and services that meet requirements. Monitor and review information related to interested parties and relevant requirements. Management Review requires the monitoring of relevant interested parties.
4.3 Determining the scope of the QMS.
The scope statement must state the products and services covered. The organization must establish the scope of the quality management system by determining the boundaries and applicability of the quality management system. While determining the scope the organization must consider the internal and external issues determined in 4.1., the requirements of relevant interested parties in 4.2. and the products and services of the organization.
Requirements that can be applied by the organization shall be applied. Requirements that cannot be applied cannot affect the organization’s ability to provide products and services that meet requirements. The organization must maintain scope as documented information stating the Products and services covered by the QMS and any Justification where a requirement cannot be applied. Any interested party which is not relevant to the quality management system need not be considered and similarly, any requirement of the interested party need not be considered. Determining what is relevant or not relevant is dependent on whether or not it has an impact on the organization’s ability to consistently provide products and services that meet customer and applicable statutory and regulatory requirements or the organization’s aim to enhance customer satisfaction. The organization can decide to determine additional needs and expectations that will meet its quality objectives. However, it is at the organization’s discretion whether or not to accept additional requirements to satisfy interested parties beyond what is required by this Standard.
Applicability
The revised standard will focus on application and not just the exclusions. There are no limits to which clauses where the application can be determined. Justification will be required as documented information to ensure that limited application does not affect the organization’s ability to provide for the provision of products and services. The application of requirements may vary. Where a requirement can be applied within the scope of its quality management system, the organization cannot decide that it is not applicable. Where a requirement cannot be applied (for example where the relevant process is not carried out) the organization can determine that the requirement is not applicable. However, this non-applicability cannot be allowed to result in failure to achieve conformity of products and services or to meet the organization’s aim to enhance customer satisfaction. A manufacturing organization that does not have any monitoring and measuring resources could determine requirements in 7.1.5 do not apply. Organizations that build from a customer-provided design could determine requirements for design in 8.3 do not apply. Organizations could not determine that requirements such as competence are not applicable since this directly affects the ability to provide a product that meets requirements.
4.4 Quality Management System and its processes.
A major change that specifies the number of factors to be considered when planning the processes that make up the QMS. Although a process-planning approach has been previously expressed in earlier standards, this greatly reinforces the requirement. The standard requires the organization to establish a process-based management system. This is required to be maintained and continually improved. The clause sets out high-level requirements for the design of such a process-based management system. These processes are integral and also there are support processes that underpin the operation of the entire QMS. It does not mean that you have to fill your quality manual with flowcharts. If flowcharts work for you then use them.
Process
The process is a set of interrelated activities that transform activity inputs into outputs. For example, the process of converting a box of components into a working security system.
Process Approach
The process approach is a management strategy that requires organizations to manage their processes and the interactions between them. Thus you need to consider each major process of the company and its supporting processes.
All processes have:
inputs;
outputs;
operational control;
appropriate measurement & monitoring
Each process will have support processes that underpin and enable the process to become realized. So, for example, a typical alarm company will take inquiries/sales and convert them into working alarm systems. Below is a block diagram of a typical alarm company processes with support processes and other considerations.
Example of other processes and considerations:
Questions to ask:
What are the inputs to the process?
Where do the inputs come from?
What are the outputs of the process?
Where do the outputs go to?
Is there an effective interrelationship between processes?
Who plans the process?
Who conducts the process?
Are responsibilities and authorities defined?
Who monitors and measures the process?
What resources are required for the process? – Materials, people, information, environment, infrastructure, etc.
What documented information is required for the operation and control over the process?
What competencies & training are required?
What awareness and knowledge is required?
What methods are used to control and run the process?
What are the risks and opportunities for the process?
What happens when the process goes wrong or does not yield the correct output or result?
How can the process be improved?
Is the process part of the management review process?
Is the process subject to internal audit?
The answers to the questions above form the basis of the process, its control, measurement, and improvement.