ISO 9001:2015 Interpretation and Implementation (10/22/16)

Editor's Notes

• #3: Original premise for the presentation
• #5: Answers are still available colin@cavendishscott.com
• #7: These are the requirements that means you have to have documentation. Although there are no specific requirements for procedures – nowhere that the standard asks for a procedure for a process or requirements, ISO says that you have to have enough documentation to operate effectively and to provide it to auditors/customers. In practice you cannot prove a process was successful unless you have it documented. Further, common sense says that if you want to be able to be clear about a process, communicate it, train in it, audit it – make it successful. Then it has to be written down. There are places where you can do without a procedure. For instance, you don’t need a procedure for a meeting if the meeting has an agenda, charter, minutes, action items, etc. However, where the control is less easy to define you need procedures. In reality you need procedures for all processes.
• #8: This is why we need procedures There are different ways of doing procedures. If there is no procedure you must explain the situation to the auditor. You have to justify how it is a process and not just some activities that are performed by a particular person. You have to justify how they are successful. And verbal evidence is not as reliable for auditors. You need procedures.
• #9: Similarly you need records to prove the output of a process or activity. ISO uses the phrase “consider” which means “think about” some things but you don’t have to do anything. In order to prove that you considered things, you will have to maintain evidence of things that you are not going to use. It is important to make this a simple and not a costly process. Take a photograph of your brainstorming whiteboard with all the things you thought of but will dismiss. Easy.
• #10: Here is a list of project tasks. If you already have ISO and it s “reliable” then your Gaps are the same as the changes in the new standard. You don’t need a gap analysis project. (unless you don’t have confidence in your current ISO system). Find a list of changes on the internet and start there. Quality is now part of business planning and strategic processes, leadership is involved and committed – the quality department is tgechnically getting access to the senior strategic processes.
• #11: Talk to you CB soon. They will run out of resources soon. Book a date. Do not leave this until the end of the transition period.
• #12: This is the potential new “senior” role for quality.
• #13: This might mean a partial rewrite of an existing system – except I have yet to see a good set of documentation when they are written around the standard. They tend to reflect the standard and not the organization. If your system and documentation is not process based then you need to consider it will take a lot of re-writing. Note that this is an opportunity to “re-invent” the QMS in your organization (do this well and you are the hero, the leader). Change the look and feel of documents and sell the system positively. Definitely an opportunity to promote and train in process theory. ISO Requires No procedures: Yes but process is not about procedures. Most organizations are process orientated. They just are. But if the documentation of the QMS does not reflect that? Good luck convincing an auditor….or worse a customer. One management system. Documented once. Meets multiple standards (but importantly meets our goals for control)
• #14: So formalize, get quality on the agenda and get quality personnel involved. Adopt what you can! Its easier and you can revisit it later when the rest of your system is stable Integrate, along with the strategic aspects of transition/implementation present many challenges. are you comfortable interviewing top management about the processes are they comfortable telling you are you experienced enough to challenge them do you command enough respect to discuss and get changes do you have the authority (to back up the responsibility for ISO) Processes – they are very inter dependent Formal, documented with controls (forms, templates, software), establish AND maintain data Context and interested parties – strong process, doesn’t matter if you miss some – DEMONSTRATE Risk – KISS Opportunity – do it deliberately – don’t bury with risk alone Communication – a Plan (maintain) – will indicate the complexity to issues, interested parties, change Knowledge – new concept KISS – possibly job descriptions (partially), perhaps an “inventory” system Change – Formal but does not need to be complex. Idenify, describe, control.
• #15: The “right” approach is not to write a “flat” specific procedure for risk, or context or interested parties but in fact to write a procedure for business planning that addresses all of those (and more). This will be a valuable process that will benefit the organization and co-incidentally meet ISO. Ensure that it formally includes quality content.
• #16: DEMONSTRATE – leadership and commitment (two pieces of evidence?) and don’t think it is acceptable to address all of these with verbal evidence. Verbal is less reliable than other forms of evidence. Auditors will want more. Note – a) is similar to g) (but different of course – one says that our system must be successful, the other says that we must be successful by design not by accident) Accountability is new and may be difficult to implement. Consider having top management deal with unhappy customers. c. Not a separate system – managements fault if it is. d. Must lead and commit to the process approach (no more ISO numbered procedures, focus on processes [inputs, outputs, controls, metrics, objectives, etc.] and risk (preventive thinking) g. Focus on success. Demonstrate leading and committing to the principle of improving things. j. Demonstration of support
• #17: Probably the biggest challenge Leadership will not provide the resources or support the change if they don’t understand why or whats involved. They need education. You need to sell a vision. HOW Probably you need a promotional campaign – start to get it noticed. Probably a short presentation to management – maybe an hour? Start small and plan another (they wont show for the 4 hour session) Management are going to be audited – you need to train them on how that is going to happen. Practice. Are they going to be directly involved in the “generate” of the evidence that is required. Prepare tasks and content for management, to “ demonstrate leadership and commitment”.
• #18: It requires you to demonstrate your system. The planning and effectiveness (plans and results). Good luck arguing verbal evidence…..its not your job – let top management do that (throw them to the wolves) Who should do the writing? Perennial question in ISO. Nobody gets “ownership” by writing a procedure. Some people really hate it. Some are just not able. None of them signed up for it when they took the job. It’s a distraction, it takes a lot of effort, are you going to let them stop their “real” job. What expertise do they have outside of their job? Do they have wide ranging experience of different functions. They are probably not process experts and probably not ISO experts (consider some serious training on these topics if you take this approach). Professionally, quickly, consistent style, appropriate level of detail and bureaucracy/control, coincidentally meets ISO. (yes if it’s the CEO…..but really) How is it to be verified. Process owners don’t know what should and shouldn’t be in procedures? Why would they. They know the process but they don’t necessarily know what should and shouldn’t. Audited? Are your auditors experts in ISO (true they may not need to be). How good are they with ISO? Document Review and Audit will confirm conformance…..only. Top Management Who is going to write procedures (or just solutions) for top management? Who in the company is qualified? Who is comfortable challenging top management on their processes. Can you avoid procedures in preference for alternatives? Who designs the evidence? New Terminology. Change it in your QM. Update procedures but there isn’t any value in changing purchasing to “externally provided products, services and etc. There are some terms that are worth adopting, tweaking. And the QM shows your customers you have progressed to a great solution.
• #19: Significant areas of change in the standard
• #20: Ask your Certification Body. Soon. They would ideally provide a document that explains how they will treat some of the issues mentioned earlier – how will they look at “less or no” documentation, what about verbal evidence? What will/wont they accept to demonstrate “accountability”. They don’t have to do this but its not unreasonable to ask. Actually if they don’t do this they will have huge variation in how their auditors perform.
• #21: A list of action items. Talk to the CB soon Don’t leave the transition project too late.
• #22: Contact us at www.cavendishscott.com