Upgrade iso 9001 2000 to 2008 version

Editor's Notes

• #3: About IAF 1. What is the IAF?  The International Accreditation Forum, Inc. (IAF) is the world association of Conformity Assessment Accreditation Bodies and other bodies interested in conformity assessment in the fields of management systems, products, services, personnel and other similar programmes of conformity assessment. Its primary function is to develop a single worldwide program of conformity assessment which reduces risk for business and its customers by assuring them that accredited certificates may be relied upon. Accreditation assures users of the competence and impartiality of the body accredited. IAF members accredit certification or registration bodies that issue certificates attesting that an organization's management, products or personnel comply with a specified standard (called conformity assessment). IAF has prepared an informative brochure which provides general information about IAF, its activities, membership and programs.  To access the  Brochure please click on the following link:  IAF Brochure 2. Role of IAF  The primary purpose of IAF is two-fold. Firstly, to ensure that its accreditation body members only accredit bodies that are competent to do the work they undertake and are not subject to conflicts of interest. The second purpose of the IAF is to establish mutual recognition arrangements, known as Multilateral Recognition Arrangements (MLA), between its accreditation body members which reduces risk to business and its customers by ensuring that an accredited certificate may be relied upon anywhere in the world. The MLA contributes to the freedom of world trade by eliminating technical barriers to trade. IAF works to find the most effective way of achieving a single system that will allow companies with an accredited conformity assessment certificate in one part of the world, to have that certificate recognized else where in the world. The objective of the MLA is that it will cover all accreditation bodies in all countries in the world, thus eliminating the need for suppliers of products or services to be certified in each country where they sell their products or services. Certified once - accepted everywhere.
• #7: The presentation is organized in such a way that we can move from one part (module) of the presentation to another. Also included are two ice breakers during or after the scheduled coffee break. Application form each module is also included although in such a way that it can be part of each or both module, although the advance application will require module 2 to better understand its application.
• #11: The change in 6.2.1 from “product quality” to “productrequirements” has been made to this sub-clause: a) determine the necessary competence for personnel performing work affecting conformity to product quality requirements, Use below of the phrase "where applicable" recognizes thattraining or other actions may not be necessary, since individuals may already have the necessary competence. And,since "these needs" could be taken out of context, the requirement has been revised to specifically mentioncompetence. b) where applicable, provide training or take other actions to satisfy these needs achieve the necessarycompetence,
• #12: NOTE The term "work environment" relates to those conditions under which work is performed including physical, environmental and other factors (such as noise, temperature, humidity, lighting or weather).
• #26: Although similar, identify and determine have slightly different meaning. To identify is to recognize or establish something as being a particular thing.To determine is to apply reason and reach a decision.To determine the process implies more analysis and judgment than merely listing them.4.1 General RequirementsSub-clause (a), the word "Identify" has been replaced with "Determine".a) IdentifyDetermine the processes needed for the quality management system and their application throughout the organization (see 1.2),Although similar, the words "Identify" and "Determine" used above have slightly different meanings. We recognize or establish something as being a particular thing when we identify but we apply reason and reach a decision when we determine - to determine the process implies more analysis and judgment.e) monitor, measure (where applicable), and analyze these processes, and ...Processes are monitored but may not need to be measured; therefore, the requirement change above indicates processes are only measured where applicable.Regarding outsourcing:Where an organization chooses to outsource any process that affects product conformity withto requirements, the organization shall ensure control over such processes. Control of suchThe type and extent of control to be applied to these outsourced processes shall be identifieddefined within the quality management system.This addition clarifies that specific controls are to be defined and applied, not just identified.The current Note under clause 4.1 has been expanded and two new Notes have been added:NOTE 1: Processes needed for the quality management system referred to above should include processes for management activities, provision of resources, product realization, and measurement, analysis, and improvement.The text above expands from "measurement" to "measurement, analysis, and improvement" to match the title for clause 8 to clearly state that these processes are included rather than should be included.The new Note below provides an explanation of what is considered an outsourced process.NOTE 2: An outsourced process is identified as one being needed for the organization's quality management system, but chosen to be performed by a party external to the organization.The new Note below identifies the factors influencing the control of an outsourced process.NOTE 3: Ensuring control over outsourced processes does not absolve the organization of the responsibility of conformity to all Customer, statutory, and regulatory requirements. The type and extent of control to be applied to the outsourced process can be influenced by factors such asa) the potential impact of the outsourced process on the organization's capability to provide product that conforms to requirements,b) the degree to which the control for the process is shared;c) the capability of achieving the necessary control through the application of clause 7.4.Outsourcing a process to another organization typically involves the purchase of those services; as a result, the requirements of clause 7.4, including the controls mentioned in 7.4.1, apply equally to the supplier selected to perform the outsourced process.
• #27: 2.2    Intent of Clause 4.1 The intent of Clause 4.1 of ISO 9001:2008 is to emphasize that when an organization chooses to outsource (either permanently or temporarily) a process that affects product conformity with requirements (see ISO 9001:2008 clause 7.2.1), it can not simply ignore this process, nor exclude it from the quality management system.The organization has to demonstrate that it exercises sufficient control to ensure that this process is performed according to the relevant requirements of ISO 9001:2008, and any other requirements of the organization’s quality management system. The nature of this control will depend on the importance of the outsourced process, the risk involved, and the competence of the supplier to meet the process requirements. Based on the nature of the control, it should consider the processes referred to quality management system for management activities, provision of resources, product realization and measurement, analysis and improvement. The outsourced organization does not necessarily have to have a certified Quality Management System, but it has to demonstrate the capability of the previously mentioned processes.Outsourced processes will interact with other processes from the organization's quality management system (these other processes may be carried out by the organization itself, or may themselves be outsourced processes). These interactions also need to be managed (see ISO 9001:2008 clause 4.1 (a) and (b)). 2.3    Control of outsourced processes 2.3.1    The acquisition of outsourced processes will normally be subject to the capability of achieving the necessary control through the application of requirements of both ISO 9001:2008 clause 7.4 (Purchasing) and clause 4.1 (General Requirements) As mentioned in the Note, in some situations, the organization might not “purchase” the outsourced process in the traditional sense; it might, for example, receive the service from a corporate head office or from another division within a group of organizations, without any monetary transaction taking place (see 2.1 above). Under these circumstances, however, ISO 9001:2008 Clauses 7.4 and 4.1 are still applicable.2.3.2    There are two situations that frequently need to be considered when deciding the appropriate level of control of an outsourced process:When an organization has the competence and ability to carry out a process, but chooses to outsource that process (for commercial or other reasons).In this situation the process control criteria should already have been defined, and can be transposed into requirements for the supplier of the outsourced process, if necessary. When the organization does not have the competence to carry out the process itself, and chooses to outsource it.In this situation the organization has to ensure that the controls proposed by the supplier of the outsourced process are adequate. In some cases it may be necessary to involve external specialists in making this evaluation.2.3.3    It may be convenient, or even necessary, to define some or all of the methods to be used for control of the outsourced processes in a contract between the organization and the supplier. The potential impact of the outsourced process is based on the outsourcing’s capability to provide product that conforms to requirements. Care should be taken, however, not to inhibit the supplier from proposing innovations to the outsourced process. The organization’s control of the outsourced process has to be based on the need for product conformity to requirements. Ensuring control over outsourced processes does not absolve the organization of the responsibility of conformity to all customer, statutory and regulatory requirements. 2.3.4    In some situations it might not be possible to verify the output from the outsourced process by subsequent monitoring or measurement. In these cases, the organization needs to ensure that the control over the outsourced process includes process validation in accordance with ISO 9001:2008 clause 7.5.2.
• #30: 4.1 General RequirementsIn 4.1, General Requirements, sub-clause (a), the word "Identify" has been replaced with "Determine". a) Identify Determine the processes needed for the quality management system and their application throughout the organization (see 1.2), Although similar, the words "Identify" and "Determine" have slightly different meanings. To identify is to recognize or establish something as being a particular thing. To determine is to apply reason and reach a decision. To determine the processes implies more analysis and judgment than merely identifying them. e) monitor, measure (where applicable), and analyze these processes, and ... Processes are monitored, but may not need to be measured. Therefore, the requirement change above indicates processes are only measured where applicable. Later in clause 4.1, regarding outsourcing: Where an organization chooses to outsource any process that affects product conformity with to requirements, the organization shall ensure control over such processes. Control of such The type and extent of control to be applied to these outsourced processes shall be identified defined within the quality management system. This addition clarifies that specific controls are to be defined and applied, not just identified. See the new Note 3 below for an explanation of the type and extent of controls for an outsourced process. The current Note under clause 4.1 has been expanded and two new Notes have been added: NOTE 1: Processes needed for the quality management system referred to above should include processes for management activities, provision of resources, product realization, and measurement, analysis, and improvement. The text above expands from "measurement" to "measurement, analysis, and improvement" to match the title for clause 8. And, by deleting "should", it clearly states that these processes are included. The new Note below provides an explanation of what is considered an outsourced process. NOTE 2: An outsourced process is identified as one being needed for the organization's quality management system, but chosen to be performed by a party external to the organization. The new Note below identifies the factors influencing the control of an outsourced process. NOTE 3: Ensuring control over outsourced processes does not absolve the organization of the responsibility of conformity to all customer, statutory, and regulatory requirements. The type and extent of control to be applied to the outsourced process can be influenced by factors such as a) the potential impact of the outsourced process on the organization's capability to provide product that conforms to requirements, b) the degree to which the control for the process is shared; c) the capability of achieving the necessary control through the application of clause 7.4. Outsourcing a process to another organization typically involves the purchase of those services. As a result, the requirements of clause 7.4, including the controls mentioned in 7.4.1, apply equally to the supplier selected to perform the outsourced process.
• #33: 4.2 Documentation Requirements 4.2.1 GeneralThe changes in this section are basically just a restructuring of the sub-clauses c), d), and e). c) documentedprocedures and records required by this International Standard, and d) documents, including records, needed determined by the organization to be necessary to ensure the effective planning, operation and control of its processes,and e) records required by this International Standard (see 4.2.4). You can see that adding "records" to sub-clause (c)allowed sub-clause (e) to be dropped. Sub-clause (d) has been expanded to include the necessary records. The firstNote for clause 4.2.1 has added two more sentences: A single document may include the requirements for one or more procedures. A requirement for a documented procedure may be covered by more than one document. Anexample for the first sentence would be satisfying the requirements for documented procedures in 8.5.2, CorrectiveAction, and 8.5.3, Preventive Action, through one combined Corrective and Preventive Action procedure. An examplefor the second sentence would be splitting the required procedure for the Control of Documents into two separatedocumented procedures.
• #38: 4.2.4 Control of RecordsThe opening sentence for clause 4.2.4 has expanded from records being "maintained" to having them "controlled". Maintaining records would simply keep them in good condition. Controlling the records means to regulate their use. Records shall be established and maintained to provide evidence of conformity to requirements and of the effective operation of the quality management system shall be controlled. Records shall remain legible, readily identifiable andretrievable. The organization shall establish a documented procedure shall be established to define the controls needed for the identification, storage, protection, retrieval, retention time, and disposition of records. Records shallremain legible, readily identifiable, and retrievable. The requirement for a documented Record Control procedure hasbeen rewritten, but the content is basically the same. It is now a separate paragraph for emphasis and moved up in thesection. Note that "retention time" has been reduced to "retention". And, you can see that records must still remain legible, readily identifiable, and retrievable. This requirement is now a separate paragraph and moved to the end ofclause 4.2.4.
• #75: One example may be outsourcing where it is now concluded that it cannot be part of any exclusion to the requirement.