ISO 9001:2015 Interpretation and Implementation (10/22/16)
•Download as PPTX, PDF•
3 likes•5,796 views
How to Interpret and Implement ISO 9001:2015, presented at the 2016 St. Louis ASQ Section Conference, Nov 2, 2016
More Related Content
What's hot
What's hot (20)
Similar to ISO 9001:2015 Interpretation and Implementation (10/22/16)
Similar to ISO 9001:2015 Interpretation and Implementation (10/22/16) (20)
More from Colin Gray
More from Colin Gray (8)
Recently uploaded
Recently uploaded (17)
ISO 9001:2015 Interpretation and Implementation (10/22/16)
- 1. St Louis ASQ Quality Conference Interpretation and Implementation Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 1
- 2. Preamble • ISO 9001:2015 – Interpretation and Implementation. Addressing the key concerns and giving solutions • Its one thing to understand what the requirements mean, its another to appreciate and optimize how they are applied. The new standard gives complete freedom to the user to determine how conformance is demonstrated. This has created a dilemma for many people. How much documentation do I need? How far should I go? What level of detail do I need? Do I need any records? Gray starts by clearly answering these questions and then applies these principles to solutions and options for some of the newer and bigger requirements in the standard. This is truly the answer to the question “how to do ISO well?” Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 2
- 3. Colin Gray & Cavendish Scott • Cavendish Scott, Inc. – ISO 9001:2015 consulting packages – Training, auditing and gap analysis – 30+ Years Experience – Guaranteed Success – IRCA ISO 9001:2015 Lead Auditor Training – ISO 9001, AS, 14001, 17025, 13485 • Colin Gray - Presenter – 30 years auditing, training and consulting. – IRCA, EG, Lead Auditor – IRCA ISO 9001:2015 Lead Auditor instructor and training designer Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 3
- 4. Questions? • Interrupt, challenge • Use the cards • Catch me after (use the cards) Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 4
- 5. Agenda • Documentation (no requirement for documentation?) • Revisited: What we need to do • Project Management • Process based structure • Rewrite documentation • New Processes – Risk, etc. • Top Leadership engagement • Certification transition • System Verification • Questions Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 5
- 6. Documentation • Always for effectiveness…but also to be able to demonstrate it. (to customers to auditors and to ourselves) • Make it easy to pass versus difficult to fail • 4.4.2 To the extent necessary, the organization shall: – A) maintain documented information to support the operation of its processes; – B) retain documented information to have confidence that the processes are being carried out as planned. • 8.1 Operational planning and control – E) determining, maintaining and retaining documented information to the extent necessary: • to have confidence that the processes have been carried out as planned; • to demonstrate the conformity of products and services to their requirements. Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 6
- 7. Documentation • Definition • Communication • Training • Auditing • Improvement • Success • Procedures • Flowcharts • Alternatives • None – you better be good Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 7
- 8. Records • “Special type of document” • “shall consider” Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 8
- 9. What needs to be done? • Gap Analysis – No not really – any comparison document – How solid is your current system • Ensure a process based documentation structure • Rewrite documentation • Design and implement new processes (strategic, changes) • Ensure “engagement” of leadership – Demonstrable “leadership and commitment” • Handle the transition certification • Adapt to your new “senior” role – Assure consistency with good process control – Focus on tangible improvement Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 9
- 10. Project Management • Do NOT take responsibility for other peoples processes – It is managements responsibility to get them on track • Two goals – First and foremost, make this useful to your organization – Make it demonstrable – not just good but prove you are good. • Get a Date - Fit the plan to it. Transition information from your CB. Do not change it • You need Expertise, Resources, Time – And if your new role is “senior” and “strategic” you don’t have/need these.Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 10
- 11. Quality’s Role • QMS does have a strategic component (always did) – ISO now demands it • Leaders are experts in the strategic elements of the QMS • In-house expertise? Why? – Auditing? • Periodic ISO expertise? • ISO does not require a Management Rep – “to do ISO” • What is the purpose of Quality in the organization? Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 11
- 12. Process Based Structure • Increase awareness of process theory – Management requirement – Training/awareness on processes/systems • Restructure and rewrite some documents – (some will by nature be process based) • “There is no requirement for a procedure” • Are they currently numbered/structured around the standard! Reorganize around existing processes • Complete a document review/cross reference • Opportunity for seniority – strategic processes and integration • Multiple standards, AS9100, 13485, 14001, 45001/18001 Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 12
- 13. New Processes • Likely these exist, to some extent – Likely quality personnel wasn’t involved – Likely quality wasn’t a topic – Likely informal • How much to adopt and how much to adapt – Remember – add value, demonstrate conformance • Integration into “business processes” • Context • Interested parties • Risk (and opportunity) • Communication • Knowledge • Change Management • Changes to existing processes – Corrective action and NC Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 13
- 14. Strategic • Always a process. Always a procedure • Strategic. – SWOT/PESTLE – Ensure quality content – Ensure integration – Brainstorming and Ranking – Plans and actions • Ensure “maintenance” – Periodic – With change Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 14
- 15. 5.1 Leadership & Commitment • 5.1.1 General • Top management shall demonstrate leadership and commitment with respect to the quality management system by: • a) taking accountability for the effectiveness of the quality management system; • b)ensuring that the quality policy and quality objectives are established for the quality management system and are compatible with the context and strategic direction of the organization; • c) ensuring the integration of the quality management system requirements into the organization’s business processes; • d) promoting the use of the process approach and risk-based thinking; • e) ensuring that the resources needed for the quality management system are available; • f) communicating the importance of effective quality management and of conforming to the quality management system requirements; • g) ensuring that the quality management system achieves its intended results; • h) engaging, directing and supporting persons to contribute to the effectiveness of the quality management system; • i) promoting improvement; • j) supporting other relevant management roles to demonstrate their leadership as it applies to their areas of responsibility. Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 15
- 16. Engage Leadership • Leadership needs to be educated. – Are they going to participate in these new processes? – If not then who and how does top management “engage” – What degree of education/training will be appropriate – Necessary in order to get their commitment • On a Peer to Peer basis – You must engage them on their level – QA on the Board? – Who is going to interface with leadership and design/define processes • Direct responsibilities to demonstrate (leadership and commitment) – Tangible activities that create evidence (presentations, publications, lead projects, meetings, mentoring) – Management will be audited Copyright © 2015 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 16
- 17. Rewrite Documentation • Again – ISO doesn’t require any procedures…. • Who? • How long to allow? • How to test it? – Independent verification • Top Management level activities? – Are you comfortable/capable to challenge management on their strategic processes • Change terminology? Quality Manual? Copyright © 2015 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 17
- 18. Changes • Objectives – Meaningful that drive success – Process • Change Management – process • Communication – plan Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 18
- 19. Certification Transition • Get in touch with your CB ….now – Their process and costs – Likely timing issues – Get their documented interpretations • They had to train their auditors….. • It’s a new standard – many additional requirements – losing 3 very minor requirements – Its going to take more time • You have to maintain conformance to 2008 until you are 2015 certified • Best at recertification • Going forward may require more audit days (changes in MD5) • Deadlines – Sept 1 2017 No new certifications to 2008 – Sept 1 2018 standard withdrawn – certificates invalid Copyright © 2015 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 19
- 20. What to Do? • Generate a “draft” project plan • Contact your CB • Meet with management – Your involvement, strategic processes, engagement, project scope and resources • Preliminary Review – How to address “new” processes, strategic/integration – Determine process nature of system – How to address management engagement – Update the plan • Work on procedures – changes, new and structure – expect iteration – interdependency • Management Training • Verify (independently?) – Document review – Internal audit Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 20
- 21. Cavendish Scott, Inc. • Standard ISO 9001:2015 training classes – Free Webinars – Custom leadership training – Awareness presentations – ISO standard review – IRCA Transition Training – IRCA ISO 9001:2015 Lead Auditor • Standard ISO 9001:2016 transition consulting projects – Procedure development/change, leadership and management support/training, document review, auditing • Auditing, document review and gap analysis/project planning Copyright © 2016 Cavendish Scott, Inc. All Rights Reserved. www.CavendishScott.com 21
Editor's Notes
- Original premise for the presentation
- Answers are still available colin@cavendishscott.com
- These are the requirements that means you have to have documentation. Although there are no specific requirements for procedures – nowhere that the standard asks for a procedure for a process or requirements, ISO says that you have to have enough documentation to operate effectively and to provide it to auditors/customers. In practice you cannot prove a process was successful unless you have it documented. Further, common sense says that if you want to be able to be clear about a process, communicate it, train in it, audit it – make it successful. Then it has to be written down. There are places where you can do without a procedure. For instance, you don’t need a procedure for a meeting if the meeting has an agenda, charter, minutes, action items, etc. However, where the control is less easy to define you need procedures. In reality you need procedures for all processes.
- This is why we need procedures There are different ways of doing procedures. If there is no procedure you must explain the situation to the auditor. You have to justify how it is a process and not just some activities that are performed by a particular person. You have to justify how they are successful. And verbal evidence is not as reliable for auditors. You need procedures.
- Similarly you need records to prove the output of a process or activity. ISO uses the phrase “consider” which means “think about” some things but you don’t have to do anything. In order to prove that you considered things, you will have to maintain evidence of things that you are not going to use. It is important to make this a simple and not a costly process. Take a photograph of your brainstorming whiteboard with all the things you thought of but will dismiss. Easy.
- Here is a list of project tasks. If you already have ISO and it s “reliable” then your Gaps are the same as the changes in the new standard. You don’t need a gap analysis project. (unless you don’t have confidence in your current ISO system). Find a list of changes on the internet and start there. Quality is now part of business planning and strategic processes, leadership is involved and committed – the quality department is tgechnically getting access to the senior strategic processes.
- Talk to you CB soon. They will run out of resources soon. Book a date. Do not leave this until the end of the transition period.
- This is the potential new “senior” role for quality.
- This might mean a partial rewrite of an existing system – except I have yet to see a good set of documentation when they are written around the standard. They tend to reflect the standard and not the organization. If your system and documentation is not process based then you need to consider it will take a lot of re-writing. Note that this is an opportunity to “re-invent” the QMS in your organization (do this well and you are the hero, the leader). Change the look and feel of documents and sell the system positively. Definitely an opportunity to promote and train in process theory. ISO Requires No procedures: Yes but process is not about procedures. Most organizations are process orientated. They just are. But if the documentation of the QMS does not reflect that? Good luck convincing an auditor….or worse a customer. One management system. Documented once. Meets multiple standards (but importantly meets our goals for control)
- So formalize, get quality on the agenda and get quality personnel involved. Adopt what you can! Its easier and you can revisit it later when the rest of your system is stable Integrate, along with the strategic aspects of transition/implementation present many challenges. are you comfortable interviewing top management about the processes are they comfortable telling you are you experienced enough to challenge them do you command enough respect to discuss and get changes do you have the authority (to back up the responsibility for ISO) Processes – they are very inter dependent Formal, documented with controls (forms, templates, software), establish AND maintain data Context and interested parties – strong process, doesn’t matter if you miss some – DEMONSTRATE Risk – KISS Opportunity – do it deliberately – don’t bury with risk alone Communication – a Plan (maintain) – will indicate the complexity to issues, interested parties, change Knowledge – new concept KISS – possibly job descriptions (partially), perhaps an “inventory” system Change – Formal but does not need to be complex. Idenify, describe, control.
- The “right” approach is not to write a “flat” specific procedure for risk, or context or interested parties but in fact to write a procedure for business planning that addresses all of those (and more). This will be a valuable process that will benefit the organization and co-incidentally meet ISO. Ensure that it formally includes quality content.
- DEMONSTRATE – leadership and commitment (two pieces of evidence?) and don’t think it is acceptable to address all of these with verbal evidence. Verbal is less reliable than other forms of evidence. Auditors will want more. Note – a) is similar to g) (but different of course – one says that our system must be successful, the other says that we must be successful by design not by accident) Accountability is new and may be difficult to implement. Consider having top management deal with unhappy customers. c. Not a separate system – managements fault if it is. d. Must lead and commit to the process approach (no more ISO numbered procedures, focus on processes [inputs, outputs, controls, metrics, objectives, etc.] and risk (preventive thinking) g. Focus on success. Demonstrate leading and committing to the principle of improving things. j. Demonstration of support
- Probably the biggest challenge Leadership will not provide the resources or support the change if they don’t understand why or whats involved. They need education. You need to sell a vision. HOW Probably you need a promotional campaign – start to get it noticed. Probably a short presentation to management – maybe an hour? Start small and plan another (they wont show for the 4 hour session) Management are going to be audited – you need to train them on how that is going to happen. Practice. Are they going to be directly involved in the “generate” of the evidence that is required. Prepare tasks and content for management, to “ demonstrate leadership and commitment”.
- It requires you to demonstrate your system. The planning and effectiveness (plans and results). Good luck arguing verbal evidence…..its not your job – let top management do that (throw them to the wolves) Who should do the writing? Perennial question in ISO. Nobody gets “ownership” by writing a procedure. Some people really hate it. Some are just not able. None of them signed up for it when they took the job. It’s a distraction, it takes a lot of effort, are you going to let them stop their “real” job. What expertise do they have outside of their job? Do they have wide ranging experience of different functions. They are probably not process experts and probably not ISO experts (consider some serious training on these topics if you take this approach). Professionally, quickly, consistent style, appropriate level of detail and bureaucracy/control, coincidentally meets ISO. (yes if it’s the CEO…..but really) How is it to be verified. Process owners don’t know what should and shouldn’t be in procedures? Why would they. They know the process but they don’t necessarily know what should and shouldn’t. Audited? Are your auditors experts in ISO (true they may not need to be). How good are they with ISO? Document Review and Audit will confirm conformance…..only. Top Management Who is going to write procedures (or just solutions) for top management? Who in the company is qualified? Who is comfortable challenging top management on their processes. Can you avoid procedures in preference for alternatives? Who designs the evidence? New Terminology. Change it in your QM. Update procedures but there isn’t any value in changing purchasing to “externally provided products, services and etc. There are some terms that are worth adopting, tweaking. And the QM shows your customers you have progressed to a great solution.
- Significant areas of change in the standard
- Ask your Certification Body. Soon. They would ideally provide a document that explains how they will treat some of the issues mentioned earlier – how will they look at “less or no” documentation, what about verbal evidence? What will/wont they accept to demonstrate “accountability”. They don’t have to do this but its not unreasonable to ask. Actually if they don’t do this they will have huge variation in how their auditors perform.
- A list of action items. Talk to the CB soon Don’t leave the transition project too late.
- Contact us at www.cavendishscott.com