A new revision to ISO 9001, the Quality Management System (QMS) standard adopted by the vast majority of the world’s organisations, was published in September 2015. Companies already certified to the previous (2008) revision have until September 2018 to update their certification and avoid forfeiting their compliance status.
The new revision introduces substantial changes, considerably more than were produced during the 2008 revision. In fact, the technical committee responsible effectively went back to the drawing board by changing the fundamental structure of the standard, and introducing many new requirements and many terms.
New foundations
Earlier versions of ISO 9001 were quite prescriptive, with many requirements for documented procedures and records. In the 2000 and 2008 editions, more emphasis was placed on managing processes, and less on documentation. ISO 9001:2015 goes a step further by becoming even less prescriptive than its predecessor, focusing instead on performance. “We have achieved this by combining the process approach with risk-based thinking, and employing the Plan-Do-Check-Act cycle at all levels in the organisation,” explains Nigel Croft, chair of the ISO subcommittee that developed and revised the standard.
ISO’s key focuses for the 2015 revision were to enhance clarity and compatibility with other management system standards. Some of the specific benefits it implements are:
• Less prescriptive, but with greater focus on achieving conforming products and services
• More user friendly for service and knowledge-based organisations
• Greater leadership engagement
• More structured planning for setting objectives
• Management review is aligned to organisational results
• The opportunity for more flexible documented information
• Addresses organisational risks and opportunities in a structured manner
• Addresses supply chain management more effectively
• Opportunity for an integrated management system that addresses other elements such as environment, health and safety, business continuity, etc.
To this end, ISO 9001:2015 is written according to a High Level Structure (HLS); chapter and subchapter titles, as well as the order of clauses and paragraphs, were completely revised (a detailed list of these changes is provided by the correlation matrix on the pages that follow). As a consequence, the standard now positions itself as an integral part of an organisation’s efforts towards improving its overall performance, by encouraging more internal and external stakeholder focus. It is also more inclusive of service industries, adopting a vocabulary and level of abstraction that simplifies implementation in all industries, including services.
Croft goes on to say that “knowing that today’s organisations will have several management standards in place, we have designed the 2015 version to be easily integrated with other management systems. The new version also provides a solid base for sector-quality standards (automotive, aerospace, medical industries, etc.), and takes into account the needs of regulators.”
The new revision encourages greater leadership engagement, rather than simply management of the QMS, by requiring top management to demonstrate more direct involvement in the organisation’s QMS. Although the prescriptive title of a management representative has been deleted, it is up to top management to ensure that the roles and responsibilities are assigned for reporting on the performance of the QMS. Some organisations might find it convenient to maintain their current structure, with a single person carrying out this role, while others might take advantage of the additional flexibility to consider other structures.
Notable changes
Specific documented procedures are no longer mentioned in ISO 9001:2015. Rather, it is left to the organisation to maintain documented information to support the operation of its processes and to retain the documented information necessary to have confidence that the processes are being carried out as planned. The extent of the documentation that is needed will depend on the business context.
A quality manual is no longer specifically required. The new standard requires the organisation to maintain documented information necessary for the effectiveness of the QMS. There are many ways to do this and a quality manual is just one. If it is convenient and appropriate for an organisation to continue to describe its quality management system in a quality manual then that is still perfectly acceptable.
ISO 9001:2015 no longer refers to “exclusions” in relation to the applicability of its requirements to the organisation’s QMS, but instead allows an organisation to determine the applicability of requirements. All requirements in the new standard are intended to apply. The organisation can only decide that a requirement is not applicable if its decision will not affect its ability or responsibility to ensure the conformity of products and services and the enhancement of customer satisfaction.
Organisational knowledge, or knowledge specific to an organisation, is generally gained by experience, then used and shared to achieve the organisation’s objectives. Requirements regarding organisational knowledge have been introduced for the purpose of safeguarding the organisation from loss of knowledge and encouraging it to acquire new knowledge as its business context changes.
Risk-based thinking
The new revision requires the organisation to address risks and opportunities, quality objectives and planning of changes throughout. As new products, technologies, markets and business opportunities arise, it is to be expected that organisations will want to take full advantage of these opportunities. This has to be done in a controlled manner, and be balanced against the potential risks involved, which could lead to undesirable side effects.
The phrase ‘risk-based thinking’ is used to describe the way in which ISO 9001:2015 addresses the question of risk. The concept of risk has always been implicit in ISO 9001, by requiring the organisation to plan its processes and manage its business to avoid undesirable results. Organisations have typically done this by putting greater emphasis on planning and controlling processes that have the biggest impact on the quality of the products and services they provide.
The way in which organisations manage risk varies depending on their business context (e.g. the criticality of the products and services being provided, complexity of the processes, and the potential consequences of failure). Use of the phrase risk-based thinking is intended to make it clear that while an awareness of risk is important, formal risk management methodologies and risk assessment are not necessarily appropriate for all business situations and organisations.
Update your status
Companies already certified to ISO 9001:2008 will no doubt have been contacted by the certification body that issued their certificates, informing them about the need to update to the 2015 revision and the implications thereof. For those wanting to learn more, the ISO organisation has a wealth of information on its website (www.iso.org). Companies such as SGS and BSI Group, in addition to the certification services they provide, are already offering training courses for this purpose.
There are a number of ISO 9001 certification bodies offering their services in South Africa, all of which are prepared and willing to assist new and existing clients to certify themselves to ISO 9001:2015. In general, most organisations prefer to stick with what they know, and so choose to use the same body that issued their previous certification. However you go about it, be sure not to miss the September 2018 deadline as there’s much less red tape involved when updating to a new revision than when getting certified from scratch.
© Technews Publishing (Pty) Ltd | All Rights Reserved
printer friendly version