ISO 9001:2008 Certification Process

Certification process
Step	Topic
	What is ISO 9001? ·    Buy a Copy of the Standard ·    Free ISO 9000 Tutorial ·    What is a Process Approach?
	Gap Analysis ·    Schedule the Gap Analysis ·    Conducting an ISO 9001 Gap Analysis ·    Gap Analysis Report
	Prepare a Project Plan ·    The Team Approach ·    Steering Team ·    Task Teams
	Train Employees on ISO 9001 ·    Management Overview ·    Employee Awareness ·    Keeping them informed
	Document Your System ·    How Much Documentation Do You Need? ·    Importance of Document Control
	Implement the QMS in Your Organization ·    Training on New Procedures ·    Training of Internal Auditors
	Audit Your QMS ·    Train Internal Auditors ·    Conduct Internal Audits
	ISO 9001:2008 Registration Audit ·    Selecting a Registrar ·    Then what?

Summary of the ISO 9001:2008 Standard

Section 1: Scope

Talks about the standard and how it applies to organizations

Section 2: Normative Reference

References another document that should be used along with the standard, ISO 9000:2005, Quality Management Systems-Fundamentals and Vocabulary

Section 3: Terms and Definitions

Gives definitions used in the standard

Section 4: General Requirements

Gives requirements for the overall Quality Management System

Section 5: Management Responsibility

Gives requirements for Management and their role in the Quality Management System

Section 6: Resource Management

Gives requirements for resources including personnel, training, the facility and work environment

Section 7: Product Realization

Gives requirements for the production of the product or service, including things like planning, customer related processes, design, purchasing and process control

Section 8: Measurement, Analysis and Improvement

Gives requirements on monitoring processes and improving those processes

What is a Quality Management System?

A quality management system (QMS) is a set of policies, processes and procedures required for planning and execution (production / development / service) in the core business area of an organization. (i.e. areas that can impact the organization's ability to meet customer requirements.) Some people generically refer to the group of documents as a QMS, but specifically it refers to the entire system - the documents just describe it.

A QMS integrates the various internal processes within the organization and intends to provide a process approach for project execution. A Process Based QMS enables the organizations to identify measure, control and improve the various core business processes that will ultimately lead to improved business performance.

What is ISO 9000 and ISO 9001?

The ISO 9000 Family is a series of documents that define requirements for the Quality Management System Standard. There are several documents in the set, and we recommend buying a copy for your facility. These links bring you to

Tech Street

where you can purchase a download or hard copy of the standard(s):

·    ISO 9000:2005 Fundamentals and Vocabulary used in the ISO 9000 Standards

·    ISO 9001:2008 contains the actual requirements an organization must comply with to become ISO 9001 Registered. People often say "ISO 9000" certified, but what they mean is they have met the requirements of the ISO 9001 standard.

List of significant changes the 2008 revision brings to ISO 9001:

Clause 0.2 (Process approach) : 

·    Text added to emphasize the importance of processes being capable of achieving desired outputs

Clause 1.1 (Scope)

·    Clarification that product also includes intermediate product

·    Explanation regarding statutory, regulatory and legal requirements

Clause 4.1 (General requirements)

·    Notes added to explain more about outsourcing

·    Types of control that may be applied to outsourced processes

·    Relationship to clause 7.4 (Purchasing)

·    Clarification that outsourced processes are still responsibility of the organization and must be included in the quality management system

Clause 4.2.1 (Documentation)

·    Clarification that QMS documentation also includes records

·    Documents required by the standard may be combined

·    ISO 9001 requirements may be covered by more than one documented procedure

Clause 4.2.3 (Document control)

·    Clarification that only external documents relevant to the QMS need to be controlled

Clause 4.2.4 (Records control):

·    Editorial changes only (better alignment with ISO 14001)

Clause 5.5.2 (Management rep)

·    Clarifies that this must be a member of the organization own management

Clause 6.2.1 (Human resources)

·    Clarification that competence requirements are relevant for any personnel who are involved in the operation of the quality management system

Clause 6.3 (Infrastructure): 

·    Includes information systems as example

Clause 6.4 (Work environment)

·    Clarifies that this includes conditions under which work is performed and includes, for example physical, environmental and other factors such as noise, temperature, humidity, lighting, or weather

Clause 7.2.1 (Customer related processes)

·    Clarifies that post-delivery activities may include:

·    Actions under warranty provisions

·    Contractual obligations such as maintenance services

·    Supplementary services such as recycling or final disposal

Clause 7.3.1 (Design & development planning)

·    Clarifies that design and development review, verification and validation have distinct purposes

·    These may be conducted and recorded separately or in any combination as suitable for the product and the organization

Clause 7.3.3(Design & development outputs):

·    Clarifies that information needed for production and service provision includes preservation of the product

Clause 7.5.4 (Customer property): 

·    Explains that both intellectual property and personal data should be considered as customer property

Clause 7.6 (Now re-titled Control of Monitoring and measuring equipment)

·    Explanatory notes added regarding the use of computer software:  Confirmation of the ability of computer software to satisfy the intended application would typically include its verification and configuration management to maintain its suitability for use.

Clause 8.2.1 (Customer satisfaction)

·    Note added to explain that monitoring of customer perception may include input from sources such as customer satisfaction surveys, customer data on delivered product quality, user opinion surveys, lost business analysis, compliments, and dealer reports

Clause 8.2.3 (Monitoring / Measurement of process)

·    Note added to clarify that when deciding on appropriate methods, the organization should consider impact on the conformity to product requirements and on the effectiveness of the quality management system.

Step 2a: Scheduling the ISO 9001 Gap Analysis

Review the project plan

§  Schedule the Gap Analysis, and communicate to all employees what is being done, and why.

§  You will want to be able to make the employees comfortable with answering your auditor's questions .You may want to consider sending out a newsletter to inform employees that the Gap Analysis will be performed, by whom, when and why the Gap Analysis is being performed. Use the Employee Newsletter which is included in the Gap Analysis Checklist Toolkit.

§  Determine whether you will audit by process/procedure or by area of the facility. Our approach is usually to audit by area of the facility.

§  Divide the facility into manageable areas.

§  Schedule time to audit each section of the standard that applies to the area.

§  If you are using an audit team, assign the team to cover the various areas of the facility.

§  Arrange your Gap Analysis checklists so each auditor will have the sections of the standard that are applicable in the areas they will cover.

Conducting a Gap Analysis

§  Follow the schedule that you have prepared. Go into each area of the facility to evaluate the current quality system.

§  Focus on what is in place, and what is not in place. Remind auditors that you are not focusing on compliance or non compliance to the current system, but on the design of the current system, and how it matches the ISO 9001 requirements.

§  Take notes on what is in place, and what will need to be developed and changed. Take complete notes, reference documents and examples.

§  Notice where all the processes link to other processes in the organization

ISO 9001 Gap Analysis Report

Summarize the audit findings in the form of a task list.

You will usually identify several categories of tasks.

§  Processes that comply with the standard and are documented.

§  Processes that comply with the standard and must be documented.

§  Processes that do not comply with the standard and must be redesigned.

§  Processes required by the standard that are not currently in place.

For each requirement (or set of requirements) of the standard you will want to identify the status of the current system. The ISO 9001 Steering Team will use this information as they assign responsibility and timelines to Teams. Task Teams will be assigned responsibility for development of a procedure.

Determine the project goals

In order to start planning, you will need to determine what your goals are for the project. Answer these questions:

§  When will you start your project?

§  Consider the Gap Analysis as the start of your project

§  When do you want to complete it?

§  Schedule the Gap Analysis, and communicate to all employees what is being done, and why. You will want to be able to make the employees comfortable with answering your auditors questions.

The auditor is the person conducting the gap analysis. It may be an audit team or one individual.

Using Teams to Design and Document your ISO 9001 QMS

Our years of experience assisting companies with ISO 9001 Implementation has resulted in a very effective method of implementation using a Team Approach. As we discuss this method, think about how big your organization is; for smaller organizations we have used "teams" as small as one or two people. For larger organizations, teams are typically 5 to 7 people.

ISO Steering Team

§  We use one Team to lead the project, and call this the ISO Steering Team. The name is not important, name yours to suit your company. The function of the team is very important. This team will meet on a regular basis during the project to monitor progress, resolve questions, allocate resources and coordinate the design of the new QMS

§  The ISO Steering Team should be made up of Management representing the areas of your company. For example, a manufacturing manager, a quality manager, an administrative manager, an engineering manager and an executive manager. This will give the team the knowledge and authority it needs to make decisions and devote resources to the project.

§  The management representative and/or project manager for the implementation project should be the team leader. The team leader will schedule meetings, prepare agendas, and collect information to bring to the meetings.

§  While the ISO Steering Team leads the project, "Task Teams" will develop processes and document procedures to address requirements of the standard. The ISO Steering team will review the processes and procedures, and monitor the progress of the Task Teams. Our approach is to set up a Task Team for each Quality System Procedure that needs to be developed and documented.

ISO Task Teams

§  The Task Teams that are set up will each look at the requirements for their process and procedure. They will be responsible for comparing the requirements of the standard to the current process used at your company.

They will design a new process, or modify the current process so the company will be meeting ISO 9001 requirements. They will write a procedure for the new process, and give it to the ISO Steering Team to review. Once the procedure is approved, they will introduce it to employees, training as needed. The company will then start using the new process/procedure.

§  It is important to remember that not all of the Task Teams need to start working at the same time. The ISO Steering Team will want to prepare a timeline and assign start and end dates for the Task Teams. Visit the ISO Steering Team Page for downloads of the Task Team assignments and a Gantt chart for the project.

How to meet the ISO 9001 Requirements

As with many parts of the ISO9001 quality standard, the training requirements were designed to help improve the organization’s quality. The standard required employees to be trained with the knowledge and skill necessary to do their jobs with quality. But the added requirement is to verify that the training provided was effective (see #3 below).

Here is a summary of the training requirements from section 6.2.2 Competence, awareness and training.

1.  Define the knowledge and skill needed for each employee to conduct their job.

2.  Deliver training or other learning activities to develop the required knowledge and skill.

3.  Provide a way to prove whether the training was effective (test for understanding)

4.  Ensure employee awareness of how their activities contribute to the quality objectives. They should understand the relevance and importance of their role.

5.  Keep training records and records of employee education, skills and experience.

Once an organization determines how to organize a training program to meet these requirements, they must find a way to keep track of the training schedules, evaluation activities and training records for every employee. Regardless of the size of the organization, most find these administrative demands very time consuming and difficult to maintain so the information is easily available during audits.

ISO 9001 Project Implementation Training

Use this training to educate those who will be leading your ISO 9001 implementation project.

This computer training, available by download, CD Rom, or html runs 2-3 hours long and includes audio, quizzes and allows the student to receive a certificate upon completion.

You will learn how to implement ISO 9001 in your organization by learning about ISO 9001: what it is, what it requires and the steps to implementation.

There are 6 sections covering various aspects of ISO 9001:

1.  Introduction

QMS Basics
What is ISO 9001?
Why is it important?
ISO 9001 Requirements
Quiz 1

2.  Section 4 of the Standard - Requirements

General Requirements
Documentation Requirements
Quiz 2

3.  Section 5 of the Standard - Management

Management Responsibility
Responsibility, Authority & Communication
Planning
Management Review
Quiz 3

4.  Section 6 of the Standard - Resource Management

Human Resources
Infrastructure
Work Environment
Quiz 4

5.  Section 7 of the Standard - Product Realization

Process Planning
Design of Product/Service (Choice determines path of course)
Design & Development
Permissible Exclusions
Purchasing
Production & Service Provision
Quiz 5

6.  Section 8 of the Standard - Measurement and Analysis

Measurement, Analysis and Improvement
Customer Satisfaction
Internal Audits
Non-conforming Product
Analysis of Data
Improvement
Corrective/Preventive Action
Quiz 6

ISO 9001 Employee Training

1.  What is ISO?

Introduction to ISO 9001
Why is it important
ISO 9001 Requirements
Quiz

2.  Resource Management

Section 4 - General Requirements
Section 5 - Management Responsibility
Section 6 - Resource Management
Quiz

3.  Product Realization

Section 7 - Product Realization
Quiz

4.  Measurement and Analysis

Section 8 - Measurement, Analysis and Improvement

A.    General Requirements

Have the team review the requirements in section 4.1, notice that many are very general and will be a natural outcome of building your Quality Management System (QMS). However, this team must identify the processes that will make up the QMS and outline these processes to show how they interrelate

What does it mean to design and document your system?

When we talk about designing and documenting the system, we are talking about establishing the processes that will become the backbone of the Quality System, the processes that will fulfill the requirements of the standard. I suggest establishing teams for each section of the standard. These teams are made up of employees and managers that will be responsible for a particular process.

For example, purchasing staff would make up a team that will establish the process for meeting the purchasing requirements of the standard. Groups of 3 to 7 people work well for a team; the team size should be kept to a minimum but be appropriate for the size and complexity of the department. The approach this team will take is to evaluate the current process against the requirements of the standard. If you have performed a Gap Analysis, that information would be used for this step.

Once the team identifies what ISO 9001 requirements are not being met by the current process, they will identify how the process will be changed to address the requirements. Flow charting, interviewing employees and brainstorming ideas can all be used to come up with a new proposed process.

Another useful tool are the procedures from The 9000 Store. These procedures provide an example process and guidance for the team to use. Instead of starting from a blank slate, the team can review the procedure, compare it to the current process, modify the process to meet the standard and edit the procedure.

Once the team has a procedure prepared, they submit that to the ISO Steering team for approval. This gives the project a centralized review process so one group can see all the procedures and make sure that they will work well together.

The 9000 Store has procedures available, as well as a Quality Manual to help you get off to a great start on your ISO 9001 Quality Management System

Identifying Processes

§  Start by outlining broad categories or by listing your departments. For example:

§  Purchasing, Receiving, Production Control, Sales and Marketing, Customer Service, Production (or Service), Quality Control, Shipping,

§  You will need to show how these processes relate to each other, by use of a flow chart or diagram. A simple way of diagramming is to chart the processes. Download free trial of flow charting software

§  Once you have listed the categories or departments, have management in those departments add the detail. You will want to include all the QMS processes, and all production, service and administrative processes that affect the quality of your product or service. The chart or flow chart that you come up with should be included in your Quality Manual.

B. Documentation Requirements

§  As you review the requirements for QMS documentation, pay particular attention to the requirement for your organization to identify documents that are needed for your quality system and production or service processes. You will need to have a method to identify what processes must be documented. Remember that as you add new processes, products or services to your organization in the future you will need a method of identifying when documentation is required.

§  During implementation, set guidelines for identifying processes that need documentation as part of their control. Have management identify the processes that need documentation as they identify the processes to be included in the QMS.

§  After implementation, include the identification of documentation requirements as part of your quality planning for new processes and changes. The "Planning of Product Realization Procedure" from the  9000 Store covers this step for you.

§  What are the ISO 9001 Documentation requirements?

ISO 9001:2008 Documentation Requirements

There are 2 types of requirements for procedures and work instructions.

I. Specific procedures required by the standard.

The Standard only "requires" the following:

1.     Quality Manual

2.     Quality Policy

3.     Quality Objectives

4.     Quality Records

5.     Six Procedures

The standard says you must have these six procedures documented:

1.     Control of Documents (4.2.3)

2.     Control of Records (4.2.4)

3.     Internal Audit (8.2.2)

4.     Control of Nonconforming Product (8.3)

5.     Corrective Action (8.5.2)

6.     Preventive Action (8.5.3)

II. Procedures, work instructions, quality plans and related documentation required to ensure control of your processes.

Much depends on the size and complexity of your organization. You should have enough procedures to cover each section of the standard that applies to your business. Do you purchase anything that could have an impact on meeting the customers' requirements? Then you'll need a Purchasing Procedure to describe section 7.4 - yet that isn't "required".

The 9000 Store has designed clearly written procedures to describe each section of the standard. That is why our QMS is better than the rest - we cover the entire standard. Don't be fooled by others who only provide a few procedures and call it a QMS, leaving you to create many of them on your own. Is it worth the savings?

C. Quality Manual & Procedures

§  A complete quality manual and procedures package, with text to help you customize the manual for your organization, is available at The 9000 Store. It will definitely save you money over the hours you would spend developing one from scratch. It is designed with the same approach to the QMS as we follow in these sessions, so you will find it very compatible with this approach.

D. Document and Records Control

§  You must have a procedure for control of documents and control of quality records. This task should be on your task list and assigned to a team or individual for completion.

Implement Your ISO 9001 QMS

We finished our documentation, now what?

Congratulations on completing your QMS design and documentation! This is a good time to celebrate, and to communicate appreciation and kudos to everyone involved!

The next step in your project is to use and improve your QMS:

Follow documented procedures and work instructions

Everyone in your organization should be performing processes following your documented procedures and work instructions, complying with the QMS requirements.

Make improvements to the processes

Many of these procedures may be new to your organization, or have changed significantly during your ISO 9001 project. Now that they are actually in use, you will most likely find areas that can be improved. Make improvements using the Corrective and Preventive Action process and the document revision process.

Conduct Internal Audits

Schedule internal audits to cover all areas of the organization before your Registration Audit. Allow time to take corrective action on any findings. A robust and effective internal audit program is one of the best tools to finding and correcting shortcomings in the QMS before your Registration Audit. You willll need to train a team of internal auditors. Internal Auditor Training Materials Package allows you to do that yourself, in-house.

Hold frequent Management Review meetings

Management Review is another key factor in getting the new QMS ready for a Registration Audit. Review information from Internal Audits, Corrective and Preventive Action and results of measuring and monitoring of the QMS. Initiate corrective actions and preventive actions to fix problems and make improvements to the QMS.

Keep records

During the Registration Audit, the auditor will be looking for evidence that you are complying with the requirements of ISO 9001 and of your QMS. This evidence is in the form of records that you generate as you run your QMS. Be sure that you are following all of the records requirements that you set up in the QMS. Run your system for several months before your Registration Audit so there are sufficient records for the auditor to evaluate.

Step 7 Internal Audits

It is necessary to demonstrate that your ISO 9001 Quality System is effective. During an internal audit you will compare your quality system against the requirements of the standard. You will select a group of internal auditors from within your company to perform the audits.

You will begin once your system has been implemented and will need to perform internal audits before your Registration Audit. The Registration Audit is the audit which is performed by the Registrar who will issue your ISO 9001 Certificate upon successful completion of that audit.

Before your Registration Audit you will need to use and improve your system for 2-3 months.

Choose your audit team

You will want to have a number of trained internal auditors for your audit program. You will be auditing each area of your facility once or twice a year, with an audit team of 1 to 4 auditors depending on the size of the area. You will want to have enough auditors trained so that the auditors will not audit their own area, and so that you are not pulling one person away from their work too often. A general guidance number is 10% of the total number of employees; a company with 50 employees would train 5 auditors, and company of 100 would train 10. As the number of employees goes up, the percentage would go down.

Look for employees that have a strength in investigating issues and that are good communicators. The better people skills the auditors have, the smoother your audits will be performed.

If you haven't already, you will need to select a Registrar. When you choose a Registrar you are starting a relationship that will last at least 3 years, most likely longer. You will want to make a careful decision to lay the groundwork for a smooth and lasting relationship

When the day of your Registration Audit has arrived, it is time to showcase your Quality Management System. The Auditor or Auditors are coming in to see how you have addressed the requirements of ISO 9001, and how you have designed your QMS.

Preparing for the Audit

Prepare the employees

§  Before the Audit you will want to make sure that all employees know that the audit will be taking place, and the purpose of the audit. This will help them understand how to respond to the auditors' questions. You want employees to respond openly and honestly to the auditor. The auditor is looking for evidence that you are complying with the requirements of ISO 9001, your employees are the ones that will be providing that evidence. Preparing them to answer the auditors questions will make the audit go more smoothly.

§  This is not a test. If the auditor asks a question, they are looking for information on how something works, not if the employee has all the answers but how the employee goes about finding answers and information. Do procedures provide information? If the information is not in a procedure, where does the employee go next, do they ask a supervisor? Use our Employee Flyers to update employees on this issue and other implementation steps throughout your project.

Prepare the facility

§  Make sure all areas of the facility are clean and neat; there are potential nonconformance’s hiding in any given mess.

§  Make sure documents are available where every they need to be used.

§  Check bulletin boards, counters, cupboards, drawers for uncontrolled documents, un calibrated measuring and monitoring instruments and unidentified parts or supplies.

Prepare for the Auditor

§  Have a copy of the Quality Manual and Quality System Procedures available for the auditor.

§  Designate a place for them to work when they are not out in the facility. They will need to work on their documentation and reporting.

§  Assign someone to go with the Auditor to show them where different areas and departments are. Coach this person to let employees answer the auditors questions, not answer the questions themselves unless the question was directed