Vermont Section 0112

Welcome to:

Review of the Key Changes in ISO 9001:2008

The presentation will start soon...

1

Please Join Conference Call:

Toll free number: 1-866-613-5223

Participant code: 5154309

If you are having problems, contact:Tim King; Section Education Chair

Cell: 802-598-7333

E-mail: timking@tupelogroup.com

Vermont Section 0112

About the Presenters:

Larry Parah LSSMBB

VTASQ Vice Chair

BlueSkye Track, Inc.• ISO Auditor

• LSS Master Black Belt• LSS Master Black Belt

• Sr. Consultant and trainer

• Adjunct Instructor: Dartmouth College

LSSBB program

Tim King CMQ/OE; CQA

VTASQ Education Chair

Tupelo Group, LLC• Senior Examiner: MBNQA Program

• Adjunct Instructor: ASQ- Milwaukee, WI

• 20 years Training & Consulting in Quality

& Leadership Development

Objectives of the Presentation

� Reasons for the Amendment from ISO 9001:2000 to 2008

� Scope of the Amendment

� Timetable for Making the Transition

� Review of Primary Changes (clause by clause)

3

� Review of Primary Changes (clause by clause)• Refer to ISO 9001: 2008 Annex B

� Open Forum Q & A (time permitting)

Note: - Items in this presentation in quote marks (“ ” ) are from www.ISO.org

- Underlined clause items are new; from the ANSI/ISO/ASQ Q9001-2008 standard

- Also refer to ISO 9000:2005, Quality Management Systems- Fundamentals and vocabulary

3

To purchase these standards: www.ASQ.org

www.ISO.org

Using the WebEx FeaturesInteracting with the Presenters

We encourage participation as we go... so here are some ways for you to do this:

– Raising Hand• Gets our attention

• Offer response to a question

• “I have to step away for a bit”

4

– Text Chat

– Polling Questions

• “I have to step away for a bit”

• Respond to a question

Other Tips:� Mute & unmute as needed (but do not use the HOLD feature)� Identify yourself when speaking� Avoid having too much desktop activity (bandwidth)� Participate in the dialogue: ask questions; offer ideas ☺

• “weigh-in” on a specific question Polling ?

Participant Introductions

• Name & Title

• Your responsibility for your

5

• Your responsibility for your organization’s QMS

• Current issues (challenges) you face with your organization’s QMS

ISO 9001 Quality Management System

Process Approach

6

QMS: The management system used to direct and control an organization with regard to quality (ISO 9001)

Reasons for the Amendment:(Scope)

“ISO 9001:2008 has been released in order to:

• introduce clarifications to the prior requirements of ISO 9001:2000

• to improve compatibility with ISO 14001:2004”

Annex A shows compatibility between

7

ISO 9001:2008 does not introduce additional requirements nor does it change the intent of the ISO 9001:2000 standard

• However, it does clarify previous requirements to attempt to reduce “interpretation” variation

Annex A shows compatibility between

ISO 9001 and ISO 14001

Scope: What Happens to Those Certified?

“Certification to ISO 9001:2008 is not an “upgrade”, and organizations that are certified to ISO 9001:2000 should be afforded the same status as those who have received a new certificate

8

who have received a new certificate to ISO 9001:2008.”

Scope:Are there new requirements?

“No new requirements were introduced in this edition but, in order to benefit from the clarifications of ISO 9001:2008, users of the former version will need to take into consideration whether the clarifications

9

consideration whether the clarifications introduced have an impact on their current interpretation of the ISO 9001:2000, as changes may be necessary to their QMS.”

Corrective action may be required based on prior “interpretation”

Scope of ChangeHow did they determine the scope?

Prior to the commencement of a revision (or amendment) to a management system standard, ISO/Guide 72:2001, Guidelines for the justification and development of

10

Guidelines for the justification and development of management system standards, recommends that:

• a “Justification Study” is prepared to present a case for the

proposed project (change to the standard)

• and that it outlines details of the data and inputs used to

support its arguments (rationale)

10

Poll 1

Scope:What Were the Data & Input Sources?

“In relation to the development of ISO 9001:2008, user needs were identified from the following:

• the results of a formal “Systematic Review” on ISO 9001:2000

that was performed by the members of ISO/TC 176/SC2

during 2003-2004

• feedback from the ISO/TC 176/Working Group on

11

• feedback from the ISO/TC 176/Working Group on

“Interpretations”

• the results of an extensive worldwide “User Feedback Survey

on ISO 9001 and ISO 9004” by ISO/TC 176/SC 2/WG 18 and

similar national surveys.”

“The Justification Study identified the need for an amendment, provided that the impact on users would be limited, and that changes would only be introduced when there were clear benefits to users.”

11

Scope: Principles Behind the Scope Decisions

Remember:

“The key focuses of the ISO 9001:2008 amendment were to:

– enhance the clarity of ISO 9001:2000 and

– to enhance its compatibility with ISO 14001:2004 Poll 2

12

The following decision making principles were applied: • No changes with high impact would be incorporated into the

standard;

• Changes with medium impact would only be incorporated

when they provided a correspondingly medium or high benefit

to users of the standard;

• Even where a change was low impact, it had to be justified by

the benefits it delivered to users, before being incorporated.”

12

ScopeMinimal Impact on ISO 9001:2000 Systems

“The changes incorporated in this ISO 9001:2008 edition were classified in terms of impact into the following categories:

� No changes or minimum changes on user documents,

including records

13

including records

� No changes or minimum changes to existing processes

of the organization

� No additional training required or minimal training

required

� No effects on current certifications”

13

Time TableGetting to ISO 9001:2008

“Validity of certifications to ISO 9001:2000 and ISO 9001:2008

One year after the publication of ISO 9001:2008 all accredited

certifications issued (new certifications or re-certifications) shall

be to ISO 9001:2008.

14

be to ISO 9001:2008.

Twenty four months after publication by ISO of ISO 9001:2008,

any existing certification issued to ISO 9001:2000 shall not be

valid.”

14

According to ISO it was published

on November 14, 2008

The ANSI/ISO/ASQ Q9001-2008

indicates November 15, 2008

IntegrationSector Specific QMS Schemes

“Industry Sector Schemes Users of specific sector schemes are recommended to refer to

the organization that is responsible that sector scheme’, e.g. for:

15

• ISO/TS 16949: refer to the IATF,

• TL 9000: refer to the QUEST Forum

• AS 9000 / EN 9100: refer to the IAQG”

15

FAQ’s About ISO 9001:2008

FAQ #1If we do not make any fundamental changes to our

current documentation can we expect to receive non-conformances?

16

conformances?

Not likely, although you may need to “correct” some QMS aspects

depending on how the 2000 standard was interpreted.

Also, you may need to update any reference in your documentation

from ISO 9001:2000 to ISO 9001:2008. You also must have a

copy of the new standard for reference before an audit to the

new standard.

16

FAQ’s About ISO 9001:2008

FAQ # 2Will ISO 14001, ISO 13485, and AS 9100 also be affected?

ISO 13485 will not be amended to align with the new version of ISO

17

ISO 13485 will not be amended to align with the new version of ISO

9001. However, all other documents based on ISO 9001are likely

to be amended to incorporate the 2008 version

Plus AS 9100 is going to be subject to additional amendments.

Publications dates for the new documents are still largely unknown.

17

FAQ’s About ISO 9001:2008

FAQ #3ISO 9001:2008 more closely aligns with ISO 14001 but

does not match it exactly. Is there a plan for ISO to match these documents?

18

No, there is no existing plan.

18

Now let’s look at the Primary Changes within each Clause

Any questions from you

before we proceed ?

Review of ChangesClause by Clause

Primary changes only: those deemed most important to

understand the clarification within 2008 version, and the standard’s compatibility with ISO14000

– Underlined words: additions (new text) to the clause

19

– Try to discuss what changes imply & their value/benefits

Annex B details these changes

Clause 0:1 General

• Statutory

This International Standard can be used by internal and external parties, including certification bodies, to assess the organization's ability to meet customer, statutory and regulatory requirements applicable to the product, and the organization's own requirements.

20

the organization's own requirements.

– Added to emphasize the statutory aspect; goes beyond “regulatory”

– Statutory: defined as required, permitted or enacted by a written

law passed by a body having the power to make laws.

– Statutory and regulatory are used in other clauses

20

Clause 0.2 Process Approach

• set of activities;

• to produce desired outcome

For an organization to function effectively, it has to determine and

manage numerous linked activities. An activity or set of

activities using resources, and managed in order to enable the

transformation of inputs into outputs, can be considered as a

21

transformation of inputs into outputs, can be considered as a

process.

The application of a system of processes within an organization,

together with the identification and interactions of these

processes, and their management to produce the desired

outcome, can be referred to as the “process approach”.

– Added to clarify that a process can be a set of activities and the

importance to managing them to achieve desired outputs.

21

Clause 1.1 Scope General:

• Note 1 b)

• Note 2

NOTE 1 In this International Standard, the term “product” only

applies to

a) product intended for, or required by, a customer,

b) any intended output resulting from the product realization

22

b) any intended output resulting from the product realization

processes

NOTE 2 Statutory and regulatory requirements can be

expressed as legal requirements - clarifies terminology

– To clarify that “product” includes intermediate product; not just shipped

product. “Intended output” could be: subassemblies, testing services

prior to final shipment, etc.

“Product” can also mean a “service” (Requirement 3: Terms and definitions)

22

Clause 4.1 General Requirements:

• Notes 2 & 3 (in entirety)

NOTE 2 An “outsourced process” is a process that the organization needs for its

quality management system and which the organization chooses to have

performed by an external party.

NOTE 3 Ensuring control over outsourced processes does not absolve the

organization of the responsibility of conformity to all customer, statutory and

regulatory requirements. The type and extent of control to be applied to the

23

regulatory requirements. The type and extent of control to be applied to the

outsourced process can be influenced by factors such as:

a) the potential impact of the outsourced process on the organization's

capability to provide product that conforms to requirements,

b) the degree to which the control for the process is shared,

c) the capability of achieving the necessary control through the application of

7.4.

– This language was added to clarify “up front” within Clause 4 what was meant by

an outsourced process and that the organization is responsible for outsourced

processes. Also helps with “outsourced” &. “sub-contractor” terminology

– More requirements on this are covered by Clause 7.423

Clause 4.2 Documentation Requirements4.2.1: General

• including records

• Note 1

The quality management system documentation shall include

a) … d) documents, including records, determined by the

organization to be necessary to ensure the effective planning,

operation and control of its processes.

24

NOTE 1 Where the term “documented procedure” appears within this

International Standard, this means that the procedure is established,

documented, implemented and maintained. A single document may

address the requirements for one or more procedures. A requirement

for a documented procedure may be covered by more than one

document.

– Added to clarify that records are a form of document, and what is

needed to cover the document requirements for procedures.

24

FAQ: Documentation Requirements

Can a flow chart be considered a procedure?

Yes it can; remember there are only 6 procedures that are required

under ISO 9001: 1) control of document, 2) control of records,

25

under ISO 9001: 1) control of document, 2) control of records,

3) internal auditing, 4) control of nonconforming product, 5)

corrective action and 6) preventive action.

– Other procedures may be needed, along with work

instructions, for product realization.

25

Clause 4.2 Documentation Requirements4.2.3: Control of Documents

• 4.2.3 f)

A documented procedure shall be established to define the controls needed

a) ....f) to ensure that documents of external origin determined by the organization to be necessary for the planning and operation of the quality management system are identified and

26

operation of the quality management system are identified and their distribution controlled, and

– Added to clarify the intent of controlling external documents are

those necessary to planning/operating the QMS (business activities)

– Examples might include: Supplier documents, engineering drawings,

product standards, etc.

26

Clause 4.2 Documentation Requirements4.2.4: Control of Records

• Records shall remain Iegible, readily identifiable and retrievable

Records established to provide evidence of conformity....

The organization shall establish a documented procedure to define

27

The organization shall establish a documented procedure to define

the controls needed for the identification, storage, protection,

retrieval, retention and disposition of records.

Records shall remain legible, readily identifiable and retrievable.

– Added to clarify intent of legibility and the organization’s ability to

“readily” identify and retrieve records

27

Clause 5.5 Responsibility, Authority and Communication

5.5.2 Management Representative

• Member of the organization’s management

Top management shall appoint a member of the organization's management who, irrespective of other

28

organization's management who, irrespective of other responsibilities, shall have responsibility and authority that includes

– Added to clarify that the management representative must be a

member of the company’s management; in other words this cannot

be outsourced.

28

FAQ: Management Representative

Can the management representative be a supervisor?

Can it be a consultant who’s primary role is to fill (such as in an interim period) a management position?

- No, frontline supervisors are not considered a part of

29

- No, frontline supervisors are not considered a part of

management by the ISO standards. The exception is where top

management establishes the person as a member of

management who has been given the responsibility and

authority to act (per 5.2.2).

29

6.2 Human Resources6.2.2 Competence, training and awareness

• b) where applicable... achieve the necessary competence.

The organization shall

a) ....

30

b) where applicable, provide training or take other actions toachieve the necessary competence,

– Where applicable, the organization is required to ensure

that competence has been achieved (focus is on ensuring

that competence has been achieved)

30

Poll 3

FAQ: Evidence of Competence

Would training attendance records (sign-in sheets) be evidence of competence?

Does evidence of competence always mean testing?

31

– The organization needs to decide how competence will be

verified.

– Testing may be necessary; but verifying competence could

also be accomplished through observation (on the job) or

evaluation of work performed (results).

– Record of attending training classes (butts in the seat)

would not, by itself, be good evidence of competence.

31

FAQ: Training & Competence Records

What type of records are needed?

Keep in mind that training is only one of four components of

records required. Records of training do not always address

the other three requirements in 6.6.2:

32

the other three requirements in 6.6.2:

1) formal education, 2) specific skills (competence), and 3)

experience, the other three requirements in the standard.

So you should have records of all four requirements to create

adequate records for 6.2.2. You can do this through the storage

or resumes for education and experience as long as they are

kept up to date. Skill evidence (competence) can be through

testing, observation or other means deemed effective.

32

6.6.2: The organization shall ... e) maintain appropriate records

of education, training, skills and experience (see 4.2.4).

Clause 6.4 Work Environment.

• Note (in entirety)

NOTE The term “work environment” relates to those conditions under which work is performed including

33

conditions under which work is performed including physical, environmental and other factors (such as noise, temperature, humidity, lighting or weather).

– This note was added to clarify the intent of the term “work environment”.

33

7.2 Customer Related ProcessesClause 7.2.1 Determination of requirements

related to the product

• NOTE (in entirety)

The organization shall determine

a) requirements specified by the customer, including the

requirements for delivery and post-delivery activities,

34

requirements for delivery and post-delivery activities,

b) ....

NOTE Post-delivery activities include, for example, actions

under warranty provisions, contractual obligation such as

maintenance services, and supplementary services such as

recycling or final disposal.

– This note was added to clarify the type of post-delivery

activities that could fall under customer requirements for

product realization.

34

Poll 4

Clause 7.3 Design and DevelopmentClause 7.3.1 Design and development planning

• Note (in entirety)

NOTE Design and development review, verification and validation have distinct purposes. They can be conducted and recorded separately or in any combination, as suitable for the product and the organization.

35

– This note was added to clarify that review, verification and validation are distinct in nature and can be done in combination (suitable for the product and/or organization).

– For example a product could be verified during validation.

35

Review Verify Validate RealizeDesign/Dev.

Poll 5

Clause 7.3 Design and DevelopmentClause 7.3.3 Design and development outputs

• Note (in entirety)

Design and development outputs shall

a)… b) Provide appropriate information for purchasing, production and service provision

36

NOTE Information for production and service provision can include details for the preservation of product.

– Clarifies that design and development outputs shall include

information for preservation of product.

36

Clause 7.5 Production and Service Provision

Clause 7.5.4 Customer property

• Personal data

NOTE Customer property can include intellectual property and personal data.

– Personal data has been added to the definition of customer

property that comes under the organization’s control, or is being

37

property that comes under the organization’s control, or is being

used by the organization.

– Personal data could be:

• Patient data/information (healthcare)

• Consumer personal information (acquired by the customer

via surveys)

37

Clause 7.5 Production and Service Provision

Clause 7.5.5 Preservation of product

• Maintain conformity to requirements

The organization shall preserve the product during internal processing and delivery to the intended destination in order to maintain conformity to requirements. As applicable, preservation shall

38

requirements. As applicable, preservation shall include identification, handling, packaging, storage and protection. Preservation shall also apply to the constituent parts of a product

– These words clarify that it is important to maintain product

conformance to requirements during all phases of product

realization, including delivery.

– Scenarios to consider: while in storage, in transit

38

Clause 7.6 Control of monitoring and

measuring equipment

• Equipment (replaces “devices” used in 2000 standard)

• Note (in entirety)

The organization shall determine the monitoring and measurement to be

undertaken ...

When used in the monitoring and measurement of specified requirements, the

ability of computer software to satisfy the intended application shall be

confirmed. This shall be undertaken prior to initial use and reconfirmed as

39

confirmed. This shall be undertaken prior to initial use and reconfirmed as

necessary.

NOTE Confirmation of the ability of computer software to satisfy the intended

application would typically include its verification and configuration

management to maintain its suitability for use.

– The new Note indicates that when software is used in monitoring

and measurement of specific requirements, confirming its ability to

do so involves software verification and configuration

management.

39

Clause 8.2 Monitoring and Measurement

Clause 8.2.1 Customer satisfaction

• Note (in its entirety)As one of the measurements of the performance of the quality

management system, the organization shall monitor information

relating to customer perception as to whether the organization has

met customer requirements. The methods for obtaining and using

40

met customer requirements. The methods for obtaining and using

this information shall be determined.

NOTE Monitoring customer perception can include obtaining input

from sources such as customer satisfaction surveys, customer data

on delivered product quality, user opinion surveys, lost business

analysis, compliments, warranty claims and dealer reports.

– This note was added to show there are multiple ways to

consider when determining how to get data relating to

monitoring customer perception.

40

Poll 6

Clause 8.2 Monitoring and Measurement Clause

8.2.3 Monitoring and measurement of processes

• Note (in entirety)

The organization shall apply suitable methods for monitoring and, where applicable,

measurement of the quality management system processes. These methods shall

demonstrate the ability of the processes to achieve planned results. When

planned results are not achieved, correction and corrective action shall be taken,

41

as appropriate.

NOTE When determining suitable methods, it is advisable that the organization

consider the type and extent of monitoring or measurement appropriate to each of

its processes in relation to their impact on the conformity to product requirements

and on the effectiveness of the quality management system.

– This note clarifies that when determining methods for monitoring and

measurement of processes, the organization is advised to consider how

the process impacts product conformity and/or the effectiveness of the

QMS.

41

Clause 8.2 Monitoring and Measurement

Clause 8.2.4 Monitoring and measurement of product

• for delivery to the customer

Records shall indicate the person(s) authorizing release of product for delivery

to the customer (see 4.2.4).

42

– This was added to clarify that the release of the product relates to

releasing for delivery to the customer.

42

This completes the clause by clause review of primary changes!

Open Forum Q&ATime Permitting

Some questions to get it started:

1. Where do you see you need to update your internal documentation to reflect these clarifications to ISO 9001:2008?

43

2. How might you have to adjust our internal audits?

3. What other aspects of ISO 9001 (in general) would you like to hear others (presenters/participants) perspective on?

VT-ASQ Thanks You

for Participating Today

For additional questions on, or help with, the ISO 9001:2008 transition:

44

Contact:

Larry Parah LSSMBB

VT ASQ Vice Chair

lparah@blueskyetrack.com

T: 802-876-7262

44

Please give us your feedback on the session: complete the brief survey that will appear shortly.