Transcript of Richard Green s CQI / IRCA Presentation ISO the story so far

Transcription

1 Transcript of Richard Green s CQI / IRCA Presentation ISO the story so far Slide 1 Hello good morning and welcome. My name is Richard Green and I am IRCA's Technical Manager. I will be your host for today s CQI/IRCA webinar which is focussed on the ISO 9001:2015 Draft International Standard or DIS for short. Slide 2 The purpose of today's webinar is two-fold. Firstly, we would like to take this opportunity to provide you with an insight into some of the more significant changes that are being proposed for the next release of Secondly, we would like to explain how you can register your comment on these changes if you believe the standard writers need to revise the draft. Slide 3 Before we take a look at the DIS itself, let's start with some key messages. ISO 9001 is the world's most adopted management system standard. According to ISO figures there were just over 1.1 million 9001 certificates held in This equates to 73% of all management system standard certificates. This does not include many other organisations who are working to the standard but who have not chosen to certificate. Accordingly, based on numbers alone, any change to ISO 9001 is going to have a major, global impact. The 9001 revision process is well underway and we are expecting the final version to be released in September That may sound like a long way off but it isn't! Although the Standard is still work in progress we already know much of what it will contain. And on that basis we are able to say that the changes proposed are significant. Whether you are a quality professional, an audit professional or a member of senior management you need to start assessing the impact of these changes now. The CQI holds Category A liaison status to ISO TC 176, the Technical Committee tasked with rewriting the standard. Category A liaison status is only conferred in those instances where the Standard writers believe an organisation has a valuable and pertinent contribution to make to a Standard s development. Holding this status enables the CQI to prepare and submit a collective response on behalf of its members in

2 respect of the contents of the draft. A little later on I will be explaining how we intend to solicit that response by means of a member survey. Finally bear in mind that ISO the environmental management system standard is due to be published at around the same time as ISO 9001:2015. If you are therefore operating both a QMS and an EMS you are likely to be very busy in the near future! Slide 4 So why is the Standard changing? Well the last significant revision to the Standard took place in 2000 and the world is a very different place now to what it was then. The business environment, for example, has changed significantly. We have seen a meteoric rise of e-business with a significant proportion of all transactions now being carried out online. Small organisations and even sole traders can now access global markets with ease and social media means there's no place to hide if you supply poor quality goods or services. The Standard needs to be revised to reflect these new ways of doing business. Over the course of the last 14 years we've also witnessed an exponential rise in the number of management system standards. Back in 2000 there were only two; 9001 and By 2010 this number had risen to 6 and by 2015 we are expect there to be 15 or 16. All of these standards require essentially similar but not the same things. The International Standards Organisation (or ISO) rightly identified that there was a need to introduce a much greater degree of standardisation into the management system standard development process, in order to ensure a much greater degree of consistency between these documents. The result was Annex SL and we will be looking at Annex SL in more detail in a few moments. In addition, we've experienced an evolution in quality. Although the 2000 standard acknowledged the existence of services (i.e. for products read product or service ) it still remained primarily focused on the former. The service sector however is a very different animal; here were not trying to produce homogenous outputs but are looking instead to tailor what we provide on an almost individual basis. The DIS for 9001:2015 is much more explicit in respect of recognising and referencing services than its predecessor. Lastly we are revisiting ISO 9001 because we have to. ISO requires all of its standards to be reviewed on a five yearly basis at which point the standard is either accepted 'as

3 is', is updated or is withdrawn. Slide 5 This is the current revision timetable. Here we are in June at the start of the DIS ballot. This marks the opening of a five-month window of opportunity to you to have your say on the contents of the DIS. Is this important? Well, yes. Based on our experience to date, the final version of the Standard is likely to remain substantively unchanged for the next 12 to 15 years. This means that if you have any significant reservations as to what is in there, now is the time to communicate these. If you are a member of CQI this can be done in one of two ways, either through participation in our forthcoming DIS survey or by submitting an individual response through the BSI draft review system. If you are a UK based member of IRCA and not the CQI then the only option open to you is to use the BSI draft review system. This is because IRCA does not share the CQI's Category A liaison status. For those watching this webinar overseas, your national equivalent of BSI will have its own arrangements in place to capture your feedback. Following the closure of the ballot in October, the standard writers will then consider the comments received and will produce a final draft international standard or FDIS. This will then go out for internal ballot in July of next year but at this time only minor editorial changes will be considered. To all intents and purposes the Standard is a done deal at this point. So, if you want to materially contribute to how the final version of ISO 9001 will look you have to act now. Slide 6 So what we know about the Standard so far? Well we know it has adopted Annex SL. We also know that there is text that has been taken across directly from ISO 9001:2008 and that it incorporates changes made at both the Committee Draft and the Draft International Standard stages. Slide 7 Annex SL has previously been described by IRCA as the most significant innovation in management system standards since the introduction of ISO 9001 itself. So why do we believe it is so important? Annex SL could rightly be described as the management system standard writer s standard. The annex itself is buried deep within ISO/IEC Directives Part 1 which sets out the rules and regulations governing the development of any ISO standard.

4 Whilst Annex SL forms a tiny part of this document, the implications of its contents for all those with a connection to the management systems world are profound. Annex SL, or to be technically correct appendix 2 of annex SL, contains three elements. What we are looking at here is the high level structure. This is the structure that all management system standards must now adopt. So, irrespective of the discipline, be this environmental management, quality management, health and safety management or food safety management; all will contain these same high level clauses, in this order with this numbering. A number of Standards have already been constructed using this framework including ISO Information Security management and ISO Asset Management. Pre dating these, ISO Business Continuity management was based on an earlier version of Annex SL, namely Guide 83. Sitting underneath these 10 principal clause headings is identical core text which again is carried across to all Standards. The final element is common terms and definitions. As the name suggests the meaning of these terms and definitions is consistent across all management system standards. Anything coming through from annex SL is fixed and as a result standard writers are not able to remove any of these clauses or change the identical core text or manipulate the common terms and definitions although they do have the ability to add additional clauses, text or definitions if they so wish. For those who are interested in learning more about Annex SL, a free guide is available for CQI and IRCA members on our website. Slide 8 Those first few slides have hopefully set the scene. What we will do now is to move into the core of the presentation itself, an examination of some of the principal differences between the existing version of the standard and the DIS. In the 50 minutes or so that we have available today we are not going to be able to cover all of the proposed changes in detail, (we have a DIS report on the way which will provide this level of analysis). For the present my focus is going to be on flagging up the key changes as well as picking out other worthy points of note. The Introduction to the DIS is well worth a look. There is a new section covering risk

5 based thinking, a concept that runs across many areas of the Draft. The section on process approach is beefed up considerably and we are reminded that the PDCA methodology should be applied at both process and system levels. Those of you who do not normally read introductions to Standards this is an instance where you may wish to make an exception. Moving on to Scope. The scope of Standard, that is its reason for existing, remains unchanged. It is still a set of requirements for organisation that need to demonstrate their ability to consistently provide product and service that meets customer and applicable statutory and regulatory requirements, and where the organisation aims to enhance customer satisfaction through the effective application of the system. The next point I d like to pick up on concerns terms and definitions. In ISO 9001:2008 under section 3 you will be redirected to ISO 9000 where the terms and definitions that apply to ISO 9001:2008 are currently located. This time around the standard writers intend to include the applicable terms and definitions within the body of 9001 itself. This has had the effect of almost doubling the size of the Standard. As ISO charge for standard on a per page basis this will have a direct impact on ISO 9001:2015 s cost. On the plus side however it does mean that the terms and definitions are immediately to hand. Okay I d now like to pick up on the first of the major changes, Section 4 Context of the organisation. Slide 9 The context of the organisation equates to the business environment the organisation is operating in. It is about the organisation understanding its place in the universe. Slide 10 So what we mean by an organisation? Well here is the annex SL definition and if you have a look at note 1 you will see that it is very wide-ranging indeed, encompassing everyone from a sole trader up to a multinational, and including profit and not-for-profit organisations, partnerships, associations, charities and institutes. Slide 11 So irrespective of the size or legal status of the organisation, all organisations must understand their business context. Let s look at 4.1 in more detail. Slide 12 Under 4.1 the organisation is required to do two things. Firstly, it needs to determine

6 those internal and external issues, relevant its purpose and its strategic direction that have the ability to impact the intended outcomes of its quality management system. Once this has been done it must then ensure that it continues to monitor and review its internal and external issues as these will change through time. Slide 13 Here s an example. The purpose of this organisation is to produce men s clothing. Here we see those internal and external issues that the organisation has determined it needs to monitor and review. Within the organisation, it needs to be mindful of the level of automation it employs, the skills and competency of its workforce, how it will maintain the secrecy of its designs and so on. All of these factors are under its direct control and all have the ability to either positively or negatively impact its ability to achieve its intended outcome i.e. the production of men clothing. But the organisation does not operate in a vacuum and there are external issues that can similarly hinder or support it in achieving its intended outcomes. These include changes in its customer base, changes in fashion, the opening up of new markets, the generosity or otherwise of customer s deadlines and the actions of its competitors. As for the internal issues, the external issues will change as time goes by so the organisation must continue to monitor and review these. During our series of UK roadshows some attendees expressed the view that it would be difficult to determine their organisation s context. In actuality, if your company is still trading today, the chances are that you already have a good understanding of your business issues. Therefore in order to comply with the requirements of the DIS you will simply need to evidence what you are already doing. To the right slide of the slide we can see a list of relevant interested parties. These are sometimes referred to as stakeholders but interested parties is the preferred term. Let s look at the annex SL definition. Slide 14 An interested party is a person or organisation that can affect, be affected by or perceive themselves to be affected by a decision or activity. That sounds as if it could include just about everybody but what we are really interest in for the purposes of the standard is something a much more specific. The DIS requires the organisation to understand the relevant need and expectations of relevant interested parties. So let s see how we arrived at this group.

7 Slide 15 This rectangle represents all parties. This includes you, me, Fred down the street, Martians and amoeba. But not all of these are interested in your quality management system. So let s exclude those that aren t. Slide 16 Those are interested in your quality management system are interested parties. But not all interested parties are relevant. Someone may have an interest in your QMS but that doesn t mean to say that their interest needs to be taken into account. The good news is it is the organisations decision as to whether the party is relevant, not the party s. Slide 17 If we exclude those whose interests are not relevant that leaves us with this group. Relevant interested parties. We re gradually getting closer to where we need to be. Whilst the party may be relevant not all of its requirements will be relevant. Consider this example. I m a member of the Automobile Association. As their customer I am one of their relevant interested parties (a stakeholder). I have a requirement to have dinner this evening. This is not relevant to their QMS. I also have a requirement if my car breaks down I would like someone to attend to it within 30 minutes. This is a relevant requirement. Slide 18 So we have finally arrived at the relevant requirements of relevant interested parties. The DIS requires organisations to initially determine the relevant requirements of relevant interested parties and to subsequently monitor and review this information. The auditor will want to see evidence that this has taken place. So what happens to this information relating to internal and external issues and the relevant requirements of relevant interested parties? The answer is that this is used as an input into clause 4.3 determine the scope of the quality management system. Slide 19 The next thing I would like to pick up on is clause 4.4. The note the addition of and its processes. Within ISO 9001:2008 the process approach was promoted. Within the DIS it is very much mandated and this is the first of many references to process that are contained within the proposed new version of the standard. Let s now take a look at another area that has sparked much debate documented

8 information. Slide 20 Here is the annex SL definition. One thing you will notice when you first look at the DIS is that the 2008 references to a quality manual, mandatory quality procedures and records have been removed. This is an attempt by the standard writers to give organisations greater freedom to determine their own documentation needs. If the organisation believes a quality manual is a valuable tool there s nothing to stop it from producing one. Similarly if the organisation wishes to publish procedures it may continue to do so however under the new standard neither a quality manual or procedures are required. This doesn t of course mean that the requirement to evidence controls has been removed. Instead throughout the DIS you will see requirements to either maintain or retain documented information. The extent and format of this documented information is a decision for the organisation itself. One of the questions that we often get asked is will I need to renumber all of my existing quality management system documentation to align it to the new numbering scheme that appears in the DIS. The answer to this is no, if you wish to do so there s nothing to stop you but this isn t something that you are required to do. The absence of familiar friends such as quality manual and written procedures may well present challenges for some auditors who will in future be confronted by different types of evidence in different formats. Navigation through an organisation s quality management system could therefore prove more difficult. From a practical perspective, if you are meeting the current documentation requirements of ISO 9001:2008 then there is little to do in order to meet the new requirements contained within the DIS. Slide 21 Let s move on. Slide 22 We are now going to explore what for me is one of the most significant changes within the draft standard, namely the switch from management commitment to leadership and commitment. Slide 23

9 Leadership is very different from Management. Leadership is about inspiring people to come with you because they choose to not because they are told to. So what are the leadership changes? Slide 24 Don t worry too much about all the text on this slide. The point to note here is that there are certain activities which top management are now required to undertake themselves which previously they may well have delegated to a third party, for example their management representative. Whilst on the subject of the management representative, this role has been deleted from the DIS. This is a conscious attempt by the standard writers to ensure that top management are directly engaged in the operation of their quality management systems and are not simply passing their quality obligations down to a third party. Slide 25 So who exactly are top management? Here is the annex SL definition. Person or group of people who directs and controls an organisation at the highest level. The last four words here are particularly significant. At the highest level. This is where the scope of your registration comes into play. If your scope of registration covers the whole organisation then by top management we are referring to the CEO and board level representatives, not the quality manager, not the management representative. If your scope of registration covers an individual factory or plant then top management are the Directors or Managers of that factory or plant. Will this change result in more quality managers being elevated to the board? Time will tell. Slide 26 So what are the implications these changes? Well, organisations internal audit programmes must in future include audits of top management. QMS implementers will need to assist top management to provide objective evidence of compliance and may be involved with changing meeting agendas and creating or updating communication channels and methods in order to allow top management to

10 carry out their new requirements. If you are a quality manager you will need to make top management aware of their new responsibilities. Perhaps you will be involved in coaching and training them. Top managers need to understand that they will be audited as a matter of routine and that there are responsibilities within their QMS that they can no longer delegate. But perhaps the biggest challenges of all will fall to auditors. Many will not be experienced in auditing the most senior company personnel and may find this prospect intimidating. Auditors will in future need to speak the language of the Boardroom in order to gain top management s respect. For those organisations where top management is already playing a significant and active role in their organisations quality management system, complying with the new requirements contained within the DIS should prove relatively straightforward. For those organisations where top management is however somewhat divorced from the quality management system, this could prove to be a difficult cultural transition. Slide 27 Let s move on again Slide 28 Clause 6 of the DIS addresses Planning (planning of the QMS, not of the product or service). The principal change here is the emphasis placed on risk and opportunity. Slide 29 This is the annex SL definition of risk. The point to note here is that risk can either be a positive or negative thing. This is in line with the thinking behind ISO 31000, the Risk Management standard. The authors of the DIS however assume, as does the typical man on the street that risk is an inherently bad thing, and therefore what you will see throughout the DIS are references to risk and opportunities, not just risk. The concept of Risk based thinking is discussed within the Introduction to the DIS. It is an approach which the organisation is required to employ in many areas of its QMS. These include those clauses relating to the design of processes, product and service, the design of the QMS itself, in respect of determining the level of control placed on external providers, and in respect of internal audit and management review. Although the DIS does not prescribe a specific risk management methodology it does require the organisation to demonstrate that it understands the risks and opportunities

11 to its quality management system (and hence its ability to achieve its intended outcomes), and is taking appropriate action to mitigate those risks or realise these opportunities. The nature of the action taken must be proportionate to the potential impact should the risk or opportunity come to fruition and the effectiveness of the action must be evaluated. As is the case for internal and external issues, most organisations will already have a good appreciate of the risks they face and will have plans in place to eliminate or mitigate these. The required focus on opportunities may however be less well developed within the organisation. Slide 30 Let s return to the comparison table Slide 31 A point to note in respect of Communications (Clause 7.4). The current requirements have been expanded to cover external communications as well as internal ones. Each organisation must determine those quality management system related matters on which it wishes to communicate. Once this has been done consideration must then be given as to the timing of such communications, their target audience and the method of their delivery. Slide 32 The requirements of DIS clause 7 are broadly in line with the existing requirements of ISO 9001:2008 Clause 6. The scope of the Awareness clause has been expanded; this now applies to all persons doing work under the organisation s control. Also what individuals need to be made aware of has similarly been expanded. This now includes the organisation s quality policy, any quality objectives of relevance to them, how they are contributing to the effectiveness of the QMS and what the implications of not conforming to the QMS requirements are. Note also that work environment has now become the Environment for the operation of processes. This reflects the fact that QMS activities may not be conducted in the traditional workplace. Slide 33 It s now time to consider Clause 8, Operation. It is primarily the contents of Clause 8 that distinguish one Annex SL based management system standard from another. This is where most of the discipline

12 specific requirements live. Note the repeated explicit references to products and services. Slide 34 There has been a subtle but important change in the order of the sub clauses under 8.2. In ISO 9001:2008, the determination of and the review of requirements relating to products (and services) preceded customer communication. In the DIS, however customer communication takes place before determination of the requirements for products and services. Why? This reflects the way that most business is conducted today. Organisations will take customer views and perceptions into account when initially deciding what products and services they wish to supply. Once they have made their decision there is relatively little scope, except perhaps in the case of major contracts or high value items, for customers to register their own individual requirements. It is more usually a case of here is my product or service offering, you may take it as is or leave it. Consider the Amazon business model for example. They offer a wide range of music CD s. A customer will have some options around delivery but if they want their CD wrapped in red paper or to be supplied in a round case then the answer will be no. slide 35 Lets now take a look at Clause 8.3, Design and development of products and services There has been a reorganisation of the existing ISO 9001:2008 design and development requirements under the new DIS clause headings but the obligations on organisations are pretty much the same. Clause however is a new sub-clause. Now, the organisation is required to implement and maintain a design and development process where it has not established detailed requirements for its products or services, or where these have not been defined by the customer or other interested parties to the extent that they are adequate to allow production or service provision to take place. Design and development inputs have been expanded though design outputs remain essentially unchanged. slide 36 Note that references to Purchasing have disappeared from the DIS. In its place we see externally provided products and services.

13 External to what? External to the scope of the QMS. If the scope of your QMS encompasses your entire organisation then anything that comes in from outside is externally provided. If however your scope relates to a single plant in a group then anything coming in from the rest of the group is externally provided and subject to the same control requirements as if the process, product or service was being secured from a third party provider. As is the case with ISO 9001:2008, a risk based approach needs to be adopted when considering the type and extent of controls that are to be applied to externally provided processes, products and services. Another point of note here; customer property has been expanded to include property belonging to customers or external providers. Back to the comparison table. slide 37 And let s move on again. slide 38 Clause 9 relates to Performance Evaluation. This encompasses 3 sub clauses, Monitoring, measurement, analysis and now evaluation, Internal Audit and Management Review. The organisation must decide what it is appropriate to monitor or measure and how this monitoring or measuring should take place. An increased focus on monitoring recognises that for service organisations in particular, the extent of the check that the service meets requirements can be as straightforward as a quick visual inspection. Consider for example a Chef releasing food from a restaurant kitchen. There is an existing requirement within ISO 9001:2008 for the organisation to monitor customer perception, however in the DIS, consideration of customer perception has been expanded to include soliciting perceptions of the organisation and of its products and services and not just perceptions as to whether the organisation has met the customer s requirements. The organisation must also decide how it is going to obtain and use customer satisfaction information. There are changes in respect of Internal Audit. The requirement for a documented internal audit procedure has disappeared and the results of audits now need to be reported to relevant management as opposed to the management of the area concerned. The considerations to be taken into account when designing the internal audit programme are now explicitly defined.

14 Management reviews will in future become more strategic, including consideration of context and risks and opportunities. The DIS also requires organisations to use trends and indicators to monitor the performance of the quality management systems. And so to Improvement. A new General clause has appeared. This sets out a headline requirement for the organisation to actively seek out and realise improvement in terms of their processes, their products and services, and their quality management system results. The associated note reminds us improvement doesn t always take place on a continual basis. Sometimes it occurs as a result of corrective action, sometimes through innovation and sometimes as a result of re-organisation. All references to preventive action have been removed. Preventive action no longer exists as a concept in the DIS. It has been superseded by risk based thinking. Finally, a word on nonconformity. On discovering a nonconformity, there is now an explicit requirement for organisations to determine whether other similar nonconformities actually do or could exist. There is also a requirement for the organisation to determine whether changes are required to the wider QMS in order to prevent a reoccurrence. slide 39 Okay, that s essentially all we have time to cover today. So let s close by having a look at what you should be doing next. A good place to start is by raising your own awareness and understanding of the forthcoming changes. Once you ve gained a better insight you can start the process of communicating the proposed changes to your own organisation, making them aware of what is on the horizon. As the development of the Standard continues, both the CQI and IRCA will be making additional technical material available to our members to support you through the transition. Finally, it s not too soon to start making changes. Whilst September 2015 may seem a long way away it isn t. The new standard will be here before you know it.

15 And even with a 3 year transition period, running through to September 2018, if there are headline items in this webinar against which you know your organisation is currently underperforming, you should move to address these now. If changes in the culture of the organisation are required for example, these can take a very long time to drive through. Lastly, if you are a member of the CQI we would urge you to participate in our forthcoming survey. We intend to run this between June and August with the results then being collated and analysed in September. At the end of September a report will be submitted to TC 176 setting out the CQI s position on the DIS. Slide 40 And so we ve reached the end of this first in a series of ISO 9001 webinars. Thank you for taking the time to view this session which I hope you have found informative. Copyright CQI 2014 Chartered Quality Institute2 nd Floor North Chancery Exchange 10 Furnival Street London EC4A 1AB registration@irca.org Tel: +44 (0) Fax: +44 (0) If you wish to reproduce any of this presentation, please contact Neil Everett, IRCA Business Development Manager at neverett@irca.org