ISO 9001:2000 The International Quality Management Business System

Transcription

1 ISO 9001:2000 The International Quality Management Business System Table of Contents What is ISO 9000? Page 1 The Benefits of ISO 9001:2000 Page 1 Why an ISO 9001:2000 System? Page 2 Major Steps to Implementation Page 3 Major Clauses of ISO 9001:2000 Page 5 ISO 9001: 2000 Quality Management System Requirements 4.0 Quality Management System Page Management Responsibility Page Resource Management Page Product Realization Page Measurement, Analysis and Improvement Page 13

2 What is ISO 9000? With over 500,000 worldwide companies registered, ISO 9000 has become the most accepted business management standards in the world. The standards are not specific to a particular product or service, but apply to the processes that create them. The purpose was to simplify the exchange of goods and services by creating a common set of standards. As a generic set of standards, manufacturing and service industries around the world are using it. ISO 9000 is much more than a quality systems standard. The intention of ISO 9000 is to establish, document, and maintain a system for ensuring the output of a process. This takes place through the process of defining, documenting, and establishing the organization s operational and quality system around the clauses and elements of the standard. When understood and put to practise, these clauses and elements define sound business principles. When implemented correctly, it will guide your organization to build quality into your products and/or services, and help you to avoid costly inspections, warranty costs and rework. First released in 1987, with a limited revision in 1994, the standards have undertaken a new look under a revision released in December The four standards are ISO 9000:2000, Quality Management Systems-Fundamentals and vocabulary; the primary standard ISO 9001:2000, Quality Management System- Requirements defines the system creating a comprehensive and user-friendly application. The process-based structure of the standard provides real value, in that it recognizes that every company and process is different. Therefore, it is flexible enough to allow differences by offering the option of omitting inapplicable requirements. The remaining two are ISO 9004:2000, Quality Management Systems Guidelines for performance improvements; and ISO 19011:2002, Guidelines on quality and/or environmental management systems auditing. The Benefits of ISO 9001:2000 The benefits of ISO 9000 are well documented. For example, 62% of ISO-registered companies have increased sales, 54% have increased market share, 57% have decreased the cost of quality, 37% have increased export growth, and 20% have increased employee retention. (ISO 10 th Cycle Survey) Further documented benefits include: Reduction in variability resulting both from documentation and the use of monitoring and measuring techniques to improve the system. Using registration to help develop and expand business, particularly those areas where registration is a prerequisite for doing business. 1

3 Reduction or elimination of customer audits. Documentation of the company's operational and quality system. Increased profitability and reduced costs. Improved communications, both internal and external. Greater awareness of quality by employees, accompanied by enhanced pride in their jobs and contribution to the company's quality system. Provision of training to all personnel. Ability to remain/become competitive in the markets. Elimination of redundancy ISO 9001:2000 also provides a competitive advantage. Companies that operate under this standard focus on continuous review of operations, prevention rather than detection, corrective actions and accurate outcomes, communication within processes, company personnel, suppliers, and customers. A high level of management commitment and involvement that supports a customer-focused environment is essential. Many companies also find benefits in their non-manufacturing functions, which tend to be absent in quality control standards. These attributes lead to predictable process inputs and outputs, control of business costs, and increased productivity, and reduced waste. It provides the potential of reducing timeconsuming supplier and customer audits, and is a powerful marketing tool in today s highly competitive global marketplace. A company that is ISO 9001:2000 registered has an improved competitive advantage at home and abroad over its competitors. The standard has become a virtual requirement in many overseas countries, and is increasingly becoming a supplier quality assurance program requirement for U.S. companies, including acquiring work from the U.S. Government and Military Contracts. Registered organizations are authorized to display a special mark or logo, and companies throughout the world understand the significance behind it. Why an ISO 9001:2000 System? Regardless of your company size, effective management systems are critical for maintaining and improving business performance. ISO 9001:2000 creates a documented management system that helps identify your business functions, processes, inputs and outputs, methods of control and improvement, customer focus, measurement and analysis. This system tells your organization s customers, employees, suppliers, investors, and all concerned, that your business operates under a globally accepted system that produces tangible result. 2

4 Major Steps to Implementation There is no single blueprint for implementing ISO 9001:2000. Your organization should approach implementation as a project. A detailed project plan will need to be developed defining the necessary steps for achieving a successful system. This will include top management involvement, cross-functional teamwork, and ownership at all levels. If ISO9001:2000 is a completely new subject and you lack the knowledge, expertise, time and objectivity, you should consider hiring a Management System Consultant to assist you with your implementation. The consultant can take on the project leader role, especially if you have a specific deadline to meet for implementation. An experienced consultant will have a structured process approach that will save your company time, money, and effort. The key objectives to implementation include: 1. Approach implementation as a project. 2. Consider use of a consultant Acquire and read the ISO 9000 family of standards. Copies can be purchased through the American Society for Quality at 4. When you read the ISO 9001:2000 Standard, read the process approach described in the introduction section. It describes what is a process and how your organization must identify and manage the interactions of your quality management system. 5. Develop an implementation team. 6. Conduct Management Systems Training. 7. Implement a quality system that meets ISO 9001:2000 requirements. a. Perform a Gap Analysis of your current system against the ISO 9001:2000 standard requirements. This helps you to determine where your processes are, and where they need to be. 3

5 8. Write and develop documentation: Four Levels of Documentation Quality Manual, Quality Policy, and Quality Objectives QMS Procedures Work Instructions Forms and Records Defines scope and application, responsibility and authority; references procedures in accordance with ISO9001:2000. States the overall commitment to quality and objectives, which measure the effectiveness of the quality system relative to the quality policy. Describes specific responsibilities, tasks, associated documents and records. Define specific task information Documents used to record information and referenced in procedures, as appropriate. These may be electronic or hard copy. Evidence of the quality system requirements. 9. Time Frame to Implementation The time it will take for your company to conform to the requirements of ISO 9001:2000 depends on a number of factors such as complexity of the system, size of the organization, resources, a sound implementation process approach, and commitment and involvement of top management. It is very important to consider all these issues when you are in the planning phase. The implementation plan can take up to six months in order to have sufficient time to plan the system and execute. This will include defining the interactions of your system, documenting, collecting, and defining the necessary data systems, required records, and verifying your system is working properly. Registrars usually want to see up to three months of the system in operation before conducting a third party audit. The operating period will also include a complete internal audit of your system and a management review. 10. Select a Registrar Registrars administer ISO registration. Registrars are accredited, independent third party organizations that review the organizations quality manual and other pertinent documentation to ensure that it meets the standard requirements. A registrars function is to verify whether an organizations quality system has been properly implemented and conforms to ISO 9001:2000 and any other applicable requirements. This includes auditing processes to verify the system described in the documentation is in place and operating effectively. A universal phrase of this system is say what you do, do what you say. Once registration is achieved, the registrar conducts regular surveillance audits of the facility to determine if the system continues to meet the standards requirements. 4

6 Major Clauses of ISO 9001:2000 Quality Management System- describes general requirements along with such documentation requirements as the quality manual, procedures, work instructions and records. It establishes the system and defines the processes in producing a good product and/or service and allows for continual improvement. Management Responsibility- management defines policy, objectives, planning and quality management requirements and providing feedback through management review for changes and implementation of improvements. It addresses the responsibility that a system must continually meet customer needs and expectations. This responsibility includes quality objectives at each organizational function and level. Resource Management where resources, such as human and facilities are determined and utilized. These resources, which include infrastructure and work environment are required to implement and maintain the quality management system. Product Realization- processes, such as customer-related processes, design, purchasing, and production and service provision, are established and implemented. The processes that are needed to manufacture product and/or deliver services from receipt to delivery. Measurement, Analysis and Improvement- process results are measured, analyzed, and improved through internal audits, nonconforming product control and continual improvement. Organizations are required to monitor and measure processes, product and/or service conformity. Data collected must be analyzed to initiate corrective and preventive actions for continuous improvement. 5

7 ISO 9001:2000 Quality System Requirements 4.0 Quality Management System 4.1 General Requirements. Requires an organization to establish, document, implement, maintain and continually improve a quality management system (QMS) covering ISO 9001:2000 requirements. 4.2 Documentation Requirements General - requires an organization to prepare quality policy and objectives statements, a quality manual, documented procedures, quality records and other documents required to ensure effective operation and control of its processes. The extent of the documentation depends on the size and type of the organization, complexity and interaction of its processes, and competence of personnel Quality Manual - requires the organization to establish and maintain a quality manual that includes the scope of the QMS, documented procedures, and a description of QMS processes Control of Documents - requires QMS documents including quality records to be controlled. A documented procedure must be established to approve, review, update, and identify the current revision level of QMS documents. Requires relevant versions are available at points of use, documents are legible, readily identifiable and retrievable, and documents of external origin are identified and controlled. Unintended use of obsolete documents is also to be prevented Control of Records - requires the organization to control and maintain QMS records to provide evidence of conformance to requirements and of effective QMS operation. A documented procedure must be established for the identification, storage, retrieval, protection, retention time, and disposition of records. 6

8 5.0 Management Responsibility 5.1 Management Commitment - requires top management to demonstrate its commitment to the QMS and continually improve its effectiveness by establish the quality policy and objectives. This includes conducting management reviews, communicating to the organization the importance of meeting customer, regulatory and legal requirements, and ensuring the availability of necessary resources. 5.2 Customer Focus - requires top management to ensure that customer requirements are determined and met with the aim of enhancing customer satisfaction. 5.3 Quality Policy - requires top management to establish an appropriate quality policy, which includes a commitment to meeting requirements and continual improvement, including a framework for establishing and reviewing quality objectives. The quality policy is communicated and understood at appropriate organizational levels, and is reviewed for continuing suitability. 5.4 Planning Quality Objectives - requires the organization to establish quality objectives that are measurable and consistent with the quality policy, including those needed to meet product requirements Quality Management System Planning - requires top management to plan the QMS to meet Element 4.1 requirements and quality objectives, and ensure that QMS integrity is maintained when changes are planned and implemented. 5.5 Responsibility, Authority and Communication Responsibility and Authority - requires top management to ensure that responsibilities, authorities, and their interrelation within the organization are defined and communicated Management Representative. requires top management to appoint a member of the management with the responsibility for ensuring that QMS processes are established, implemented and maintained, reporting QMS performance and any need for improvement to top management, and ensuring that awareness of customer requirements is promoted throughout the organization. 7

9 5.5.3 Internal Communication - requires top management to ensure communication processes are established within the organization and that communication takes place regarding QMS effectiveness. 5.6 Management Review General - requires top management periodically review the QMS to ensure its continuing suitability, adequacy and effectiveness, and evaluate opportunities for improvement and the need for changes, including the quality policy and objectives Review Input - requires management review inputs to include information on audit results, customer feedback, process performance and product conformity, preventive and corrective actions, follow-ups to previous management reviews, and changes that could affect the QMS, including recommendations for improvement Review Output - requires management review output to include decisions and actions related to improving the effectiveness of the QMS and its processes, product improvement related to customer requirements, and resource needs. 6.0 Resource Management 6.1 Provision of Resources - requires the organization to determine and provide the resources needed to implement and maintain the QMS, continually improve its effectiveness, and enhance customer satisfaction by meeting customer requirements. 6.2 Human Resources General - requires the organization to assign personnel to work affecting product quality who are competent on the basis of appropriate education, training, skills, and experience Competence, Awareness and Training - requires the organization to identify competency needs and provide training for personnel performing activities affecting product quality. This includes evaluating training effectiveness, ensuring that employees are aware of the relevance and importance of their activities, and how they contribute to achieving quality objectives, and maintain appropriate education, training, skills and experience records. 8

10 6.3 Infrastructure - requires the organization to determine, provide and maintain the infrastructure needed to achieve product conformity, including buildings, workspace and associated facilities. This includes process equipment, both hardware and software, and supporting services, such as transport or communication. 6.4 Work Environment - requires the organization to determine and manage the work environment needed to achieve product conformity. 7.0 Product Realization 7.1 Planning of Product Realization - requires the organization to plan and develop the processes needed for product realization, which must be suitable for the organization s method of operations. The organization must determine the product s quality objectives and requirements; the need to establish processes and documents, and provide resources specific to the product. This includes required product verification, validation, monitoring, inspection and test activities, and acceptance criteria, and necessary records to provide evidence that the realization processes and resulting product fulfill requirements. 7.2 Customer-Related Processes Determination of Requirements Related to the Product- requires the organization to determine customer-specified requirements, including requirements for delivery and post-delivery activities. This includes requirements not specified by the customer, but necessary for specified or intended use, where known, statutory and regulatory requirements related to the product, and any additional requirements Review of Requirements Related to the Product - requires the organization to review requirements related to the product before committing to provide it. This review must ensure that product requirements are defined, changes in contract or order requirements are resolved, and the organization is able to meet the requirements. Records of review results and follow-up actions must be maintained. Customer requirements must be confirmed by the organization before acceptance if not previously documented by the customer. When product requirements are changed, relevant documentation must be amended and relevant personnel must be made aware of the changes. 9

11 7.2.3 Customer Communication - requires the organization to identify and implement effective communication arrangements with customers relating to product information, inquiries, contracts or order handling. This includes amendments, and customer feedback, including complaints. 7.3 Design and Development (only if applicable) Design and Development Planning - requires the organization to plan and control design and development of product. This planning determines the design and development stages, appropriate review, verification and validation activities, and responsibilities and authorities for design and development activities. Interfaces between different groups involved in design and development must be managed to ensure effective communication and clarify assignment of responsibilities. Planning output must be appropriately updated as the design and development progresses Design and Development Inputs - requires inputs relating to product requirements to be determined and reviewed for adequacy with records maintained. These include functional, performance, and applicable statutory and regulatory requirements, applicable information derived from previous similar designs, and other essential design and development requirements. Requirements must be complete, unambiguous and not in conflict with each other Design and Development Outputs - requires design and development outputs to be provided in a form that enables verification against input requirements, and to be approved before release. Outputs must meet input requirements, provide appropriate information for purchasing, production and service provision, contain or reference product acceptance criteria, and specify product characteristics that are essential for its safe and proper use Design and Development Review - requires systematic reviews of design and development at suitable stages in accordance with planned arrangements to evaluate the ability of design and development results to meet requirements, identify problems and propose necessary actions. Representatives of functions concerned with the design and development stages(s) being reviewed must participate, and records of review results and any necessary actions must be maintained. 10

12 7.3.5 Design and Development Verification - requires performing design and development verification in accordance with planned arrangements to ensure the design and development outputs have met the input requirements. Records of verification results and any necessary actions must be maintained Design and Development Validation - requires performing design and development validation in accordance with planned arrangements to ensure that the resulting product is capable of meeting specified application or intended use requirements, where known. Validation must be completed before product delivery or implementation wherever practicable. Records of validation results and any necessary actions must be maintained Control of Design and Development Changes - requires design and development changes to be identified, recorded, reviewed, verified, and validated as appropriate, and approved before implementation. This review of changes includes evaluation of the effect of the changes on constituent parts and product already delivered. Records of change review results and any necessary actions must be maintained. 7.4 Purchasing Purchasing Process - requires the organization to ensure that purchased product conforms to specified requirements, with the type and extent of control applied to the supplier and the purchased product dependent upon the effect on subsequent product realization or the final product. Suppliers must be evaluated and selected based on their ability to supply product in accordance with the organization s requirements, with the criteria for selection, evaluation and re-evaluation established. Records of evaluation results and any necessary actions must be maintained Purchasing Information - requires purchasing information describing the product to be purchased, including where appropriate, requirements for approval of product, procedures, processes and equipment, qualification of personnel, and the QMS. The organization must ensure the adequacy of specified purchase requirements before communicating them to the supplier. 11

13 7.4.3 Verification of Purchased Product - requires the organization to establish and implement the inspection or other activities necessary to ensure that purchased product meets specified purchase requirements. Where the organization or its customers proposes to perform verification at the supplier s premises, the organization must state the intended verification arrangements and product release method in the purchasing information. 7.5 Production and Service Provision Control of Production and Service Provision - requires the organization to plan and carry out production and service provision under controlled conditions. This includes, as applicable, the availability of product characteristics information, the availability of work instructions, using suitable equipment, the availability and use of monitoring and measuring devices, the implementation of monitoring and measurement, and the implementation of release, delivery, and post-delivery activities Validation of Processes for Production and Service Provisionrequires the organization to validate production and service provision where the resulting output cannot be verified by subsequent monitoring or measurement, including any processes where deficiencies become apparent only after the product is in use or the service has been delivered. Validation must demonstrate the ability of these processes to achieve planned results, and must include, as applicable, defined criteria for process review and approval, approval of equipment and qualification of personnel, use of specific methods and procedures, requirements for records, and revalidation Identification and Traceability - requires the organization, as appropriate, to identify the product by suitable means throughout product realization, and the product status with respect to monitoring and measurement requirements. The organization must control and record the product s unique identification where traceability is required Customer Property - requires the organization to exercise care with customer property while it s under the organization s control or being used by the organization. Customer property provided for use or incorporation into the product must be identified, verified, protected and safeguarded. Lost, damaged or otherwise unsuitable customer property must be recorded and reported to the customer. 12

14 7.5.5 Preservation of Product - requires the organization to preserve product conformity to customer requirements during internal processing and delivery to the intended destination, including identification, handling, packaging, storage and protection. Preservation also applies to a product s constituent parts. 7.6 Control of Monitoring and Measuring Devices (only if applicable) - requires the organization to determine the monitoring and measurements to be undertaken, and the monitoring and measurement devices needed to provide evidence of product conformity to determined requirements. The organization must establish processes to ensure that monitoring and measurement can be carried out and in a manner that is consistent with monitoring and measurement requirements. Where necessary to ensure valid results, measuring equipment must be calibrated or verified at specific intervals, or measurement standards, or under a recorded basis where no such standard exist, adjusted or re-adjusted as necessary, identified to enable the calibration status to be determined, safeguarded from adjustments that would invalidate the measurement result, and protected from damage and deterioration during handling, maintenance and storage. The organization must re-assess and record the validity of previous measuring results when the equipment is found not to conform to requirements, with appropriate action taken on the affected equipment and product. Records of calibration and verification results must be maintained. The ability of computer software to satisfy monitoring and measuring specified requirements must be confirmed prior to initial use and reconfirmed as necessary. 8.0 Measurement, Analysis and Improvement 8.1 General. requires the organization to plan and implement the monitoring, measurement, analysis, and improvement processes needed to demonstrate product conformity, ensure QMS conformity and continually improve QMS effectiveness, including determining applicable methods, such as statistical techniques, and the extent of their use. 8.2 Monitoring and Measurement Customer Satisfaction - requires the organization to monitor information relating to customer perception of the organization and meeting customer requirements as a performance measurement, while determining methods for obtaining information. 13

15 8.2.2 Internal Audit - requires the organization to conduct periodic internal audits to determine if the QMS conforms to planned arrangements. This includes ISO 9001:2000 requirements and the organization s QMS requirements, and has been effectively implemented and maintained. Audit program planning must take into consideration the status and importance of processes and areas to be audited, as well as the results of previous audits. The audit scope, frequency, and methods must be defined. Auditor selection and audit conduct must ensure that the audit process is objective and impartial. Auditors must not audit their own areas of responsibility. A documented procedure must define responsibilities and requirements for planning and conducting audits, reporting results, and maintaining records. The management responsible for the areas being audited must ensure that actions are taken without undue delay to eliminate detected nonconformities and their causes. Follow-up activities must include verification of actions taken and the reporting of verification results Monitoring and Measurement of Processes - requires the organization to apply suitable methods to monitor and where applicable, measure the QMS processes. These methods must demonstrate the ability of the processes to achieve planned results. When planned results are not achieved, correction and corrective action must be taken, as appropriate, to ensure product conformity Monitoring and Measurement of Product - requires the organization to monitor and measure product characteristics at appropriate product realization stages in accordance with planned arrangements to verify that product requirements have been met. Evidence of conformity to the acceptance criteria must be maintained, with records indicating the person(s) authorizing product release. Product release and service delivery cannot proceed until the planned arrangements have been satisfactorily completed, unless otherwise approved by a relevant authority and where applicable, the customer. 8.3 Control of Nonconforming Product - requires the organization to ensure that product which does not conform to requirements is identified and controlled to prevent its unintended use or delivery. A documented procedure must define the controls and authorities for dealing with nonconforming product. The organization must deal with nonconforming product by either taking action by eliminating the nonconformity, authorizing its use, release or acceptance under concession by a relevant 14

16 authority and, where applicable, the customer taking action to prelude its original intended use or application, or some combination of these methods. Records of the type of nonconformity and actions taken, including concessions must be maintained. When nonconforming product is corrected, it must undertake reverification to demonstrate conformity to requirements. When nonconforming product is detected after delivery or use has started, action must take place appropriate to the effects, or potential effects, of the nonconformity. 8.4 Analysis of Data - requires the organization to determine, collect and analyze appropriate data to demonstrate the suitability and effectiveness of the QMS, and to evaluate where continual improvement of the QMS effectiveness can be made. This includes data generated by monitoring and measuring, and from other relevant sources. The data analysis must provide information relating to customer satisfaction, supplier performance, and conformance to product requirements, characteristics and trends of processes and products, including opportunities for preventive action. 8.5 Improvement Continual Improvement - requires the organization to continually improve the effectiveness of the QMS through the use of the quality policy, objectives, and audit results, analysis of data, corrective and preventive action, and management review Corrective Action - requires the organization to take action to eliminate the causes of nonconformities in order to prevent recurrence. Corrective actions must be appropriate to the effects of the discovered nonconformities. A documented procedure must be established to define requirements for reviewing nonconformities, including customer complaints. This includes determining the causes of nonconformities, evaluating the need for action to prevent the recurrence of nonconformities; determining and implementing needed actions, recording the results of actions taken, and reviewing corrective actions taken Preventive Action - requires the organization to determine action to eliminate the causes of potential nonconformities in order to prevent their occurrence. Preventive actions must be appropriate to the effects of the potential problems. A documented procedure must be established to define requirements for determining potential nonconformities and their causes, evaluating the need for action to prevent nonconformity occurrence, determining and implementing needed action, and reviewing preventive actions taken. 15