ISO 9001:2000 expires globally after November 12, 2010

Transcription

1 February 18, 2010 Attention NSF-ISR ISO 9001:2000 certified customers, This is a reminder that ISO 9001:2000 expires globally after November 12, Consistent with the initial transition arrangements outlined last year, clients no longer have the option of being audited to ISO 9001:2000 and all ISO 9001 audits will be conducted against the 2008 version. This includes audits conducted to AS9100, AS9110 and AS9120 and clients with TS certification who chose to maintain a seperate ISO 9001 certificate. Additionally, all ISO 9001:2000 certificates will be cancelled in our system after this date. Auditors should mention this at the opening meeting and closing meeting where appropriate. Any clients who are ISO 9001:2000 certified and are not due for another audit within a reasonable timeframe before the deadline will need to have either an early audit (surveillance or reassessment, depending on which audit is next in the cycle) or a verification audit well in advance. Please note that there will be no extensions granted for ISO 9001:2000 certificates by ANAB. If the organization fails to make the deadline, then they will lose their certification. If you have any questions/concerns, please feel free to contact: Che Masters Technical Specialist NSF International Strategic Registrations 789 N. Dixboro Rd. Ann Arbor, MI P: (734) F: (734) E: cmasters@nsf-isr.org

2 December 12, 2008 To: All QMS Auditors, Staff and ISO 9001:2000 customers Subject: ISO 9001:2008 Transition Update ISO 9001:2008 was issued on November 13, The International Organization for Standardization (ISO) and the International Accreditation Forum (IAF), the body that oversees registrars worldwide, have agreed an 24-month transition period between ISO 9001:2000 and ISO 9001:2008. Therefore after November 12, 2009, all accredited certifications issued (new certifications or re-certifications) must be to ISO 9001:2008 and all accredited ISO 9001:2000 certificates will no longer be valid after November 12, Below are frequently asked questions regarding NSF-ISR s policies related to the transition: Q: When will we be required to have ISO 9001:2008 audits? What about our current ISO 9001:2000 certificate? A: All audits after November 12, 2009 will be conducted to the new standard. No ISO 9001:2008 certificates can be issued until NSF-ISR completes an audit to ISO 9001:2008. The auditor will specify on the audit report and at the opening meeting that the audit is an upgrade to ISO 9001:2008. If you choose not to upgrade during a surveillance audit or respond with acceptable corrective action plans for transitional findings, then your ISO 9001:2000 certificate is valid until November 13, If you choose not to upgrade during a recertification audit, then the new certificate will be issued to the ISO 9001:2000 standard and expires on November 13, 2010*. If you upgrade during a surveillance audit then a new certificate is issued to the ISO 9001:2008 standard with the expiration date remaining the same as your previous ISO 9001:2000 certificate. If you upgrade during a recertification audit then the ISO 9001:2008 certificate will be issued for the normal three-year period. Clients may also conduct an early recertification audit in lieu of a surveillance audit in order to receive an ISO 9001:2008 certificate valid for three years. Q: Will additional time be added to our audits? A: NSF-ISR recommends that you have at least a half day documentation review in preparation for your upgrade audit. Please contact your sales person for details on how this can be achieved. Q: How will nonconformities effect our transition? A: Transitional findings are defined as those associated with the language changes incorporated into the ISO 9001:2008 standard. All findings to the ISO 9001:2008 standard will be labeled Transitional. Transitional findings may be either major or minor. You may submit corrective actions for transitional findings or you may choose to ignore them and retain your ISO 9001:2000 certification until November 12, 2010*; Failure to address minor transitional findings with an acceptable corrective action plan will prevent an upgrade to ISO 9001:2008. Minor transitional findings may be closed at the next surveillance. In order to upgrade to ISO 9001:2008 all major findings must be closed and all minor transitional findings must have an acceptable corrective action plan. All transitional findings must be addressed by November 13, You can be recommended for registration to the ISO 9001:2008 standard if there are no major findings. If you have any questions or need clarification, please contact: Che Masters (734) cmasters@nsf-isr.org or Garry Puglio (814) puglio@nsf-isr.org *NOTE: After November 12, 2009, all accredited certifications issued, new or renewed, must be to ISO 9001:2008. Please bear this in mind regarding recertification audits.

3 The following is a table that NSF-ISR has prepared to assist our customers in understanding some of the changes made to the ISO 9001 standard. These are changes that NSF-ISR believes are of the most significant and not sanctioned interpretations, nor is this a comprehensive guide to all the changes made to the ISO 9001 standard. Not Auditable 0.1 General Added additional language to emphasize that statutory and regulatory requirements are a concern as it relates to product and included various factors that influence the design and implementation of a quality management system. 0.2 Process approach Added additional language to emphasize that a process approach also needs to take into account the desired outcomes (i.e. objectives) of a process. 0.4 Compatibility with other management systems standards 1.1 General 1.2 Application 2. Normative Reference 3 Terms and definitions Emphasis added that consideration was given to ISO 14001:2004 to ensure that the standards are compatible Statutory was added in certain paragraphs to ensure the user is aware that these requirements must be taken into consideration. Additional notes were added to explain that where the word product appears, it refers to every stage of its existence, from raw material received to the final product being shipped to the customer. Reference to ISO 9000 (vocabulary and concepts) was updated to refer to the current revision (i.e. ISO 9000:2005). The supplier/organization/customer model was removed. These relationships, in reality, are not always linear.

4 4.1 In 4.1 a, identify was replaced with determine to emphasize that an organization must give careful consideration to what processes are needed in order to fulfill requirements. 4.1e, where applicable was added to qualify the requirement to measure processes, as not all processes requires discrete, finite measurement (e.g. PPMs, ontime delivery, etc). Outsource processes: Control does not have be identified, rather the type and extent of controls must be defined within the quality management system. A link is drawn to 7.4 in the additional note to illustrate that the supplier approval, evaluation, re-evaluation process is typically where evidence of the control of outsourced processes is demonstrated. A second note was added to define outsourced process References to records and documents were consolidated. Also, the organization can require records not specified in this international standard are created and maintained Clarification is given to the requirement for external documents. Only those needed for the planning and operation of the QMS need to be controlled as determined by the organization. This could exclude documents related to occupational health and safety since ISO 9001 contains requirements only concerned with product (see 0.1) Despite record control procedures imposed upon the organization by external sources, the organization is still responsible for documenting record control procedures The Management Representative must be from the organization s management. This would exclude consultants and other individuals external to the organization (e.g. A management representative from the corporate entity) who operate externally to the organization. The purpose is to ensure that this individual entrusted with the responsibilities of championing the quality management system is not out of touch with the organization.

5 The Auditable Requirements The boundaries of competence only extend to individuals who impact product conformity to defined requirements. However this does not just include those who are directly involved in production. For example as the decision made by management affect product conformity, they must be competent as well Conformity to requirements was added to draw boundaries on what is meant by product quality. The term quality is too subjective. If said personnel have not yet attainted the competence needed to perform their job, then the organization must provide training or some other remedy to ensure that competence is achieved. The organization must also have a mechanism to ensure that personnel have been evaluated based on how well they demonstrate their knowledge and skill (i.e. competence). It is not enough to merely provide training or consider an individual s experience. The organization must prove to itself that this person can, in fact, perform. 6.3 Infrastructure also includes databases and information technology. 6.4 Emphasis is added in a note to highlight that the concept of work environment only extends to product quality. 7.1 c Measurement is added Post-delivery activity is clarified in a note with examples A note emphasizes that design verification, validation, and review are different from one another and serve different purposes; Design review is for the organization to evaluate if the design can meet requirements and if any changes need to be made. Design verification is where the organization has ensured that requirements have been met (e.g. is the widget blue and is it hexagonal?). Design validation is where the organization proves that the design can perform as required. However, the records of these activities do not have to be as distinct.

6 The Auditable Requirements Production and service provisions also extend to how product is preserved, handled, etc, to ensure product conformity. See Design outputs should include requirements related to preservation. See Product status must be identified throughout product realization and not just the final product. See Property can include personal data (e.g. social security numbers). 7.6 The definition of monitoring and measuring devices has been clarified to include equipment and devices that are purposed for monitoring and measuring, regardless of their original, intended purpose. An additional note regarding software was added Requirements for the organization to maintain records of internal audits have been clarified. Actions deemed necessary and taken by management to address nonconformities identified during the internal audit process must follow the requirements of the corrective action process (i.e. root cause, correction and corrective action). Reference to auditing guidance document was updated (i.e. ISO 19011).

7 8.2.3 Wording was changed to emphasize that correction and corrective actions are not only to be taken to preserve the conformity of the product, but also the quality management system. For example, internal rejection/scrap rates show evidence that the organization is preserving product conformity and is taking intermediate action to prevent bad product from being shipped to their customers; however, it could also be a sign that the organization is not efficient since the higher rejection/scrap rates are undesirable. A note was added to clarify the meaning of suitable methods related to planning monitoring and measurement processes. Suitability should be determined based on risk and the impact that nonconformity would have on the product or process Product can be released to other internal processes despite planned arrangements not being satisfactorily completed as long as it conforms prior to release to the customer. This relaxes requirements on intermediate inspection results and records. 8.4 Links to other clauses in the standard were added to further understanding of the intent of the requirements Nonconformity can have multiple causes ( cause ; i.e. a singular reason, was used in the 2000 version); therefore, the organization must consider this when conducting root cause analysis. Also, it is not enough to simply review corrective action and insure that procedures were changed, personnel have been re-trained, and that processes were amended. The organization must review whether or not the action(s) taken were effective; i.e. did they successfully eliminate the nonconforming condition? Similar to the new emphasis on the effectiveness of corrective action, the organization must also whether or not the preventive action(s) taken were effective in eliminating the risk of nonconformity.