GMX Understanding & Implementing ISO 9001:2008

1. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 PREPARED & EDITED BY: ENG. A. KARAM MALKAWI GLOBAL MATRIX CONSULTATION CO. AMMAN-JOR VERSION 1.0 APRIL 24, 2016

2. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 1 of 100 SECTION I.................................................................................................................................................................................6 IMPLEMENTING ISO 9001:2008..................................................................................................................................................6 STEPS TO IMPLEMENT ISO 9001:2008 ...................................................................................................................................9 ISO 9001 REQUIREMENTS........................................................................................................................................................15 INTRODUCTION TO ISO 9001 REQUIREMENTS .........................................................................................................................17 ISO 9001-CLAUSE 1, 2 AND 3...................................................................................................................................................18 CLAUSE 1 SCOPE.................................................................................................................................................................18 CLAUSE 1.1 GENERAL..........................................................................................................................................................18 ISO 9001-REQUIREMENT.....................................................................................................................................................18 EXPLANATION.....................................................................................................................................................................18 CLAUSE 1.2 APPLICATION ...................................................................................................................................................19 ISO 9001-REQUIREMENT.....................................................................................................................................................19 EXPLANATION ................................................................................................................................................................19 Clause 2 Normative references.............................................................................................................................................20 ISO 9001-REQUIREMENT.....................................................................................................................................................20 EXPLANATION ................................................................................................................................................................20 CLAUSE 3 TERMS AND DEFINITIONS ...................................................................................................................................20 ISO 9001-REQUIREMENT.....................................................................................................................................................20 EXPLANATION ................................................................................................................................................................20 ISO 9001-CLAUSE 4.1..........................................................................................................................................................20 4.0 QUALITY MANAGEMENT SYSTEM ...................................................................................................................................20 EXPLANATION ................................................................................................................................................................20 ISO 9001-Clause 4.1............................................................................................................................................................21 4.1 GENERAL REQUIREMENTS .............................................................................................................................................21 ISO 9001 REQUIREMENT.....................................................................................................................................................21 EXPLANATION ................................................................................................................................................................22 ISO 9001-CLAUSE 4.2..........................................................................................................................................................25 ISO 9001-CLAUSE 4.2 DOCUMENTATION REQUIREMENTS ....................................................................................................25 4.2.1 GENERAL ...................................................................................................................................................................25 ISO 9001 REQUIREMENT.....................................................................................................................................................25 EXPLANATION ................................................................................................................................................................25 4.2.2 QUALITY MANUAL ......................................................................................................................................................26 ISO 9001 REQUIREMENT.....................................................................................................................................................26 EXPLANATION ................................................................................................................................................................26 4.2.3 CONTROL OF DOCUMENTS .........................................................................................................................................26 ISO 9001 REQUIREMENT.....................................................................................................................................................26 EXPLANATION ................................................................................................................................................................27 4.2.4 CONTROL OF RECORDS ..............................................................................................................................................28 ISO 9001 REQUIREMENT.....................................................................................................................................................28 EXPLANATION ................................................................................................................................................................28

3. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 2 of 100 ISO 9001-CLAUSE 5.1, 5.2 & 5.3..........................................................................................................................................30 CLAUSE 5 MANAGEMENT RESPONSIBILITY...........................................................................................................................30 ISO 9001-CLAUSE 5.1, 5.2 & 5.3..........................................................................................................................................30 5.1 MANAGEMENT COMMITMENT ........................................................................................................................................30 ISO 9001 REQUIREMENT.....................................................................................................................................................30 EXPLANATION ................................................................................................................................................................31 5.2 CUSTOMER FOCUS ........................................................................................................................................................31 ISO 9001 REQUIREMENT.....................................................................................................................................................31 EXPLANATION ................................................................................................................................................................31 5.3 QUALITY POLICY...........................................................................................................................................................32 ISO 9001 REQUIREMENT.....................................................................................................................................................32 EXPLANATION ................................................................................................................................................................32 ISO 9001-CLAUSE 5.4..........................................................................................................................................................34 ISO 9001-CLAUSE 5.4 PLANNING.........................................................................................................................................34 CLAUSE 5.4.1 QUALITY OBJECTIVES....................................................................................................................................34 ISO 9001 REQUIREMENT.....................................................................................................................................................34 EXPLANATION ................................................................................................................................................................34 CLAUSE 5.4.2 QUALITY MANAGEMENT SYSTEM PLANNING ...................................................................................................36 ISO 9001 REQUIREMENT.....................................................................................................................................................36 EXPLANATION ................................................................................................................................................................36 ISO 9001-CLAUSE 5.5..........................................................................................................................................................38 ISO 9001-CLAUSE 5.5 RESPONSIBILITY, AUTHORITY AND COMMUNICATION........................................................................38 ISO 9001-CLAUSE 5.5.1 RESPONSIBILITY AND AUTHORITY..................................................................................................38 ISO 9001 REQUIREMENT.....................................................................................................................................................38 EXPLANATION ................................................................................................................................................................38 ISO 9001 REQUIREMENT.....................................................................................................................................................39 EXPLANATION.....................................................................................................................................................................39 ISO 9001-CLAUSE 5.5.3 INTERNAL COMMUNICATION...........................................................................................................40 ISO 9001 REQUIREMENT.....................................................................................................................................................40 ISO 9001-CLAUSE 5.6..........................................................................................................................................................42 ISO 9001-CLAUSE 5.6 MANAGEMENT REVIEW ......................................................................................................................42 ISO 9001 REQUIREMENT ISO 9001-CLAUSE 5.6.1 GENERAL.................................................................................................42 ISO 9001-CLAUSE 5.6.2 REVIEW INPUT..............................................................................Error! Bookmark not defined. ISO 9001 REQUIREMENT.....................................................................................................................................................42 ISO 9001-CLAUSE 5.6.3 REVIEW OUTPUT...........................................................................Error! Bookmark not defined. ISO 9001 REQUIREMENT.....................................................................................................................................................42 EXPLANATION ................................................................................................................................................................42 ISO 9001-CLAUSE 6 ............................................................................................................................................................44 ISO 9001-CLAUSE 6: RESOURCE MANAGEMENT ...................................................................................................................44 ISO 9001-CLAUSE 6.1 PROVISION OF RESOURCES ...............................................................................................................44 ISO 9001 REQUIREMENT.....................................................................................................................................................44 EXPLANATION ................................................................................................................................................................44

4. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 3 of 100 ISO 9001-CLAUSE 6.2 HUMAN RESOURCES ..........................................................................................................................45 ISO 9001 REQUIREMENT.....................................................................................................................................................45 ISO 9001-CLAUSE 6.2.1 GENERAL........................................................................................................................................45 EXPLANATION ................................................................................................................................................................45 ISO 9001-CLAUSE 6.3 INFRASTRUCTURE .............................................................................................................................46 ISO 9001 REQUIREMENT.....................................................................................................................................................46 ISO 9001-CLAUSE 6.4 WORK ENVIRONMENT........................................................................................................................47 ISO 9001 REQUIREMENT.....................................................................................................................................................47 EXPLANATION ................................................................................................................................................................47 ISO 9001-CLAUSE 7.1..........................................................................................................................................................49 ISO 9001-CLAUSE 7 PRODUCT REALIZATION .......................................................................................................................49 ISO 9001-CLAUSE 7.1 PLANNING OF PRODUCT REALIZATION...............................................................................................49 ISO 9001 REQUIREMENT.....................................................................................................................................................49 EXPLANATION ................................................................................................................................................................49 ISO 9001-CLAUSE 7.2..........................................................................................................................................................51 ISO 9001-CLAUSE 7.2 CUSTOMER-RELATED PROCESSES ......................................................................................................51 ISO 9001 REQUIREMENT ISO 9001-Clause 7.2.1 Determination of requirements related to the product ...................................51 EXPLANATION ................................................................................................................................................................52 ISO 9001-CLAUSE 7.3..........................................................................................................................................................55 ISO 9001-CLAUSE 7.3 DESIGN AND DEVELOPMENT..............................................................................................................55 ISO 9001-CLAUSE 7.3.1 DESIGN AND DEVELOPMENT PLANNING ..........................................................................................55 ISO 9001 REQUIREMENT.....................................................................................................................................................55 EXPLANATION ................................................................................................................................................................55 ISO 9001-CLAUSE 7.3.2 DESIGN AND DEVELOPMENT INPUTS...............................................................................................56 ISO 9001 REQUIREMENT.....................................................................................................................................................56 EXPLANATION ................................................................................................................................................................56 ISO 9001-CLAUSE 7.3.3 DESIGN AND DEVELOPMENT OUTPUTS............................................................................................57 ISO 9001 REQUIREMENT.....................................................................................................................................................57 EXPLANATION ................................................................................................................................................................57 ISO 9001-CLAUSE 7.3.4 DESIGN AND DEVELOPMENT REVIEW..............................................................................................58 ISO 9001 REQUIREMENT.....................................................................................................................................................58 EXPLANATION ................................................................................................................................................................58 ISO 9001-CLAUSE 7.3.5 DESIGN AND DEVELOPMENT VERIFICATION ....................................................................................58 ISO 9001 REQUIREMENT.....................................................................................................................................................58 EXPLANATION ................................................................................................................................................................58 ISO 9001-CLAUSE 7.3.6 DESIGN AND DEVELOPMENT VALIDATION .......................................................................................59 ISO 9001 REQUIREMENT.....................................................................................................................................................59 EXPLANATION ................................................................................................................................................................59 ISO 9001-CLAUSE 7.3.7 CONTROL OF DESIGN AND DEVELOPMENT CHANGES.......................................................................59 ISO 9001 REQUIREMENT.....................................................................................................................................................59 EXPLANATION ................................................................................................................................................................59 ISO 9001-CLAUSE 7.4..........................................................................................................................................................62

5. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 4 of 100 ISO 9001-CLAUSE 7.4 PURCHASING.....................................................................................................................................62 ISO 9001-CLAUSE 7.4.1 PURCHASING PROCESS...................................................................................................................62 ISO 9001 REQUIREMENT.....................................................................................................................................................62 EXPLANATION ................................................................................................................................................................62 ISO 9001-CLAUSE 7.4.2 PURCHASING INFORMATION...........................................................................................................63 ISO 9001 REQUIREMENT.....................................................................................................................................................63 EXPLANATION ................................................................................................................................................................63 ISO 9001-CLAUSE 7.4.3 VERIFICATION OF PURCHASED PRODUCT........................................................................................64 ISO 9001 REQUIREMENT.....................................................................................................................................................64 EXPLANATION ................................................................................................................................................................64 ISO 9001-CLAUSE 7.5..........................................................................................................................................................66 ISO 9001-CLAUSE 7.5 PRODUCTION AND SERVICE PROVISION ............................................................................................66 ISO 9001-CLAUSE 7.5.1 CONTROL OF PRODUCTION AND SERVICE PROVISION.....................................................................66 ISO 9001 REQUIREMENT.....................................................................................................................................................66 EXPLANATION ................................................................................................................................................................66 ISO 9001-CLAUSE 7.5.2 VALIDATION OF PROCESSES FOR PRODUCTION AND SERVICE PROVISION.......................................67 ISO 9001 REQUIREMENT.....................................................................................................................................................67 EXPLANATION ................................................................................................................................................................67 ISO 9001-CLAUSE 7.5.3 IDENTIFICATION AND TRACEABILITY..............................................................................................68 ISO 9001 REQUIREMENT.....................................................................................................................................................68 EXPLANATION ................................................................................................................................................................68 ISO 9001-CLAUSE 7.5.4 CUSTOMER PROPERTY....................................................................................................................69 ISO 9001 REQUIREMENT.....................................................................................................................................................69 EXPLANATION ................................................................................................................................................................69 ISO 9001-CLAUSE 7.5.5 PRESERVATION OF PRODUCT..........................................................................................................70 ISO 9001 REQUIREMENT.....................................................................................................................................................70 EXPLANATION ................................................................................................................................................................70 ISO 9001-CLAUSE 7.6..........................................................................................................................................................73 ISO 9001-CLAUSE 7.6 CONTROL OF MONITORING AND MEASURING EQUIPMENT .................................................................73 ISO 9001 REQUIREMENT.....................................................................................................................................................73 EXPLANATION ................................................................................................................................................................73 ISO 9001-CLAUSE 8.1..........................................................................................................................................................76 ISO 9001-CLAUSE 8 MEASUREMENT, ANALYSIS AND IMPROVEMENT ....................................................................................76 ISO 9001-CLAUSE 8.1 GENERAL.........................................................................................................................................76 ISO 9001 REQUIREMENT.....................................................................................................................................................76 EXPLANATION ................................................................................................................................................................77 ISO 9001-CLAUSE 8.2..........................................................................................................................................................78 ISO 9001-CLAUSE 8.2 MONITORING AND MEASUREMENT.....................................................................................................78 ISO 9001-CLAUSE 8.2.1 CUSTOMER SATISFACTION .............................................................................................................78 ISO 9001 REQUIREMENT.....................................................................................................................................................78 EXPLANATION ................................................................................................................................................................78 ISO 9001-Clause 8.2.2 Internal audit....................................................................................................................................79

6. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 5 of 100 ISO 9001 REQUIREMENT.....................................................................................................................................................79 EXPLANATION ................................................................................................................................................................80 ISO 9001-CLAUSE 8.2.3 MONITORING AND MEASUREMENT OF PROCESSES..........................................................................81 ISO 9001 REQUIREMENT.....................................................................................................................................................81 EXPLANATION ................................................................................................................................................................82 ISO 9001-CLAUSE 8.2.4 MONITORING AND MEASUREMENT OF PRODUCT.............................................................................82 ISO 9001 REQUIREMENT.....................................................................................................................................................82 EXPLANATION ................................................................................................................................................................83 ISO 9001-CLAUSE 8.3..........................................................................................................................................................86 ISO 9001-CLAUSE 8.3 CONTROL OF NONCONFORMING PRODUCT ........................................................................................86 ISO 9001 REQUIREMENT.....................................................................................................................................................86 EXPLANATION ................................................................................................................................................................86 ISO 9001-CLAUSE 8.4 & CLAUSE 8.5 ....................................................................................................................................88 ISO 9001-CLAUSE 8.4 & CLAUSE 8.5 ....................................................................................................................................88 CLAUSE 8.4 ANALYSIS OF DATA ..........................................................................................................................................88 ISO 9001 REQUIREMENT.....................................................................................................................................................88 EXPLANATION ................................................................................................................................................................88 CLAUSE 8.5 IMPROVEMENT .................................................................................................................................................89 8.5.1 CONTINUAL IMPROVEMENT........................................................................................................................................89 EXPLANATION.....................................................................................................................................................................89 8.5.2 Corrective action.........................................................................................................................................................90 ISO 9001 REQUIREMENT.....................................................................................................................................................90 EXPLANATION ................................................................................................................................................................90 8.5.3 PREVENTIVE ACTION..................................................................................................................................................91 ISO 9001 REQUIREMENT.....................................................................................................................................................91 EXPLANATION ................................................................................................................................................................91 SECTION II .............................................................................................................................................................................94 DOCUMENTATION REQUIREMENTS OF ISO 9001:2008..............................................................................................................94 Introduction to Documentation Requirements of ISO 9001: 2008 ...........................................................................................95 What is a “document”..........................................................................................................................................................95 Documentation requirements of ISO 9001:2008....................................................................................................................96 Guidance on Clause 4.2 of ISO 9001:2008 ............................................................................................................................96 Documented procedures ......................................................................................................................................................97 Records..........................................................................................................................................................................98 Organizations preparing to implement a QMS........................................................................................................................99 Organizations wishing to adapt an existing QMS.................................................................................................................. 100 Demonstrating conformity with ISO 9001:2008 ................................................................................................................... 100

7. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 6 of 100 SECTION I IMPLEMENTING ISO 9001:2008

8. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 7 of 100 There is no quick step-by-step for implementing ISO9001 according to ISO9001 into any other serious standard. Many have publicized it, but there are too many steps to do and to go through thoroughly making the implementation process complicated. In this approach we claim that all the really needed elements are discussed. What is not needed is not discussed. The implementation of a formal management system is best handled as a specific project with a professional project manager, who should be a key member of the organization’s management team and having sufficient authority and trust of the personnel involved. In the ideal situation this person will also be the Management Representative, but skills in project management are essential. It is important that none of the stages in the flow chart are omitted. The existing system of management and working practices must be known in some detail, before the framework of the formal QMS-documentation can be designed. The system is best designed around existing processes as the development of new systems that require additional resources may simply delay the implementation process. The total flow chart for the implementation of the QMS is visualized. On the following pages each step of the implementation process is described that have to be carried out before moving to the next step. It is advised to get more people involved in decision making and not to leave the decision to move to the next step up to one person only. Everybody involved must feel comfortable that a part is under control and that the organization is ready to move on. The total implementation process for QMS takes fourteen steps. Communicate with the employees what has done, what has to be done and when it is expected to be completely implemented. This creates interest and involvement and will speed-up the process of implementation.

9. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 8 of 100 Implementation flow chart

10. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 9 of 100 STEPS TO IMPLEMENT ISO 9001:2008 STEP 1: Evaluate the organization’s objectives and targets for implementing ISO9001 The need for a QMS may arise from repeated customer complaints, frequent warranty returns, delayed deliveries, too high inventories, frequent production hold-ups or a high level of rework or rejection of products or services. Also it could be that the need for implementing ISO9001 comes from the market, that is demanding a certified QMS, or otherwise it is impossible to operate in this market, or supply this dominant customer. Strong technological driven markets such as the aircraft and automotive business put this demand on their contractors and subcontractors for cost reasons but also for safety and liability reasons. This third party certification demonstrates the abilities of the organization to the potential customer. At this stage, identify the goals and objectives which should be achieved through a QMS, such as an improved company structure, greater efficiency, better profitability, reliable supplier etc. Introduce the Eight Quality Management principles to top management and get them motivated and committed to apply to these principles. Checklist at this stage:  Check that the management has adopted the 8 leadership principles and is motivated and committed to apply them.  Communicate the objectives and targets for the implementation of the QMS with all the staff. STEP 2: Obtain knowledge about the ISO 9000 family and appoint a management representative Decide on the responsibilities of the person who will be involved in developing and documenting the QMS, including the appointment of a management representative who will oversee the implementation of the QMS. The person made responsible for the process of implementing the QMS should understand the requirements of ISO 9000 and 9001 and read the contents of ISO 9004. Checklist at this stage:  Check to see that the management representative should has been appointed at this stage.  Check that the contents and the philosophy of ISO 9000 and 9001 have been made clear and have been accepted. STEP 3: Organize the resources Decide on the responsibilities of the person who will be involved in developing a documenting the QMS, including the appointment of a management representative who will oversee the implementation of the QMS. Establishing a project or ISO-team may also prove to be useful to oversee progress and in providing resources wherever required. The ISO team should consist of involved employees from different levels.

11. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 10 of 100 Some authority can be given by top management to speed up the process. If within the organization no adequate competence is available, or no resources such as time and knowledge can be made available, then a consultant should be appointed. Before doing so, it is good to realize that with subcontracting a part of the implementation process, a part of the knowledge and the commitment is lost. An organization can learn more and better from its mistakes and own developments, than from just doing what a consultant is recommending. Prepare a cost estimate and procure and allocate the resources for this project. Raise commitment from the top management. Checklist at this stage:  Check that the management has decided upon the individual who will develop the QMS and about its authority.  At this stage, check that the supporting ISO-team is established and the objectives for the team should have been made clear.  Check if commitment has been made at this stage to the implementation process, if not, it should be stopped here.  Don’t continue if there is no support group such as an ISO-team or a similar solution.  Check that the needed resources such as manpower, money and time have been made available to the Management Representative and the ISO-team. STEP 4: Raise awareness and provide training: Raise awareness about QMS requirements amongst all personnel performing activities and tasks that affect quality. Plan for and provide specific training on how to develop quality manual, procedures and work instructions. Besides that, it is important to instruct people how to identify and implement improvement processes and how to audit compliance with the QMS. Appoint a certain number of people to be the internal auditors and provide sufficient training. The ISO-team and/or the consultant should be resources for assistance during the training. Checklist at this stage:  Check that training has been provided to the people involved in the writing of procedures and work instructions. Make sure that the written documents reflect the actual situation and not the desired situation.  Check if a number of people have been selected as internal auditors and that the internal auditor training has been provided.  Check that the ISO-team assist in providing insight into the QMS to the other employees by means of presentations, newsletters and other ways of communication.  Develop forms that can replace difficult status reporting and provide instruction on how to use them. STEP 5: Gap Analysis Evaluate the gaps between the existing QMS and the requirements of ISO 9001:2008. Prepare how to bridge these gaps, including the planning for any additional resources required. Gap analysis may be carried out through self-assessment, by the ISO-team or by an external consultant. Checklist at this stage:

12. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 11 of 100  Check that the gap analysis has been carried out and study the outcome.  With this analysis it should be possible to identify the gaps when it is compared with the ISO 9001 QMS  Check that a plan has been developed to bridge the found gaps. Make sure that the plan also contains a time schedule and that the actions are realistic and can be finished in time.  Check that the results of the gap analysis and the actions to bridge the gaps have been reported to top management and that management is also committed. STEP 6: Product realization processes  Review clause 7 of ISO 9000:2008 relating to Product Realization to determine how the requirements apply or do not apply to the company’s QMS. The processes covered by this clause include:  Customer related processes.  Design and development.  Production and service provision.  Control of measuring and monitoring devices.  Note that if the company is not responsible for preparing the design of the product, it can exclude the requirement for design and development from the QMS, as long as the reasoning is mentioned in the quality manual. Flow chart each process in detail and discuss these flowcharts with the experts, in another words, the people that work with these processes.  Draft the framework of the quality management system and identify the supporting documents. Then develop the QMS documentation. Checklist at this stage:  Check to see that all the processes have been properly documented.  Have this documentation done by the experts, the people that are responsible for these processes.  Check on the requirements of the standard and exclude the elements that are not applicable to the organization.  Get the approval from top management for these exclusions STEP 7: Planning and time frame In this stage the allocation of the resources for the QMS project should be defined. Prepare a complete plan including the plan to close the gaps identified in the Gap Analysis, to develop the QMS processes. In the plan, include activities to be performed, resources required, responsibilities and an estimated completion time for each activity. Build in check point to assure in time completion. Clause 4.1 and 7.1 of ISO 9000:2008 provide information that should be used when developing the plan. The total time required for each phase (planning, documentation, implementation and evaluation) depends on the extent of the gaps in the existing QMS. Communicate the master plan to all staff, but especially the ISO-team and the people involved. Checklist at this stage:

13. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 12 of 100  Check that the plan is complete, including the actions to bridge the gaps, a time schedule and the allocation of the resources such as manpower, money and time.  Check that enough effort has been made to communicate the plan and the result of it to all staff. If needed provide extra information to key people and the ISO-team. STEP 8: Draft a Quality manual and develop a Quality Policy  Draft the quality policy for the organization. Get the policy committed by top management. Make sure that the policy is a strong statement, original and applies to the organization. In the quality manual:  Include how the QMS applies to the products, processes, locations and departments of the organization.  Exclude any requirement with justification if applicable.  Refer to or include documented procedures (if available already) for QMS.  Describe the interaction between the processes of the QMS, e.g. the interaction between product realization processes and other management, measurement and improvement processes. Checklist at this stage:  Check that there is an adequate policy developed, that top management is committed and it is a strong statement. Do not continue without this policy statement.  Check that everybody in the organization has seen it, understands it and can repeat it in his/her own words.  Check that the QMS manual is ready. Don t continue without an approved manual.  Check that the requirements from the standards are fulfilled and that reference is made to at least six procedures, but no more than that are needed.  Keep it simple.  If there is still not sufficient commitment from top management, don’t continue. STEP 9: Draft the Documentation, design the QMS and implement it The implementation has two parts. The implementation of the QMS, and that of the supporting paperwork. The implementation of the QMS is another way of working. Define the structure and get the people involved committed to work accordingly. Introduce the quality manual to the top management. Explain the document structure and how it fits in the QMS. After top management introduction, middle management should be made aware of the document structure. Top management should be showing that they are working according to the leadership principles. After companywide commitment, procedures have to be written. ISO 9000 outlines clearly what has to be documented. What is not needed can be decided by the organization. In principle the employees that work with the documents must write these procedures. The procedures should reflect the actual situation, not the desired one. After the completion and implementation of the procedures, the next level will be the work instructions. Here the same system applies. Get the experts to describe their work and activities. Finally a complete documentation set should be available. It should be noted that only six procedures are required by the standard. Key is that the people involved, work according to these documents. Maintain the QMS for three months before internal auditing should take place. Correct the QMS where needed.

14. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 13 of 100 Checklist at this stage:  Check that the elements of the standards are implemented in the organization.  Elements such as continual improvement, leadership principles and customer orientation.  Check that all the needed procedures have been developed and that the work instructions have been written.  Check that the process owners are involved in the development of the work instructions. STEP 10: Carry out internal audits During the phase of implementation of some three to six months after the documentation has been written, the trained auditors should carry out one or two internal audits covering all activities for the QMS, and concerned management should take corrective action on the audit findings without delay. Wherever required, revise the manuals, procedures and objectives. After each internal audit, the top management should review the effectiveness of the system and provide resources for corrective actions and improvements. Checklist at this stage:  Check that the responsible people have been trained for the internal auditor function.  Record their training results and data.  Check that internal auditors do not audit their own department or work area.  Check that the results of the internal audits are fed back into the system and lead to improvement of the QMS, the processes and the documents.  Check that the results of the internal audits are reviewed on top management level and that appropriate action has been taken.  Check that there is a time schedule for internal audits and that it is maintained. STEP 11: Conduct a Management Review It is important in this stage to have a formal management review that shows the commitment of all levels. The recommendations from this review have to be carried out. Use the Management Review procedure developed for the organization. Checklist at this stage:  Check that the result of the management review is functioning well and that all people involved know what is expected from them. Check the involvement and commitment of the top management.  Check that actions are taken and decisions are made.  Check that the main focus is on the customer s satisfaction.  Check that the decision makers are present. STEP 12: Pre-assessment. Apply for certification Carry out a pre-assessment. Correct the QMS and the documentation where needed. Re-assessment can be done with the help of an external certification body, but also by local consultants or by consultants from the branch organization. On satisfactory completion of the previous step, and if the company decided to obtain third party certification, an application for certification should be made to a certification body. Checklist at this stage:

15. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 14 of 100  Carry out a pre-assessment to win trust and confidence among the people involved in the certification process.  Check that actions are taken and decisions are made based on the results of the pre-assessment.  Check that the right partner has been found to carry out the pre-assessment.  Check that a certification body has been approached for the final assessment. STEP 13: Conduct periodic evaluations and initiate corrective and preventive actions After certification, the organization should periodically conduct internal audits to review the effectiveness of the QMS and see how it can be continually improved. The organization should evaluate periodically if the purpose and goals for which the QMS was developed are being achieved, including its continual improvement. It is needed to look at the organization s overall systems performance and then decide when and where the most effective improvements can be realized. Then objectives have to be set for those improvements and a periodic evaluation has to be conducted to monitor achievements. Improvements could be the reduction of cycle time within a process or the reduction of contamination in a manufacturing process. Checklist at this stage:  Check that periodically internal audits are planned and conducted.  Check that the non-conformities from the final assessment will be solved as soon as possible.  Check that the organization will review its goals and objectives on a regular basis.  Check that management reviews are planned and conducted periodically STEP 14: Evaluation The certification is certainly not the last phase. The people involved need to measure the success of the implementation of the QMS during the implementation process and by the conclusion of the process. Measurements should be made against the original aims and goals and the key indicators of an effective QMS as stated below: Checklist at this stage:  Check that senior management is fully committed to the QMS and owns the appropriate processes.  Check that the QMS is designed around business processes and not around ISO 9001 or any other standard.  Check that staff knows how to access the QMS documentation.  Check that visibility of processes and the clarity of the instructions in the QMS documentation set are clear, concise, readable and understandable. The people involved maintain their own documents  Check that the organizational culture is a culture of opportunities, focused around continual improvement rather than a person-to-blame culture.  Check that the quality management representative is a key organization person rather than a sideline person.  Check that internal auditing is seen as adding value and part of the continual improvement of the QMS.  Ensure that there is continual improvement in system.  Keep up with regular internal audits and Management Reviews.

16. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 15 of 100 ISO 9001 REQUIREMENTS The ISO 9001 REQUIREMENTs has the following clauses; 0 Introduction to ISO 9001 REQUIREMENTs 1 Scope 1.1 General 1.2 Application 2 Normative references 3 Terms and definitions 4 Quality management system 4.1 General requirements 4.2 Documentation requirements 4.2.1 General 4.2.2 Quality manual 4.2.3 Control of documents 4.2.4 Control of records 5 Management responsibility 5.1 Management commitment 5.2 Customer focus 5.3 Quality policy 5.4 Planning 5.4.1 Quality objectives 5.4.2 Quality management system planning 5.5 Responsibility, authority and communication 5.5.1 Responsibility and authority 5.5.2 Management representative 5.5.3 Internal communication 5.6 Management review 5.6.1 General 5.6.2 Review input 5.6.3 Review output 6 Resource management 6.1 Provision of resources 6.2 Human resources 6.2.1 General 6.2.2 Competence, training and awareness 6.3 Infrastructure 6.4 Work environment 7 Product realization 7.1 Planning of product realization 7.2 Customer-related processes 7.2.1 Determination of requirements related to the product

17. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 16 of 100 7.2.2 Review of requirements related to the product 7.2.3 Customer communication 7.3 Design and development 7.3.1 Design and development planning 7.3.2 Design and development inputs 7.3.3 Design and development outputs 7.3.4 Design and development review 7.3.5 Design and development verification 7.3.6 Design and development validation 7.3.7 Control of design and development changes 7.4 Purchasing 7.4.1 Purchasing process 7.4.2 Purchasing information 7.4.3 Verification of purchased product 7.5 Production and service provision 7.5.1 Control of production and service provision 7.5.2 Validation of processes for production and service provision 7.5.3 Identification and traceability 7.5.4 Customer property 7.5.5 Preservation of product 7.6 Control of monitoring and measuring equipment 8 Measurement, analysis and improvement 8.1 General 8.2 Monitoring and measurement 8.2.1 Customer satisfaction 8.2.2 Internal audit 8.2.3 Monitoring and measurement of processes 8.2.4 Monitoring and measurement of product 8.3 Control of nonconforming product 8.4 Analysis of data 8.5 Improvement 8.5.1 Continual improvement 8.5.2 Corrective action 8.5.3 Preventive action

18. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 17 of 100 INTRODUCTION TO ISO 9001 REQUIREMENTS The implementation of a QMS should be a strategic decision of the organization implementing QMS. Various factors influence the design and implementation of QMS. These include – diverse needs and risks of organizations; particular goals and objectives; complexity of products and services provided; number of and complexity of processes employed; and size and structure of the organization. As a result of these and other underlying factors, the ISO 9001 standard does not require uniformity of QMS structure or documentation. The QMS requirements specified in ISO 9001 are complementary to requirements for product. The standard specifies requirements for organization’s QMS, whereas requirements for product come from customers and regulatory authorities. ISO 9001:2008 standard can be used by internal and external parties, including certification bodies, to assess an organization’s ability to meet customer, regulatory and the organization’s own requirements. The quality management principles stated in ISO 9000 and ISO 9004 have been taken into consideration in developing this standard. The present editions of ISO 9001 and ISO 9004 have been developed as a consistent pair of quality management system standards, which have been designed to complement each other, but can also be used independently. Although the two standards have different scopes, they have similar structures in order to assist their application as a consistent pair. PLAN - DO - CHECK - ACT (PDCA) – is a very effective tool for business management and the ISO 9001 standard strongly recommends its use. PDCA is a dynamic cycle that can be applied to each of the organization’s processes, and also to the system of processes as a whole. It may be used to plan, implement, control and continually improve both product realization and other QMS processes. Maintenance and continual improvement of QMS processes can be achieved by applying PDCA to processes at all levels within the organization – from the executive high-level strategic processes, such as business planning or management review to operational processes such as product realization or calibration. Plan: Establish the objectives and processes necessary to deliver results in accordance with customer requirements and the organization’s policies. Do: Implement the processes Check: Monitor and check processes and product against policies, objectives and requirements for the product and report the results Act: Take actions to continually improve process performance ISO 9001 specifies requirements for a quality management system that can be used for internal application by organizations, or for certification, or for contractual purposes. It focuses on the effectiveness of the quality management system in meeting customer requirements. ISO 9004 gives guidance on a wider range of objectives of a quality management system than does ISO 9001, particularly for the continual improvement of an organization’s overall efficiency, as well as effectiveness. ISO 9004 is recommended as a guide for organizations whose top management wishes to move beyond the requirements of ISO 9001, in pursuit of continual improvement of performance. However, it is not intended for certification or for contractual purposes.

19. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 18 of 100 This Standard has been aligned with ISO 14001 in order to enhance the compatibility of the two standards for the benefit of the user community. This Standard does not include requirements specific to other management systems, such as those particular to environmental management, occupational health and safety management, financial management or risk management. However, this standard enables an organization to align or integrate its own quality management system with related management system requirements. ISO 9001-CLAUSE 1, 2 AND 3 CLAUSE 1 SCOPE CLAUSE 1.1 GENERAL ISO 9001-REQUIREMENT This International Standard specifies requirements for a quality management system where an organization a) needs to demonstrate its ability to consistently provide product that meets customer and applicable statutory and regulatory requirements, and b) aims to enhance customer satisfaction through the effective application of the system, including processes for continual improvement of the system and the assurance of conformity to customer and applicable statutory and regulatory requirements. NOTE 1 In this International Standard, the term “product” only applies to: a) product intended for, or required by, a customer, b) any intended output resulting from the product realization processes. NOTE 2 Statutory and regulatory requirements can be expressed as legal requirements. EXPLANATION Your organization must meet requirements consistently and enhance customer satisfaction by effective application of QMS, continual improvement of QMS and providing assurance of conformity to customer and applicable regulatory requirements which can be expressed as legal requirements .Product means any product or service which is required by a customer or intended for a customer and can be output of product realization processes. Ability means that the organization has the capability to determine customer’s needs and requirements; design and develop product; know-how and capacity to manufacture product; package product; deliver on time; provide service and support; etc.. Consistency is being able to repeat your capability within specified parameters for quality as defined by customers, your own organization or regulatory bodies.

20. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 19 of 100 CLAUSE 1.2 APPLICATION ISO 9001-REQUIREMENT All requirements of this International Standard are generic and are intended to be applicable to all organizations, regardless of type, size and product provided. Where any requirement(s) of this International Standard cannot be applied due to the nature of an organization and its product, this can be considered for exclusion. Where exclusions are made, claims of conformity to this International Standard are not acceptable unless these exclusions are limited to requirements within Clause 7, and such exclusions do not affect the organization’s ability, or responsibility, to provide product that meets customer and applicable statutory and regulatory requirements. EXPLANATION All requirements of ISO 9001 are generic and are intended to be applicable to all organisations, regardless of type, size and product provided. Where any requirements of this standard cannot be applied, due to the nature of an organisations and its product, this can be considered for exclusion. Where exclusions are made, claims of conformity to ISO 9001 are not acceptable unless these exclusions are limited to requirements within clause 7, and such exclusions do not affect the organization’s ability, or responsibility, to provide product that meets customer and applicable regulatory requirements. This clause requires to state clearly if any areas of the standard do not apply to the organisations, together with an EXPLANATION of the reason for this exclusion. For example, if you do not design product, but only manufacture product from customer provided specifications, then clause 7.3 Product Design and Development may not be applicable to you. However, if you buy a complete design and manufacture a product to that design and sell it under your own brand name, then you must include Product Design and Development in the scope of your QMS. The rationale here is that if a capability is required or responsibility implied, to meet customer requirements, then that capability must be included in your QMS. It is your responsibility to perform the required capability whether you purchase, outsource or do it yourself. The standard mentioned specifically that in case of exclusions, the organization’s ability will not be affected to supply a product or service that will meet customer expectations. If you do make any exclusion and these exclusions affect your ability or responsibility to meet contracted customer requirements or applicable regulatory requirements, then you cannot claim conformity to ISO 9001. All exclusions, with appropriate justification must be specified in your Quality manual. Your QMS scope must include – specific products; processes; locations; any exclusions from the ISO 9001 standard with appropriate justification; etc.

21. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 20 of 100 CLAUSE 2 NORMATIVE REFERENCES ISO 9001-REQUIREMENT The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO 9000:2005, Quality management systems — Fundamentals and vocabulary EXPLANATION This clause explains that the Fundamentals and vocabulary given ISO 9000:2005 Quality Management Systems -fundamentals and vocabulary, apply. CLAUSE 3 TERMS AND DEFINITIONS ISO 9001-REQUIREMENT For the purposes of this document, the terms and definitions given in ISO 9000 apply. Throughout the text of this International Standard, wherever the term “product” occurs, it can also mean“service”. EXPLANATION ISO 9000:2005 Quality Management Systems -fundamentals and vocabulary, apply. For service industries or for industries where service is also part of customer requirement, wherever the terms product occurs, it will also include service provided by the organization ISO 9001-CLAUSE 4.1 4.0 QUALITY MANAGEMENT SYSTEM EXPLANATION The Quality Management System (QMS) is the means by which the organisations should be managed and controlled. How to do this is entirely up to the top management. However, the system should use processes to achieve this. Those processes consist of a balance between procedures and competencies. The current systems for control may already have much of the detail that is needed for the revised standard. There is an all-embracing requirement to identify the processes, determine their interaction, and ensure that there is enough information to monitor them and to document them where they are needed to maintain control. A process is described in the standard as a set of interrelated or interacting activities, which transform inputs into outputs. Put more simply they are those chains of activities that take place across an organisations and deliver the organization’s products or services to either internal or external customers. Processes are what

22. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 21 of 100 need to be done, which needs to do it and what is the result. Either procedures and/ or competencies will support processes. Procedures and other documents, work instructions etc. define how an activity is required to be done. In the past there has been a perception that the standard requires a detailed description of every activity undertaken by an organisations and this has led to cases of severe over documentation. A quality manual is needed. The standard allows flexibility in respect of its status and structure. It can be part of the overall system, and need only contain the scope of the QMS, processes and any related procedures. System processes need to be detailed. The standard requires control of documents and records per procedure. ISO 9001-CLAUSE 4.1 4.1 GENERAL REQUIREMENTS ISO 9001 REQUIREMENT The organization shall establish, document, implement and maintain a quality management system and continually improve its effectiveness in accordance with the requirements of this International Standard. The organization shall; Determine the processes needed for the quality management system and their application throughout the organization (see 1.2), Determine the sequence and interaction of these processes, Determine criteria and methods needed to ensure that both the operation and control of these processes are effective, Ensure the availability of resources and information necessary to support the operation and monitoring of these processes, Monitor, measure where applicable, and analyze these processes, and Implement actions necessary to achieve planned results and continual improvement of these processes. These processes shall be managed by the organization in accordance with the requirements of this International Standard. Where an organization chooses to outsource any process that affects product conformity to requirements, the organization shall ensure control over such processes. The type and extent of control to be applied to these outsourced processes shall be defined within the quality management system. NOTE 1 Processes needed for the quality management system referred to above include processes for management activities, provision of resources, product realization, measurement, analysis and improvement. NOTE 2 an “outsourced process” is a process that the organization needs for its quality management system and which the organization chooses to have performed by an external party. NOTE 3 Ensuring control over outsourced processes does not absolve the organization of the responsibility of conformity to all customer, statutory and regulatory requirements. The type and extent of control to be applied to the outsourced process can be influenced by factors such as:

23. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 22 of 100  The potential impact of the outsourced process on the organization’s capability to provide product that conforms to requirements,  The degree to which the control for the process is shared,  The capability of achieving the necessary control through the application of 7.4. EXPLANATION The primary focus of clause 4.1 requirements is to manage and control all your QMS processes including product realization processes. QMS includes processes for management activities, provision of resources, product realization, and measurement as part of QMS. Clause 4.1 requires the ‘Process Approach’ to be used in defining your QMS. Documentation of QMS processes and the need for and detail of specific process documentation is determined by ISO 9001, customer, regulatory and your own organizational requirements, complexity of products and processes, effect on quality, risk of customer dissatisfaction, economic risk, effectiveness and efficiency, competence of personnel. Clause 4.2.1d requires you to have documents needed to ensure the effective planning, operation and control for QMS processes. Based on these factors, you must determine what processes need to be documented and how you will document it. Not all processes need to be documented; however your quality manual must include a description of the interaction between your QMS processes. A number of different methods can be used to document processes, such as graphical representations, written instructions, checklists, flow charts, visual media, or electronic methods, etc. Process flowcharts or block diagrams can show how policies, objectives, influential factors, job functions, activities, material, equipment, resources, information, people and decision making interact and/or interrelate in a logical order. Procedures may be an acceptable way to document processes provided they describe inputs and outputs, appropriate responsibilities, controls and resources needed to satisfy customer requirements. Regardless of whether or not you document all of your processes, you must provide evidence of effective implementation of all your QMS processes. Such evidence does not necessarily need to be documented. Clause 4.1c requires you to determine criteria for effective process operation and control. You could determine criteria to control inputs, outputs and resources used. For example Raw materials as an input to production would have acceptance criteria that it must meet before it can be used. Finished product as an output of the production process must meet acceptance criteria before it can be shipped to the customer; The equipment used to transform raw materials into finished product may have set-up and capability criteria or parameters that it must meet in order to produce conforming product. These prevention based criteria (controls) must be established for each QMS process. Note that such controls may also come from the customer, regulatory or industry bodies. Equally important are the specific methods required for effective operation and control of each process. These may include job travelers; work instructions; in process inspection sheet; specifications and drawings; SPC charts; set up checklist; machine manuals; etc. Note these control methods may apply to any or all of inputs, outputs or conversion activities. Under 4.1d, resources for QMS processes may include facility, material, equipment, labor, supplies, utilities etc. Every QMS process will require a different combination of resources. Resource details may be identified in specifications, production schedules, bill of materials, production travelers or routers,

24. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 23 of 100 work instructions, etc. Information for QMS processes will vary from process to process and may include -production schedules, bill of materials, product acceptance and process performance criteria, production traveler or router, work instructions etc. Use clause 4.2.3 and other relevant clauses to control process information. Clause 4.1e requires you to monitor and measure your QMS processes. Clause 8 provides requirements to plan and implement these controls for monitoring and measuring conformity to process performance criteria determined in 4.1c above. Ways to monitor and measure QMS processes may include – tracking against process parameters, goals and objectives, using tools and records such as process check-sheets; product acceptance criteria; SPC records; production records; maintenance records; labor records, etc. More details on monitoring and measuring controls are covered in clause 8. Clause 4.1e requires analysis of QMS processes may be done through a review of measurement and monitoring records and performance indicators for each process. These reviews must identify opportunities to improve QMS processes, use of resources and product quality. Under clause 4.1.f, when process nonconformities occur, then corrective action is required to bring the QMS process under control. Remember, the corrective action process is not just for product related nonconformities. Processes must be continually improved through setting of incrementally realistic, measurable objectives. Planning for continual improvement requires a review of process data, resources and controls to bring about the desired change. Clause 4.1a – 4.1.f must be applied to all QMS processes. Note also that many ISO 9001 clauses (e.g. clause 7.2; 7.4; 7.6; etc.), require specific processes to be established within your QMS, These processes must also be identified and controlled in your QMS. Make sure you include all outsourced processes affecting product quality, in the scope of your QMS. An outsourced process is any value-adding or conversion activity related to your product or service, that is performed by an external organization such as a subcontractor, sister facility, etc. Note that the external organization may perform the outsourced activity at their facility or yours. A manufacturing company may outsource welding, heat treatment or painting of product. A software company may outsource software development. A bank may outsource check clearing services. You must be able to demonstrate sufficient controls over outsourced processes to ensure that such processes are performed according to the relevant requirements of ISO 9001:2008. The nature and scope of such control will depend on the nature of the outsourced or subcontracted process and the risk involved. Outsourced processes may be controlled in any number of ways, e.g., providing the vendor with product specifications; your supplier quality manual that they must meet; asking for inspection and test results or certificates of compliance; validation of outsourced process; conducting product and QMS audits of your vendor; etc. The expectation here is that you flow down to your vendor, the relevant ISO 9001 REQUIREMENTs that you would have to implement, had you performed the process at your own facility. In systematically applying clause 4.1 requirements to each QMS process, we are intuitively using the PDCA approach to development of QMS processes. PLAN will call upon sub-clauses 4.1.a – 4.1e as well as other applicable ISO 9001 clauses as shown above; DO is required by 4.1.f as well as other applicable ISO 9001 clauses CHECK is controlled by 4.1.e as well as other applicable ISO 9001 clauses; ACT is governed by clause 4.1.e-f as well as clause 8.

25. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 24 of 100 AUDIT CHECKLIST Does the QMS address all of the requirements within ISO 9001:2008? Is there evidence that the QMS has been improved over the past year? Have the processes of the business been identified? How have they been documented? Who developed/defined them? Are they reviewed? How do these processes connect or link to each other? Are outputs identified? Is it clear who the customer is of each process? The owner? How are the business processes monitored, measured and controlled? How are improvements identified for these processes? Are any of these processes (or sub-processes within them) outsourced to other organizations who carry them out? If so, how are they identified and how are they controlled? Have any outsourced processes been the root cause of problems either internal or external? MANDATORY PROCEDURE Not applicable Mandatory record: Nor applicable Process map or process flow chart (part of quality manual) EVIDENCE / IMPLEMENTATION DOCUMENT Not mandatory but helps in fulfillment of requirement Different methods used to document processes: Quality manual, Graphical representations, written instructions, checklists, flow charts, visual media, or electronic methods. Process flowcharts or block diagrams can show how policies, objectives, influential factors, job functions, activities, material, equipment, resources, information, people and decision making interact and/or interrelate in a logical order. Methods for effective operation and control of processes: Process flowcharts, block diagrams, job travelers, work instructions, in process inspection sheet, specifications and drawings, SPC charts, set up checklist, machine manuals. Resources for QMS processes may include – facility, material, equipment, labor, supplies, utilities, Resource details may be identified in specifications, production schedules, bill of materials, production travelers or routers, work instructions, etc. Information for QMS processes will vary from process to process and may include – production schedules, bill of materials, product acceptance and process performance criteria, production traveler or router, work instructions, Ways to monitor and measure QMS processes may include – tracking against process parameters, goals and objectives, using tools and records such as process check-sheets, product acceptance criteria, SPC records, production records, maintenance records, labor records, etc. Outsourced processes may be controlled in any number of ways, e.g., providing the vendors with product specifications, your supplier quality manual that they must meet, asking for inspection and test

26. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 25 of 100 results or certificates of compliance, validation of outsourced process, conducting product and QMS audits of your vendors, etc. ISO 9001-CLAUSE 4.2 ISO 9001-CLAUSE 4.2 DOCUMENTATION REQUIREMENTS 4.2.1 GENERAL ISO 9001 REQUIREMENT The quality management system documentation shall include a) Documented statements of a quality policy and quality objectives, b) A quality manual, c) Documented procedures and records required by this International Standard, and d) Documents, including records, determined by the organization to be necessary to ensure the effective planning, operation and control of its processes. NOTE 1 where the term “documented procedure” appears within this International Standard, this means that the procedure is established, documented, implemented and maintained. A single document may address the requirements for one or more procedures. A requirement for a documented procedure may be covered by more than one document. NOTE 2 the extent of the quality management system documentation can differ from one organization to another due to a) the size of organization and type of activities, b) the complexity of processes and their interactions, and c) the competence of personnel. NOTE 3 the documentation can be in any form or type of medium. EXPLANATION Clause 4.2.1 specifies all the different types of documentation needed for your QMS. The need to have additional documentation beyond those specified in this standard may depend upon – customer; regulatory and your own organizational requirements. Other factors to consider may include complexity of products and processes, effect on quality, risk of customer dissatisfaction, economic risk, effectiveness and efficiency, competence of personnel. Clause 4.2.1d requires you to have documents needed to ensure the effective planning, operation and control for QMS processes. Each organization must determine what documentation is needed to achieve this based upon complexity of products and processes, effect on quality, risk of customer dissatisfaction, economic risk, effectiveness and efficiency, competence of personnel. You must have documented statements of your quality policy and objectives. A procedure is a specific way to perform an activity or process, and it may or may not be written. If it is established, documented, implemented and maintained, it is called a documented procedure. A document is information that is written or recorded on some medium such as paper or computer. A document may specify requirements for e.g. a

27. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 26 of 100 drawing or technical specification, may provide direction for e.g. quality plan, or show results or evidence of activities performed for e.g. records. 4.2.2 QUALITY MANUAL ISO 9001 REQUIREMENT the organization shall establish and maintain a quality manual that includes a) The scope of the quality management system, including details of and justification for any exclusions (see 1.2), b) The documented procedures established for the quality management system, or reference to them, and c) A description of the interaction between the processes of the quality management system. EXPLANATION The quality manual is a special type of document that describes your QMS. Besides describing your QMS, your quality manual could provide information on organizational background and capabilities. It may be used by customers, regulatory bodies, suppliers and company personnel for a variety of purposes. There are many acceptable ways to document your quality manual. You must define the scope of your QMS in your quality manual. Your QMS scope should include facilities (manufacturing and support locations), products, processes, Quality Management and other standards, etc. Customers will want to know the extent of your capabilities and the Registrar will want to determine the time and effort needed to audit your organization. Provide details of any clause exclusions from your scope, and justification for it. You must justify all exclusions and remember, exclusions can only be made from clause 7.Your quality manual must include a description of the interaction of your QMS processes. You have flexibility in whether or not to include your procedures and lower level documentation with your quality manual or organize them in some other fashion. You may include all or some of your procedures in your Quality Manual or reference them to your Quality Manual. Keep a listing or index at the front or back of your Manual showing the complete list of your procedures whether included or referenced. As a controlled document, the quality manual is subject to all of the controls in clause 4.2.3. 4.2.3 CONTROL OF DOCUMENTS ISO 9001 REQUIREMENT Documents required by the quality management system shall be controlled. Records are a special type of document and shall be controlled according to the requirements given in 4.2.4. A documented procedure shall be established to define the controls needed a) to approve documents for adequacy prior to issue, b) to review and update as necessary and re-approve documents,

28. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 27 of 100 c) to ensure that changes and the current revision status of documents are identified, d) to ensure that relevant versions of applicable documents are available at points of use, e) to ensure that documents remain legible and readily identifiable, f) to ensure that documents of external origin determined by the org to be necessary for the planning and operation of the quality management system are identified and their distribution controlled, and g) to prevent the unintended use of obsolete documents, and to apply suitable identification to them if they are retained for any purpose. EXPLANATION A document is information that is written or recorded on some medium such as paper or computer. Clause 4.2.1 tells you what documents you must include in your QMS. All documents that you determine under clause 4.2.1 to be needed for your QMS processes must be controlled. This clause 4.2.3 provides requirements on how these documents must be controlled. Documents outside the QMS need not be subject to these controls. This clause requires you to have a documented procedure. Ensure that your procedure specifically addresses each of the control requirements, in terms of who, what when, where and how as applicable. Your procedure must address new and old as well as internal and external documents used by the QMS. You must approve all new QMS documentation prior to issue. Some degree of checking, examination or assessment is inherent in ‘approval for adequacy’. You must periodically determine if any updating or revisions of any QMS documentation is needed, and if they are changed, they must be re- approved for adequacy. The frequency of this review, responsibility and method must be defined in your procedure. This will be determined by events within your organization and how mature or recent your QMS is. Auditors will explore this if they find that your documents have not changed in years, while the nature of your business has changed significantly. Identify changes made to documents so users know exactly what has changed. There are many ways of doing this on printed as well as computerized documents. Have a method for revision control such as a revision log and master-list of documents which identifies the current revision status. Again, there are other ways of doing this as well. Not all documents need to be available everywhere within your organization. You must determine what document is applicable (i.e. needed to assure product or process quality) to a specific process or activity and make the relevant version of that document available to that activity, e.g. providing current packaging and shipping work instructions to the shipping department. Once you determine that certain documents need to be made available at various locations, implement some form of distribution control. There are many ways to do this. One way would be to keep a distribution log. Documents can take a beating in very harsh environments (covered in oil, dust, acid eaten, weather-beaten, etc.) to the point of being illegible. You must regularly review the condition of frequently used hard copy documents to determine whether they need to be replaced. Documents must also be readily identifiable as to its purpose and scope. A simple heading may suffice, (e.g. In-process Inspection Sheet). Computerized documents are sometimes given file names that don’t identify its contents and this might require numerous files to be opened before you find the right one. Identification also implies effective filing for timely retrieval, whether manual or computerized. A frequent nonconformity is not being able to retrieve a document or record because of poor filing procedures. External documents (such as customer drawings or

29. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 28 of 100 supplier material/part specifications) must be identified. There are many ways to do this. One way would be to keep a manual or computer list of these documents. Determine who needs these documents and have some form of distribution control. Don’t overlook supplier, regulatory or industry documents. Apply applicable controls to these as well. Obsolete documents can cause many problems if not controlled. There are many ways to do this. One way would be to provide computerized documents in read-only mode and make only the current version accessible at workstation computer screens. Obsolete hard copy documents can be removed through distribution control. Ensure your procedure a covers methods to disallow unauthorized and unapproved or incorrect documents from being created, used or distributed. If documents are archived, make sure that all such documents are properly identified, indexed and filed, and preferably have controlled or restricted access to them. Nonconformities against the document control process are one of the most frequent audit findings. Develop appropriate performance indicators to demonstrate effective implementation of your document control process. Examples include – number of obsolete or unauthorized documents found being used; number of unauthorized changes found; number of instances documents were not available at points of use; etc. Track trends in these indicators and use this information to tighten your controls and continually improve your document control process. Use the PDCA to plan, implement, measure and improve your document control process. 4.2.4 CONTROL OF RECORDS ISO 9001 REQUIREMENT Records established to provide evidence of conformity to requirements and of the effective operation of the quality management system shall be controlled. The organization shall establish a documented procedure to define the controls needed for the identification, storage, protection, retrieval, retention and disposition of records. Records shall remain legible, readily identifiable and retrievable. EXPLANATION A record is a special type of document that provides written evidence of results achieved or activity performed (e.g. an inspection record). Records provide one of the strongest forms of evidence of maintaining and demonstrating the effectiveness of your QMS. Ensure that your documented procedure for control of QMS records addresses each of the control requirements specified in this clause, in terms of who, what when, where and how. These controls apply to all QMS records whether they are hard copy or computerized. ISO 9001 calls for many records. Some records are specified, while others are implied. The onus is on you to demonstrate or provide evidence (records) of conformity to requirements, whether the specific clauses ask for records or not. Requirements for records may originate from the customer, regulatory, industry, or within your organization. Ensure you maintain records to conform to all of these as applicable. Records may also come from suppliers and vendors. All these records are subject to the above controls. The comments under document control regarding legibility, being identifiable and retrievable apply equally to QMS records.

30. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 29 of 100 Readily identifiable – relates to easily determining the purpose and scope of the record, e.g. an inspection record for a product at final inspection. The design of QMS records must prevent confusion or ambiguity in the completion and use of records. Records must be written legibly to be useful. Also make sure that they are not exposed to unauthorized change or alteration. For the duration that they are kept, store records in locations and mediums that will protect against unauthorized access and environmental damage – (covered in oil, dust, acid eaten, weather-beaten, etc.). Regularly review the condition of records. The indexing and filing of records (hardcopy or computer) must ensure easy retrieval. Keep a listing of all the different categories of records and define the retention times associated with each category (inspection and test; sales and purchasing; management review; calibration; training; etc.). Retention times are typically determined by customer, regulatory, industry or organizational requirements and policies. Records must eventually be disposed-off once past their defined retention times. Disposition could range from permanent destruction of records to permanent storage in a secure onsite or off-site archive. The intent here is to remove the risk of inadvertent use and availability for current activities and unauthorized access. Depending upon the industry, specific records may be kept indefinitely. Nonconformities against the process for control of records arise frequently. Develop appropriate performance indicators to demonstrate effective implementation of your record control process. Examples of indicators could include – number of instances of inability to retrieve records; amount of time spent looking for records; number of instances of incomplete records; number of instances of damaged records found; etc. Track trends in these indicators and use this information to tighten your controls and continually improve your record control process. Use the PDCA to plan, implement, measure and improve your process for record control. AUDIT CHECKLIST An audit checklist should cover these areas: Does the documented Quality Management System (QMS) include a Quality Policy, Quality Objectives, Quality Manual, Procedures, Work Instructions and Records? How does the Quality Manual address the ISO requirements? Does it show the exclusions which are not applicable? Does it have the all the procedures or reference of Procedures? Does it covers the mandatory 6 Procedures and 19 Records, as required by ISO 9001 STD? How QMS are controlled documents identified? (Master List?) Are personnel using up-to-date “instructional” QMS documents? How these QMS documents are kept current? What triggers a review? How was the last new QMS document issued? How was the last change or revision handled? Who approved these changes? How are new/ changed QMS documents communicated? Was any training done? Is there a list of QMS records that are controlled? Verify through sampling that they exist, are legible, are retained, and kept in a secure/safe location. Look at both electronic and paper records. MANDATORY PROCEDURE Clause 4.2.1: Not applicable

31. UNDERSTANDING & IMPLEMENTING QMS IN ACCORDANCE TO ISO 9001:2008 Global Matrix Consultations Mob. +962 78-1-501-940 Email. kmalkawi@gmx.us Page 30 of 100 Clause 4.2.2: Quality Manual Clause 4.2.3: Procedure for control of Document Clause 4.2.4: Procedure for control of Records. Mandatory record: Not applicable Clause 4.2.1: Not applicable Clause 4.2.2: Not applicable Clause 4.2.3: Not applicable Clause 4.2.4: Not applicable EVIDENCE/IMPLEMENTATION DOCUMENT Not mandatory but helps in fulfillment of requirement; Clause 4.2.1: A document may specify requirements (e.g. a drawing or technical specification), provide direction (e.g. quality plan), or show results or evidence of activities performed (e.g. records). Clause 4.2.2: Quality Manual Have a method for revision control such as a revision log and master-list of documents which identifies the current revision status. Distribution log for distribution control, in process inspection sheet-readily identifiable. Some of the documents for external control may be standards such as ISO standards or Engineering specification and also customer drawing Master list of operating procedures, Master list of Work Instruction, Master list of Quality Manual. ISO 9001-CLAUSE 5.1, 5.2 & 5.3 CLAUSE 5 MANAGEMENT RESPONSIBILITY ISO 9001-CLAUSE 5.1, 5.2 & 5.3 5.1 MANAGEMENT COMMITMENT ISO 9001 REQUIREMENT Top management shall provide evidence of its commitment to the development and implementation of the quality management system and continually improving its effectiveness by communicating to the organization the importance of meeting customer as well as statutory and regulatory requirements, establishing the quality policy, ensuring that quality objectives are established, conducting management reviews, and

GMX Understanding & Implementing ISO 9001:2008

Eng. A.karam Al Malkawi

GMX Understanding & Implementing ISO 9001:2008