ISO9001 IAT.pptx

ISO 9001: 2015
Quality Management System
Internal Auditor Training

ISO 9001: 2015 STRUCTURE
The standard is modeled
around the ISO Directive
Annex SL, a high level
structure (HSL) based on
the Plan-Do-Check-Act
methodology and
common language
developed by ISO for use
in all new management
system standards.

ISO 9001: 2015 STRUCTURE Cont.
The new
9001:2015
standard
comprises of ten
clauses instead of
the previous eight
used in the ISO
9001:2008.

1. Scope
2. Normative References
3. Terms and Definitions
4.Context of the
Organization
5. Leadership
6. Planning
7. Support
8. Operation
9. Performance Evaluation
10. Improvement
1.Scope
2.Normative Reference
3.Terms and Definitions
4.Quality
Management System
5.Management
Responsibility
6.Resource Management
7.Product Realization
8.Measurement, Analysis
and Improvement

The use of Annex SL across all management system
standards will aid in the integration of different
systems as almost a third of text is common across
all standards under Annex SL.

CLAUSE:
1. Scope
2. Normative References
3. Terms and Definitions
1-3 -> Non auditable Clause
4-10 -> Auditable Clause

Context of The
Organization
Clause 4

4.1 Understanding
This clause is looking to require companies to
identify, monitor and review issues that are
relevant to the organization in terms of its
performance that could have an impact on its
quality management system.
Most successful businesses will already be
monitoring such issues; however they are now
required to provide evidence of this for assessment
purposes.

4.2 Understanding The Needs and Expectations of
Interested Parties
Organizations are being asked to identify ‘relevant
requirements’ or ‘relevant interested parties’ and,
once identified, monitor and review such
information.

Interested parties could be groups or individuals,
(such as suppliers, employees, shareholders,
neighbors, etc.) who could impact on the
organization’s ability to provide the product and/or
service that meet their customer’s requirements, as
well as those of any legal and regulatory nature.
As with the Clause above most successful
businesses will already be monitoring their
interested parties, but they are now required to
provide evidence of this for assessment purposes.

4.3 Determining The Scope of The Quality
Management System
The scope of the quality management system (QMS)
sets its boundaries, identifying what requirements
of the QMS are applicable to and what are not. It
should be done with consideration of the
organization’s context (what your company does,
what it wants to achieve, who you supply to, etc.) as
well as the products and/or services it supplies; the
scope shall be documented.

4.4 Quality Management System and Its Processes
This clause requires organizations to establish
processes that, once established, are maintained
and continually improved. Organizations are also
asked to set performance indicators that enable the
effective operation and control of the processes
established by the organization.

Context of the Organization 14
Context of the Organization

4.1 Understanding the organization and its context
The organization shall determine external and internal
issues that are relevant to its purpose and that affect its
ability to achieve the intended outcome(s) of its QEHS.

Requirement here is to;
— Understanding the organization, and
— Understanding its context (business environment)

Understanding the
Organization

What is an organization?
person or group of people that has its own functions with
responsibilities, authorities and relationships to achieve its
objectives.

Understanding the organization
— Mission (organization’s purpose for existing as expressed
by top management)
— Vision (aspiration of what an organization would like to
become as expressed by top management)
— Strategy (plan to achieve a long-term or overall objective)

Understanding the organization
— Policy (intentions and direction of an organization as
formally expressed by its top management)
— Objective (result to be achieved)
— Core values, culture, beliefs, guiding principles

Understanding its Context

context of the organization
combination of internal and external issues that can
have an effect on an organization’s approach to developing
and achieving its objectives.
“context” here refers to;
— business environment
— organizational environment
— ecosystem of an organization

Issues
Issues are important topics for the organization, problems
for debate and discussion, or changing circumstances
that affect the organization’s ability to achieve the
intended outcomes it sets for its QEHS management
system.
Issues can include;
— positive and negative factors or conditions for consideration

To understand which issues are important, the
organization can consider those that;
—are key drivers and trends, affecting the objectives of the
organization;
—can present problems for the organization;
—can be leveraged for beneficial effect, provide safe and
healthy workplaces;
—offer competitive advantage, avoiding direct / indirect cost,
value for customers, or improvement of the organization’s
reputation and image.

external context
external environment in which the organization seeks to
achieve its objectives
Note:
External context includes; cultural, social, political, legal, regulatory, financial,
technological, economic, natural and competitive environment, whether
international, national, regional or local (PESTLE)
External Issues gives raise to Threats & Opportunities

internal context
internal environment in which the organization seeks to
achieve its objectives
NOTE: Understanding the internal context can be facilitated by considering issues
related to;
— core values,
— culture,
— knowledge and
— performance of the organization (capabilities & constraints).
Internal Issues gives raise to Strengths & Weaknesses

intended outcome
what an organization intends to achieve by implementing
its QEHS.

minimal, core outcomes;
QMS EMS OHSMS
— “consistent” products &
services;
— “enhancing” customer
satisfaction
— achieving QMS results
(Objectives & KPIs)
— “enhancing”
environmental
performance;
— fulfilling compliance
obligations (LOR)
— achieving environmental
objectives.
— “enhancing” OH&S
performance;
— fulfilling compliance
obligations (LOR)
— achieving OH&S
objectives.

positive or negative, in line with;
— Purpose of the Organization’s existence
(Mission)
— Aim / Goals of the Organization (Vision)
— Strategic direction
Issues / Factors / points for
considerations
External Issues
Political, Economical, Social,
Technological, Legal & Environmental
factors whether international, national,
regional or local; (PESTLE)
Internal Issues
values, culture, knowledge and
performance of the organization -
capabilities and constraints
Determine
(on-going review & monitoring)
Intended outcome of QEHS

Understanding the needs &
expectations of Interested Parties

interested party (preferred term) /
stakeholder (admitted term)
person or organization that can affect, be affected by, or
perceive itself to be affected by a decision or activity
Note : to “perceive itself to be affected” means the perception has been made
known to the organization.

Overview
— interested parties are also part of organization’s
context (internal or external) and should be considered
when reviewing its context.
— interested parties can change over time (as a result of
changes in external & internal issues) and can depend
on the sector or industry or the geographic location in
which organization operates, so are their needs &
expectations.

Overview
— developing a relationship with interested parties
enables communication which can lead to potential for
building mutual understanding, trust and respect
— creates synergy

relevant
Interested Parties
(Stakeholders)
Determine
(on-going review & monitoring)
relevant Requirements
(needs & expectations)
External & Internal Issues
(4.1)
Compliance Obligations
(6.1.3)
that can affect, be affected by, or
perceive itself to be affected by
Risks & opportunities
(6.1.1)
4.2

Which of these relevant needs and expectations from
relevant interested parties becomes its compliance
obligations – LOR (6.1.3)
• Indoor air quality, indoor noise, lux level, SWL
• Licensing requirements for operating a facility etc.,
Legal requirements (has to comply with)
• Customer requirements
• Voluntary codes and
• Agreements with community groups or public authorities
Other requirements (has to or chooses to comply with)

Examples of relevant
interested parties
Relationship
Examples of relevant
needs and expectations
References
Outline related Issues,
identified if any
Investors By responsibility
Non-governmental
organizations (NGOs)
By influence
Neighbours, the community By proximity
Employees By dependency
Industry membership
organization
By representation
Regulatory or statutory
agencies
By authority

Reviewing its Context

establish a process / methodology for reviewing its
context
 practical approach, that adds value to the organization
 provides a high-level, not detailed conceptual
understanding of the important issues that can affect,
either positively or negatively, the way the organization
manages its QEHS
 involve a cross-functional team (design, sales &
marketing, procurement, production, engineering,
finance, human resource, etc.,)

establish a process / methodology for reviewing its
context
 consider life-cycle perspective (upstream &
downstream), taking into consideration of its authority &
ability to control and influence

The review can include the following key areas;
—identification of relevant external & internal issues, which relate
to the organization’s activities, products and services that can
impact the organization’s QEHS performance.
—consideration of how these issues can affect the organization’s
purpose and ability to achieve the intended outcomes of its
QEHS.

Understanding of its context should result in knowledge
that can be used to assist the organization in;
— setting the scope (boundaries & applicability) of its QEHS (4.3)
— determining risks & opportunities (6.1.1)
— developing or enhancing QEHS policy (5.2)
— establishing its QEHS objectives (6.2)
— determining the effectiveness of its approach to fulfil its compliance
obligations – LOR (6.1.3)
— identification of opportunities to improve its QEHS performance (10.3)

Determining the scope of QEHS

Determining the
QEHS Scope (4.3)
(boundaries & applicability)
Documented
information
made available to
relevant
interested parties
Consider;
a) External / Internal Issues (4.1)
b) Needs & Expectations of IPs
(4.2)
c) its organizational units,
functions and physical boundaries;
d) its activities, products and
services;
e) take into account the planned or
performed work-related activities.
f) its authority and ability to
exercise control and influence
(considering life cycle perspective)

Overview – Scope of qEHS;
— specific to the organization
— intended to clarify the physical, functional and organizational
boundaries (it may include the entire organization or specific operating
units of one or more locations)
— understand the extent of control or influence that it can exert (authority
& ability) over activities, products and services (considering a life-cycle
perspective – both upstream and downstream)

Overview – Scope of QEHS;
— critical to the success of QEHS and to organization’s credibility
and reputation (to ensure that the scope is not defined in a way that
excludes activities, products, services or facilities that have or can
have significant QEHS risks or in a way that evades its compliance
obligations, or misleads interested parties)
— factual and representative statement of the organization’s operations,
or business processes included within its boundaries

Overview – Scope of QEHS;
— Scope should be reconsidered (when the organization changes its
sphere of control or influence, expands its operations, acquires / divests
business lines or property)

QEHS & its Processes

Purpose
(Mission & Vision)
Strategic direction
Understanding the Organization
Understanding the
Context
4.1 4.2
QEHS Scope (boundaries & applicability)
4.3
QEHS Management System
(4.4)
QEHS
Requirements
Business Processes
- Core process
- Support process
- Management process
=
+
Integrate / Embed (5.1.c)
PDCA is an
on-going, iterative
process to enhance
QEHS performance
with a commitment to
continual
improvement of IMS.

Leadership and
Commitment
Clause 5

5.1.1 Leadership and Commitment to The Quality
Management System
This clause will require management to demonstrate
their leadership and commitment to the quality
management system by taking responsibility for the
effective running of the organization’s quality
management system.

They can do this by ensuring that the organization’s
quality policy, quality objectives and commitment is
consistent with the organization’s overall business
plan.
Top management shall also ensure that the
requirements of the quality management system are
aligned with the organization’s business practices
and they should promote awareness of the system
throughout their organization.

5.1.2 Customer Focus
Top management are required to take the lead in
demonstrating customer commitment within the
organization by ensuring that all applicable
statutory, regulatory and customer requirements
are identified and achieved while, at the same time,
ensuring that the organization continues to provide
the products and services expected by their
customer.

5.2 Quality Policy
5.2.1
Top management are required to establish a quality
policy that is in line with the purpose and context of
the organization (see clause 4.1) while, at the same
time, providing a framework for the organization’s
quality objectives and the basis on which the
improvements in the quality management system
can be achieved.

5.2.2
The policy shall be available as documented
information and communicated and understood
throughout the organization and by relevant
interested parties.

5.3 Organizational Roles, Responsibilities and
Authorities
Top management need to ensure that individuals are
given the responsibility and authority to enable them
to carry out their duties in line with the requirements
of the quality management system.

Planning
Clause 6

6.1 Actions to Address Risks and Opportunities
6.1.1
Organizations are required to think about the
internal and external issues they face and the
relevant requirements of their interested parties
and how this may impact on their quality
management system. The organization must then
determine the risks and opportunities that need to
be addressed. This is in order to provide
confidence that the quality management system
can achieve its intended outcomes and to achieve
continual improvement.

6.1.2
Once the organization has identified the risks and
opportunities it faces, it must then determine how
it wishes to address these; however the
organization may take an informed decision to keep
the risk, in effect taking no action beyond
identifying and evaluating the risk or opportunity.

6.2 Quality Objectives and Planning to Achieve
Them
6.2.1
This Clause requires an organization to set quality
objectives for relevant areas within its quality
management system. It is for the organization to
decide which areas are relevant. The quality
objectives must be consistent with the
organization’s quality policy and be relevant to
products and services it provides, and the
enhancement of customer satisfaction.

Quality objectives must be measurable, take into
account applicable customer, statutory and
regulatory requirements and be monitored in order
to determine whether they are being met. They
must also be communicated across the organization
and be updated as and when the need arises.

6.2.2
The organization must undertake planning in order
to determine how its quality objectives will be
achieved.

6.3 Planning of Changes
When the organization decides that there is a need
to change the quality management system, they
are to be carried out in a controlled manner.
Changes need to be planned and then acted upon.
The organization needs to be clear as to what it is
attempting to achieve.

Support
Clause 7

1. Resources
1. General
Requires an organization initially to determine and
then subsequently provide the resources necessary
to establish, implement, maintain and continually
improve its quality management system.

7.1.2 People
This requires an organization to provide those
people necessary for the effective operation of its
quality management system and its processes in
order that it can consistently meet customer,
statutory and regulatory requirements.

3. Infrastructure
Requires an organization to identify, provide and
maintain the infrastructure necessary to enable
processes to operate effectively.
4. Environment for The Operation of Processes
Requires an organization to “determine, provide
and maintain” a suitable environment for the
business to operate.

7.1.5 Monitoring and Measuring Resources
Where an organization uses monitoring or
measuring to demonstrate that its products and
services conform to requirements, it must make
sure that it provides the necessary resources to
ensure that its monitoring and measuring results
are valid.

7.1.6 Organizational Knowledge
This requires an organization to ensure that it has
or obtains the knowledge necessary to respond to
changing business environments, changing
customer needs and expectations and, where
applicable, related improvement initiatives.

7.2 Competence
The organization must determine the competency
levels necessary for those people performing work
under its control. Once these competency levels
have been determined, the organization must then
ensure that those people possess the necessary
competencies, either on the basis of their
education, training or experience.

7.3 Awareness
The requirements apply to all “persons doing work
under the organization’s control” – this can include
contractors. People doing work under the
organization’s control are to be aware of the
organization’s quality policy, any quality objectives
that are relevant to them, how they are
contributing to the effectiveness of the QMS and
the implications for not conforming to the QMS
requirements

7.4 Communication
An Organization must determine how it wishes to
communicate on QMS matters, to whom it will
communicate and when such communications will
be made.

5. Documented information
1. General
An Organization’s quality management system
should include documented information required
by the standard and that identified by the
organization as being necessary for the effective
operation of their quality management system.

7.5.2 Creation and Updating
When documented information is created or
updated, the organization must ensure that it is
appropriately identified and described and
reviewed and approved for suitability and
adequacy.

7.5.3 Control of documented information
7.5.3.1
An Organization is required to control documented
information in order to ensure that it is available
where needed and that it is suitable for use.
7.5.3.2
The organization must determine how it will
distribute, access, retrieve and use documented
information.

Operation
Clause 8

8.1 Operational Planning & Control
Requires an organization to plan, implement and
control processes identified in clause 4.4 in order to
meet requirements for the delivery of their
products and services and to put into place the
actions determined as a result of risk assessment

8.2 Determination of Requirements for Products &
Services
Requires an organization to put processes in place to
enable communication with clients on matters relating to
their products and services. To put in place processes to
ensure product or service requirements are known and
that any statutory and regulatory requirements including
customer requirements are also known. To review the
requirements related to their products and services and
those specified by their customer, including any statutory
and regulatory requirements.

8.3 Design and Development of Products and Services
Requires an organization who designs and develops their
own products and services to implement a design and
development process, plan and control the design and
development of products or services, determine specific
inputs into its design and development process, apply
controls to design and development process, ensure that
outputs from design and development process meet input
requirements and that changes to the design and
development input or output must be controlled

8.4 Control of Externally Provided Products and
Services
Requires an organization to ensure that externally
provided products and services meet specified
requirements; they shall decide the type and extent
of controls it wishes to apply and the information it
needs to give to external providers.

8.5 Production and Service Provision
Requires an organization to control the way they
supply their products and services, to be able to
identify and trace their product and service, if
necessary, to take care of property belonging to
customers or external providers and to preserve its
product. It also requires an organization decide on
the extent of post-delivery activities and to control
of changes made to the provision of their product
or service.

8.6 Release of Products and Services
Requires an organization carry out checks to
ensure its products and services are correct and
meet all necessary requirements before release to
their customers.

8.7 Control of Nonconforming Process Outputs,
Products and Services
Requires an organization to ensure that any issues
or problems with their products and services are
identified and controlled so that they are not used
or delivery to customers. Actions will be taken to
correct any problems this includes where the
product or service has been delivered.

Performance Evaluation
Clause 9

9.1 Monitoring, Measurement, Analysis and
Evaluation
Requires an organization to decide what needs to
be monitored and measured to ensure they fully
understand the performance of their management
system. The organization shall monitor their
customer’s satisfaction in relation to their opinion
of their products and services and they shall
analyze and evaluate data and information
relevant to their business and management system
operation.

9.2 Internal Audit
Requires an organization to carry out internal
audits of their management system at regular
intervals and to create a structure to plan,
establish, implement and maintain an audit
program that will detail the objectives of the audit
program including the scope, who will be carrying
out the audit and when they will take place.
Results of these audits will be made available to
senior managers to review at their management
review meeting.

9.3 Management Review
Requires an organization’s top management to
review the organization’s management system at
regular intervals using information gathered during
the review period.

Improvement
Clause 10

10.1 General
Requires an organization to find opportunities for
improvement in relation to their management
system with a view to enhance customer satisfaction

10.2 Nonconformity and Corrective Action
Requires an organization to act when
nonconformity is identified, take action to control
and correct it and deal with any consequences.
They should also take action to ensure that the
issue doesn’t occur elsewhere

10.3 Continual Improvement
Requires an organization to continually improve the
performance of their management system

ISO9001 IAT.pptx

Recommended

Recommended

More Related Content

Similar to ISO9001 IAT.pptx

Similar to ISO9001 IAT.pptx (20)

Recently uploaded

Recently uploaded (10)

ISO9001 IAT.pptx