ISO 9001:2008 – Key Changes

1. ISO 9001:2008 – Key Changes

2. This presentation is intended to identify the changes to ISO 9001:2008 that will have the greatest impact in terms of organisations’ quality management systems. • After completing this course you should be able to: • Understand and explain the key changes to ISO 9001 • Conduct ISO 9001 : 2008 audits (provided that you are qualified ISO 9001: 2000 auditor / lead auditor) Key Changes to ISO 9001

3. Specifies terminology and describes quality management systems Was initially released in 2000 along with ISO 9001, but was updated in 2005 per the normal 5 year ISO review period The ISO 9000 Series of Standards ISO 9001 ISO 9004 ISO 9000 • The aim is improvement of the performance of the organization and satisfaction of customer and other interested parties. • This standard is currently under revision and expected to be released with major changes in 2009. • Specifies requirements for a quality management system • Was expected to be updated in 2005, but because of a 3 year transition period from the 1994 version to the 2000 version, revision was delayed until 2008

4. Overview of Changes introduced by ISO 9001:2008

5. The committee responsible for ISO 9001 notes that: “ISO 9001:2008 has been developed in order to introduce clarifications to the existing requirements of ISO 9001:2000 and changes that are intended to improve compatibility with ISO 14001:2004. ISO 9001:2008 does NOT introduce additional requirements nor does it change the intent of the ISO 9001:2000 standard.” • Many new notes have been included in the 2008 version of the standard to provide further clarification • Cross-references have been added between clauses in the standard to show relationships between clauses Changes to ISO 9001

6. The introduction now includes a reference to “business environment” and “risk” • The update is sowing the seeds for future revisions : • that QMS should be applied to the entire business and should extend past provision of product or service. • introduces risk to the business includes unsatisfied customers Introduction

7. Clarification of regulatory requirements added for consistency within the standard and with other management system standards The term “statutory” added along with regulatory requirements throughout the whole of the 2008 standard The standard now expects that both local and national laws that are applicable to the organization in providing products and services to theircustomers' requirements should be considered Scope(1)

8. Enhanced control required for outsourcing to cover “the type and extent of control to be applied” Clause now highlights that organisations should clarify what controls they have in place for any outsourced products or services Outsourcing (4.1)

9. Example - “the type and extent of control to be applied to these outsources processes shall be defined with the QMS” • Where an organization outsources Training to be delivered, they may write specific details within the Outsourcing process procedures ( which form part of the QMS) such as  • “the trainer must attend the organization’s train-the-trainer process. The organization then requires feedback from the course to evaluate the competency of the trainer”. • In this example, they have defined within the process the types of controls they have over their outsourced training provision.

10. A “record” is now officially a “document” All documentation requirements also apply to records Records are just as much a part of the management system documentation as procedures, work instructions and other documents The revised statement also now covers any record that falls within the scope of the management system Documentation (4.2)

11. The management representative must now be a “member of the organization’s management” team The management representative position should not be an outsourced position The management system is the responsibility of the top management of the organization and therefore the management representative should come from the top management team in the organization Management Representative (5.5.2)

12. The Human Resources clause has been extended to now apply to all staff who can affect “conformity to product requirements” which extends beyond just product quality as in the previous version of the standard The clause now requires competence of any employee that could affect “conformity to product requirements” Human Resources (6.2.1-6.2.2)

13. Example Example: • A delivery driver would not have a direct effect on the quality of the product he is transporting, but would be responsible for the requirement of a safe and/or timely delivery of the product to the customer. This way, this employee is also included in the requirement for competence because his actions could affect product requirements even if it does not affect physical product quality.

14. Supporting services expanded to include information systems Information systems should be included as part of the infrastructure to ensure the agreement for the product/service to be delivered is achieved Infrastructure (6.3)

15. Example: • If an organization includes any sort of order processing system, it should now be included as part of the infrastructure the organization controls within the management system as it is key to conformity to product requirements.

16. Identification of product status should be kept “throughout product realization” A process should be in place at each stage of product realization that ensures the identification and status of the product is known Identification and Traceability(7.5.3)

17. Example: During a chemical treatment to be performed on an item, the paper labeling must be removed but the organization may use a color classification system to ensure identification is maintained during the chemical treatment process.

18. Addition of a requirement that the management team in the area being audited is responsible for “necessary corrections and corrective actions.” The previous version of the standard only stated “actions” but did not specify the types of actions required of the management in response to internal audit findings Now, not only do you have to correct the problem by making a “correction” you also have to ensure that the problem does not recur by initiating a “corrective action” Internal Audit (8.2.2)

19. Example: • During an audit it was observed that Mary Smith did not have the proper competence to perform her job. The correction to the nonconformity is to train her and the corrective action is to develop a process to assess competencies for new employees.

20. Changes include addition of: • “where applicable” in reference to methods for dealing with nonconforming product and; • bullet d) which was previously the last sentence of the clause • The addition of “where applicable” now permits flexibility for solutions for dealing with nonconforming product • Allows for consideration of other ways and other actions that may be taken to deal with nonconforming product Control of Nonconforming Product (8.3)

21. Addition of a requirement to review the “effectiveness” of corrective and preventive actions taken Now, you must ensure any action taken is effective Corrective and Preventive Action (8.5.2 - 8.5.3)

22. Example: • A nonconformity was raised on a process for scanning documents. Two sided documents were only being scanned on the front side. • The corrective action was to implement a checklist to confirm the requirements for scanning the document. Reviews were later carried out to show that implementation of the checklist improved the scanning process in other ways than just ensuring both sides were scanned and the new process was considered more effective.

23. ISO 9001:2008 introduces no new requirements, but introduces clarifications to the existing requirements of ISO 9001:2000 based on eight years of experience of implementing the standard world wide  Changes have been made to clarify interpretations and existing requirements based upon feedback from users  Using the eight management principles that underpin ISO 9001, an organization can improve the way they view and use their management systems Summary

24. Thank you!