Creating ISO 9001:2015 Quality Management Systems

Starting the Journey to ISO 9001 Certification

Creating ISO 9001:2015 Quality Management Systems (QMS) that fulfills the requirements of the ISO Standard can seem like a daunting task.  But it doesn’t have to be.  Creating an ISO 9001-based QMS should be done like all projects.  Priorities need to be established, responsibilities determined, and milestones set.  But what priorities?  What are the key milestones?  How do you get started?

By presenting one possible approach to implementing ISO 9001, we will answer these questions in this section of the introduction.  To simplify the discussion, we will divide the ISO QMS implementation project into four distinct phases. By breaking the implementation into stages, it becomes more manageable and less overwhelming.

At Bizmanualz, we have helped a number of small and medium sized businesses move from having no QMS to becoming ISO 9001 certified.  It is a process that usually takes about six months, but it can be done in three to four months for very small companies.  It could take 12 to 18 months for a larger company.  This includes establishing all the required elements of the ISO Quality Management System and getting it off the ground functionally using ISO 9001 Quality Procedures Manual.

One way to establish priorities and milestones is to use the organization of the ISO 9001:2015 QMS Requirements itself as a pro-forma project plan.  The project we describe in this section is heavily influenced by the layout of the requirements. Recall, however, that the ultimate goal of ISO 9001 QMS is continual improvement.  So, to gain the benefits of improvement, an organization has to be committed to maintaining and modifying the system over time to best suit its needs.  Creating the ISO 9001 QMS is just the beginning.

Create an ISO Implementation Plan

Since the best approach is to treat your ISO 9001:2015 transition plan as a project, you should start with a project plan that estimates the resources needed (people, materials, expertise) and the project timeline from the beginning until the certification audit.  If you have experience and knowledge of the ISO 9001 requirements, you might begin with a gap assessment, which provides input into the project plan.  A gap assessment is just as the name describes – comparing current systems and documentation to what is needed for a system that is ISO 9001 compliant.

If you don’t feel comfortable with the ISO 9001:2015 Changes to the standard, then perhaps the first step is ISO training for you and members of the project team or ISO Steering Committee.  The ISO Steering Committee includes key members from the quality department along with representatives from other departments such as Sales & Marketing, Design & Development, Human Resources, Production, and Accounting.

The Steering Committee members provide valuable input to the ISO 9001 QMS development project about systems and processes, they divide up tasks and actions items, and assist in distributing important information throughout the organization.  But remember, involving a committee can also take more time as you wait for meetings in order to make decisions and follow-up on actions.  So be sure to build such delays into your project plan.

Phase 1 – Start with Clause 4 of the ISO 9001 Standard

The QMS really starts where the ISO 9001 General Requirements begin – in Clause 4, and that is where the efforts of phase one are focused.  Start by defining the context of the organization. Define who the interested parties are. Build a table that lists their needs, expectations, and objectives. Prioritize them. And give them a power and interest rank.

Communications Plan

Develop a communications plan addressing each interested party’s needs. Consider what part of the quality system should be communicated and when. There are many ways to accomplish this and we list an example chart below. Be creative and this of your own communication methods. Then practice the communication plan.

Note: meetings are a default communications method not listed here.

Communication Methods

• AP Annual Report summarizes the annual results shareholders.
• FS Financial Statements summarize financial results.
• MN Monthly Newsletter highlights performance and improvements.
• PS Posted Signage.
• IW Internet Website.
• SM Social Media.
• RE Regular Email sent as needed to alert interested parties.
• EP Provider Scorecard compiled monthly for external providers.
• PD Process Dashboard summarizes QMS status.
• PR Periodic Reports provides summaries and details.
• CT Contracts define requirements for doing business.

Define Your ISO Processes Procedures

ISO 9001:2015 Procedures Manual

It is well established that ISO 9001 is a process-based standard, and the General Requirements listed in clause 4.4 establish this clearly:

1. Determine the processes of the QMS
2. The sequence and interaction of those processes
3. Identify process risks and controls
4. The criteria and methods used to ensure QMS processes are effective
5. Ensure availability of resources and information to operate and monitor the processes
6. Monitor and measure and analyze the processes
7. Continually improve the processes

The first four items are the focus while setting up your ISO QMS.  The remaining three become central as you maintain the ISO QMS and use it to improve the organization.

Therefore, step one in creating the ISO 9001 QMS is to understand and define the processes of the QMS.  Understanding your processes is the key to a functional QMS.  There is a scope question each organization has to answer (which will also eventually be included in the Quality Manual).  Exactly what processes will be part of the ISO 9001 QMS?  The ISO 9001 QMS could encompass the entire organization, a particular facility, or perhaps just a single product line.

One way to get started defining processes is to consider the over-arching, top level processes that convert supplies and resources (i.e., materials, knowledge, and capital equipment) into customer deliverables.  Figure 3 shows an example of defined processes in an organization.  If necessary, once top level processes are defined, you can identify key sub-processes that make up the top level process.  Notice that Figure 3 also displays the interaction of the top level processes.  Be sure to identify the process owners who have ultimate responsibility.

Creating the First Level of ISO 9001 Documents

Once the QMS processes are defined, you are ready to start the next step in phase 1: creating the first level of documentation.  The first document tier in the QMS may consist of the Quality Manual, the Quality Policy, and the Quality Objectives.

Figure 3: Example of Organization Processes

By having already clearly defined the QMS processes, creating a draft of the Quality Manual is easier since you have already determined much of the key content.  Remember, the description and interaction of the processes in the Quality Manual does not have to be large amounts of text.  Diagrams, process maps, and flow charts all describe processes just as well as, if not better, than written descriptions.  Also, be sure to list all exclusions your organization has to the ISO 9001 QMS.

Exclusions are ISO 9001 requirements that do not apply to your organization.  Sometimes you exclude minor requirements; sometimes you exclude large sections.  For example, a contract manufacturer that does not do any design and development can exclude large parts of Clause 8.  If you never have possession of customer property then you would want to exclude that clause.  Failure to properly exclude or trying to over-exclude are common issues when developing an ISO 9001 QMS.  Be sure to review exclusions carefully.

Completing Phase One with a Quality Policy, Objectives, and Document Control

At this point you have completed two crucial steps on your way to ISO compliance – defined processes and a draft of the Quality Manual. The next step is to write drafts of the quality policy and quality objectives.  Remember, the quality objectives should be measurable and align/fulfill the quality policy.  Just start with drafts for now, they don’t have to be perfect.  But is it helpful to have a working draft of these key documents before you move forward.

The last step for phase one of your ISO QMS project is to create the documented information control system that will be used for the QMS documents.  How is documented information reviewed and released, updated, stored, and retrieved?  These questions should be addressed in ways that meet the requirements for documented information control established in Clauses 7.5.3.

Now, at the end of phase one, you have fulfilled most of the requirements established in Clause 4 of the ISO 9001 QMS Requirements, and you have also created the framework for meeting the additional requirements in other clauses of  ISO 9001.  While you may only have drafts of the quality manual and document and record control procedures, having a good draft in place represents a majority of the effort.  Hopefully you will only need to make minor additions and revisions to them as you continue on your ISO 9001QMS project path.