The certification process for ISO 9001 requires an extensive external audit to ensure the requirements of the standard are being met and the company is conforming to the standard and their own Quality Management System (QMS). For an organization to succeed in these stages of audits, it is crucial to ensure they are implementing the system according to the standard and their businesses needs, not simply using blanket statements to satisfy the auditor. Your organization should strive to set up an effective management system that will help your business thrive.

What is the Purpose of an Effective QMS?

The overarching purpose of a quality management system is to ensure your business is operating effectively, and in a way that not only sustains itself using smart practices but produces goods and services of the highest quality.

For an example of how a QMS can help your business use better practices to achieve quality results, let’s explore ISO Standards and Training. Your business needs to be dynamic in nature, as processes and procedures are constantly changing alongside a changing market. Your team needs to be adaptive and so do your processes.

ISO 9001:2015 has an increased emphasis on Management Reviews, which should be a cause for celebration, not concern. This is where your staff members can demonstrate to their management better modes of operation that allow them to make superior products and present these to upper management. It is during these reviews that upper management should be reviewing the evidence and crunching numbers to determine if old practices or “the way it’s always been done” is truly the best course of action in this expanding global market. If it’s not, management needs to review their process and determine the best course of action for improvement.

This improvement can be provided through external learning as well as company training programs. These training activities could be development sessions or team-related activities and are great opportunities to communicate your organization’s commitment to employee growth and ideas and demonstrate what your company needs from each employee.

What to Consider When Setting Up Your QMS

No two quality manuals should ever be the same. This is because no two businesses are the same. Even within a multi-site operation, your two locations operate with different sets of shared experiences, successes and hardships that need to be considered when you set up your processes.

For example, if you run a multi-site operation with one location providing mostly warehouse operations, and the other providing office and administrative duties, you should not have the same manual dictating hiring needs. The training requirements for your warehouse could be far more extensive and may even be legally mandated compared to those who work in the administration buildings. You might also need different onboarding training to follow, as warehouse workers might need to be trained for ergonomics differently than those who spend 8 hours at a desk.

You don’t treat the hiring processes the same, so don’t assume your whole process manual can be the same.

It is here in the process that you may want the help of a consultant. Consultants should be seen as an important resource for your organization, even an extension of your own team, who take the time to learn about your unique situations and develop a plan alongside you that not only follows the standard you are looking to certify to, but also pushes your organization towards continued and sustainable growth. If you have an internal quality department, consultants can also act as an impartial team member to help your organization prepare for your certification audit.

Another thing to consider when setting up your QMS is not to be afraid of NCR’s and OFI’s. Non-conformities and opportunities for improvement should be celebrated in the early stages of your certification journey. You want to find holes and problems from your consultant and internal auditors, and you do not want to hide things from your auditor. It is here that you can discover problems and implement solutions prior to your third-party certification audit. Use these audits to switch your mindset of the audit process.

So, how can you ensure your QMS is effective? Easy, don’t assume copying-and-pasting another organisation’s manual will help. If you state in your manual that you perform a process a certain way, and if in practice you don’t follow that process, well that’s an NCR. Write your manual specifically for your organization, either through your own internal quality department, or with the help of a consultant, or both. Use audits as a way to grow, not as a way to stress. And lastly, use management reviews to grow your business, not waste your time. Time is money they say, so be mindful how you are using management review meetings.

Some food for thought: Effective management systems will do nothing but help your organization, but an ineffective management system is the reason organizations don’t like ISO 9001. Consider this when you are pitching the idea of implementing an ISO Standard to your organization.

A key to understanding ISO Standards is to understand the 7 Quality Management Principles that Standards are based on. We have summarized the key points for you here.

What is ISO 13485

Specifically developed for the manufacture of medical devices, ISO 13485’s primary objective is to help facilitate harmonized medical device regulatory requirements in the industry. It contains a comprehensive list of requirements meant to guide organizations that belong to the pharmaceutical supply chain by referencing specific requirements for the manufacture, installation and servicing of supplies. Its applicability is extended by the fact that it is useful to companies that operate in any tier of the industry, with a special focus on organizations that service medical device manufacturers.
Despite it being based upon ISO 9001, ISO 13485 shifts its focus from continual improvement to meeting regulatory requirements and risk management. The system aligns its requirements to match those of the FDA and other foreign regulators, which provides it with the framework to expand upon with further regulatory as well as customer requirements.

Why is it important?

The requirements of ISO 13485 are flexible enough to be applicable to any organization within the production line regardless of their size. These organizations could be involved within design, production, distribution, servicing or even external suppliers. ISO 13485 establishes specific requirements for organizations to follow through on to ensure that they can meet customer and regulatory requirements.
Because of its versatility and range within the market, ISO 13485 has become a staple necessity for organizations in the market, especially competitive ones.

How do you become certified?

The process of becoming certified to ISO 13485 involves developing a management system based on the standards’ guidelines customized to your company and then hiring a recognized third party to conduct regular audits.

The primary objective of your management system development process must revolve around your product policy and quality manual; these set the basis for the implementation of the system. Starting with management support and identifying the customer requirements for the management system, you will need to start with defining your quality policy, objectives, and manual which will work to determine the scope and extent of implementation of the management system.
Additional processes and procedures – including mandatory ones, need to be created to ensure efficient delivery of products and services. For this, you must consult the list of mandatory documents required by ISO 13485:2016.
Once all of this is accomplished, your management system will need to be operational for a period to collect necessary records and documentation required for audits and system reviews to become certified. This length of time will be stated by your certification body.

Steps to Get Certified:

Internal audit- Provides the ideal opportunity for you to check that all the records are in place and to verify that all the processes of the management system are being followed and there is total compliance.
It also serves as an opportunity to investigate potential issues and threats and to rectify them prior to a third-party audit. For this reason, the internal audit needs to be followed up with a Management Review.

Management review- A formal review conducted by management to meticulously go over the management system processes and make appropriate decisive plans and assign resources based on them. Certain key variables need to be looked upon based on the results of the internal audit and action plans must be created that will need to be implemented within a reasonable timeframe. These new procedures must be communicated with all relevant parties prior to being set in place.
Corrective Procedures- Any previously identified non-compliances or opportunities for improvement found during the internal audit need to be resolved with procedures set in place to ensure this. Documentation, procedures and results shall be kept for third-party certification auditor’s review.

Certification:

After these actions have been performed, the organization will begin the certification process which is further divided into 2 stages, Documentation Review (Stage 1) and Certification Audit (Stage 2).

Documentation Review – Auditors from the selected certification body will review all company documentation to ensure it meets the ISO requirements.

Certification Audit – The certification body will conduct a comprehensive audit of your organization to assess whether your activities conform to ISO 13485 as well as your own provided documentation.

If your certification body deems it fit, your company will become certified after these steps.

by Kyle Chambers of Texas Quality Assurance

Competence, Training, Awareness….  Organizational Knowledge too?

When compared to the ISO 9001:2008 standard the requirement in ISO 9001:2015 is more heavily weighted towards Competence.  In facilities, where competence is often based on compliance to a WPS or ASNT training, along with standard common in house training such as Control of Nonconforming Outputs some simple systems are required to effectively identify and track these records.

By utilizing the method detailed in this post, you will be able to develop a complete, comprehensive and well-executed Competence, Training and Awareness program.

Organizational Knowledge | ISO 9001 7.1.6

The ISO 9001:2015 Standard concerning Competence, Training and Awareness technically starts at clause 7.2 Competence.  However, it really has it’s roots going back to 7.1.6 Organizational Knowledge and further still to 5.2.1 Establishing the Quality Policy and 5.2.2 Communicating the Quality Policy.  So much is based on the awareness as described in 5.2.2.  Little is given on what the awareness or any evaluation of it should or should not look like.  We will explore some methods below.  Next, we jump forward to 7.1.6 for Organizational Knowledge.  Organizational Knowledge comes in a variety of forms, some documented such as intellectual property (documented information for specs and manuals generally).  Other undocumented forms include knowledge gained from experience, such as lessons learned, and “undocumented knowledge” from experience.  Somehow, we have to ensure the appropriate people have access to this organizational knowledge.  This is often not in a documented manner that we might have used in the previous 9001:2008 edition of the standard.  In the previous standard, we could easily have reached the conclusion that a Metallurgist with 10 years experience must account for his skills and abilities in a matrix, with required documentation for each new method “tip or trick” developed in his department.  Today, under ISO 9001:2015, we have to ensure everyone has access to such information and can “tell the same story”.

Competence | ISO 9001 7.2

The 2015 edition of the standard is well developed in that one section rolls into the next.  Much, not all, but much of what can be considered organizational knowledge can be evaluated as a part of the Job Descriptions, or Offer Letters, Cross Training Reports, and Annual Evaluations.  It is at these junctures where appropriate documented information can be attained to demonstrate base competence for a particular job without the requirement for more lengthy processes.  By utilizing these methods, keeping Organizational Knowledge in mind, we are able to quickly meet letters a) “determine the necessary competence of person(s)”, b) “ensure that these persons are competent on the basis of appropriate education, [not yet on ‘training’], or experience;”, and much of d) “retain appropriate documented information”

Training (the missing clause) and The Matrix

Clause 7.2 Competence letters b) and c) make it necessary for most (nearly all) organizations to have an official training program.  Below, we will outline one such method.

The training matrix is a simple list that identifies the following:

1. Training/Competence by title: IE Orientation, WPS-XYZ, Control of Nonconformities Process, ASNT UT Level II, etc….
2. Departments/Job Title Required
3. Retrain/Recert frequency
4. Type of Training (Dem, Comp, Aware) – see below

Dem – Demonstrated Competency trainings require a hands on demonstration, IE qualification for a WPS, or ASNT cert

Comp – Competence Training require a test or simple evaluation of understanding, IE the process of nonconformities

Aware – Awareness only Training require no more documentation than a signing sheet for the training event

Training Records

The training records should be in direct reference to the individual training title, reference the employee, and the date taken.

Follow-up Actions

Follow-up actions can be tough to identify and account for.  Without a Learning Management Tool in place, a simple monthly or even quarterly review is sufficient.  In this case, it is my recommendation that you add an extra value to your training matrix, the “retrain date”.  Then a simple filter or query for dates less than or equal to today (or some interval of days in the future) will quickly and easily tell you who is due for training.

About the Author

Kyle Studied at the University of Houston in the Architecture program for some time and graduated with a degree in Management Information Systems. Soon he began work with a Gas Turbine Repair company as the systems administrator. Having worked himself out of a job as the local systems administrator within a year, he was placed in charge of facilitating the development and implementation of the first health and safety system for his employer in 2009. Soon additional environmental and quality concerns arose, and Kyle was officially the QHSE & IT Manager for a growing company. By the end of 2013, they were certified to ISO 9001, OHSAS 18001 running an ISO 14001 compliant Integrated QMS.

Since then Kyle has gone on to providing custom QMS solutions including QMS Software, Internal Auditing, Consulting and Training. Through knowledge and firsthand experience with the standards that he has learned inside and out, Kyle is able to quickly and effectively conduct audits, and identify positional solutions, and bring organizations into compliance fostering continual improvement.

About Texas Quality Assurance

Based in Friendswood, just outside of Houston, TX, Texas Quality Assurance was developed out of a need to save time and energy managing quality systems. The end goal is to save folks time, and make business more efficient, and more profitable for everyone in the process.

Management systems are designed to add value to the organization by saving resources, time, and money. PAS 99, developed according to the ISO standards for writing management system standards, is a single framework developed by the British Standards Institution (BSI) which assists in proficient management of all ISO certified systems. PAS 99 was developed in response to the need for a reference document for the implementation of a real and effective integrated management system. Prior to the publication of PAS 99, there was confusion in the market about what should be considered an integrated management system as organizations were only able to merge the reference documentation (manuals, procedures, etc). This approach was far from a real integrated management system and insufficient for many organizations.

PAS 99:2006 was created to enable organizations to integrate common management system requirements into one framework. PAS 99:2012 is based upon the structure of ISO Guide 83, and now sets a common structure to be followed by all management system standards moving forward.

PAS 99 is designed to be used by organizations that have a management system standard or are implementing various management system standards. It applies to organizations of all sizes and industries.

To integrate different management systems, some elements of the standards were restructured to enable easier integration of various management systems. The high-level structure as adopted by many of the new standards has the following elements:

1.  Scope
2. Normative Reference
3. Terms and Definitions
4. Context of the Organization
5. Leadership
6. Planning
7. Support
8. Operation
9. Performance Evaluation
10. Improvement

Benefits of PAS 99 Integrated Management Systems:

PAS 99 has gained success because it provides a great number of benefits to users.

Some of the benefits of implementing the PAS 99 system include, but are not limited to:

1. Meet differently implemented standard requirements of your business with a single set of policies and procedures. This helps govern the standards in a more coherent and less cumbersome manner, which results in a more streamlined and smooth approach to meeting the multiple different requirements.
2. A single audit can cover all the various management systems in place, providing a way to achieve the same end goal but with far fewer resources involved.
3. Improve the overall efficiency of your business by systematically removing redundancy and duplicate tasks. The duplicate tasks with different targets are now replaced by singular tasks that cover all the different targets of the individual management systems.
4. Roles and responsibilities are clearly defined with roles now being responsible for all the areas that have an overlap causing the merger of multiple roles into one. This new role will now be responsible for all the common objectives that were previously being looked after by multiple different roles.
5. Continuously improve multiple management systems by providing an integrated overview of the systems which allows growth to be driven without handling and executing improvements on multiple disparate systems.

Implementation and certification of PAS 99 Integrated Management Systems:

PAS 99 can be tailored for specific business needs and can be built to suit any organization that utilizes multiple certified systems. The developers of your organization’s specific PAS 99 will help your management design and implement a tailored PAS 99 integrated management system. Then, your staff must be trained to ensure effective implementation of PAS 99. The type of training your staff receives can vary and is based on your organization’s specific needs.

In the process of getting PAS 99 certified you can expect the following:

1. Gap analysis

It is during a Gap Analysis that discrepancies between PAS 99 requirements and the organization’s existing integrated management system are assessed before any further formal assessment.

2. Formal Assessment

It is during a Formal Assessment that, firstly, your organization is assessed for preparedness for the assessment of PAS 99 controls and procedures. If there is any gap found, it will be communicated to you for rectification. Then, if the primary requirements are fulfilled, an assessment of the actual implementation of controls and procedures is carried out.

3. Certification and beyond

After the Formal Assessment, a PAS 99 certificate is issued having validity for three years and during this time the client manager of PAS 99’s developers would stay in touch with the user’s organization and would help in any improvements.

Compliance with this specification does not in itself ensure conformity with any other management system standards or specifications. The requirements of each management system standard will still need to be addressed to achieve certification. Organizations that wish to certify compliance with PAS 99, can do so to demonstrate that an effective integrated management system is in place.