Key Steps in Implementing ISO 9001

By Andrew Nichols

When an organization is considering certification their Quality Management System to ISO 9001, the old maxim "Start with the end in mind" is often the first thought. So, it's not uncommon for such an organization to contact NQA as their Certification Partner and to also ask; "what do we have to do now?"

The implementation of a Quality Management System (QMS) in compliance with ISO 9001 - or one of its close relatives such as ISO/TS 16949, AS 9100 etc. could be viewed as a daunting challenge to those new to such an opportunity. In the next few newsletters, we'll analyze a typical implementation and take a look at some of the key steps necessary for a fully compliant and effective QMS. In this newsletter, we'll start at the beginning, rather than the goal!

Where to Begin?
All organizations are unique and their markets, customers, management, suppliers and workforce are all different. Despite this variety, they have something in common; they all operate processes; processes which satisfy customers, produce products, develop products, etc. These processes are often supported by a number of others - the hiring or training processes, for example. One thing that is often common to these processes is the fact that much of what is done, on a day to day basis, is informal and undocumented. As a result, to get a complete understanding of what is supposed to happen, it may be necessary to talk to a variety of personnel. This is where a Gap or Needs Assessment is very helpful.

In planning the implementation of a QMS to meet ISO 9001, it might be tempting to take the easy route by simply comparing what ISO requires to what the organization does - a paper-based or desk-top assessment, perhaps, conducted by someone internal to the organization. Drafting the ISO 9001 standard into some sort of checklist and then going through each requirement, checking off if the organization does/does not comply may seem appropriate, but it is unlikely to deliver the maximum value to those who are responsible for implementation. The presence of a written procedure, a form or calibration sticker may give a false indication that a requirement has been met, but there are many related requirements which can be overlooked. Let's not overlook that the QMS has to be effectively implemented and maintained, so doing only superficial things to meet a requirement is likely to bring the QMS down, affecting product integrity and the perception of the customer. What is needed, therefore, is a comprehensive and composite picture of all the gaps between the organization's methods of operation compared to each requirement of the ISO standard.

In essence, three 'Gaps' or conditions exist are common in organizations, when compared to ISO 9001 requirements:-

• A requirement of ISO 9001 that the organization never planned or implemented.
  Internal Audits are an example
• A requirement of ISO 9001 that the organization does implement as part of doing business, but it's informal, undocumented and/or inconsistent.
  Product manufacturing process controls for example.
• A requirement of ISO 9001 which is implemented, however is may be documented or defined, but it is ineffective.
  Corrective Actions are a typical example.

It is highly likely that these gaps are most effectively revealed through the use of an in-depth audit of the organization's current practices and processes, compared to the ISO 9001 requirements. This audit is best conducted by someone who is fully familiar with the requirements of ISO 9001, the client's industry and competent as a Quality Systems Auditor - this is not something which someone can 'learn on the fly'.

Some gaps, for example internal audits, may appear to be obvious but others may be less so and all have to be considered in the planning phase. Experience has shown that an effective Gap Assessment can reveal much about the creativity of the organization's people and their development of tools to help control their processes and these can be effectively leveraged as part of a formal Quality Management System.

The report, resulting from the Gap Assessment might be used by the organization's management in understanding and planning the implementation. For example, if an "executive overview course' of the ISO 9001 requirements is considered as helpful to Management, then the findings of the Gap Assessment might be discussed and actions drawn up, responsibilities assigned in that session.

In the next newsletter article, we'll take a look at important considerations for the planning phase.