4.1 General Requirements

"Whores don't live in company of poor men, citizens never support a weak company and birds don't build nests on a tree that doesn't bear fruits."

Chanakya (Indian politician, strategist and writer, 350 BC-275 BC) 

The quality management system should:

• Determine the processes needed for the quality management system. Also, identify all activities that affect the quality of the product. For example, certain accounting activities (such as payroll) may not be part of the scope of a quality system (unless accounting is a core part of the business).
• Determine the sequence and interaction of these processes. In order to control ongoing activities, an organization first needs to know what these activities are. Which activities are carried out, in which sequence, and what is the relationship between them?
• Determine criteria and methods needed to be controlled. This means that they should be organized in such a way that customer requirements are consistently met. It should be noted that, customer requirements are not only the written requirements in the contracts; they cover all customer expectations, both objective and subjective. In short, the quality management system should be beneficial to customers and to the organization itself. In this way it is a management tool, and not a goal in itself.
• Ensure the availability of resources and information necessary to support the operation and monitoring of these processes. Resources and information are key factors on controlling activities. The quality management system should be a dynamic system. It is not something that is created once and then remains unchanged. Customers change, markets change, organizations change, and the people in the organization change. A quality management system should reflect these changes so that it remains a dynamic tool for serving customers. It should help now and in the future.
• Monitor, measure and analyze these processes. Improvement is only possible if you know where to improve. This means that you need to collect data on the effectiveness of your operations. However, data alone will not give you any information. Data will only become useful if you analyze them. This analysis should give you the necessary information for you to determine where your organization stands.

The Note 1 makes it clear that all processes needed to implement QMS should be identified to meet the requirement of clause 4.1. This includes processes for management activities, provision of resources, product realization and measurement. Click here to see ISO/TC 176 Approved Interpretation.

Explanation on Outsourcing

2008 edition of the standard added explanatory notes to clause 4.1 in relation to outsourcing. Standard makes it clear by way of note that an outsource process is identified in the quality management system of the organization but it is performed by a vendor of supplier.

The year 2008 (and 2000) edition of the standard required you to define control over the processes which affects conformity to product requirements. (Product requirements are defined in clause 7.2.1).

The year 2008 standard now requires to you define type and nature of control on outsourced processes. The out sourced process could be any quality management system process which affects conformity to product requirements (not limited to product realization processes such as heat treatment, welding or data processing for service sector).

The control should be determined given consideration to:

• The potential impact of the outsourced process on the organizations ability to meet customer requirement, product requirement.
• The extent to which the process is shared (between you and your vendor), and
• Apply requirement of clause 7.4 to achieve this control

Even though the organization has applied sufficient and necessary controls over outsourced process, the responsibility to meet customer requirement, product requirement, statutory and regulatory requirement, etc shall remain with you (organization using ISO 9001 standard or seeking certification).

Also see clause 1.1 for requirements of the standard on excluding processes from quality management system.

Improvement Necessary

An important addition in ISO 9001:2008 (and 2000) is the requirement to improve the quality management system. This means that it should not only be a tool for control of processes, but also for continual improvement: knowing performance based on analysis of data and information, and improving the organization based on this knowledge.

Earlier versions (1987 and 1994) were focused on consistency of quality, which means an egg supplier can continue to supply rotten eggs and still be certified as ISO 9001. Now an egg supplier has to define the quality and improve upon the quality on continual basis.

Guidance to organizations wishing to adapt an existing QMS

An organization with an existing QMS should not need to rewrite all of its documentation in order to meet the requirements of ISO 9001:2008. This is particularly true if an organization has structured its QMS based on the way it effectively operates, using a process approach. In this case, the existing documentation may be adequate and can be simply referenced in the revised quality manual.

An organization that has not used a process approach in the past will need to pay particular attention to the definition of its processes, their sequence and interaction, and it may be appropriate to document these as process maps. It must be emphasized, however, that documented process maps are not a requirement of ISO 9001.

Because ISO 9001:2008 (and 2000) is less prescriptive than the 1994 versions of the standard, an organization may be able to carry out some streamlining and/or consolidation of existing documents, in order to simplify its QMS.

Guidance to organizations preparing to implement a QMS

For organizations that are in the process of implementing or have yet to implement a QMS, the new ISO 9001 emphasizes a process approach.

This includes:

• Identifying the processes necessary for the effective implementation of the quality management system understanding the interactions between these processes.
• Documenting the processes to the extent necessary to assure their effective operation and control.

These processes include the management, resource, product realization and measurement processes that are relevant to the effective operation of the QMS.

Analysis of the processes should be the driving force for defining the amount of documentation needed for the quality management system, taking into account the requirements of ISO 9001. It should not be the documentation that drives the processes.

Demonstrating compliance with ISO 9001

In order to claim conformity with ISO 9001, the organization must provide objective evidence of the effectiveness of its processes and its quality management system. This may not necessarily depend on documented procedures or records, except where specifically mentioned in ISO 9001 standard.

Organizations (and in particular small organizations) may be able to demonstrate compliance without the need for extensive documentation.

ISO 9001:2008 (and 2000) are less prescriptive than the 1994 version of the standard, and allows an organization more flexibility in the way it chooses to document its quality management system (QMS). This enables each individual organization to develop the minimum amount of documentation needed in order to demonstrate the effective planning, operation and control of its processes and the implementation and continual improvement of its QMS.

It must be stressed that ISO 9001 requires (and always has required) a "Documented quality management system", and not a "system of documents".

External Document Reference: Documentation Kit

Interaction of QMS Processes
Controls needed for outsourcing Heat Treatment.