Iso 9001 2008 To Dis Iso 9001 2015 Early Implem Guide1

AAA
0 1June2015
5
Pagge1of58

Table of Contents
Interpretation.........................................................................................................................................3
TenthingstoknowaboutISO/DIS9001:2015........................................................................................3
ClausebyclauseevaluationofDIS/ISO9001:2015.................................................................................6
0.1General..........................................................................................................................................7
0.2TheISOstandardsforqualitymanagement.................................................................................7
0.3Processapproach..........................................................................................................................7
0.4PlanDoCheckActcycle...............................................................................................................8
0.5Riskbasedthinking....................................................................................................................8
0.6Compatibilitywithothermanagementsystemstandards...........................................................8
1Scope................................................................................................................................................8
2Normativereferences......................................................................................................................9
3Termsanddefinitions......................................................................................................................9
4Contextoftheorganization.............................................................................................................9
5Leadership......................................................................................................................................12
6Planningforthequalitymanagementsystem...............................................................................17
7Support...........................................................................................................................................22
8Operation.......................................................................................................................................31
9Performanceevaluation.................................................................................................................48
10Improvement...............................................................................................................................54
Annexes.............................................................................................................................................57
AAA
01June2015
Page2of58
Interpretation
Theinterpretationsofrequirementscontainedwithinthisdocumentarethoseofauthorother
entitiesmayinterprettherequirementsofDIS9001:2015differently.
Assuch,thisdocumentshouldnotbeviewedasthedefinitivereferencesourceforthisdraft
internationalstandard;indeed,thereisnodocumentthatcanfulfilthispurpose.
Ten things to know about ISO/DIS 9001:2015

ThepublicationoftheDraftInternationalStandard(DIS)ofISO9001,thequalitymanagement
system(QMS)ofchoiceforoveronemillionorganisationsaroundtheworld,signifiesthefirsttime
allcurrentandfutureuserscanaccessandreviewtheproposedchanges.TheDISphaseofthe
standardrevisionwillbeasignfororganisationsthattheycanbegintoplantheirtransitionfromthe
existingISO9001(ISO9001:2008)totherevisedISO9001:2015(scheduledforreleaseinlate2015).
Here,weexplorewhatthepublicationoftheDISmeansandimportantly,whatorganisationsshould
donext.
1.WhatdoestherevisionofISO9001meanfororganisations?
Itsactuallybeenalongtimesincethestandardwaslastrevisedwithanysignificance,some14year
infactandalothaschangedinthattime.ThepotentialorganisationalimpactoftherevisedISO
9001isdependentuponhoworganisationsandtheirindividualQMShaveevolvedinthistime.
FactorssuchasthematurityandcomplexityoftheexistingISO9001:2008managementsystem,the
existenceofothermanagementsystems(suchasISO14001,theglobalenvironmentalmanagement
systemstandard(EMS)orOHSAS18001,theglobalhealthandsafetymanagementsystemstandard)
aswellastheorganisationscurrentevaluationandmanagementofriskwillallheavilyinfluencethe
degreeofchangethatanorganisationwillneedtoundertakeinordertomeettheserequirements
oftherevisedISO9001:2015.
2.AnnexSL:
TheintroductionofAnnexSL,whichestablishesaconsistentstructurefeaturing10clausesaswellas
commonterminologyanddefinitionsapplicabletoallISOManagementSystemStandards(MSS),is
probablythebiggestchangetotheISO/DIS9001:2014document.Asorganisationsbeginto
understandandappreciatethevalueofdifferentmanagementsystemsallspeakingacommon
language,therebymakingMSSintegrationeasier,itwillbeorganisationsandandinturnthe
consumerwhostandtobethetruebeneficiaries.
3.Processbasedapproach:
TheDIScontainsmanyreferencesacrossseveralclausestoorganisationsplacingagreateremphasis
onapplyingaprocessbasedapproachtotheirmanagementsystem.
4.Riskbasedapproach:
TheincorporationofAnnexSLintoISO/DIS9001:2014nowdrivesariskbasedapproachtothinking
andacting.Therequirementsunderariskbasedapproachaffectqualityplanningandnow
AAA
01June2015
Page3of58
incorporatemuchofwhatwaspreviouslyreferredtoas'preventiveaction'.Nowanorganisationwill
needtodeterminetherisksandopportunitiesthatneedtobeaddressedtogiveassurancethatthe
QMScanachieveitsintendedresults.Manyorganisationsalreadyhaveriskbasedthinkingand
planninginmanypartsoftheirorganisationwhichmayormaynothavebeenconnectedtotheQMS
inthepast.Thisgreaterfocusonriskwillmeanthatanorganisationwillneedtodemonstratehow
thisrequirementismet.Theextentandformalityoftheapproachneededinaparticular
organisationwillofcoursebeinfluencedbyitscontext.
5.Leadership:
TherequirementsrelatingtotherelationshipbetweentheroleTopManagementplayincreating
andsupportinganeffectiveQMShavebeenenhanced.TherearenowmoreareaswhereTop
Managementneedstodemonstratetheirinvolvementandengagementwiththequality
managementsystemincludingaccountabilityfortheeffectivenessoftheQMSandensuring
integratedwiththeoverallbusinessprocesses.
6.Contextoftheorganisation:
Thisisnewandhastwodistinctelements.Firstly,contextrequiresanorganisationtodeterminethe
internalandexternalissuesandrequirementsthatcanimpactontheplanningofthequalitysystem.
Contextbecomesanimportantconsiderationandhelpstoensurethatthemanagementsystemis
designedandsuitablyadaptedforaspecificorganisation.Thishelpsprovidetherightfocus,
approachandbalancetothedifferentelementsofthemanagementsystemratherthanthesame
genericapproachacrossallorganisations.Thesecondelementistheconsiderationofrelevant
interestedparties.Thereisnowarequirementtodeterminetheirrequirementsandensurethese
aremonitoredandreviewedasthesenowformprimaryinputsintothedesignofQMS.
7.Knowledge:
Anorganisationwillnowneedtoconsiderwhatknowledgeitneedstoachieveconformityof
productsandservicesalongwithhowitwilldevelop,maintainandretainsuchknowledge.
8.Controlofexternallyprovidedproductsandservices:
Formerlyknownaspurchasing,thisclausehasbeenretitledtomakeitclearthattherequirements
applytobothphysicalproductandservicesrelatedtotheendproductoftheorganisation.Whilst
notspecificallyanewrequirement,therehasalwaysbeensomeconfusionaroundcertaincategories
ofexternallyprovidedproductsandserviceswhetherthishasbeenthroughanassociatecompany,
jointventureoroutsourcedactivity.Nowitisclearthathoweverprovided,anorganisationwillneed
toapplyariskbasedapproachanddeterminethetypeandextentofcontrolsnecessary.
9.Transitioning:
CurrentinformationfromISOshowsthatorganisationswillhavethreeyearsfrompublicationto
transitiontothenewstandard,sotheycanchoosetotransitionatanypointwithinthisperiod.
Somemaychoosetheirnextcertificationcycle,althoughmanywillwanttobeamongthefirst
giventheincreasedfunctionalitythatISO9001:2015willdeliver,alongwiththebonusofaclear
commitmenttobestpracticebeingdemonstratedtotheirinterestedparties.Startingthetransition
AAA
01June2015
Page4of58
planningearly,includingsettingandcommunicatingatransitiondatewillenableyouandyour
organisationtoproactivelymanagethetransitionatyourpace.
10.Nextsteps:
OrganisationsshouldstartbyobtainingacopyoftheDISandfocusontheareasthatarecompletely
neworhavebeenrevised.Thosearetheareasthatarelikelytobeincludedinanytransitionplan.
Also,makesurethatqualitymanagersandinternalauditorsunderstandthedifferencesthatAnnex
SLwillbringtotheQMSandanyothermanagementsystemstandardsintheorganisation.Ensure
thatwhenselectingacertificationbody,theynotonlyunderstandtheDIS,butmoreimportantly,
understandwhattheDISmeanstotheQMSandthewiderorganisation.Engageacertificationbody
tofindouthowagapanalysisandtrainingonspecificareasofISO/DIS9001:2014canbeofbenefit
totheorganisation.Finally,beginformalisingatransitionplanandprocessandensurethattop
managementisinvolvedfromthestart.
Summary
RememberthattheDISisjustthat;aDraftInternationalStandard.Thisisanimportantstageforany
standardandgivesgreatvisibilityonwhatthefinalstandardwillcontain.Wearenowinathree
monthballotingperiod,sotherewillbecommentsandthestandardsdeveloperswillhaveto
considerthosecommentsandtakeactionwheredeemedrelevantandnecessary.
However,giventhatasignificantamountofchangeinthisrevisionisthroughtheincorporationof
AnnexSLscoretextandhighlevelstructure,thestandardwritersmayhavelittlefreedomtochange
thistextevenifitreceivescommentsinthoseareas.Essentially,ISO/DIS9001:2014isanextremely
goodindicatoronwhatthefinalversionoftheworldsmostwidelyimplementedqualitysystem
standardwilllooklikeandmoreguidancefromISOisontheway.Sotosecureadistinctadvantage,
itssensibletostartplanningforthatchangenow.
AAA
01June2015
Page5of58
Clause by clause evaluation of DIS/ISO 9001:2015
ISO9001:2015issettobeparticularlysignificantasaresultoffundamentalchangestobothits
structureanditscontents.Complyingwiththerevisedrequirementswillpresentnewchallenges.
ISO 9001:2008
1 Scope
2 Normative references
3 Terms and definitions
4 Quality management system
4.1 General requirements
4.2 Documentation requirements
5 Management responsibility
5.1 Management commitment
5.2 Customer focus
5.3 Quality policy
5.4 Planning
5.5 Responsibility, authority and
communication
5.6 Management review
6 Resource management
6.1 Provision of resources
6.2 Human resources
6.3 Infrastructure
6.4 Work environment
7 Product realization
7.1 Planning of product realization
7.2 Customer-related processes
7.3 Design and development
7.4 Purchasing
7.5 Production and service provision
7.6 Control of monitoring and measuring
equipment
8 Measurement, analysis and improvement
8.1 General
8.2 Monitoring and measurement
8.3 Control of nonconforming product
8.4 Analysis of data
8.5 Improvement
DIS/ISO 9001:2015
1 Scope
4 Context of the organization
context
interested parties
scope of QMS quality management system
5 Leadership
General
management commitment policy
roles, responsibility and authority
6 Planning
actions to address risks and opportunities
objectives and plans to achieve them
planning of changes
7 Support
resources
competence
awareness
communication
documented information
8 Operation
operational planning and control
determination of market needs and
interaction with customers
operational planning process
control of external provisions of goods and
services
development of goods and services
production of goods and provision of services
release of goods and services
non conforming goods and services
9 Performance evaluation
monitoring, measurement, analysis and
evaluation
internal audit
management review
10 Improvement
Non-conformity and corrective action
improvement
AAA
01June2015
Page6of58
0.1 General
ISO9001:2008remindsusthatthattheadoptionofaqualitymanagementsystemisastrategic
decisionfortheorganisation.Itisnotsomethinganorganisationiscompelledtodo.
Similarly,itacknowledgesthatthedesignandimplementationofthequalitymanagementsystem
willbeinpartdependenton:
theorganisationscontextanditsspecificobjectives;
risksassociatedwithitscontextorspecificobjectives;
theproductsand/orservicesitisseekingtoprovide;
thecomplexityofitsprocesses;
itssizeandorganisationalstructure.
DIS9001:2014addstwofurtherconsiderationstothislisttheneedsandexpectationsofthe
organisationscustomersandrelevantinterestedparties,andthecompetencyofpersonswithin,or
workingonbehalfof,theorganisation.
Weareremindedthatthestandarddoesnotprescribehowtheorganisationsqualitymanagement
systemshouldlook.Instead,theorganisationcanaddresstherequirementsinthewaythatsuits
thembest.
Wearealsoremindedthatthestandardmaybeusedbybothinternalandexternalpartiesasthe
basisforassessment.
Note:ISO9001:2008referstotheorganisationalenvironment,changesinthatenvironmentand
risksassociatedwiththatenvironment.DIS9001:2014expandstheconceptoftheorganisational
environmenttoincludenotonlythebusinessenvironment,butalsointernalfactors,suchas
organisationalculture,andexternalfactors,suchassocioeconomicconditionsunderwhichit
operates.DIS9001:2014replacesorganisationalenvironmentwithcontextoftheorganisation.
0.2 The ISO standards for quality management

ThisisanewsubclauseforDIS9001:2014.Itconfirmsthattherearethreecorequalitymanagement
systemstandards:9000,9001and9004.Anoverviewisprovidedforeach.
WearethendirectedtoAnnexCforalistofotherguidancestandardsdevelopedtosupportthe
implementationofaqualitymanagementsystemcomprisingtheISO10000series.
0.3 Process approach

AlthoughISO9001:2008statedthatitpromotedtheadoptionofaprocessapproach,thiswasmore
ofanencouragementthanarequirement.However,withtheintroductionofDIS9001:2014,thereis
nownochoiceinthematter,withrequirementsaroundprocessappearingthroughoutthestandard
andtheprocessapproachbeingreferredtoasessentialinthissection.
ThediagramintroducedintoISO9001:2008depictingamodelofaprocessbasedquality
managementsystemhasbeenextensivelyrevisedandnowreferencestheclausenumbersusedin
theDIS.Boxtitleshavealsobeenchangedtoreflectthenewterminology(egLeadershipreplaces
Managementresponsibility,PlanningreplacesResourcemanagement,etc)andSupport
AAA
01June2015
Page7of58
Processeshasbeenadded,underpinningtheoperationofthewholeQMS.Alsoaddedisatwoway
exchangebetweenContextandCustomersandotherrelevant,interestedparties.
0.4 PlanDoCheckAct cycle

WhenCD9001:2015waspublishedwithoutthefamiliarPlanDoCheckAct(PDCA)cyclediagram,
somequestionedwhetherthePDCAapproachhadbeenremovedfromthestandard.Thissection
confirmsPDCAisverymuchaliveandoperatingatbothaprocesslevelandanoverallsystemlevel
too.Aseconddiagramtoshowaprocesshasbeenadded.
0.5 Riskbased thinking

DIS9001:2014acknowledgesthatriskbasedthinkinghasalwaysbeenimplicitin9001.However,as
isthecaseregardingtheprocessapproach,theDISmakestherequirementforriskbasedthinking
explicitatcertainpointsthroughoutthestandard.TheDISdoesnotprescribeariskmethodology
thattheorganisationmustadopt;instead,eachorganisationisfreetodecideitsownapproach.The
robustnessoftheriskapproachmustbeproportionatetotheconsequences,shouldtheriskbe
realised.
0.6 Compatibility with other management system standards

TheDIS9001:2014confirmstheadoptionofAnnexSL,whichhasbeenintroducedtoensurealevel
ofconsistencyacrossallmanagementsystemstandards.ItpointstoAnnexAofDIS9001:2014
wheresomeofthekeychangesintroducedinthisversionofthestandardaredetailed.
Usersofthestandardareremindedthattheydonotneedtofollowaclausestructurethatmirrors
AnnexSLwhenestablishingorrefreshingtheirownsystems.
Finally,thereisareminderthat,althoughDIS9001:2014doesnotincludeanyrequirementsspecific
toothermanagementsystems(egenvironmentalmanagement,healthandsafetymanagementor
assetmanagement),thereisnothingtostoporganisationsintegratingsuchsystemswiththeir
qualitymanagementsystemshouldtheywishtodoso.AnnexSLshouldmakethisprocesseasier.
1 Scope
TheoverallpurposeofthestandardisunchangedfromISO9001:2008.Itisstillintendedasameans
bywhichorganisationscandemonstratetheirabilitytosupplyproductsandservicesthat
consistentlymeetcustomerandapplicablestatutoryandregulatoryrequirements.Itisalsoforuse
whereanorganisationisseekingtoenhanceitscustomerssatisfactionasaresultofitoperatinga
qualitymanagementsystem.
AllreferencestoexclusionsinISO9001:2008subclause1.2Applicationhavebeenremoved.
ThisisbecausealloftherequirementsinISO9001:2015areintendedtobeapplicabletoalltypes
andsizeoforganisation.
However,DIS9001:2014AnnexAA.5recognisesthattheremaybecircumstanceswhereitis
impossibleforanorganisationtoconformtoaspecificrequirementforexample,whereitdoesnot
operatearequiredprocess.Intheseinstances,theorganisationcandeemtherequirementnot
applicableprovidingthisdoesnotaffectitsabilitytosupplyconformingproductsorservices,or
compromiseitsaimtoenhancecustomersatisfaction.
AAA
01June2015
Page8of58
WithinNote1,theISO9001:2008referencetooutputresultingfromproductrealisationhasbeen
removed.
ISO9001:2008citedISO9000:2005qualitymanagementsystemsfundamentalsandvocabularyas
anormativereference.Thismeansthatthesetwodocumentswereintendedtobeusedasapair.
AsaresultoftheincorporationofcontentpreviouslycontainedwithinISO9000:2005directlyinto
DIS9001:2014,theneedforDIS9001:2014holdersalsotoacquireISO9000:2005hasbeen
removed.ConsequentlyDIS9001:2014nowcontainsnonormativereferences.

ThetermsanddefinitionsforISO9001:2008werecontainedwithinasupplementarystandard,ISO
9000.
ForDIS9001:2014,thesehavebeenbroughtdirectlyintotheprimarystandard.Whilethisensures
thattheyarereadilyavailable,ithaseffectivelydoubledthesizeofDIS9001:2014whencompared
toISO9001:2008.AsISOpricesstandardsonaperpagebasis,thiscouldhaveasignificantimpact
onitscost.
Notethatsomeofthecurrentdefinitionshavechanged,thattherearesometermswhichwerenot
definedin9000:2005(egmonitoring,performance)thatarenowdefinedinDIS9001:2014,andthat
therearedefinitionsforsomeofthenewtermsusedin9001:2015(egrisk,innovation)
4 Context of the organization

4.1Understandingtheorganizationanditscontext
INTERPRETATION:
DIS9001:2014requiresorganisationstoidentify,monitorandreviewinternalandexternalissues
thatarerelevanttoitspurposeandstrategicdirection,andthathavetheabilitytoimpactthe
qualitymanagementsystemsintendedresults.
Implicationsforqualityprofessionals:
ThisisthefirstoftwonewclausesintroducedintoDIS9001:2014relatingtoContext.Most
organisationswillalreadybesuccessfullymonitoringinternalandexternalissuesthathavethe
potentialtoaffectnotonlytheirqualitymanagementsystem,butalsotheveryexistenceofthe
organisationitself.Theywillnowneedtoevidencethisprocesstotheirauditors.
Implicationsforauditprofessionals:
Auditorswillneedtoallowadditionaltimetoprepareforauditsinordertoestablishtheir
understandingofthecontextthatauditeeorganisationsareoperatingin.Theywillneedto
understandtheinternalandexternalissuestypicallyexperiencedinorganisationsofthattype,and
mustbepreparedandabletochallengeanorganisationiftheybelievetheorganisations
interpretationoftheircontextisdeficientorincorrect.Evidenceneedstobeobtainedtoprovide
assurancethatorganisationsarereviewinginternalandexternalissuesatperiodicintervals.
AAA
01June2015
Page9of58
4.2Understandingtheneedsandexpectationsofinterestedparties
Interpretation:
Theorganisationisrequiredtodeterminetherelevantrequirementsofrelevantinterested
parties.Oncedetermined,theorganisationmustthenmonitorandreviewtheinformationitholds
aboutthesepartiesandtheirrequirements.
ThisisanothernewclauseintroducedforDIS9001:2014.Relevantinterestedpartiesaregroupsor
individualswhohavetheabilitytoimpact(orpotentiallyimpact)theorganisationsabilitytosupply
consistentlyproductsandservicesthatmeetcustomerandapplicablestatutoryandregulatory
requirements.Customers,shareholders,boardmembersandcompetitorswouldallfitintothis
classification.Eachorganisationwillhaveitsownsetofrelevantinterestedpartiesandthissetwill
changeovertime.Veryfewoftherelevantinterestedpartiestotalrequirementswillberelevantto
theoperationofaparticularorganisationsqualitymanagementsystem.Theseveryfewarethe
onesthattheorganisationneedstocapture.
Asforclause4.1above,auditorswillneedadditionaltimetoprepareforauditsinordertoestablish
theirviewoftherelevantinterestsofrelevantinterestedparties.Ifthisdiffersfromtherganisations
perception,thenauditorsmustbepreparedtochallengethis.
Auditorswillneedtoensurethattheorganisationhasbeenthroughaprocessinitiallytoidentify
thesegroupsandthentoidentifytheirrequirementsthatarerelevanttotheorganisationsquality
managementsystem.
Theywillalsoneedtoensurethatthisprocessisrevisitedperiodicallybecausetherelevant
requirementsofrelevantinterestedpartiesmaychangeovertime.
4.3Determiningthescopeofthequalitymanagementsystem
Interpretation:
Thescopeofaqualitymanagementsystemsetsitsboundaries,identifyingwhattherequirementsof
thequalitymanagementsystemareapplicableto,andtowhattheyarenot.Thescopeofthequality
managementsystemisdefinedbytheorganisation.Whendefiningthescopeofitsquality
managementsystem,theorganisationneedstotakeintoaccountitscontext(egtheinternaland
externalissuesitfacesandtherequirementsofrelevantinterestedparties),andalsotheproducts
and/orservicesitintendstodeliver.
Thescopemustbemadeavailableandbemaintainedasdocumentedinformation.Thescopeneeds
tostatetheproductsandservicescoveredbythequalitymanagementsystemandmustalsoinclude
anyjustificationsorinstanceswherespecificelementsofDIS9001:2014cannotbeapplied(for
example,wherearequiredprocessisnotundertaken).
AAA
01June2015
Page10of58
Theorganisationhasalwaysbeenrequiredtospecifythescopeofitsqualitymanagementsystem.
However,thismustnowbedoneinexplicitconsiderationoftheorganisationscontext,aswellasin
termsoftheproductsandservicesitintendstosupply.
DIS9001:2014makesitclearthatifarequirementofthestandardcanbeapplied,giventhe
organisationsdeterminedscope,thenitmustbeincluded.Onlyincaseswheremeetingthe
requirementisimpossible(andwheretheabsenceofmeetingtherequirementdoesnotadversely
impacttheorganisationsabilitytosupplyconformingproductsandservices)isitpermissiblenotto
applyit.
Thisreplacesexclusions,whicharereferencedinISO9001:2008clause1.2(Application)which
acknowledgesthattheremaybeinstanceswhereitisimpossibletoapplyaspecificrequirement,but
limitsthesetorequirementsappearinginclause7Productrealisation.
Auditorswillneedtoverifythattheorganisationsscopeexistsasdocumentedinformation.They
mustgatherevidencethatithasbeenproducedinconsiderationoftheorganisationscontextand
productsandservices.
AuditorsshouldreviewanyexclusionsappliedunderISO9001:2008forongoingsuitability.Theywill
needtoensurelegacyissues,whereanorganisationhaspreviouslysoughttolimititsscopeand
excludedactivitiesthatcanaffectitsabilityorresponsibilitytoensureconformityofproductsor
services,arenotperpetuated.
Ifexclusionshavebeenappliedbytheorganisation,auditorsmustensurethattheyarerecordedand
thattherationalefortheexclusionisstatedandjustified.
4.4Qualitymanagementsystemanditsprocesses
Interpretation:
DIS9001:2014requirestheorganisationtoestablishaprocessbasedqualitymanagementsystem.
Onceinplacethisneedstobemaintainedandcontinuallyimproved.Clause4.4setsouthighlevel
requirementsforthedesignofaprocessbasedmanagementsystem.
Mostofwhatisgiveninclause4.4canbefoundinISO9001:2008,wheretherequirementsareless
clearandarefragmentedacrossanumberofclauses,includingGeneralrequirements(clauses4.1
and8.1)andMonitoringandmeasurementofprocesses(subclause8.2.3).
TheprincipalchangefromISO9001:2008isanelevatedfocusonprocesses,whichissomethingthat
appearsthroughouttheDIS.WhereasISO9001:2008promotedtheadoptionofaprocess
approach,DIS9001:2014mandatesthis.
Inaddition,organisationsneedtodetermineperformanceindicatorsthatallowfortheeffective
operationandcontrolofprocesses,determineresponsibilitiesandauthoritiesforprocesses,identify
risksandopportunitiesforprocesses,andplantoaddressthese.
AAA
01June2015
Page11of58
The9001:2008requirementtodetermineopportunitiestocontinuallyimproveprocesseshasbeen
expandedtoincludecontinuallyimproveprocessesandthequalitymanagementsystem.
Organisationsarerequiredtomaintainthedocumentedinformationnecessarytosupportthe
operationofitsprocesses.Theymustalsoretaindocumentedinformationthatevidencesthat
processesarebeingcarriedoutasplanned.
FororganisationsalreadyapplyingISO9001:2008,thekeyfactor(s)inmeetingtheserequirements
willbetheextenttowhichtheprocessapproachhastrulybeenembracedandadoptedalready.This
includestheeffectivenessofqualitymanagementsystemplanningcarriedoutunderISO9001:2008
subclause5.4.2,theeffectivenessofplanningofprocessesneededforproductrealisationcarried
outunderISO9001:2008clause7.1,andtheeffectivenessofprocessmonitoring,measurement,
analysisandimprovementcarriedoutunderISO9001:2008subclause8.2.3.Formanagement
systemimplementers,thesewillbekeyareasforreview.
Auditprofessionalsmustnotetheexplicitrequirementforaprocessbasedqualitymanagement
system.Thisisnowmandatory.Theyshouldalsonotetheadditionalnewrequirementsregarding
useofperformanceindicatorstocontrolandmonitorprocesses,andtherequirementforprocesses
tobeassessedfromariskandopportunityperspective.
Clause4.4statesexplicitrequirementsthatneedtobemetinthedesign,operationand
maintenanceofaprocessbasedmanagementsystem.Forexample,determinationofinputs
requiredandoutputsexpected,resourcesneeded,andassignmentofresponsibilitiesand
authorities.Althoughnotstrictlynewrequirements,DIS9001:2014makesitclearthatthese
requirementsareessentialelementsofaprocessbasedmanagementsystemthatauditorswillneed
toverifyhavebeendeterminedandimplementedasrequired.Ineffect,auditorswillneedtoreview
howtheorganisationhasdesigneditsprocessbasedmanagementsystem.
Existingoperationalprocedures,workinstructionsandflowchartsarevalidexamplesof
documentedinformationandcanbeusedtoevidencethattherequirementfordocumented
informationtosupporttheoperationofprocessesisbeingmet.Iftheseareworkingwellforthe
organisationthenthereisnoneedtoreplacethem.

5 Leadership
5.1Leadershipandcommitment
5.1.1Leadershipandcommitmenttothequalitymanagementsystem
Interpretation:
DIS9001:2014replacesManagementresponsibilitywithLeadership,andrepositionsanumber
ofISO9001:2008requirementsasleadershipactivities.
Subclause5.1.1identifiesspecificaspectsofthequalitymanagementsystemwheretop
managementareexpectedtodemonstratebothleadershipandcommitment.
AAA
01June2015
Page12of58
Thisstartswiththeirtakingaccountabilityfortheeffectivenessoftheirorganisationsquality
managementsystem.Theymustensurethattheirorganisationsqualitypolicyandqualityobjectives
areconsistentwiththeorganisationsoverallstrategicdirectionandthecontextinwhichthe
organisationisoperating.Theymustalsoworkalongsidetheirpeopleinordertoensurethatthe
qualityobjectivesareachieved.Inaddition,topmanagementmustensurethatthequalitypolicyis
communicated,understoodandappliedacrosstheorganisation.
Topmanagementmustalsoensurethatqualitymanagementsystemrequirementsareintegralto
theorganisationsbusinessprocessesthatis,thequalitymanagementsystemmustnotbejusta
bolton.Theymustpromoteawarenessandtheadoptionoftheprocessapproach,andmust
takesurethattheresourcesrequiredfortheeffectiveoperationofthequalitymanagementsystem
aremadeavailable.
Topmanagementmuststresstheimportanceofeffectivequalitymanagementandofconformingto
therequirementsofthequalitymanagementsystem.Theymustmakesurethatthequality
managementsystemisachievingtheresultsintendedandmustleadpeopletocontributetothe
effectiveoperationofthesystem.Theymustdrivecontinualimprovementandinnovation,and
developleadershipintheirmanagers.
ThemovefrommanagementcommitmenttoLeadershipandcommitmentisperhapsthemost
significantandfarreachingchangecontainedwithinDIS9001:2014,althoughtheactualimpactwill
dependverymuchonwhereeachorganisationisstartingfrom.
Forthosewherethemostseniormembersoftheorganisationcurrentlyplayanactiveroleindriving
itsqualitymanagementsystemforward,thechangeswillsimplybeaformalisationofwhatis
happeningnow.However,forthoseorganisationswheretopmanagementhaveeffectivelydevolved
responsibilityfortheirqualitymanagementsystemtotheirManagementRepresentative,the
ramificationsoftheDIS9001:2014changeswillbesignificantlygreater.
DIS9001:2014requirestopmanagementtobemuchmorehandsonwithrespecttotheirquality
managementsystemsthanISO9001:2008does.Wherethewordensuringisusedinsubclause
5.1.1,topmanagementmaystillassignthistasktoothersforcompletion.Wherethewords
promoting,taking,engagingorsupportingappear,theseactivitiescannotbedelegatedand
mustbeundertakenbytopmanagementthemselves.Implementerswillneedtomaketop
managementawareofthenewrequirements,andthefactthattheywillnowbeauditedasamatter
ofroutine.
Note:whenDIS9001:2014usesthetermtopmanagement,itisreferringtoapersonoragroupof
peopleatthehighestlevelwithinanorganisation,iethepeoplewhocoordinate,direct,andcontrol
theorganisation.
Auditorsmustseekevidencethattopmanagementhasahandsonapproachtothemanagement
oftheirqualitymanagementsystem.
AAA
01June2015
Page13of58
AuditorsmustunderstandwhichDIS9001:2014requirementstopmanagementcandelegateand
whichtheycannot.
Auditorsmustensurethattheyareequippedtochallengetopmanagementinrespectoftheir
commitmenttotheirqualitymanagementsystems.Auditingatthislevelislikelytobeanew
experienceformany.Tobeeffectiveandgaintherespectoftopmanagement,auditorswillneedto
haveagoodunderstandingofmanagementactivities,beabletoengagewithtopmanagementona
rangeofsubjects,andspeakthelanguageoftopmanagement.Formanyauditors,thiswillinvolve
developingnewandenhancedcompetencies.
5.1.2Customerfocus
Interpretation:
Subclause5.1.2requirestopmanagementtotaketheleadindemonstratingtheorganisations
commitmenttoitscustomers.
Theymustensurethatcustomerandapplicablestatutoryandregulatoryrequirementsareidentified
andmet.Theymustconsiderandaddressanyrisksthatthreatentheabilityoftheorganisationto
provideconformingproductsand/orservices,orwhichmaynegativelyimpactcustomersatisfaction.
Inaddition,topmanagementmustalsoensuretheorganisationremainsfocusedondelivering
conformingproductsandservices,onmeetingitsstatutoryandregulatoryobligations,andon
enhancingitscustomerssatisfaction.
Subclause5.1.2expandsonISO9001:2008clause5.2byrequiringtopmanagementnowtoensure
thatrisksandopportunitiesthatcouldaffecttheorganisationsabilitytosupplyconforming
productsandservices,andtoenhancecustomersatisfaction,areidentifiedandaddressed.
Therequirementtodeterminecustomerandapplicablestatutoryandregulatoryrequirementsis
movedtothisclausefromISO9001:2008subclause7.2.1c.
Topmanagementarenowexplicitlyrequiredtomaintainafocusonconsistentlyproviding
productsandservicesthatconformtocustomerrequirementsandthatmeetapplicablestatutory
andregulatoryrequirements,aswellasmaintainingafocusonenhancingcustomersatisfaction.
Auditorswillneedtoseekevidencethattopmanagementareensuringthatanyrisksand
opportunitieswiththepotentialtoimpacttheorganisationsabilitytosupplyproductsandservices
thatconformtocustomerrequirementsandapplicablestatutoryorregulatoryrequirements,orthat
mayaffectcustomersatisfaction,arebeingidentifiedandaddressedbytheorganisation.Auditors
shouldexpecttofindafocusonrisks,butshouldnotethatopportunitiesmustalsobeconsidered
too.
Note:therequirementistomaintainacustomerfocusthisis,therefore,notaoneoffexercise,
butratheranactivitythatmustbeevidencedasongoing.
AAA
01June2015
Page14of58
5.2Qualitypolicy
Interpretation:
5.2.1
Subclause5.2.1setsouttherequirementsoftopmanagementinrespectoftheorganisations
qualitypolicy.
Topmanagementmustestablishaqualitypolicythatisconsistentwiththepurposeandcontextof
theorganisation.Itmustadditionallyprovideaframeworkforthesettingandreviewofquality
objectives,andincludecommitmentstosatisfyanyapplicablerequirementsandcontinuallyto
improvetheirqualitymanagementsystem.
Itistheresponsibilityoftopmanagementtoreviewandmaintainthequalitypolicy.
Implicationsforqualitypractitioners:
ISO9001:2008requirestopmanagementtoestablishthequalitypolicy(5.1),andtoensurethat
itisreviewedforcontinuingsuitability.DIS9001:2014requiresthatthetopmanagementestablish,
reviewandmaintainaqualitypolicy.
DIS9001:2014requiresthatthequalitypolicyisalsoappropriatetothecontextoftheorganisation,
notjustitspurpose.Thiswillrequirethereviewoftheorganisationsqualitypolicyafterhaving
decidedonthecontextoftheorganisationandhavingconsideredtherelevantrequirementsofthe
relevantinterestedparties.
ThepolicymustincludeacommitmenttocontinuallyimprovetheQMS.ISO9001:2008requireda
commitmenttocontinualimprovetheeffectivenessoftheQMS.
Thepolicymustnowprovideaframeworkforthesettingandreviewingofqualityobjectives.
Auditorsshouldseekevidencethattopmanagementhaveparticipatedinthecreationofthequality
policy,andarereviewingandmaintainingit.Auditorsshouldensurethatthepolicyisappropriateto
thecontextoftheorganisationaswellasitspurposeandthatthereisacommitmenttoimprovethe
organisationsqualitymanagementsystem.Theyshouldalsoseekevidencethattheorganisations
qualityobjectivesareconsistentwiththepolicy.
Therequirementtodeterminethatthequalitypolicyisappropriatetothepurposeandcontextof
theorganisationreinforcestheneedforauditorstoestablishtheirpersonalunderstandingofthe
contextthattheauditeeorganisationisoperatingin.However,fromanauditperspectiveitis
importantthattopmanagementcandemonstratethatthepolicyiscompatiblewiththestrategic
directionandcontextoftheorganisation,asrequiredbysubclause5.1.1b.
AAA
01June2015
Page15of58
5.2.2
Interpretation:
Subclause5.2.2setsoutspecificrequirementsinrespectoftheorganisationsqualitypolicy.The
policymustbeavailableasdocumentedinformation.Itmustbecommunicated,understoodand
appliedacrosstheorganisationandmustbeavailabletorelevantinterestedpartiesasappropriate.
Asanitemofdocumentedinformation,thequalitypolicycannowbeheldinanymannerthatmeets
therequirementsofDIS9001:2014clause7.5.
Qualityprofessionalsshouldnotethatthereisnowanexplicitrequirementforthequalitypolicyto
beappliedthroughouttheorganisation.Thiscanhavesomeimplicationsforimplementersofthe
QMS.
Thenewrequirementforthequalitypolicytobeavailabletorelevantinterestedparties,as
appropriate,meansthatsomeorganisationswillneedtodemonstratehowthisisdoneiftheyare
notalreadymakingthepolicyavailable.
AuditorsshouldnotethattheISO9001:2008requirementfordocumentedstatementsofquality
policyandqualityobjectiveshasnowbeenremoved.Instead,DIS9001:2014requiresthepolicyto
bemaintainedasdocumentedinformation.
Auditorsshouldensurethatthequalitypolicyisbeingappliedthroughouttheorganisationandthat
theorganisationismakingthepolicyavailabletorelevantinterestedpartieswhereitisappropriate
todoso.
5.3Organizationalroles,responsibilitiesandauthorities
Interpretation:
Thisislargelyaclarificationofrequirementsgiveninclause5.5ofISO9001:2008.Thetop
managementoftheorganisationneedtoensureassignmentofthenecessaryresponsibilitiesand
authoritiestoindividualswithintheorganisationtocarryoutqualityrelatedactivities.
Specifically,theyneedtoassignresponsibilityandauthorityforensuringthat:
AAA
therequirementssetoutinDIS9001:2014aremet;
qualitymanagementsystemprocessesaredeliveringtheirintendedoutcomes;
reportingontheoperationofthequalitymanagementsystemandidentifyingany
opportunitiesforimprovementistakingplace;
acustomerfocusispromotedthroughouttheorganisation;
wheneverchangestothequalitymanagementsystemareplannedandimplemented,the
integrityofthesystemismaintained.
01June2015
Page16of58
Topmanagementneedtoensurethatresponsibilitiesandauthoritiesrelatingtoanorganisations
qualitymanagementsystemarecommunicatedwithintheorganisationandthattheyarenderstood
withintheorganisation.
DIS9001:2015requiresthatnotonlyareresponsibilitiesandauthoritiesassigned,butthattheyare
alsocommunicatedandunderstoodwithintheorganisation.TheroleofManagement
RepresentativehasdisappearedinDIS9001:2014.Thisisanattempttoensurethatownershipofthe
qualitymanagementsystemdoesnotcentrearoundasingleindividual.Dutiesassignedtothe
ManagementRepresentativeinISO9001:2008,includingensuringQMSprocessesareestablished
andmaintained,thereportingofQMSperformanceandpromotionofcustomerrequirementsacross
theorganisation,cannowbeassignedtoanyroleorsplitacrossseveralroles.
Note:thereisanewrequirementfortopmanagementtoensurethatsomeoneistaskedwith
preservingtheintegrityofthequalitymanagementsystemwhileitisintheprocessofrevision.The
qualityprofessionalswithintheorganisationmayhavetorevisittheexistingresponsibilitiesand
authoritieswithregardstotheQMS,especiallytheresponsibilitiesoftopmanagement.Thereview
mayidentifygaps,includinggapsofknowledgeandskills,whichwillthenneedtobeaddressed
beforeacompliantsystemcanbeestablished.
Auditorsmustseekevidencethatanorganisationspeoplehavenotonlybeenadvisedoftheir
qualitymanagementsystemresponsibilitiesandauthorities,butthattheyalsounderstandthesein
thecontextofwhatthequalitymanagementsystemistryingtoachieve.
Auditorsshouldnotethatthereisnolongerarequirementforanorganisationtohaveanidentified
ManagementRepresentative,thoughthedutiescurrentlyassignedtotheManagement
RepresentativeinISO9001:2008muststillbeundertaken.
Auditorsmustseekevidencethattopmanagementhaveassignedresponsibilityandauthorityfor
preservingtheintegrityoftheorganisationsQMSduringrevisionsorupdates.
DIS9001:2014givesorganisationsandauditorsopportunitytoreevaluatetheeffectiveassignment
andcommunicationofauthority,aswellasresponsibility;authorityoftenbeingvagueandunclear.

6 Planning for the quality management system
6.1Actionstoaddressrisksandopportunities
6.1.1
Interpretation:
Subclause6.1.1isanewrequirementorganisationsarerequiredtoconsidertheircontextwhen
planningfortheirqualitymanagementsystems.Thismeansthinkingabouttheinternalandexternal
AAA
01June2015
Page17of58
issuestheyfaceandtherelevantrequirementsoftheirrelevantinterestedparties,andhowthismay
impactontheirqualitymanagementsystemdesign.
Theorganisationmustthenmoveontodeterminetherisksandopportunitiesthatneedtobe
addressedwithinitsgivencontext.Thisisinordertoprovideassurancethatthequality
managementsystemcanachieveitsintendedoutcomes,topreventorreduceundesiredeffects,and
toachievecontinualimprovement.
Thissubclauseintroducesanewrequirementfororganisationstodeterminethoserisksand
opportunitiesthathavethepotentialtoimpacttheoperationandperformanceoftheirquality
managementsystem,bothpositivelyandnegatively.
Whilenospecificriskmanagementmethodologyisprescribed,riskmanagementasanactivitymust
nowbecarriedout.
Note:thatriskisspecificallydefined(TermsandDefinitions3.09).
Auditorsshouldseekevidencethatconfirmsthatanorganisationhasamethodologyinplacethat
enablesthemtoeffectivelyidentifyrisksandopportunitiesinrespectoftheplanningoftheirquality
managementsystem.
Theroleoftheauditorisnottocarryouttheirowndeterminationofrisksandopportunities,butto
ensurethattheorganisationisapplyingtheirmethodologyconsistentlyandeffectively.However,
wheretheauditorsknowledgeofthecontextoftheorganisationrevealsthattheorganisationhas
failedtoidentifyafamiliarknownriskoropportunity,theymaycallintoquestiontheorganisations
approach.
6.1.2
Interpretation:
Oncetheorganisationhasidentifiedtherisksandopportunitiesitfaces,itmustthendeterminehow
itwishestoaddressthese.
Thereisastatementregardingproportionalitytotheeffectthatactionstakentoaddressrisksand
opportunitiesshouldbeinlinewiththepotentialimpactoftheriskoropportunityontheconformity
ofproductsand/orservices,aswellasoncustomersatisfaction.Theassociatednotesetsout
potentialstrategiesformitigatingrisks,andrecognisesthatnotallrisksandopportunitiesneed
actions.Forexample,theorganisationmaytakeaninformeddecisiontokeeptherisk,ineffect
takingnoactionbeyondidentifyingandevaluatingtheriskoropportunity.
Subclause6.1.2requiresaplannedapproachwithrespecttotheseactions,withtheminitiallybeing
integratedintothequalitymanagementsystempriortoasubsequentevaluationtodetermine
whethertheactionwaseffectiveinreducingtheriskorrealisingtheopportunity.
AAA
01June2015
Page18of58
Thisnewrequirementrequiresqualityprofessionalstoensurethattheirorganisationshaverobust
riskmanagementmethodologiesinplace.Theseneedtoallowrisksandopportunitiesrelatingtothe
QMStobecapturedandassessed.
Dependingontheoutcomeofthisassessment,actionthenneedstobetakentomitigatetheriskor
torealisetheopportunity.Thestandardrequirestheextentofthisactiontobeproportionatetothe
riskoropportunityitself,iemajorrisksrequiringmajoraction(s).
Subsequently,organisationsneedtoevaluatehoweffectivetheactionthattheytookwas.
Organisationsarefreetodecideonthemostappropriateriskmanagementmethodtouse.This
clauseisrelatedtoseveralotherclauseswithintheDISwithregardstoitsoutcomes(iewhatarethe
risksandopportunitiesfortheorganisation,andhowaretheytobeaddressed?).
Consequentlyorganisationstrulyneedtounderstanditandapplyiteffectively.Itisclearthatwrong
assessmentwillnotresultinasuitablequalitymanagementsystem,andhencenoteffective.
Auditorsshouldensurethattheorganisationistakingaplannedapproachtoaddressingrisksand
realisingopportunities,andthatanyactionstakenhavebeenrecorded.Forthoseactionsthathave
beencompleted,auditorsshouldensurethateachactionseffectiveness(orotherwise)has
subsequentlybeenassessed.Theyshouldalsoensurethattheactiontakenwasproportionatetothe
riskoropportunity.
6.2Qualityobjectivesandplanningtoachievethem
6.2.1
Interpretation:
Subclause6.2.1isanenhancementandextensionofISO9001:2008requirements.Itrequiresan
organisationtosetqualityobjectivesforrelevantfunctions,levelsandprocesseswithinitsquality
managementsystem.Itisfortheorganisationitselftodecidewhichfunctions,levelsandprocesses
arerelevant.
Thequalityobjectivesmustbeconsistentwiththeorganisationsqualitypolicyandberelevantto
theconformityofproductsandservices,andtheenhancementofcustomersatisfaction.
Qualityobjectivesmustbemeasurable,takeintoaccountapplicablecustomerandstatutoryand
regulatoryrequirements,andbemonitoredinordertodeterminewhethertheyarebeingmet.They
mustalsobecommunicatedacrosstheorganisationandbeupdatedasandwhentheneedarises.
Informationonthequalityobjectivesneedstoberetainedbytheorganisationasdocumented
information.
AAA
01June2015
Page19of58
ThisisanextensionofISO9001:2008subclause5.4.1Qualityobjectives.Therequirementfor
qualityobjectivestobemeasurableandconsistentwiththeorganisationsqualitypolicyiscarried
across,asistherequirementforobjectivestobesetforrelevantfunctionsandlevels.
NewforDIS9001:2014arerequirementstosetqualityobjectivesforapplicableprocesses,toset
objectivesthatarerelevanttotheenhancementofcustomersatisfaction,andtomonitorprogress
againsttheachievementofobjectives.
Fororganisationsthatsimplycreatedtheminimumamountofqualityobjectivesnecessaryto
conformtotherequirementsofISO9001:2008,thisclausewillmeansomeadditionalworkto
demonstratethevalueofthequalityobjectivesatrelevantfunctions,levelsandprocesseswithinthe
organisation.
AdditionalrequirementshavebeenincludedintheDISassetoutabove.Auditorsshouldensurethat
organisationsareabletoevidencethattheyarecomplyingwiththesenewrequirements.
6.2.2
Interpretation:
Subclause6.2.2isanenhancementofISO9001:2008subclause5.4.2,whichnowclearlystates
requirementsthatwerepreviouslyinferredwithinISO9001:2008.
Theorganisationmustundertakeplanninginordertodeterminehowitsqualityobjectiveswillbe
achieved.
Subclause6.2.2requiresanorganisationtodeterminetheworkrequiredinordertorealiseits
qualityobjectives,theresourcesnecessarytoundertakethiswork,whowillberesponsiblefor
ensuringthattheworkisdoneandwhentheworkneedstobecompletedby.
Additionally,theorganisationmustdeterminehowitwillevaluatetheworkdonetodetermine
whetherithasledtotheobjectivebeingrealised.
Subclause6.2.2focusesnotjustonwhatneedstobedone,butalsoasksorganisationstoidentify
whatresourceswillberequiredtodoit,whowilldoit,whenitwillbecompletedandhowitwillbe
evaluatedinordertodetermineifithasrealisedtheobjective.
Thetargetsetoncompletionofqualityobjectivesmeansmorerobustmonitoringoftheobjectives
willneedtotakeplace.
Itmaybenecessaryfortheorganisationtorevisititsexistingqualityobjectivesinordertoensure
thattheenhancedplanningrequirementsofclause6.2.2havebeenapplied.
AAA
01June2015
Page20of58
Auditorsshouldlookforevidencethateffectiveplanningistakingplacetosupporttheachievement
oftheorganisationsqualityobjectives.Theyshouldensurethatthistakesintoconsiderationthe
newrequirementssetoutabove.
6.3Planningofchanges
Interpretation:
Clause6.3isanenhancementofISO9001:2008clause5.4.2b.Whentheorganisationdetermines
thereisaneedtochangethequalitymanagementsystem,clause6.3.3ofDIS9001:2014requires
suchchangestobecarriedoutinacontrolledmanner.Changesneedtobeplannedfirstandthen
logicallyenacted.Theorganisationneedstobeclearastowhatitisattemptingtoachieveby
implementingtheproposedchangeandwhattheconsequences(bothpositiveandnegative)of
proceedingmaybe.Itneedstoassesswhethertheintegrityofthequalitymanagementsystem
couldbecompromised(orindeedimproved)asaresultofmakingthechange.Theorganisation
mustalsoconsiderwhethertherearesufficientresourcesavailabletoeffectthechangeand
whetheranychangesinresponsibilitiesorauthoritylevelsarenecessarytodrivethechange
through.
Theorganisationisrequiredtoretaindocumentedinformationrelatingtoplannedchangesthat
impactitsqualitymanagementsystem.
ThisisanextensionofISO9001:2008subclause5.4.2b,whichrequirestheintegrityofthequality
managementsystemtobepreservedwheneverchangestoitareplannedorimplemented.
ThenewrequirementsinDIS9001:2014buildonthis,addinginspecificconsiderationsthatan
organisationmustundertakewhenplanningandimplementingQMSchanges.
Auditorsshouldensurethattheorganisationisabletoevidencethatithastakenintoaccountthe
considerationsdetailedinDIS9001:2014clause6.3whenplanningandimplementingchangestoits
AAA
01June2015
Page21of58
7 Support
7.1Resources
7.1.1General
Interpretation:
Subclause7.1.1updatesISO9001:2008clause6.1Provisionofresources.Itrequiresan
organisationinitiallytodetermineandthensubsequentlyprovidetheresourcesnecessaryto
establish,implement,maintainandcontinuallyimproveitsqualitymanagementsystem.
Indoingso,theorganisationisrequiredtoconsiderboththecapabilitiesandconstraintsonits
existinginternalresourcesaswellaswhatneedstobesourcedfromexternalproviders.
TheISO9001:2008clause6.1breferencetoidentifyingresourcesneededtoenhancecustomer
satisfactionhasbeenremovedfromsubclause7.1.1.(althoughthisisstillimpliedthrough5.1.1f).
ThereisnowanexplicitrequirementtoconsiderbothinternalandexternalQMSresource
requirements.
Auditorsmustnowevidencethatorganisationshaveconsideredtheirneedforexternalresourcesin
additiontotheirneedforinternalones.
7.1.2People
Interpretation:
Subclause7.1.2requiresanorganisationtoprovidethosepeoplenecessaryfortheeffective
operationofitsqualitymanagementsystemanditsprocessesinorderthatitcanconsistentlymeet
customerandapplicablestatutoryandregulatoryrequirements.
ThisisessentiallyanexistingrequirementseparatedoutfromISO9001:2008clause6.1Provisionof
resources.Whereasthereferencetomeetingstatutoryandregulatoryrequirementswasimplicitin
clause6.1,itisnowexplicit.
Nochangeinauditapproachrequired.
7.1.3Infrastructure
Interpretation
Subclause7.1.3updatesISO9001:2008clause6.3Infrastructure.AsisthecaseforISO9001:2008,
therequirementsforinfrastructureinDIS9001:2014arecentredaroundidentifying,providingand
maintainingthemeanstoenableprocessestooperateeffectively.
AAA
01June2015
Page22of58
TheexamplesofinfrastructureappearingintheDISareessentiallythesameasthoseinISO
9001:2008,withsomeminorrevisionstowording.Buildings,workspaceandassociatedutilities
becomesbuildingsandassociatedutilities;processequipment(bothhardwareandsoftware)
becomesequipmentincludinghardwareandsoftware;andsupportingservices(suchas
transport,communicationorinformationsystems)becomestransportation,andinformationand
communicationtechnology.
Noactionrequired.
Nochangestoauditapproachrequired.
7.1.4Environmentfortheoperationofprocesses
Subclause7.1.4updatesISO9001:2008clause6.4Workenvironment.
Interpretation:
DIS9001:2014requiresorganisationstodetermine,provideandmaintainasuitableenvironment
fortheoperationofprocesses.ThisisalittlemoreprescriptivethantheISO9001:2008wording,
whichsimplyrequiredorganisationstodetermineandmanagetheirworkenvironment.
Thenotegivesexamplesofenvironmentsfortheoperationofprocesses.Theexamplesinclude
physical,social,psychologicalenvironmentalandotherfactors,includingtemperature,cleanliness
andothers.
Thekeychangehereisthatworkenvironmentnowbecomesenvironmentnecessaryforthe
operationofprocessesreflectinganincreasedfocusthroughoutthestandardonaprocessbased
approach.
Asisthecaseforsubclause7.1.3InfrastructureinDIS9001:2014,thepurposeofmaintainingthe
processenvironmentistoassureconformityofproductsandservices.
Thenotetosubclause7.1.4DIS9001:2014explainsthatanenvironmentfortheoperationof
processescanincludephysical,social,psychological,environmentalandotherfactors,suchas
temperature,humidity,ergonomicsandcleanliness.
Auditorswillneedtoaudittheorganisationsprocessenvironment,notitsworkenvironment.As
wellasphysicalfactors,thisnowincludessocialandpsychologicalfactorstoo.
WhenauditingorganisationscurrentlyoperatingtoISO9001:2008,auditorswillwanttosee
evidencethattheauditeeorganisationisapplyingthisupdatedrequirementtoallprocesses
determinednecessaryforthequalitymanagementsystem.
AAA
01June2015
Page23of58
7.1.5Monitoringandmeasuringresources
Interpretation:
Subclause7.1.5updatesISO9001:2008clause7.6Controlofmonitoringandmeasuring
equipment.
Whereanorganisationusesmonitoringormeasuringtodemonstratethatitsproductsandservices
conformtorequirements,itmustmakesurethatitprovidesthenecessaryresourcestoensurethat
itsmonitoringandmeasuringresultsarevalid.
Theseresourcesneedtobesuitabletothetypeofmonitoringormeasurementbeingundertaken
andmustbemaintainedinordertoensuretheyremainfitforpurpose.
Theorganisationmustmaintainappropriatedocumentedinformationasevidencethatmonitoring
andmeasuringresourcesarefitforpurpose.Ininstanceswheremeasurementtraceabilityhasbeen
identifiedasarequirement,acustomerorrelevantinterestedpartyexpectation,orisconsideredby
theorganisationasessentialinordertoprovideconfidenceinthemeasurementresults,measuring
instrumentsmustbeverifiedorcalibratedagainstinternationalornationalmeasurementstandards
atspecificintervalsorpriortotheiruse.
Ifnosuchstandardsexist,theorganisationmustrecordthebasisitisusingforcalibratingor
verifyingthemeasuringinstrumentintheformofdocumentedinformation.
Measuringinstrumentsmustbeidentifiedinsuchawaythattheircalibrationstatuscanbe
determined.Theymustalsobeprotectedtopreventthembeingadjusted,damagedorsubjectedto
deterioration.
Ifmeasuringequipmentisfoundtobedefective,previousresultsneedtoberevisitedandany
necessarycorrectiveactionimplemented.
DIS9001:2014subclause7.1.5relatestomonitoringandmeasuringresourceswhereasISO
9001:2008clause7.6isconcernedsolelywithmonitoringandmeasuringequipment.Thischange
isanacknowledgementthat,incertaininstances,humansalsocarryoutmonitoringor
measurementactivitywithoutrelianceonequipment,egashipsCookreleasingfoodtobeserved
forthecrew.
Theorganisationisnowrequiredtoretaindocumentedinformationasevidencethatthemeasuring
andmonitoringresourcesarefitforpurpose,notjustthemonitoringormeasuringequipment
(referredtoasinstrumentsinDIS9001:2014).
Ifmeasurementtraceabilityisrequiredthenmeasuringinstrumentsaresubjecttoadditional
controls.Theseare,however,justareworkingofthosecurrentlycontainedinISO9001:2008clause
7.6Controlofmonitoringandmeasuringequipment.
AAA
01June2015
Page24of58
Auditorsshouldnotethatwheremeasurementtraceabilityisrequired,measuringinstrumentsare
subjecttoadditionalcontrols.ThesearecommensuratewiththecurrentrequirementsofISO
9001:2008clause7.6.
Ifmeasurementtraceabilityisnotrequiredthenauditorsmustsatisfythemselvesthatthe
monitoringandmeasuringresourcesanorganisationhasemployedaresuitableandfitforpurpose,
andthatarrangementsareinplacetoensuretheircontinuedfitnessforpurpose.
Auditorsshouldalsoensurethatdocumentedinformationisbeingmaintainedbytheorganisationto
demonstratethatmonitoringandmeasuringresourcesarefitforpurposeintheseinstances.
7.1.6Organizationalknowledge
Thisisanewrequirementaimedatensuringthatorganisationstakestepstocaptureandpreserve
knowledgeandlearning,whichisnecessaryfortheeffectiveoperationoftheirprocessesandfor
ensuringtheconformityoftheirproductsandservices.
Interpretation:
Thisisabroadrequirementdirectedprimarilyatensuringtheorganisationhasorobtainsthe
knowledgeresourcesnecessarytorespondtochangingbusinessenvironmentsreferredtoinclause
4.1,changingcustomerandinterestedpartyneedsandexpectationsreferredtoinclause4.2and,
whereapplicable,relatedimprovementinitiatives.Assuch,thisrequirementhasstronglinkswith
managementreviewactivities.
Thisknowledgeneedstobemaintainedandmadeavailabletotheextentnecessary.The
organisationcanchoosehowbesttodothis;thereisnoexplicitrequirementfororganisational
knowledgetobeheldasdocumentedinformation.
Theorganisationmustreassesstheextentofitsorganisationalknowledgeifitisconsideringmaking
changestoitsqualitymanagementsystemsinresponsetochangingneedsortrendsinitsoperation
environment.
Ifthecurrentlevelofknowledgeisdeemedinsufficientthentheorganisationmusttakestepsto
enhanceit.Thisisanattempttoensurethatorganisationsmakeinformeddecisionsinrespectof
updatestotheirqualitymanagementsystems.
Thisisanewrequirement.Qualityprofessionalsshouldensurethattheyintroduceprocessesto
addresstherequirementsabove.
Thenotestoclause7.1.6givegoodexamplesofwhatorganisationalknowledgecanincludeas
wellastohowadditionalknowledgecanbeobtained.
AAA
01June2015
Page25of58
Thisisanewrequirement.Auditorsshouldensurethatorganisationshavetakenstepstoidentify
theorganisationalknowledgenecessarytoestablishthecontinuingconformityoftheirproductsand
services.
Auditorsshouldensurethatorganisationalknowledgehasbeencommunicatedasnecessarywithin
theorganisationandthatitisbeingmaintainedandprotected.
Theyshouldalsoensurethatanassessmentoforganisationalknowledgehastakenplacepriorto
anychangesmadetothequalitymanagementsysteminresponsetochangingneedsortrends.
7.2Competence
Interpretation:
Clause7.2isessentiallyanamalgamationofISO9001:2008subclause6.2.1HumanResources
Generalandsubclause6.2.2Competence,trainingandawareness(saveforrequirement6.2.2d,
whichnowtransferstoDIS9001:2014clause7.3Awareness).
Theorganisationmustdeterminethecompetencyrequirementsforthosepeopleperformingwork
underitscontrol.Oncethesecompetencyrequirementshavebeendetermined,theorganisation
mustthenensurethatthosepeoplepossessthenecessarycompetencies,eitheronthebasisoftheir
education,trainingorexperience.Theorganisationisrequiredtotakeactiontoacquirethe
necessarycompetence.Actionstakenneedtobeevaluatedforeffectiveness.
TheNoteinthisclausegivesexamplesofapplicableactions,suchastraining,recruitmentoruseof
externalpeople.
Ifthosepeoplearefoundnottobecompetent,actionmustbetakentomakethemcompetentorto
gainthenecessarycompetenciesfromothersources,forexample,recruitmentoruseofexternal
people.Anassessmentneedstobesubsequentlyundertakentodeterminewhetherthishasbeen
successfulinraisingcompetencetotherequiredlevel.
Organisationsmustretainappropriatedocumentedinformationtoevidencethecompetenceofits
people.
Note:clause7.2referstoPeopleperformingworkunderitscontrol.Thisembracescontractand
agencypeople,aswellaspeopleperformingprocessesandfunctionsthathavebeenoutsourcedto
externalproviders.Theseareoperatingunderthecontroloftheorganisation,recognisedinDIS
9001:2015byaspecificreferenceinclause8.4.3totheneedtocommunicatetoexternalproviders
competenceandqualificationrequirementsasapplicable.Inpracticethisrequirementislikelytobe
addressedthroughprocurementprocesses.
Competenceisdefinedastheabilitytoapplyknowledgeandskillstoachieveintendedresults.
Competencenowneedstobeconsideredintermsofitspotentialimpactonqualityperformance,
asopposedtoitsabilitytoaffectconformitytoproductrequirements.
AAA
01June2015
Page26of58
Organisationsarestillrequiredtotakeactiontoaddressanycompetencyissuesandsubsequentlyto
checkthatthisactionhasbeeneffective.Additionally,organisationsarestillrequiredtomaintain
evidencetodemonstratethatpeopledoingworkunderitscontrolarecompetent.Thisevidence
needstobemaintainedasdocumentedinformation.
Whileclause6.2.2of9001:2008requiresrecordsofeducation,training,skills,andexperience,clause
7.2.5DIS9001:2014requiresdocumentedinformationasevidenceofcompetence.
Nosubstantivechangealthoughattentionisdrawntotherelatedrequirementsforcontrolof
externallyprovidedproductsandserviceswithinDIS9001:2014clause8.4.1.
Also,someorganisationsrecordsregardingclause6.2.2mayhavetobereviewedtoassesswhether
theycanalsoconstituteevidenceofcompetence.Ifnot,documentedinformationofevidenceof
competenceneedstobeidentifiedandestablishedormaintained.
7.3Awareness
Interpretation:
Awarenesshasnowbeenelevatedfromaconstituentelementofsubclause6.2.2Competency,
trainingandawarenessin9001:2008toaseparatesubclauseinitsownright.
Therequirementscontainedinthenewclause7.3nowapplytoallpersonsdoingworkunderthe
organisationscontrol.ThisismoreexpansivethanunderISO9001:2008wheretheorganisation
neededtoensurethatitspersonnelwereaware.
Inrespectofwhatindividualsneedtobeawareof,thistoohasbeenextended.UnderISO
9001:2008,theawarenessrequirementforpersonnelwasquitelimited;necessitatingonlyan
awarenessoftherelevanceandimportanceoftheworktheywereconducting,andanappreciation
astohowthiscontributedtotheorganisationsqualityobjectives.
Now,however,thereareexplicitrequirementsforpeopledoingworkundertheorganisations
controltobeawareoftheorganisationsqualitypolicy,anyqualityobjectivesthatarerelevantto
them,howtheyarecontributingtotheeffectivenessoftheQMSandwhattheimplicationsareof
themnotconformingtoQMSrequirements.
Clause7.3containsexpandedrequirements.Qualityprofessionalsshouldnotethatthepeoplewho
needtobemadeawarenowextendstoallpersonsdoingworkontheorganisationsbehalf
(previouslythiswaslimitedtotheorganisationspersonnel).Qualityprofessionalsshouldalsonote
thatadditionalinformationassetoutabovemustbecommunicatedtotheseindividuals.
Theimportantfactorhereistheadditionoftherequirementtomakepersonsdoingworkunderthe
organisationscontrolawareoftheimplicationsofnotconformingtotheQMS.
AAA
01June2015
Page27of58
DIS9001:2014hasenhancedrequirementsforawarenessbothintermsofwhoneedstobemade
awareandalsointermsofwhattheyneedtobemadeawareof.Thelatterisnowdetailedexplicitly
withinthisclause.Auditprofessionalsmustensurethattheorganisationisabletoprovideevidence
thattheseenhancedrequirementsarebeingmet.
7.4Communication
Interpretation:
ThisexpandsonthecurrentISO9001:2008subclause5.5.3byextendingitsscopetoinclude
externalcommunicationsaswellasinternalones.
Clause7.4Communicationencompassesallinternalandexternalcommunicationrelatingtoan
organisationsQMS.EachorganisationmustdeterminethoseQMSrelatedmattersonwhichit
wishestocommunicate.Oncethishasbeendone,considerationmustthenbegivenastothetiming
ofsuchcommunications,theirtargetaudienceandtheirmethodofdelivery.
Note:referencetoexternalcommunicationinthisclausedoesnotencompassspecificcustomer
communicationrequirementsofISO9001:2008subclause7.2.3,whicharelargelyretainedinDIS
9001:2014subclause8.2.1.
Thenewclauseismoreprescriptiveinrespectofthemechanicsofthecommunication;subclause
5.5.3referstotheneedforcommunicationtotakeplacewhereasDIS9001:2014clause7.4
requiresorganisationstodetermineonwhatitwillcommunicate,whenitwillcommunicate,with
whomitwillcommunicateandhowitwillcommunicate.Qualityprofessionalsshouldbepreparedto
evidencetheseconsiderations.
Auditorsshouldensurethatorganisationsareidentifyingexternalcommunicationsaswellas
internalcommunicationsthatneedtotakeplaceinrespectoftheoperationofitsquality
managementsystem.Theyshouldalsoensurethattheorganisationhasdeterminedwhatitneedsto
communicate,whenitwillcommunicate,withwhomitwillcommunicateandhowitwill
communicate.
7.5Documentedinformation
7.5.1General
Interpretation:
Subclause7.5.1confirmsthatanorganisationsqualitymanagementsystemincludesboth
documentedinformationidentifiedasrequiredinDIS9001:2014anddocumentedinformation
identifiedbytheorganisationasnecessaryfortheeffectiveoperationofitsqualitymanagement
system.
AAA
01June2015
Page28of58
Thenotetotheclauseadvisesthattheextentofdocumentedinformationpresentcandiffer
betweenorganisationsduetotheirsize,complexityandthecompetencyoftheirpeople.
NochangetheserequirementsarealreadycontainedinISO9001:2008clause4.2.
Nochangeinauditapproachisrequired.
7.5.2Creationandupdating
Interpretation:
Whendocumentedinformationiscreatedorupdated,theorganisationmustensurethatitis
appropriatelyidentifiedanddescribed(egtitle,date,author,referencenumber).Itmustbeinan
appropriateformat(eglanguage,softwareversion,graphics)andonappropriatemedia(egpaper,
electronic).
Documentedinformationmustbereviewedandapprovedforsuitabilityandadequacy.
Nofurtheractionisrequiredastheserequirementsarealreadycontainedwithinthesubclauses
thatcompriseISO9001:2008clause4.2.
7.5.3Controlofdocumentedinformation
7.5.3.1
Interpretation:
Theorganisationisrequiredtocontroldocumentedinformationinordertoensurethatitisavailable
whereneededandthatitissuitableforuse.Itmustalsobeadequatelyprotectedagainstimproper
use,lossofintegrityandlossofconfidentiality.
Qualityprofessionalsshouldnotethat,whiletherequirementforadocumentedproceduresetting
outhowdocumentsaretobecontrolledhasbeenremoved,theneedtocontroldocumented
informationremains.
Therequirementsinsubclause7.5.3.1mirrorcurrentrequirementsinISO9001:2008.
AAA
01June2015
Page29of58
Auditorsshouldnotethat,whiletherequirementforadocumentedprocedurespecifyinghow
documentsaretobecontrolledhasbeenremoved,therequirementsaboveareunchangedfromISO
9001:2008.
7.5.3.2
Interpretation:
Theorganisationmustdeterminehowitwilldistribute,access,retrieveandusedocumented
information.Itmustdecidehowitwillstoreandpreservedocumentedinformation,andhowitwill
controlanychangestothedocumentedinformation.Itmustalsodecideitsretentionanddisposal
arrangements.
Theorganisationisalsorequiredtoidentifyanydocumentedinformationofexternalorigintothe
organisationthatitconsidersnecessaryfortheplanningandoperationoftheorganisationsquality
managementsystem.Suchdocumentationmustbeidentifiedandcontrolled.
WhileISO9001:2008containsrequirementsforcontrolsinrespectofthedistributionandretrieval
ofdocuments,DIS9001:2014extendsthesealsotocovertheaccessandusageofdocumented
informationrequiredbytheorganisationsqualitymanagementsystemandbyDIS9001:2014.
Whereorganisationschosetoholdtheirdocumentedinformationinelectronicforms,theremaybe
aneedtorevisitaccesscontrols(passwords/logins)andauthorisationlevelsinordertoensure
currentcontrolsareappropriate.Organisationswillneedtoconsiderhowsuchsystemsaretobe
protectedwhenpasswordsarelostandhowaccesstothedocumentedinformationcanbe
preservedintheeventofsystemunavailability.Theywillalsoberequiredtodemonstratehowthe
integrityoftheirdocumentedinformationismaintained.
TheNoteinclause7.5.3.2statesaccesscanimplypermissiontoviewonly,orpermissiontoview
andauthoritytochange.
Withmostorganisationsmovingtoelectronicdocumentsthataremaintainedandaccessed
remotelyusingpasswords,etc.thiscanmeanmorecontrolsthatneedtobedemonstratedif
claimingcompliance.
Auditorswillincreasinglyfindthemselveshavingtoaccessanduseelectronicsystemsinorderto
evidencehoworganisationsarecontrollingtheirdocumentedinformation.Thiscouldrequirea
technicalupskilling.
Auditorswillneedtoestablish,priortocommencinganaudit,whetheranelectronicsystemisin
placeandwillneedtomakethenecessaryarrangementswiththeorganisationtoensurethatthey
canaccessandusesuchsystems.
AAA
01June2015
Page30of58
8 Operation
8.1Operationalplanningandcontrol
Interpretation:
Clause8.1requirestheorganisationtoplan,implementandcontrolthoseprocessesthatithas
previouslyidentified(seeclause4.4)asnecessaryinorderforittomeetproductorservice
requirements.Itmustadditionallyplanhowitwilladdressanyrisksandopportunitiesthatmay
impacttheseprocessesand,therefore,itsabilitytoachievetheserequirements.
Theplanningprocesscommenceswiththeorganisationestablishingitsproduct/service
requirements.Oncethishasbeencompleted,theorganisationmustthenconsideritsprocessesand
foreachitmustestablishthecriteriafortheprocess,howitwillcontroltheprocess,theacceptance
criteriafortheoutputsofeachprocessandtheresourcesnecessarytosupporteachprocess.This
meansthattheinputs(triggersfortheprocess),outputs(productsand/orservices),andresources
andcontrols(toensurethattherequiredoutputsareachieved)shouldbedetermined.Inaddition,
whatmakestheoutputacceptablealsoneedstobedeterminedthiscanbetargets,measures,
values,KPIs,specificationsandothercriteriaasrelevanttotheoutput.
Subsequently,theorganisationisrequiredtocreateandkeepdocumentedinformationtotheextent
itdeterminesisnecessarytoallowittoensurethatitsprocessesarebeingcarriedoutasplanned,
andthattheproductsandservicesthatarebeingproducedconformtotheidentifiedrequirements
andacceptancecriteria.
Theextentofplanningfortheprovisionofproductsandservicesmustbeproportionatetothesize,
natureandcomplexityoftheorganisationsoperations.
Theoutputfromoperationalplanningandcontrolmustbesuitablefortheorganisationsoperation.
Theorganisationmustcontrolplannedchangestotheprovisionofproductandservices,andmust
reviewtheconsequencesofanyunintendedchanges.Wherenecessary,theorganisationshould
takeactiontoaddressormitigateanyadverseeffects.
Anyoutsourcedprocessesmustbecontrolledinaccordancewithclause8.4Controlofexternally
providedproductsandservices.
Therequirementtoplananddevelopprocessesisnotnew.ForDIS9001:2014,however,thishas
beenextendedalsotoincludeimplementationandcontrol.
Thetermproductrealizationhasbeenwithdrawnandreplacedbyoperation,andthe
requirementforPlanningofproductrealizationhasbeenreplacedbyOperationalplanningand
control.
TheISO9001:2008clause7.1arequirementtodeterminequalityobjectivesforproductsorservices
hasbeenrelocatedtoDIS9001:2014subclause6.2.1,whichcallsforqualityobjectivestobe
establishedatrelevantfunctions,levelsandprocesses.
AAA
01June2015
Page31of58
ISO9001:2008clause7.1breferstoprovidingresourcesspecifictotheproduct.DIS9001:2014
referstoresourcesneededtoachieveconformitytoproductandservicerequirements.
Therequirementforplanningproportionatetotheorganisationssize,natureandcomplexitycomes
straightacrossfromISO9001:2008,asdoestherequirementfortheoutputfromoperational
planningandcontroltobeinaformthatissuitableforusebytheorganisation.
Thenewcontrolfocusedrequirementscentreonensuringthatprocessesareimplementedas
planned,includingactionstoaddressrisksandopportunities.Thisneedstobeevidencedbymeans
ofdocumentedinformation.
Thissectionshouldbereadinconjunctionwithguidancegiventoauditprofessionalsunderclause
4.4.Theincreasedfocusontheprocessapproachmakesproperlyunderstandingclause4.4and
clause8.1afundamentalrequirementforauditors.
Auditprofessionalsshouldnotethatthisclausenowincludesimplementationandcontrol
requirements,notjustplanninganddevelopmentrequirementsasperISO9001:2008.Theyshould
alsonotethechangeofterminologyProductrealizationhasbeenreplacedbyProductionand
serviceprovision.
Clause4.4,togetherwithclause8.1,makesitveryclearthattheorganisationisrequiredto
determineandplan(design)itsprocessestomeetrequirements.Assuch,auditorsneedtoevidence
thatthishasbeendone,ieevidencethattheprocess(includingprocessinputs,outputs,resources,
controls,criteria,processmeasurementandperformanceindicators)hasbeenplanned.Thefact
thattheyexistisnotinitselfevidencethattheyhavebeenplanned.
Thereisalsoaclearlinkand,hence,audittrail,fromclause6.1Actionstoaddressrisksand
opportunitiesthroughtoclause8.1.Forthoserisksandopportunitiesthattheorganisationhas
determinedneedtobeaddressed,auditorsshouldgatherevidencethattheseactionshavebeen
integratedintothemanagementsystem;assuch,theseactionsshouldbeverifiableatprocesslevel
forexample,evidenceofcontrols,acceptancecriteriaandresourcestoaddresstherisksand
opportunities.
Auditorsalsoneedtoevidencethatprocesseshavebeenimplementedandcontrolledasplanned,
andinsofarastheyrelatetoprocessplanningandcontrol,evidencethattheorganisationhas
evaluatedtheeffectivenessofactionstakentoaddressrisksandopportunities.
Auditorsshouldalsogatherandevaluateevidencerelatingtoplannedchangesandtoany
unintendedchanges.
8.2Determinationofrequirementsforproductsandservices
8.2.1Customercommunication
Subclause8.2.1requiresanorganisationtoensurethatithasprocessesinplacetoallowitto
communicatewithitscustomersonmattersrelatingtoitsproductsandservices,enquiries,
contractsororderhandling(includingamendments);customerviewsandperceptions(including
AAA
01June2015
Page32of58
customercomplaints),thehandlingortreatmentofcustomerpropertyifapplicable;andspecific
requirementsforcontingencyactionswhenrelevant.
QualityprofessionalsshouldnotethattheserequirementsareessentiallythesameasforISO
9001:2008subclause7.2.3Customercommunication,butwiththeadditionofnewrequirements
tocommunicateinrespectofthehandlingortreatmentofcustomerpropertyandspecific
requirementsforcontingencyactionswhererelevant.TheISO9001:2008requirementtoobtain
customerfeedbackhasbeenamendedtoobtaincustomerviewsandperceptions.
Achangeherethatmayhaveimplicationsforqualitypractitionersisthattheclauseoncustomer
communicationnowappearsbeforethedeterminationandreviewingofrequirements.Thisisto
demonstratetheimportanceofcommunicatingwiththecustomeronunderstandingthe
requirementsbeforedeterminingwhattheorganisationintendstoofferthem.
Auditorsshouldnotethechangesandadditionalrequirementssetoutabove.
8.2.2Determinationofrequirementsrelatedtotheproductsandservices
Interpretation:
Theorganisationisrequiredtoputinplaceaprocesstoensurethatrequirementsfortheproducts
andservicesitintendstooffertocustomershavebeendefined.Thisincludesthecaptureofany
applicablestatutoryandregulatoryrequirements.
Oncethishasbeendone,theorganisationmustthenensurethatithastheabilitytomeetthe
definedrequirementsandsubstantiatetheclaimsitismakingfortheproductsandservicesit
intendstosupply.
ThisreplacesISO9001:2008subclause7.2.1.Thenewclauserepresentsasubtlechangein
emphasisinthenatureoftheinteractionbetweensupplierandcustomerinrespectofdetermining
customerrequirements.InISO9001:2008,theorganisationdeterminescustomerrequirements
beforereviewingtheseandthenproceedingtodesignordevelopaproductorservice.DIS
9001:2014startsfromthepositionthattheorganisationhasalreadydeterminedtheproductsand
servicesitintendstooffertocustomers,takingintoaccountcustomerrequirements.Thisreflects
thewaythatmuchofbusinesstakesplacethesedays,withorganisationseffectivelysettingouttheir
productportfoliosfromwhichcustomersmustchoose.
Qualityprofessionalsshouldnotethenewrequirementtoestablish,implementandmaintaina
processthatensuresthattheorganisationhasdeterminedtherequirementsfortheproductsand
servicesitintendstooffertocustomers.
Anorganisationwillneedtobeabletosubstantiateanyclaimsitmakesaboutitsproductsor
servicesinrespectofthemmeetingdefinedrequirements.
AAA
01June2015
Page33of58
Auditorsshouldnotetherequirementforaprocessthatensuresthattheorganisationhas
determinedtherequirementsfortheproductsandservicesitintendstooffertocustomers.They
shouldseekevidencethatthisisinplace.
Auditorsshouldalsoevidencethattheorganisationisabletosubstantiateanyclaimsitismakingfor
theproductsandservicesitoffers.
8.2.3Reviewofrequirementsrelatedtoproductsandservices
Interpretation:
Theorganisationisrequiredtoreviewrequirementsrelatingtoitsproductsandservices.Thisreview
needstoconsiderrequirementssetbythecustomer,includingonesrelatingtodeliveryandpost
delivery.Itmustalsoincludeconsiderationofanyrequirementsnotexpresslystatedbythe
customerbutthatareknowntobenecessaryfortheproductorservicetobesuitableforthe
customersintendeduse.
Inaddition,thereviewmustconsideranystatutoryorregulatoryrequirementsrelatingtothe
productorservice,andanyneworchangedrequirementsthatdifferfromthosepreviously
determined.
Requirementreviewsmusttakeplacebeforetheorganisationcommitstosupplyproductsor
servicestoacustomerand,shoulditbenecessary,mustseektoresolveanydifferencesbetween
whatwasoriginallyorderedorcontractedandwhattheorganisationhasnowdeterminedthe
requirementstobe.
Ifthecustomerdoesnotprovideadocumentedstatementoftheirrequirementsthenthe
organisationmustconfirmthecustomersrequirementswiththecustomerpriortothe
order/contractbeingaccepted.
Documentedinformationrelatingtorequirementreviewsmustberetainedbytheorganisation.
Whererequirementshavebeenrevisedasaresultofreview,thismustbeidentifiedinthe
documentedinformation.
Whereproductorservicerequirementshavebeenchanged,theorganisationmustensurethatany
relevantdocumentsareamendedandthatrelevantpersonnelaremadeawareofthechanged
requirements.
QualityprofessionalsshouldnotethatthissubclauseamalgamatesISO9001:2008subclauses7.2.1
and7.2.2.
Thereisnosubstantivechangetocontent,thoughthereisrecognitionthatwhenreviewing
requirementsrelatingtoproductsorservices,theserequirementscouldnowincludethosearising
fromrelevantinterestedpartiesnotjustfromcustomers.
AAA
01June2015
Page34of58
Auditprofessionalsshouldensurethatrequirementsfromrelevantinterestedpartiesareconsidered
aspartofanorganisationsproductandservicerequirementreviewprocess.
8.3Designanddevelopmentofproductsandservices
8.3.1General
Interpretation:
Inthoseinstanceswheretheorganisationhasnotestablisheddetailedrequirementsforproductsor
services,orwherethesehavenotbeendefinedbythecustomerorotherinterestedpartiestothe
extentthattheyareadequatetoallowproductionorserviceprovisiontotakeplace,the
organisationmustimplementandmaintainadesignanddevelopmentprocess.
Subclause8.3.1isanewclausethatmandatestheintroductionofadesignanddevelopment
processinthecircumstancessetoutabove.
Auditprofessionalsshouldensurethatadesignanddevelopmentprocessexistsandisbeing
operatedinthecircumstancessetoutabove.
Increasedknowledgeoftheproductsandservices,andmethodsofarrivingatthem,willberequired
byauditorsinordertobeabletoverifywhethertheorganisationsQMSshouldorshouldnot
includedesignanddevelopment.
8.3.2Designanddevelopmentplanning
Interpretation:
Theorganisationisrequiredtoplanandcontrolthedesignanddevelopmentofitsproductsand
services.Thedesignanddevelopmentprocesswillcompriseanumberofstages,eachofwhichwill
besubjecttocontrols.
Whendeterminingthestagesandcontrolstobeappliedtoitsdesignanddevelopmentprocess,the
organisationmustconsider:
AAA
thecomplexity,natureanddurationofthedesignanddevelopmentactivities;
thatanyrequirementsthatspecifyparticularprocessstagesmustbeincluded,forexample
designanddevelopmentreviews;
thedesignanddevelopmentverificationandvalidationthatisrequiredateachstage;
theresponsibilitiesandauthoritiesofthoseinvolvedinthedesignanddevelopmentprocess;
theneedtoensurethattheinterfacesbetweenindividualsandpartiesinvolvedinthedesign
anddevelopmentprocessareappropriatelymanaged;
whetheritisnecessarytoinvolvethecustomerand/orusergroupsinthedesignand
developmentprocess;
01June2015
Page35of58
thedocumentedinformationthatwillbenecessarytoconfirmthedesignanddevelopment
requirementshavebeenmet.
DIS9001:2014subclause8.3.2buildsontheexistingISO9001:2008subclause7.3.1Designand
developmentplanning.
Subclause8.3.2ismoreexplicitthanitspredecessorintermsofwhatneedstobetakeninto
considerationwhenplanningthedesignanddevelopmentprocess.However,itislikelythat
organisationscomplyingwithISO9001:2008willalreadybeundertakingtheseactivitiesanyway.
Thiscouldbe,forexample,byinvolvingthecustomerand/orusergroupsinthedesignand
developmentprocesswhereappropriate,andinensuringthattheorganisationsdesignand
developmentprocesstakesintoaccountanyidentifiedrequirementtoincludespecificstages,such
asdesignoradevelopmentreview.
Therequirementtoretaindocumentedinformationthatconfirmsthatthedesignanddevelopment
requirementshavebeenmetisanewadditiontothisclause.
Auditprofessionalsshouldensurethatorganisationsareabletoevidencethattheyhavetakeninto
considerationtheexplicitlyreferencedconsiderationsrelatingtothedesignanddevelopment
processsetoutabove.
Theyshouldalsoensurethattheorganisationhasretaineddocumentedinformationtoconfirmthat
itsidentifieddesignanddevelopmentrequirementshavebeenmet.
8.3.3Designanddevelopmentinputs
Interpretation:
DIS9001:2014subclause8.3.3requirestheorganisationtodeterminespecificinputsintoitsdesign
anddevelopmentprocess.
Theseinclude:
AAA
anyrequirementsthatareessentialforthespecifictypeofproductorservicethatisbeing
designedanddeveloped(includinganyfunctionalorperformancerelatedrequirementsas
applicable);
anyapplicablestatutoryorregulatoryrequirements;
anycodesofpracticethattheorganisationhasagreedtoimplement;
anyresourceneeds,whetherinternalandexternal,requiredforthedesignand
developmentoftheproductorservice;
thepotentialconsequencesoffailureduetothenatureoftheproductorservice;
thecustomersandotherinterestedpartiesexpectedlevelofcontrolofthedesignand
developmentprocess.
01June2015
Page36of58
Theorganisationmustensurethatdesignanddevelopmentinputsareadequate,completeand
unambiguous.Ifthereareanyconflictsbetweendesigninputs,thenthesemustberesolved.
Theseareamendedrequirements.ThissubclausebuildsonthepreviousrequirementsofISO
9001:2008subclause7.3.2Designanddevelopmentinputs.
TheISO9001:2008requirementstoincludeasadesignanddevelopmentinputinformationfrom
previoussimilardesignshasbeendeleted.Initsplacearenewrequirementstoincludeasadesign
anddevelopmentinputinternalandexternalresourceneedsandthepotentialconsequencesof
designordevelopmentfailurebasedonthenatureoftheproductorservice.
TheremainingISO9001:2008designanddevelopmentinputrequirementsareessentially
unchanged.
Auditorsneedtoverifythattheorganisationhasaddressedthespecificnewrequirementssetoutin
DIS9001:2014subclause8.3.3specifically,thoserelatingtoresourcerequirementandthe
consequencesofdesignordevelopmentfailure.
8.3.4Designanddevelopmentcontrols
Interpretation:
Theorganisationisrequiredtoapplycontrolstoitsdesignanddevelopmentprocessinorderto
ensurethat:
theresultsfromundertakingthedesignanddevelopmentprocessareclearlydefined;
designanddevelopmentreviewstakeplaceinaccordancewithplannedarrangements;
thedesignanddevelopmentoutputsmeetthedesignanddevelopmentinputs(verification);
theresultingproductsandservicesarefitfortheirintendeduseorspecifiedapplication
wherethisisknowntotheorganisation(validation).
ThissubclausedrawsinanumberofexistingrequirementsfromISO9001:2008subclauses7.3.3,
7.3.4,7.3.5and7.3.6.Therearenonewrequirements.
8.3.5Designanddevelopmentoutputs
Interpretation:
Theorganisationmustensurethattheoutputsfromdesignanddevelopmentmeettheinput
requirementsfordesignanddevelopment,andaresuitableforuseinsubsequentprocesses.
AAA
01June2015
Page37of58
Asapplicable,designoutputsmustincludeorreferenceanyrelatedmonitoringormeasuring
requirementsandacceptancecriteria.
Finally,theorganisationmustensurethattheproductsthataretobeproducedortheservicesthat
aretobedeliveredarefitfortheirintendedpurposeandaresafetouse.
Theorganisationisrequiredtoretaindocumentedinformationresultingfromthedesignand
developmentprocess.
QualityprofessionalsshouldnotethatthissubclausecorrespondstoISO9001:2008subclause7.3.3
Designanddevelopmentoutputs.
Itisessentiallyunchanged,exceptthattherequirementtoincludeorreferencemonitoringand
measuringrequirementshasbeenaddedtoISO9001:2008subclause7.3.3c.
Arequirementtoretaindocumentedinformationresultingfromthedesignanddevelopment
processhasalsobeenaddedintothissubclause.
Auditorsshouldnotetheadditionalrequirementfordocumentedinformationinrespectofsub
clause8.3.5.
Theyshouldalsonotetheneedfordesignoutputstoreferencemonitoringandmeasuring
requirementsasapplicable.
8.3.6Designanddevelopmentchanges
Interpretation:
Ifchangesaremadetoeitherdesigninputsordesignoutputs,thentheorganisationmustreview,
controlandidentifytheseinordertoensurethatconformitytorequirementsismaintained.
Therequirementtoreviewandexercisecontrolappliesatallstagesduringthedevelopmentof
productsorservicesand,subsequently,forexample,aftertheproductorservicehasbeendelivered.
Theorganisationisrequiredtoretaindocumentaryinformationrelatingtodesignanddevelopment
changes.
ThissubclauseisessentiallyunchangedfromISO9001:2008subclause7.3.7Controlofdesignand
developmentchanges.
TheorderofreviewandidentifyhasbeenreversedinDIS9001:2014,withreviewtakingplace
first.Controlhasbeenadded.
AAA
01June2015
Page38of58
TheISO9001:2008requirementtoreview,verify,validateand,asappropriate,approvedesign
changesbeforeimplementationisnolongerexplicitlydefinedbutisimpliedinthewordingofsub
clause8.3.6.
Therearefurtherimplicationsforqualityprofessionalsoforganisationsthataresignificantlyaffected
bythenewrequirementforpostdeliveryactivitiesinsubclause8.5.5.
Nochangetothecurrentauditapproach.
8.4Controlofexternallyprovidedproductsandservices
8.4.1General
Interpretation:
Theorganisationmustensurethatexternallyprovidedprocesses,productsorservicesmeetthe
organisationsspecifiedrequirements.
Theorganisationmustemploycontrolstoenableittoverifythatexternallyprovidedprocesses,
productsorservicesmeettheserequirements.
Thesecontrolsmustbeputintoeffectwhentheorganisationisseekingtoobtain:
productsandservicesfromtheexternalprovidersforincorporationintotheorganisations
ownproductsandservices;
productsandservicestobeprovideddirectlytothecustomerbytheexternalprovideron
theorganisationsbehalf;
outsourcedprocessesorpartsofprocessesfromanexternalprovider.
Theorganisationmustdetermineandputinplacecriteriathatallowittoevaluateandselect
externalproviders,andthatallowitsubsequentlytomonitortheirperformance.
Criteriarelatingtothereevaluationofexternalprovidersalsoneedtobeestablishedand
implemented.
Documentedinformationneedstoberetainedevidencingtheresultsofexternalprovider
evaluations,reevaluationsandthemonitoringoftheirperformance.
TheimplicationsofthissubclausearebroadlyinlinewiththerequirementsofISO9001:2008sub
clauses7.4.1and7.4.3;however,DIS9001:2014subclause8.4.1nowexplicitlysetsoutthose
instancesinwhichtheorganisationmustapplycontrolstoexternalproviders(seethebulletpoints
above).
Thenewrequirementhereistoestablishcriteriatomonitortheperformanceofexternalproviders
andtohavetheresultsoftheevaluation,reevaluationandperformanceasdocumented
information.
AAA
01June2015
Page39of58
InISO9001:2008subclause7.4.1,itisrequiredtokeeprecordsofthecriteriaforselection,
evaluationandreevaluationofthesuppliers.Whereas,inDIS9001:2014,organisationsarerequired
torecordnotonlythecriteria,butalsotheresultsoftheseactivities,includingperformance.Thisas
manyimplicationsforqualitypractitioners.Ifpreviouslytheorganisationhasnotmaintainedrecords
oftheresultsoftheseactivities,nowtheyneedtodoso,meaningmoredocumentedinformation
thanbefore.
Note:anexternalproviderisaproviderexternaltothescopeofthequalitymanagementsystem.
Assuch,ifascopeofregistrationcoversasingleplantinawidergroupstructurethenanything
sourcedfromothermembersofthegroupwouldbeexternallyprovidedandhencesubjecttothe
requirementsofclause8.4.
Auditorsshouldnotethenewrequirementfortheorganisationtoestablishcriteriatoallowit
additionallytomonitortheperformanceofexternalproviders.Thismustbemaintainedas
documentedinformation.
Theyshouldalsonotetherequirementfororganisationstoprovidearecordoftheresultsoftheir
monitoringoftheexternalprovidersperformanceasdocumentedinformation.
8.4.2Typeandextentofcontrolofexternalprovision
Interpretation:
Theorganisationmustdeterminethetypeandextentofcontrolsthatitwishestoapplytoexternal
providers.
Indecidingthenatureandextentofthesecontrols,theorganisationneedstotakeinto
considerationthepotentialimpactthattheexternallyprovidedprocesses,productsorservicescould
haveonitsabilitytosupplyconformingproductsandservicestoitscustomers.Theorganisation
mustalsoconsiderhoweffectiveitconsidersthecontrolsthatarebeingappliedbytheproviderare.
Theorganisationmustestablishandcarryoutchecksinordertoensurethatexternallyprovided
processes,productsandservicesdonotdetrimentallyaffectitsabilityconsistentlytodeliver
conformingproductsandservicestoitscustomers.
Ifprocesseshavebeenoutsourcedtoanexternalprovider,thesameconsiderationsassetoutabove
mustbeappliedwhendeterminingtheextentofcontrolstobeapplied.
ThisclausebringsinelementsfromISO9001:2008subclauses7.4.1Purchasingprocessand7.4.3
Verificationofpurchasedproduct.
InISO9001:2008subclause7.4.1,whendeterminingthenatureandextentofcontrolstobe
employedtosuppliers,theorganisationneededtoconsidertheeffectofthepurchasedproducton
subsequentproductrealizationorthefinalproduct.However,inDIS9001:2014thishasbeen
amendedtothepotentialimpactoftheexternallyprovidedprocesses,productsorservicesonthe
AAA
01June2015
Page40of58
organisationsabilityconsistentlytomeetcustomerandapplicablestatutoryandregulatory
requirements.
Therequirementtoverifyexternallyprovidedprocesses,productsorservicesremainsinsubclause
8.4.2.However,inISO9001:2008theverificationwastoensurethepurchasedproductmet
specifiedpurchaserequirements.InDIS9001:2014,theverificationistoensuretheexternally
providedprocesses,productsandservicesdonotadverselyaffecttheorganisationsabilitytodeliver
conformingproductsandservicestoitscustomers.
Auditorsshouldnotetherevisedrequirementsassetoutabove,includingthoserelatingto
outsourcedprocesses.
8.4.3Informationforexternalproviders
Interpretation:
Subclause8.4.3setsouttheinformationthattheorganisationisrequiredtocommunicateto
externalprovidersofprocesses,productsandservices.
Thisinformationmustincludeapplicablerequirementsforthefollowing:
Requirementsrelatingtotheproductsorservicestobeprovidedortheprocessestobe
performedbytheexternalprovideronbehalfoftheorganisation.
Requirementsrelatingtotheapprovalorreleaseoftheproductorservice,methods,
processesorequipment.
Requirementsrelatingtothecompetencyofpersonnel,includinganynecessary
qualificationstheymustpossess.
Anyactionsthattheexternalprovidermustundertakeinordertoensurethatitinteracts
appropriatelywiththeorganisationsqualitymanagementsystem.
Detailsastohowtheexternalprovidersperformancewillbemonitoredandcontrolledby
theorganisation.
Detailsofanyverificationactivitiesthattheorganisation(oritscustomer)intendsto
performattheexternalproviderspremises.
Theorganisationisrequiredtoensurethattherequirementsitintendstocommunicatetothe
externalproviderarereviewedforadequacypriortotheirbeingcommunicated.
DIS9001:2014subclause8.4.3drawsinexistingrequirementsfromISO9001:2008subclauses7.4.1
Purchasingprocesses,7.4.2Purchasinginformationand7.4.3Verificationofpurchased
product.
Essentially,theserequirementsareunchanged.Thereisanacknowledgementthatorganisations
mayneedtocommunicatenotjusttheproductsorservicestheywishtoreceive,butalsoany
processestheywanttheexternalprovidertoundertakeontheirbehalf.
AAA
01June2015
Page41of58
Therequirementfortheorganisationtocommunicate,asapplicable,thenecessaryqualificationof
personnelhasbeenexpandedtocoverthecompetencyandqualificationofpersonnel.
Therequirementfortheorganisationtocommunicateanyqualitymanagementsystem
requirements,asapplicable,hasbeenexpandedtotheir(ietheexternalproviders)interactions
withtheorganisationsqualitymanagementsystem.
8.5Productionandserviceprovision
8.5.1Controlofproductionandserviceprovision
Interpretation:
Subclause8.5.1requiresorganisationstocontrolthewayinwhichtheyprovidetheirproductsand
services.
Thesecontrolledconditionsmustinclude,asappropriate,ensuringthat:
documentedinformationthatdefinesthecharacteristicsoftheproductorserviceis
available;
documentedinformationthatdefinestheactivitiesthatneedtobeperformedtoproduce
theproductordelivertheserviceisavailable,andthatthisspecifiestheresultsthatareto
beachieved;
monitoringandmeasurementtakesplaceatappropriatepointsintheproductionprocessto
ensurethatboththeprocessesthemselvesandtheprocessoutputsmeettheorganisations
acceptancecriteria;
theprocessenvironmentandinfrastructurearesuitable;
suitablemonitoringandmeasurementresourcesaremadeavailable;
personnelarecompetentand,wherenecessary,appropriatelyqualified;
forprocesseswheretheresultscannotbeverifiedbysubsequentmonitoringor
measurement,
theprocessitselfisinitiallyvalidatedandthenperiodicallyreevaluated;
productandservicerelease,deliveryandpostdeliveryactivitiesareimplemented.
ThissubclauseisanamalgamationandexpansionofISO9001:2008subclauses7.5.1Controlof
productionandserviceprovisionand7.5.2Validationofprocessesfromproductionandservice
provision.
Thereferencetoworkinstructionshasbeenreplacedbyareferencetodocumentedinformation
thatdefinestheactivitiestobeperformedandtheresultsachieved.
Theresultsachievedisanimportantaddition;thesemaynotappearinexistingdocumentation
describingtheactivitiestobeperformedorinrecordsgeneratedfromthem.
AAA
01June2015
Page42of58
Thereisnowanexplicitrequirementtoensuremonitoringandmeasurementactivitiesare
undertakenatappropriatepoints.Thisisinordertoverifyprocessesarebeingcontrolledandthat
processoutputs,productsandservicesaremeetingtheiracceptancecriteria.Thisisanexpansionon
ISO9001:2008subclause7.5.1e.
Theuseofsuitableequipmenthasbeenreplacedbytheuseandcontrolofsuitableinfrastructure
andprocessenvironment.
Referenceismadetomonitoringandmeasuringresourcesasopposedtomonitoringand
measuringequipment,reflectingthefactthatmonitoringmaybebeingcarriedoutbyhumans.
TheISO9001:2008subclause7.5.2breferencetothequalificationofpersonnelhasmodifiedto
thecompetencyand,whereapplicable,requiredqualificationofpersonsemphasisingcompetency
overqualification.
Auditorsshouldnotethechangedrequirementsassetoutabove.
8.5.2Identificationandtraceability
Interpretation:
Theorganisationisrequiredtoputarrangementsinplacetoallowitsprocessoutputstobe
identifiedwherethisisnecessary,inorderforittobeabletodemonstratethattheyconformto
requirements.
Theorganisationmustbeabletoidentifythestatusofprocessoutputsinrespectofanymonitoring
andmeasurementrequirementsithasset,atallstagesofproductionorserviceprovision.
Incaseswheretraceabilityisarequirement,theorganisationmustadditionallyensurethatits
processoutputsareuniquelyidentifiable.Documentedinformationthatenablesproductoutputsto
betracedbackthroughthequalitymanagementsystemmustberetained.
Thenotetothesubclauseremindsusthatprocessoutputscaninclude,butarenotlimitedto,
products,services,intermediatepartsorcomponents.
Essentially,thissubclauseisunchangedfromISO9001:2008subclause7.5.3Identificationand
traceability.
DIS9001:2014subclause8.5.2statesthatidentificationandtraceabilityistobeemployedwhere
necessarytoensuretheconformityofproductsandservices.However,ISO9001:2008simplystates
thatitistobeemployedwhereappropriate.
Thereareterminologychanges.DIS9001:2014referstoprocessoutputs,theprovisionof
productsandservicesanddocumentedinformation,whereasISO9001:2008referstoproducts,
productrealizationandrecords.However,thesubstanceoftherequirementsisidentical.
AAA
01June2015
Page43of58
Nochangeinauditapproachisnecessary.
8.5.3Propertybelongingtocustomersorexternalproviders
Interpretation:
Subclause8.5.3requirestheorganisationtotakecareofpropertythathasbeensuppliedtoitfor
incorporationintoitsproductsorservicesbycustomersorbyexternalproviders.
Theorganisationmustensurethatanysuchpropertyisidentified,verified,protectedand
safeguarded.
Ifthepropertyisincorrectlyused,lostordamaged,theorganisationmustmakesurethatthisis
reportedbacktothecustomerorexternalprovider.
Anoteprovidesexamplesofthetypesofpropertythatthisclauseisintendedtocover.
ThisrequirementisessentiallyunchangedfromISO9001:2008subclause7.5.4.However,ithasnow
beenextendedtocovernotjustcustomerproperty,butalsopropertybelongingtotheexternal
providersthathasbeenprovidedtotheorganisationforuseorincorporationintotheproductsand
services.Assuch,existingarrangementsmustberevisedtoreflectthis.
Fororganisationsthatuseexternalprovidersproperty,thiscanimpactontheirQMSinrelationto
gapsincontrolsneeded,and,hence,thereareimplicationsforthequalitypractitionersofsuch
organisationstoensurecompliancewiththisrequirement.
EvidenceisrequiredtoconfirmthatthecontrolsappearinginISO9001:2008relatingtocustomer
propertyhavebeenextendedtocoverpropertyfromexternalproviders.
8.5.4Preservation
Interpretation:
Subclause8.5.4requirestheorganisationtotakeappropriatemeasuresduringproductionand
serviceprovisiontosafeguardprocessoutputs,inordertomaintaintheirconformityto
requirements.
Thenotetosubclause8.5.4providesexamplesofpreservation.Theseincludeidentification,
handling,packaging,storage,transmissionortransportationandprotection.
Notwithstandingthatthissubclausereferstoprocessoutputsasopposedtoproduct,its
requirementsareessentiallythesameasforISO9001:2008subclause7.5.5Preservationof
product.
AAA
01June2015
Page44of58
Examplesofwhatpreservationcouldinclude(egidentification,handling,packaging,storageand
protection)nowappearinanotetosubclause8.5.4insteadofinthebodyofthesubclauseitself.
TransportationandTransmissionhavebeenaddedtotheoriginalISO9001:2008preservation
examples.Theimplicationsforqualityprofessionalsofthisadditionmeansthatiftheir
organisationsproductsaredataandinformation,theywillneedtolookattherisksoflossofdata
andsecurityissuesduringtransmission(egwebsitesubscriptions,webbasedinformation,data
attachedtoemails,informationinemails).Thisissomethingthatpreviouslymighthavenotbeen
consideredaqualityissue.
Nosubstantivechangetocurrentauditpractice.
8.5.5Postdeliveryactivities
Interpretation:
Subclause8.5.5requirestheorganisationtodeterminethenatureandextentofanypostdelivery
activitiesitneedstoundertake.
Whenmakingthisdecision,theorganisationmustconsidertherisksassociatedwiththeparticular
productorservice,thenatureoftheproductorservice,howtheproductorservicewillbeusedand
whattheproductorservicesintendedlifetimeis.
Inaddition,considerationofanypostdeliveryactivitiesalsoneedstotakeintoaccountcustomer
feedbackandanyapplicablestatutoryorlegalrequirements.
Qualityprofessionalsshouldbeawarethatthesearenewrequirements.Theyshouldensurethat
theirqualitymanagementsystemisamendedtoaddressthisclause.Theyshouldalsonotethe
necessaryconsiderationsrelatingtorisk,thenatureoftheproductorservice,itsintendedlifetime,
customerfeedbackandapplicablestatutoryorlegalrequirements.
Thiscanpotentiallyrequiresomeworkforthequalitypractitionersiftheorganisationsproductsor
servicesareofhighriskandhavealargeorindefinitelifetime(egmedicaldevices,aerospace,
researchresultsortestresults).
Auditorsshouldbeawarethatthesearenewrequirements.Theyshouldensurethatthe
organisationhastakenintoaccountthenecessaryconsiderationswhendeterminingthenatureand
extentofpostdeliveryactivities.
AAA
01June2015
Page45of58
8.5.6Controlofchanges
Interpretation:
Theorganisationisrequiredtocontrolanyunplannedchangesthatareconsideredessentialinorder
toensurethatproductsorservicescontinuetomeettheirspecifiedrequirements.
Insuchinstances,theorganisationmustretaindocumentedinformationdescribingtheresultsofthe
reviewofthechanges,theperson(s)authorisingthechangesandanynecessaryactions.
Qualityprofessionalsshouldbeawarethatthisisanewclause.Iftheorganisationdeterminesthatit
mustmakeunplannedchangestoitsprocessesinordertoensureitsproductsorservicescontinue
toconformtotheirspecifiedrequirements,thenthesechangesmustbemadeinacontrolled
manner.Thereareseveralimplicationsforqualitypractitionersoforganisationsthatareregularly
makingunplannedchangesasaresultofmarketorcustomerneeds,orlackofsupplierperformance.
Auditorsshouldevidencethattheorganisationhascontrolledunplannedchangesinaccordance
withtherequirementssetoutabove.
8.6Releaseofproductsandservices
Interpretation:
Clause8.6requirestheorganisationtocarryoutpredeterminedverificationatappropriatepointsin
theproduction/deliveryprocessinordertoverifythatproductsandservicesmeetagreed
acceptancecriteria.Evidencethattheproductorservicemeetstheacceptancecriterianeedstobe
retained.
Productsorservicesmustnotnormallybereleasedtothecustomeruntilalloftheplannedtestsand
checkshavebeensatisfactorilycompleted,unlesssomeonewiththerelevantauthorityagreesto
theirearlyrelease.Whereapplicable,permissionforearlyreleasemustalsobeobtainedfromthe
customer.
Documentedinformationthatallowstheindividualauthorisinganyearlyreleasestobeidentified
mustberetained.
Subclause8.6referstoproductsandservicesinsteadofproducts,andtotheneedtoretain
documentedinformationasopposedtoevidenceofconformitytorequirements.Apartfrom
this,itisotherwiseequivalenttoISO9001:2008subclause8.2.4.
Nosubstantivechange.Auditorsshouldnotetherefreshedterminologyproductsandservices
replacesproducts,anddocumentedinformationreplacesrecord.
AAA
01June2015
Page46of58
8.7Controlofnonconformingprocessoutputs,productsandservices
Interpretation:
Theorganisationisrequiredtoidentifyanyprocessoutputs,productsorservicesthatdonot
conformtotheirintendedrequirements.Controlsneedtobeestablishedandimplementedto
ensurethatthesenonconformingprocessoutputs,productsorservicesarenotdeliveredtothe
customerorusedunintentionally.
Wherenonconformingprocessoutputs,productsorservicesareidentified,theorganisationis
requiredtotakeactiontocorrectthefault.Thiscorrectiveactionmustbeproportionate,reflecting
boththenatureofthenonconformityanditsabilitytoimpacttheorganisationsintendedproduct
orservice.Thisrequirementalsoappliestononconformingproductsorservicesthatareidentified
afterdeliverytothecustomer.
Theorganisationisrequiredtodealwithnonconformingprocessoutputs,productsorservicesin
oneormoreofthefollowingways:
bycorrectingthefault;
bysegregationorcontainmentoftheprocessoutput,productorservice;
bysecuringtheprocessoutput,productorservicesreturn;
bysuspensionoftheprovisionofproductsandservices;
byinformingthecustomer;
byobtainingauthorisationtousetheprocessoutput,productorserviceasis;
byobtainingauthorisationtoreleasetheproductorservice;
byobtainingauthorisationtoreprovidetheproductorservice;
byobtainingauthorisationforacceptanceunderaconcession.
Iftheorganisationdecidestocorrectanonconformingprocessoutput,productorservicethenit
mustverifythatthecorrectiveactionithastakenhasrestoredtheprocessoutput,productor
servicesconformitytorequirements.
Theorganisationisrequiredtoretaindocumentedinformationofactionstakenwhere
nonconformingprocessoutputs,productsorserviceshavebeenidentified.Thisneedtoinclude
detailsofanyconcessionsobtainedanddetailsofthepersonorauthoritythatmadedecisionsin
respectofdealingwiththenonconformity.
ThisclausecontainsminorchangesinrequirementsfromISO9001:2008clause8.3Controlof
nonconformingproduct.
DIS9001:2014includesreferencetoprocessoutputsandservicesaswellastoproducts.
Thereisnolongerarequirementforadocumentedprocedurethatdefinesthecontrolsandrelated
responsibilitiesandauthoritiesfordealingwithnonconformingproducts.
AAA
01June2015
Page47of58
Auditorsshouldnotetheremovaloftherequirementforadocumentedprocedurecoveringcontrol
ofnonconformingproducts.
ThedocumentedinformationrequirementequatestotheexistingISO9001:2008requirementto
retainrecordsofnonconformitiesandresultantactions.
9 Performance evaluation
9.1Monitoring,measurement,analysisandevaluation
9.1.1General
Interpretation:
Subclause9.1.1requirestheorganisationinitiallytodeterminewhatitneedstomonitorand
measure.Oncethishasbeendoneitmustthendecidehowitisgoingtocarryouttheseactivitiesin
ordertoensurethattheresultsobtainedarevalid.Therequirementformethodstoensurevalid
resultsalsoextendstotheorganisationsanalysisandevaluationactivities.Inaddition,the
organisationmustalsodeterminewhenmonitoringandmeasurementshouldbecarriedoutandat
whatstagetheresultsofmonitoringandmeasurementshouldbeanalysedandevaluated.
Organisationsaresubsequentlyrequiredtoensurethatmonitoringandmeasurementtakesplacein
accordancewiththerequirementstheorganisationhassetitself.Theymustensurethatwhere
monitoringandmeasurementtakesplace,documentedinformationisretainedtoevidencethe
results.
Finally,thereisarequirementfororganisationstoevaluatethequalityperformanceand
effectivenessoftheirqualitymanagementsystems.
Thedecisiononwhethertomonitorortomeasure,andwhattomonitorandmeasure,canhavea
significantimpactontheeffectivenessoftheQMS,itsimplementationanditsresults.Inevitablythe
decisionwillbebasedon:
thedegreeofconfidencethattheorganisationhasintheoperationalcontrolsthatithas
establishedforitsprocesses,andtheireffectiveness(thiscanusehistoricaldataon
performancetoestablishwhatshouldbemonitoredandwhatshouldbemeasured).
thedegreeofconfidencethattheorganisationneedstohaveintheoperationalcontrols
thatithasestablishedforitsprocesses,andtheireffectiveness(thiscanusetheoutputfrom
theorganisationsapproachtoaddressingrisksandopportunities;aswellastheneedsand
expectationsofitscustomersandinterestedparties).
Inevitably,intheabsenceofdataforeitheroftheabovepoints,theorganisationmayhavetohavea
comprehensivesetofmonitoringandmeasurementactivitiesuntilsuchtimethatitcanbuild
enoughinformationand/ordatatohelpinformitsdecisionmakingforfuturemonitoringand
AAA
01June2015
Page48of58
measurementactivities.Anexampleiswherecertificationbodiescarryoutmorefrequent
surveillancevisitsofthoseorganisationsnewlycertified,andonceconfidenceisachievedthrough
thesevisitsandtheirresults,theycanreducethefrequencyoffuturesurveillancevisits.Ultimately,
thisisallaboutriskassessment.
Auditorsshouldnotetheadditionalrequirementfororganisationstoevidenceevaluationofthe
resultsofmonitoringandmeasurement,notjusttheiranalysis.
Theyshouldconfirmthattheorganisationhasconsideredwhat,howandwhentomeasureandthat
theoutcomesfromthisdecisionresultareensuringappropriateprocesscontrol.
Theyshouldalsonoteanewrequirementtomonitorthequalityperformanceandeffectivenessof
theorganisationsqualitymanagementsystem.
9.1.2Customersatisfaction
Interpretation:
Subclause9.1.2requirestheorganisationtoputinplacearrangementstomonitorthedegreeto
whichcustomersbelievetheirrequirementsforproductsandserviceshavebeenmet.
Additionally,thereisalsoarequirementfortheorganisationtoobtaindatarelatingtocustomer
perceptionsoftheorganisationitself,aswellastheproductsandservicesitprovides.
Theorganisationneedstoidentifyhowthisinformationistobesecuredandthewayinwhichitisto
beused.
GuidanceisprovidedbymeansoftheNotesimilartothatin9001:2008clause8.2.1astothe
methodsthatcouldbeemployedtoobtaincustomerviews.
ThisclausesupersedesISO9001:2008subclause8.2.1.
Theprincipalchangehereisthatconsiderationofcustomerperceptionnowincludessoliciting
perceptionsoftheorganisationandofitsproductsandservices,andnotjustperceptionsasto
whethertheorganisationhasmetthecustomersrequirements.Theorganisationmustalsodecide
howitisgoingtoobtainandusecustomersatisfactioninformation.
Auditorsshouldensurethattheorganisationhasmettheadditionalrequirementstoseekcustomer
perceptionabouttheorganisationitselfandalsoitsproductsandservices.Theyshouldalsoensure
thattheorganisationhasidentifiedhowitintendstoobtaincustomersatisfactioninformation.
AAA
01June2015
Page49of58
9.1.3Analysisandevaluation
Interpretation:
Subclause9.1.3requirestheorganisationtoanalyseandevaluateappropriatedataandinformation
thatithasobtainedeitherinternallyorexternallyforavarietyofpredefinedpurposes.
Theseinclude:todemonstratethattheorganisationsproductsandservicesconformto
requirements;toassessandenhancecustomersatisfaction;toensuretheconformityand
effectivenessofthequalitymanagementsystem;andtodemonstratethatplanninghasbeen
successfullyimplemented.Additionally,itistobeusedtoevaluatetheperformanceofprocesses
andofexternalproviders,andtodeterminetheneedoropportunityforimprovementswithinthe
Subclause9.1.3nowreferstoanalysisandevaluationofdata,ratherthanjustanalysisasinISO
9001:2008clause8.4.
Qualityprofessionalsshouldnotethenewrequirementfordataandinformationtodemonstrate
thatplanninghasbeeneffective.
TheISO9001:2008clause8.4creferencetopreventiveactionhasbeenremoved.
Subclause9.1.3referstoevaluatingtheperformanceofprocesses,whereasISO9001:2008refersto
providinginformationrelatingtothecharacteristicandtrendsofprocesses.
TheISO9001:2008clause8.1referencetostatisticaltechniquesandtheextentoftheirusehas
beenremoved.
Auditorsshouldnotethatorganisationsnowneedtoevidencebothanalysisandevaluationofdata
andinformation.Itisnotsufficientjusttocarryoutananalysiswithoutinterpretingtheresults.
Theyshouldensurethatorganisationsareabletoevidencethroughanalysisandevaluationthat
planninghasbeeneffective.
Notetherequirementtoevaluatetheperformanceofprocesses.
Notetheremovalofreferencestopreventiveactionandstatisticaltechniques.
9.2Internalaudit
9.2.1
Interpretation:
Subclause9.2.1confirmstherequirementfortheorganisationtocarryoutinternalauditsat
plannedintervalsinordertodeterminewhetherthequalitymanagementsystemconformstoboth
theorganisationsownrequirementsandtherequirementsofISO9001.
AAA
01June2015
Page50of58
Internalauditsmustalsoidentifywhetherthequalitymanagementsystemisbeingeffectively
implementedandmaintained.
QualityprofessionalsshouldnotethattheserequirementsareessentiallyunchangedfromISO
9001:2008subclause8.2.2.
Nochangetocurrentauditpractice.
9.2.2
Interpretation:
Subclause9.2.2setsoutaseriesofrequirementsrelatingtohowauditprogrammesmustbe
structured,whatauditsmustcover,whoshouldundertakeauditsandhowauditsaretobereported.
Whendesigninganauditprogramme,organisationsneedtoconsidertheirqualityobjectives,the
importanceoftheprocessesconcerned,customerfeedback,changeswithintheorganisation,risks
andopportunities,andtheresultsofpreviousaudits.
Eachauditneedstohaveadefinedscopeanditsownauditcriteria.
Auditsandauditorsneedtobeimpartialandobjective.
Finally,thefindingsfromauditsneedtobefedbacktotherelevantmanagementwithanyrequired
correctionsorcorrectiveactionsbeingtakeninatimelymanner.
Documentedinformationneedstoberetainedtoprovideevidencethattheauditprogrammehas
beenimplemented.Documentaryinformationmustalsoexisttoprovideevidenceoftheresultsof
audits.
Thereisnolongerarequirementfororganisationstoestablishadocumentedinternalaudit
procedure.However,organisationsmaystillchosetooperateoneiftheysowish.
Qualityprofessionalsshouldnotetheneedtoretaindocumentedinformationevidencingthe
implementationofanauditprogrammeandalsotheresultsofaudits.
Theyshouldalsonotethatwhendesigningtheinternalauditprogramme,customerfeedback,
organisationalchanges,andqualityobjectivesnowneedtobeconsideredexplicitly.
Notethattheresultsoftheauditsshouldbereportedtotherelevantmanagementversus
9001:2008wherethenonconformitiesarereportedtothemanagementoftheareaaudited.
AAA
01June2015
Page51of58
Auditorsshouldnotnecessarilyexpecttofindadocumentedinternalauditprocedureinplace.
However,theymustbeabletoaccessdocumentedinformationconfirmingtheimplementationof
anauditprogrammebytheorganisation.Documentedinformationmustalsobeavailableto
evidencetheresultsofaudits.
Whendetermininghowtheauditprogrammehasbeendesigned,auditorsshouldensurethat
customerfeedback,organisationalchanges,andrisksandopportunitieshavebeenbroughtinto
consideration.
9.3Managementreview
9.3.1
Interpretation:
Subclause9.3.1requiresreviewsofthequalitymanagementsystemtobeundertakenbytop
managementatplannedintervalsinordertoensurethequalitymanagementsystemscontinuing
suitability,adequacyandeffectiveness.ThisisessentiallyunchangedfromtheexistingISO
9001:2008subclause5.6.1.
However,DIS9001:2014requiresmanagementreviewsadditionallytoconsideranychangestothe
contextoftheorganisationandalsothedegreeofalignmentbetweenthequalitymanagement
systemandthestrategicdirectionoftheorganisation.
Subclause9.3.1detailstheitemsthattopmanagementmust(asaminimum)considerduringa
managementreview.
Theinitialrequirementistorevisitthestatusofanyactionsidentifiedatpreviousreviews.Thenext
requirementcallsforconsiderationoftheorganisationscontext,includingbothinternaland
externalissuesthatarerelevanttotheQMSanditsstrategicdirection.
Thethirdrequirementisforconsiderationofqualityperformance.Here,specificreferenceismade
totheneedfortrendsandindicatorsrelatingtononconformitiesandcorrectiveaction,monitoring
andmeasurementresults,auditresultsandcustomersatisfaction,processperformanceand
conformityofproductsandservices.Alsocontainedwithinthequalityperformancesectionisa
requirementtoconsiderissuesconcerningexternalprovidersandotherinterestedparties,aswellas
theadequacyofresources.
Finally,managementreviewsmustconsideropportunitiesforimprovementandthestatusofrisks
andopportunities.
ThissubclausesupersedesISO9008:2008subclause5.6.2Reviewinput.Whiletheoverall
purposeofmanagementreviewsremainsunchanged,therearenownewstrategicitemsrelating
tocontext,riskandopportunitiestobeincludedontheagenda.Inaddition,thereisarequirement
thattrendsandindicatorsbeusedtomonitorspecificelementsofqualityperformance.This
AAA
01June2015
Page52of58
contrastswithISO9001:2008,wheretherequirementissimplytoincludeinformationonthese
items.
Theimplicationfororganisationsisamorecomprehensivereviewprocess.Itshouldbenotedthata
lotoftheinformationlistedwillalreadybeavailableinsomeorganisations,butmaynothavebeen
addressedunderqualitymanagementinthepast.
Auditorsshouldexpecttoevidenceamorestrategicallyfocusedmanagementreview.Context,risks
andopportunitiesneedtobeconsidered,aswellasthealignmentofthequalitymanagement
systemtotheorganisationsoverallstrategicobjectives.Auditorsshouldalsonotetheexplicit
requirementfororganisationstousetrendsandindicatorstomonitortheperformanceoftheir
qualitymanagementsystems.
9.3.2
Interpretation:
Subclause9.3.2setsoutspecificrequirementsinrespectoftheoutputsfrommanagementreviews.
Thesemustincludedecisionsastowhetherthereisaneedtochangeanyaspectofthequality
managementsystemincluding,butnotlimitedto,thelevelofresourcesprovidedtosupportthe
operationoftheQMS,aswellasanydecisionsrelatingtocontinualimprovementopportunities.
Theorganisationmustretaindocumentedinformationtoprovideevidenceastotheresultsof
managementreviews.
QualityprofessionalsshouldnotethatthissubclausesupersedesISO9001:2008subclause5.6.3
Reviewoutput.Therequirementsofbothsubclausesare,however,essentiallythesame.
Organisationsarenow,however,requiredtoretaindocumentedinformationasevidenceofthe
resultsofthemanagementreviews(ratherthanrecordsofmanagementreviewasstatedin
9001:2008).
Auditorsshouldexpecttoevidencethesameoutputsfrommanagementreviewsasatpresent.
However,theyshouldnotethattheresultsofmanagementreviewscannowbeheldinanyformat
thattheorganisationchooses.
AAA
01June2015
Page53of58
10 Improvement
10.1General
Interpretation:
Clause10.1isanewclause.Itsetsouttheheadlinerequirementfororganisationsactivelytoseek
outandrealiseimprovementopportunitiesthatwillbetterenabletheorganisationtomeet
customerrequirementsandenhancetheircustomerssatisfaction.
Whenlookingtoimprove,organisationsshouldreviewtheirprocesses,seektoimprovetheir
productsandservices,andseektoimprovetheirqualitymanagementsystemresults.
Theassociatednoteremindsusthatimprovementdoesnotalwaystakeplaceonacontinualbasis.
Sometimesitoccursasaresultofcorrectiveaction,sometimesthroughinnovationandsometimes
asaresultofreorganisation.
PreventiveactionnolongerexistsasaconceptinDIS9001:2014allreferencestoithavebeen
removed.Instead,ithasbeenreplacedbyriskbasedthinking.
Also,theexplicitrequirementtoimprovethequalitymanagementsystemthroughtheuseofthe
qualitypolicy,qualityobjectives,auditresults,analysisofdataandcorrectiveactions,and
managementreviewthatappearsinISO9001:2008subclause8.5.1Continualimprovementhas
beenremovedfromDIS9001:2014.
Qualityprofessionalsshouldnotethenewrequirements.Organisationsshouldensurethattheyhave
systemsinplacetoreviewtheirprocesses,productsandservices,andtheperformanceoftheir
qualitymanagementsystemasawhole,withtheobjectiveofmakingimprovements.
Note:therearenolongeranyrequirementstobefulfilledrelatingtopreventiveaction(previously
ISO9001:2008subclause8.5.3).Asaresult,itisnolongernecessarytohaveadocumented
procedureforpreventiveaction.
Payattentiontoimprovingproductsandservicesnotonlytomeetknownrequirements,butalsothe
predictedrequirements.
Auditorsshouldcontinuetoseekobjectiveevidencethatimprovementistakingplace.Theyshould
note,however,thatwhileimprovementdoesnotneedtobecontinual,itdoesneedtobeevidenced
asoccurring.
Auditorsshouldlookforevidencethattheorganisationisconsideringimprovementinrespectofits
processes,productsandservices,andtheperformanceofthequalitymanagementsystemoverall.
Inthecaseofproductsandservices,thisistomeetnotjustknownbutpredictedrequirements.
Theyshouldnotethatthereisnolongerarequirementtoauditpreventiveactionasadistinctentity.
AAA
01June2015
Page54of58
Auditorsshouldalsonotetheremovaloftheexplicitrequirementfortheorganisationtoimproveits
qualitymanagementsystemthroughthereviewofthequalitypolicy,qualityobjectives,audit
results,analysisofdataandcorrectiveactions,andmanagementreview.
10.2Nonconformityandcorrectiveaction
10.2.1
Interpretation:
Subclause10.2.1setsouthowtheorganisationisrequiredtoactwhennonconformityisidentified.
Insuchinstances,theorganisationisrequiredtotakewhateveractionisnecessarytocontroland
correctthenonconformity,andtodealwithanyresultantconsequences.
Oncethishasbeencompleted,theorganisationcanthenmoveontoconsiderwhetheranyfurther
actionisrequiredtopreventasimilarnonconformityoccurringatsomepointinthefuture.This
requirestheorganisationtodeterminewhatcausedthenonconformitiesandthentoconsider
whetherthepotentialforasimilarproblemremains.
Theorganisationisthenrequiredtoimplementanyactionsidentifiedasneeded,reviewtheir
effectivenessandmakechangestothequalitymanagementsystemifnecessary.
Thisclausealsorecognisesthattheactionsorganisationstakeonnonconformitiesshouldbe
appropriatetotheeffectofthosenonconformities.
Theassociatednoterecognisesthattheremaybeinstanceswhereitisimpossibletoeliminatethe
rootcauseofnonconformityaltogether.Thereforeinsomeinstances,thebestthatmaybepossible
istoreducethelikelihoodofasimilaroccurrencehappeningagaintoanacceptablelevel.
ThetitleofthissubclausehaschangeditwaspreviouslyISO9001:2008subclause8.5.2
Correctiveaction.
Ondiscoveringnonconformity,thereisnowanexplicitrequirementfororganisationstodetermine
whetherothersimilarnonconformitiesactuallydoorpotentiallycouldexist.
Thereisalsoarequirementfortheorganisationtodeterminewhetherchangesarerequiredtothe
widerQMSinordertopreventareoccurrence.
Thenoterecognisesthatforcertaincircumstancesitmaybeimpossibletoeliminatethecauseof
nonconformity.
Auditorsshouldevidencethat,wherenonconformitieshavebeenidentifiedbyanorganisation,an
investigationhasbeenconductedtodeterminewhetherothersimilarnonconformitiesactuallydoor
potentiallycouldexist.
AAA
01June2015
Page55of58
Theyshouldalsoevidencethatwhereanonconformityhasoccurred,theorganisationhas
consideredwhetheritneedstomakechangestothewidersystemtopreventareoccurrence.
10.2.2
Interpretation:
Subclause10.2.2requirestheorganisationtokeepdocumentedinformationdetailingthenatureof
anynonconformityidentifiedandtheactionthattheorganisationdecidedtotaketoaddressit.This
documentedinformationmustalsorecordtheresultsofthecorrectiveaction.
TheISO9001:2008subclause8.5.2requirementforadocumentedcorrectiveactionprocedurehas
beenremoved.Instead,theorganisationisnowrequiredtoretaindocumentedinformation.
Iforganisationswishtoretaintheirexistingdocumentedcorrectiveactionprocedure,thenproviding
itmeetstherequirementsofsubclause10.2.2,itwillbeacceptedasdocumentedinformation.
Pleasenotethatthedocumentedinformationwillrequirethenatureofthenonconformitiestobe
recordedaswellasanysubsequentactionstaken.Thiswasnotanexplicitrequirementof9001:2008
subclause8.5.2andisanewrequirement.
Auditorsshouldnolongerexpecttofindadocumentedcorrectiveactionprocedure.The
organisationmayelecttoprovideevidencethatitisfulfillingtherequirementsofthissubclauseby
othermeans,egbytheuseofcomputerbasedrecords.
Notethenewrequirementregardingtherecordingofthenatureofnonconformitiesaswellas
subsequentactiontobetaken.Auditorsshouldensurethattheorganisationismeetingthis
additionalrequirement.
10.3Continualimprovement
Interpretation:
Clause10.3requirestheorganisationtoworkcontinuallytoimproveitsqualitymanagementsystem
intermsofitssuitability,adequacyandeffectiveness.
Aspartofthecontinualimprovementprocess,theorganisationisspecificallyrequiredtousethe
outputsfromanalysisandevaluation(seesubclause9.1.3)andfrommanagementreview(see
clause9.3)todetermineareasofunderperformanceandtoidentifyanyopportunitiesfor
improvement.
Toolsandmethodologiesshouldbeemployedasappropriatebytheorganisationtoinvestigatethe
causeofunderperformanceandtosupportcontinualimprovement.
AAA
01June2015
Page56of58
TheISO9001:2008subclause8.5.1requirementcontinuallytoimprovetheeffectivenessofthe
QMSspecificallythroughtheuseofthequalitypolicy,qualityobjectives,auditresults,analysisof
data,correctiveandpreventiveactions,andmanagementreviewhasbeendropped.
Organisationswillnowneedtodemonstratethattheyareusingtheoutputsfromtheiranalysisand
evaluationprocessestoidentifyareasofunderperformanceandopportunitiesforimprovement.
Appropriatetoolsandmethodologiesshouldbeemployedbytheorganisationtosupportthis
activity.
Auditorsshouldevidencethatorganisationsareusingtheoutputsfromtheiranalysis,evaluation
andmanagementreviewprocessestoidentifyimprovementopportunitiesandqualitymanagement
systemunderperformance.Theyshouldalsoverifythattheorganisationisusingsuitabletoolsand
methodologiestosupportitsinvestigation.
Annexes
AnnexA(Informative)Clarificationofnewstructure,terminologyandconcepts
ISO9001:2008containedasingleinformativeannex(AnnexA).Withinthiswasatablethatmapped
eachISO9001:2008clausetoitsISO14001:2004(EnvironmentalManagementSystemStandard)
counterpart.
ThereisnosuchtableinDIS9001:2014AnnexA,whichinsteadintroducesthenewAnnexSLbased
structurethatunderpinsthestandardaswellasthecoreconceptsonwhichitisbuilt.Theseinclude
Contextoftheorganisationaswellasariskbasedapproach.
Themethodbywhichexclusionsarehandledalsoappearshere.DIS9001:2014containsno
referencetoexclusionsandthedefaultpositionisthatorganisationsareexpectedtomeetallofthe
requirementsofthestandardunlessitisimpossibleforthemtodoso.Thereisnooptiontoopt
outofspecificrequirementsthatanorganisationmaysimplybeuncomfortablewith.
Anexplanationisprovidedinrespectofdocumentedinformation.Thistermreplaces
documentedprocedureandrecords,andhasbeenincorporatedthroughoutDIS9001:2014to
alignwithotherinternationalstandards.Thereisnowmuchmorefreedomfororganisations
themselvestodeterminethenatureandextentoftheirdocumentholdings.
Organisationalknowledgeisanewrequirement(subclause7.1.5).Organisationsarenowrequired
todetermineandmaintaintheknowledgetheypossess,whichiscriticalinrespectofensuringtheir
productsandservicesconformtorequirements.Thisincludesnotjustknowledgeheldindocuments
oronITsystems,butalsoinpeoplesheads.
Thefinalconceptaddressediscontrolofexternallyprovidedproductsandservices.Thissupersedes
ISO9001:2008clause7.4Purchasingandcoversanyexternalprovisionwhereexternalis
AAA
01June2015
Page57of58
externaltothescopeofthemanagementsystem.Thiscouldbeatraditionalthirdpartysupplieror
anotherorganisationinthesamegrouporcompanyifthatorganisationisnotcoveredbythesame
scopeasthepurchasingorganisation.
AnnexB(Informative)Qualitymanagementprinciples
ThiscontainsreworkedqualitymanagementprinciplesdrawnacrossfromISO9004:2009Managing
forthesustainedsuccessofanorganisationAqualitymanagementapproach.
Theprinciplesformthebasisforallqualitymanagementsystemstandardsdevelopedby
ISO/TechnicalCommittee176including,butnotlimitedto,the9000series.Thesevenprinciples
containedinDIS9001:2014are:customerfocus;leadership;engagementofpeople(involvementof
peopleinISO9004:2009);processapproach;improvement(continualimprovementinISO
9004:2009);evidencebaseddecisionmaking(factualapproachtodecisionmakinginISO
9004:2009);andrelationshipmanagement(mutuallybeneficialsupplierrelationshipsinISO
9004:2009).
The9004:2009principlesystemsapproachtomanagementhasbeendeleted.
Eachprinciplehasanassociatedstatementthatprovidesanexpandeddescriptionoftheprinciple
andanassociatedrationalethathighlightsthebenefitsanorganisationshouldexpecttorealise
shouldtheyadopttheprinciple.
AnnexCInformationTheISOportfolioofqualitymanagementstandards
AnnexCprovidesdetailsoftheISO10000seriesofqualitymanagementstandardsaswellasISO
19011,whichrelatestomanagementsystemaudits.
TheISOreferenceandtitleofeachstandardisgiven,aswellasashortsummaryofwhateach
standardisabout.
TableC.1crossreferenceseach10000seriesstandardtooneormorespecificclause(s)ofDIS
9001:2014.9000,9004and19011aresimilarlycrossreferencedtoDIS9001:2014.
AAA
01June2015
Page58of58

Iso 9001 2008 To Dis Iso 9001 2015 Early Implem Guide1

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Iso 9001 2008 To Dis Iso 9001 2015 Early Implem Guide1

Uploaded by

Copyright:

Available Formats

AAA

Ten things to know about ISO/DIS 9001:2015

Clause by clause evaluation of DIS/ISO 9001:2015

0.2 The ISO standards for quality management

0.3 Process approach

0.4 PlanDoCheckAct cycle

0.5 Riskbased thinking

0.6 Compatibility with other management system standards

3 Terms and definitions

4 Context of the organization

You might also like