How to successfully implement ISO 9001:2015 with a minimal documents approach
•
49 j'aime•11,681 vues
The webinar covers: • Replacing the Quality Manual • Replacing All Other Procedures • Checking Yourself to Ensure You've Met All Requirements Presenter: This webinar was presented by Debra Hay Hampton, PECB Certified Trainer and Lead Auditor of Quality and Environmental Management Systems. Link of the recorded session published on YouTube: https://youtu.be/PnCjPlGGb68
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à How to successfully implement ISO 9001:2015 with a minimal documents approach
Similaire à How to successfully implement ISO 9001:2015 with a minimal documents approach (20)
Plus de PECB
Plus de PECB (20)
Dernier
Dernier (20)
How to successfully implement ISO 9001:2015 with a minimal documents approach
- 1. Prepared by Debra Hay Hampton, Certified Lead Auditor, ISO 9001:2015, ISO 14001:2015 Certified Management Consultant Certified Professional Trainer Certified Quality Engineer Prepared on behalf of PECB
- 2. Debra Hay Hampton ISO 9001 Lead Auditor Debra Hampton has over 30 years of improving processes and systems with experience from hospitals, schools, and many types of manufacturing facilities, a methodical approach is used to focus on building a system of processes that collect data to make decisions that create sustainable, continual improvement and consistent product. Companies she works with become better at “turning effort into dollars”. +1 229 798 0277 debrahampton54@hotmail.comwww.ce-q.com linkedin.com/debra-matthews-hay-hampton
- 3. Course Objectives Present methods to have minimal documentation yet meet the requirements of ISO 9001:2015 Encourage revamping of current management system documentation for those who still have procedurally based systems Encourage creation of a method to verify meeting requirements – simply, efficiently, and effectively.
- 4. Outline of Material 1. Replacing the Quality Manual and the Other Requirements for Specific Documented Procedures 2. Revamp Material vs. Retain Current System and Edit 3. Verification – Presenting Evidence of Meeting the Requirements to a Third Party Auditor
- 5. Replacing the Quality Manual and the Other Requirements for Documented Procedures
- 6. Replacing the Quality Manual and the Other Requirements for Specific Documented Procedures Previously the Quality Manual was the GLUE Where you started to explain the rest of the system Many organizations (still) have a manual that is a regurgitation of the standard….does not support the teaching of the ISO 9001:2000 and 2008 standard.
- 7. ISO 9001:2000 and 2008 Stated Requirements of the Quality Manual Quality Manual required to contain (ISO 9001:2008, 4.2.2) Scope and justifications of exclusions Documented procedures or reference to them Description of an interaction of the processes of the system No Requirements for any documented procedures Nothing left to hold the organization together!
- 8. ISO 9001:2000-2008 Quality Manual Often One Page A Picture of the Interactions of the Processes Reference to the Procedures of the System The scope and any exclusions Quality Manual more than one or two pages? Email me so we can discuss how we can help you begin revamping your management system to the 2000-2008 standard. Debra@CE- Q.com
- 9. ISO 9001:2015 Does NOT require any manual Does NOT require any documented procedures? So what will be our glue? How can we do this without a manual and documented procedures?
- 10. What is a Standard? - Is a standard leading edge thinking? - Is it progressive? NO!
- 11. Where is the Glue? What Holds the System Together? How Can We Know What Documents We Need?
- 12. Risk-Based Thinking Not a new concept ISO 14001 and other risk based standards have NOT had a requirement for a manual (Although many organizations do waste efforts and have a manual) Determine the context of the organization (ISO 9001:2015, 4.1) Determine risks as a basis for planning the system and its processes (ISO 9001:2015, 4.4, 6.1) This analysis determines the extent of documented information
- 13. How do we know what documents are needed? Determine the context of the organization Determine the risks Determine the methods to mitigate the risks. Determine the documents needed to ensure the risk is mitigated
- 14. Understanding the Context of the Organization External and Internal Issues Relevant to its purpose and strategic direction That affect its ability to achieve the intended results of its quality management system Intended results of quality management system Demonstrate ability to consistently provide products and services that meet customer and applicable statutory and regulatory requirement (ISO 9001:2015 1.a) Aim to enhance customer satisfaction (ISO 9001:2015 1.b.)
- 15. Internal Issues that Affect Consistency of Meeting Customer, Statutory and Regulatory Requirements Leadership and their commitment Assigning of Organizational Roles, Responsibilities and Authorities Lack of Planning Meeting Risks Meeting Objectives Addressing Changes Lack of Support for the Plan Lack of Competency in their People Lack of Awareness and Communication of What is Expected Inadequacies in Documented Information Lack of Operational Control of Production and Services Poor Design and Development Process Poor Evaluation of the planned methods to ensure they are being followed Poor methods of addressing nonconformity and corrective actions
- 16. External Issues that Affect Consistency of Meeting Customer, Statutory and Regulatory Requirements Customers Must understand their expectations and agree upon the expectations to be met Interested Parties Shareholders? Union? Community? Statutory and Regulatory Bodies External Providers Providers of Components, Raw Materials Providers of Services
- 17. What does all this have to do with minimal documentation? Manual one or two pages Standard is the “STANDARD” Proven Best Practices for an organization Sources of Risk both Internal and External in Context Minimize Risk Address All Potential Sources of Risk Do Only What is Necessary
- 18. ISO 9001:2015 Standard Identifies the Sources of Risk Risk Consequence Control/Solution/ Mitigation Lack of Leadership and Commitment (5.1.1) Leaders not accountable for effectiveness of QMS (a) Top Manager must ensure measurement of effectiveness of leaders is tied to effectiveness of QMS Strategic Direction becomes incompatible with QMS (b) Align QMS and Strategic Direction QMS not integrated into business processes (c) Use QMS to plan business processes Process Approach and Risk Based Thinking not Promoted (d) Use process approach and risk based thinking for managers to know their responsibilities
- 19. Sources of Risk – Competence (7.2) Risk Consequence Control/Solution/ Mitigation Lack of Competence (7.2) People doing work that affects the performance and effectiveness of the QMS are not competent (a) Define the skills and knowledge needed for each job. Create Competency Matrix per job. People do not have the appropriate education, training, or experience (b) Compare workforce against these to determine training needed. Document in Competency Matrix. People do not acquire competencies they are lacking Create Training Plan and Follow up to Determine Effectiveness of Training No evidence people are competent Retain record of competence on Competency Matrix and in Training
- 20. Sources of Risk – Externally Provided Processes, Products, and services (8.4.1) Risk Consequence Control/Solution/ Mitigation Failure to ensure externally provided processes, products and services conform to requirements. (8.4) Delays in provision of products & services due to poor quality or late deliveries from suppliers. Increases in warranty costs and losses in customer satisfaction. Materials Control Manager prepares a Supplier Performance graph to show current performance of suppliers and a Performance Improvement Plan to improve their performance. Product or Service intended for incorporation gets to point of use and can’t be used. Quality Manager determines controls to be followed when items are received based on the risk and previous history. Documents controls on Receiving Inspection Plan.
- 21. What about Section 4.4, QMS and Its Processes? How Do We Meet This? Risk Consequences Control/Mitigation Not establishing, implementing, maintaining or continually improving the quality management system Efforts are not planned or focused to ensure the processes continually improve Top Manager expects each Department Manager to plan their methods using Process Maps which meet the requirements of
- 22. The Risk and Control Table Becomes the Glue! Me: We don’t need a manual! You: What will we send to our customers? Me: Ahh, the manual is for marketing use? You: Our customer will expect us to have one. Me: Fair enough… then create a manual that markets you and your products, an advertising tool, a beautiful work of art that describes your organization and what it can do for them.
- 23. Summary of Risk-Based Thinking Understand the context of the organization (4.1) Determine the risks as a basis for planning (6.1) Demonstrate how the application of risk-based thinking affected the implementation of the qms processes (4.4) Use the risk-based thinking to determine the extent of documented information
- 24. Reminder of Documented Information 2015 standard defines requirements to “maintain documented information” and to “retain documented information” Replaces references to documents or records Same “documented information” may meet many requirements of the standard Where the standard references “information” rather than “documented information”, No requirement the information be documented
- 25. Should We Revamp Our Material vs. Retain Current, Procedural Based System with Minor Edits? Will likely require an outside service to work with managers to prepare them for the 2015 changes and make the changes in your organization, unless they listen well to you.
- 26. Verification – Presenting Evidence of Meeting the Requirements to a Third Party Auditor
- 27. Internal Auditing with a Risk-Control Table Risk Control/ Mitigation Evidence Observed During the Audit Planned intervals not frequent enough An Internal Audit Schedule is used to ensure all sections of the standard are audited and all processes with processs maps are audited Don’t verify if planned arrangements are met or if Standard met Audit using the Risk-Control Table as the criteria Don’t verify if effectively implemented and maintained Ensure auditors are trained to look for duplication of efforts and lack of improvement
- 28. Summarizing – Implementing ISO 9001:2015 with Minimal Documentation 1. Create a Risk-Control Table based on the requirements of the standard. 2. If it is a document that is used as a control or mitigation, it has value. If it isn’t in the list, why do you have the document 3. Let internal auditing be a method of verification that what is listed in the Risk- Control Table is what is actually in use. www.CE-Q.com can assist, even remotely through electronic media; debra@CE-Q.com or 229-798-0277 What will be difficult? Getting the Top Managers to understand their role. You’ll most likely need someone from the outside to help with that.
- 29. Our Team Working with Your Management Team to Bring About Transformation to the Expectations of ISO 9001:2015 – Section 5 Top Management “shall” take accountability for the effectiveness of the qms Ensure policy and objectives are established for the qms and are compable with the context and strategic direction of the organization Ensure the integration of the qms into the organization’s business processes Promote the use of the process approach and risk-based thinking www.CE-Q.com can assist, even remotely through electronic media; debra@CE-Q.com or 229-798-0277
- 30. Thank you to PECB Participants ? QUESTIONS 123 456 789 name.surname@domain.com www.domain.com linkedin.com/name.surname twitter.com/name.surname fb.com/name.surname THANK YOU
Notes de l'éditeur
- Greetings and Welcome to this course on ISO 9001:2015 – Implementation with a Minimal Documentation Approach. As introduced, I am Debra Hay Hampton. I am a Certified Lead Auditor in ISO 9001:2015 and ISO 14001:2015. This is the third standard to which I have audited. I have been auditing since 2001 for Registrars. I get to see many systems and many methods of implementation. I hope today to share some of my experience and knowledge. I’ve seen systems that are minimally documented and those with so many documents it takes a team to maintain the documentation. Thank you to PECB for allowing me to make this presentation today. PECB does a great job of investing in our profession. When you have a question, go to PECB for answers. They have a great team. Now lets look at our purpose for being here today.
- Our course objectives are to present methods that you can use to have a minimally documented system that meets the requirements of ISO 9001:2015. We will be presenting an argument to those who currently have a procedurally based system to revamp their system to the risk based, process based thinking. We will show you a method to verify that you are meeting requirements that is simple, effective, and efficient. It can be used for your internal auditing methods.
- We have three sections in this material. The first describes the methods to replace the quality manual and the other requirements for documented procedures Section 2 is where we present the reasons for revamping the material. Section 3 is the presentation of a method for internal auditing of your new system
- Section One, Replacing the Quality Manual and Other Requirements for Documented Procedures.
- Under the ISO 9001:2000-2008 standards, we used our quality manual to act as the glue for the system. It was where you started. It helped us explain our system to our customers as well as explaining our system to others in our organization … that is if the manual was not a regurgitation of the standard. Many organizations still today after 15 years with the 2000 and 2008 standard have a manual that is a regurgitation of the words of the standard and has little to no value to the management system or the organization. 2000-2008 tried to break this and specifically told us what the manual should contain.
- The 2000 and 2008 standard told us specifics that the manual should contain. Only three things. These three things could often be recorded on one piece of paper … at the most two. It required the manual contain the Scope and justifications of exclusions, the documented procedures required by the standard or reference to them, and a description of an interaction of the processes of the system.
- The Quality Manual of the 2000-2008 standard was often one page. It included a diagram or picture that identified the processes of the system. It referenced the procedures of the system or even often times referenced them on the diagram. In a corner the scope and exclusions were stated. I’m not going to take the time to get replies from everyone on the line today but, how many pages are in your quality manual today? If your answer is more than one or two pages….much work will have to be done to revamp the culture and quality management system of your organization. If you have more than two pages in your quality manual. Your entire system needs to be revamped to get you ready for 2015. Chances are your procedurals are long drawn out, wordy documents that add little value to your system.
- The new standard, the ISO 9001:2015 standard does NOT require a manual. There are not ANY required documented procedures! What is the glue? How will we define our system? How can we do this without a manual and documented procedures? Let’s turn to the standard for understanding.
- Before we go any further, lets talk a moment about what a standard is. Is a standard leading edge thinking? Progressive thinking? The answer is no! A standard is the best practices that have been proven over the years to be the best approach, the standard approach. Progressive businesses implemented these practices, years before. A standard is what a GOOD company does … it is established methods that work.
- Back to our question, if we don’t have a manual and required documented procedures, what is the glue? How can we know what documents we need? It all has to do with context and risk…
- Risk-Based Thinking is not a new concept. The ISO 14001 and OHSAS 18001 standards have not had requirements for a manual or for any documented procedures now for a long time. Note many organizations do create an environmental management manual or health and safety manual. Creating one is a wasted effort and one I have not seen yet add any value to their system. Risk based thinking asks us to determine the context of the organization then determine the risks as a basis for planning the system and its processes. This methodology determines the extent of the documented procedures, manuals, forms …. It determines the extent of the documented information necessary to effectively mitigate the risks the organization faces.
- Lets take time to repeat what we just said. This is such an important principle for implementation of the 2015 standard. How will we know what documents are needed? We first determine the context of the organization. We determine the risks. We then determine the methods to mitigate the risk. We determine the documents needed to ensure the risk is mitigated.
- The context of the organization is a new concept with the 2015 standard. The standard requires us to understand the external and internal issues that could be relevant to its purpose and strategic direction. The standard requires us to consider external and internal issues that affect its ability to achieve the intended results of its quality management system. What is the intended result of the quality management system? The purpose of the qms is to demonstrate the ability of the organization to consistently provide products and services that meet customer, statutory and regulatory requirements. The aim is to enhance customer satisfaction. The question becomes what external and internal issues affect an organizations ability to CONSISTENTLY provide products and services that meet customer, statutory and regulator and aim to enhance customer satisfaction?
- Lets think of just a few Internal issues that affect consistency of meeting customer, statutory and regulatory requirements. Leadership and their commitment to meeting requirements of customers and other interested parties has a definite affect. Lack of assigning roles, responsibilities and authorities – affect accountability Lack of planning or poor planning to meet risks, to meet objectives or to address changes when changes occur. Once the plan is made a lack of support or resources for the plan can affect the consistency of meeting the customer or legal requirements. Lack of competency – Incompetent people cant be consistent Lack of awareness of expectation – definitely affect. If you don’t know your expectations you can’t fulfill them. Lack of communication – goes hand in hand with expectations. If expectations are not communicated, they cannot be fulfilled. In adequacies in necessary documents – not enough documentation to ensure the system is well controlled. – Lack of ensuring that the documents necessary are planned. Lack of operational controls in production and services will definitely affect consistency. Poor design and development; poor evaluations of the system, poor methods of addressing nonconformities and corrective actions. These are all things that will definitely affect the consistency of meeting customer, statutory and regulatory requirements. This is a list from the standard. All of these are requirements of the standard that must be addressed.
- External issues that can affect consistency of meeting requirements are our customers themselves. We must understand their expectations and agree upon the expectations up front. We must understand how they work and how they communicate. We must ensure we AGREE upon what we provide. If we do not, we set ourselves up to hit a moving target which then causes inconsistencies in meeting other customers requirements. Interested parties will vary with each organization. Some organizations are traded publicly and have shareholders. Some have agreements with labor that must be met. Some have commitments to their community while others may be governed by regulatory bodies such as the Federal Aviation Administration, the Food and Drug Administration, or other bodies. I apologize for referencing only American regulatory bodies. Your country of course has their own. Other External providers include the external providers of components, raw materials and services.
- We’ve covered much ground all ready and we still have not shown how to minimize documentation. We have said a manual even in the 2000 standard could be one page. We’ve talked about the standard being the “STANDARD” method we in business should be following, We’ve just addressed the sources of risk from external and internal issues so now what? How do we use this to reduce documentation? Let’s use what we’ve learned to see what can be done to minimize documentation.
- The standard itself identifies the sources of risk that we must address. If you have a standard available, look at section 5.1. Leadership and Commitment. It states what the top management must demonstrate. The risk is that they do not demonstrate leadership and commitment. Writing the requirement in the standard as a negative tells us the consequence. We then must mitigate the risk by putting controls in place to prevent the consequences.
- Here is another example fro the section of the standard on Competence, section 7.2. Notice when the risk of Lack of Competence is addressed. The consequences that are seen are stated in the second column, “people doing work that affects the performance and effectiveness of the QMS are not competent. The control/solution or mitigation is to define the skills and knowledge needed for each job. The control includes creating a competency matrix per job. The competency matrix is highlighted to bring attention to it. It is a document. How do we know what are the necessary documents? The necessary documents will be controls, solutions, or mitigations and will be highlighted in that column. Emphasizing again: the necessary documents to control the system are the ones highlighted in the 3rd column. If you have documents not listed in this column, what value do they have? What risk are they addressing?
- Notice once again we have the risks which are the failure to ensure externally provided processes, products and services conform to requirements. We have stated consequences. We have controls, solutions, and mitigation stated. The methods to be used are highlighted. We have a supplier performance graph created by the Materials control manager. We have a Performance improvement plan to improve poor performing suppliers and we have a receiving Inspection Plan. As we continue this approach with every requirement of the standard. We have a plan or method to address the risk that the standard identified. We address the risk within our own system using documents that we currently use or need to create.
- Section 4.4 is treated as any other section. Ensure a method is in place to establish, implement, maintain, or continually improve the quality management system. Process mapping is an excellent choice to ensure processes essential to consistently meeting the requirements of customers are planned. Top Management may want to expect all of his department managers map the processes they manage so that he knows they are managing the processes.
- This table of risks and controls becomes the glue. A manual is not needed. You say what will we send our customers? If the current manual’s purpose is for marketing use, please create a manual that markets you and your products. Transform the traditional manual into an advertising tool, a work of art that describes your organization and what it can do for them.
- In summary lets remember what was prescribed for risk-based thinking. Understand the context of the organization. Know the internal and external issues that could prevent meeting the purpose of the standard which is to consistently meet the requirements of the customers and legal entities. Determine the risks as a basis for planning to determine the documented information that is needed to control the planning, implementation and effectiveness of the quality management system.
- These requirements for documented information that you determine as controls to mitigate the risk will most likely meet all of the requirements of the standard for documented information. Documented information replaces the references to documents or records in the previous standards. Your risk and control table will tell you what is needed as documented information.
- Some of you still have a procedural based system, meaning the system looks the same as it did in 1994 and before, when the standard required 20 documented procedures! As a third party auditor, I see many of these systems. They are almost always ineffective in accomplishing the intent of the standard. The company may consistently meet the requirements of the standard but, it is not thanks to the qms. It is often times by tribal knowledge. Take this opportunity to rewrite your management system. If you can get your managers to help you, it will become valuable to them. A note to the wise, it is often difficult for you to get the managers to do the work they need to do to make this happen when you yourself are not a member of management. I suggest you enlist an outside service to work with your managers to prepare them for the 2015 changes and make the changes happen in your organization.
- One more subject, what is the minimalistic approach to auditing the ISO 9001:2015 system that we have designed?
- The same thinking of addressing risks would apply to the internal audit process. An internal audit schedule would assist in ensuring that audits are planned at frequent enough intervals. If the audit uses the Risk-Control Table as the criteria, it will ensure the standard is considered and that planned arrangements are met. I would encourage you to add a column to your Risk-Control Table and use the last column to record evidence seen during the audit. Let this become the evidence of the internal audit.
- In summary, when implementing ISO 9001:2015 with minimal documentation, create a Risk-Control Table based on the requirements of the standard. Address each requirement as a risk. If you use a document to control or mitigate the risk, the document has value. If it isn’t in the list have you overlooked a risk or is the document of no value. When internal auditing, use the Risk-Control Table as the criteria. ISO 9001:2015 is a philosophical change in most organizations. If you are a procedural based organization, you will most likely need assistance bringing about these changes in leadership and documentation that has to occur. Please consider using CE-Q to assist you, in brining about this transformation. Most organizations will need an outsider to work with your leadership team to get them re-aligned and following the expectations of the quality management system. Rarely, will you as an internal person be able to do this. Our team can work with your managers to bring about this change and in some cases can perform the work remotely using electronic media.
- We work with your management team to bring about the transformation to the expectations of the ISO 9001:2015 standard. The new standard expects transformation in the management team. In some cases, this can be done remotely using Skype or other techniques to meet with management. We Work with them over a period of time to bring about a management style change. We help them transform their Business Philosophy in How to Manage Their Teams.
- To PECB, thank you for investing the time and effort to bring these webinars to the world. PECB has a great team of people doing much to enrich our professional fields. Look for many other webinars that they publish. To participants, you gave us your precious time today. You listened to us and hopefully learned. We now have time for some questions. Thank you again participants for honoring us by attending this webinar. PECB, the floor is yours.