​Risk-based thinking is something we all do automatically and often sub-consciously to get the best result. The concept of risk has always been implicit in ISO 9001 – the 2015 edition makes it more explicit and builds it into the whole management system. Risk-based thinking ensures risk is considered from the beginning and throughout.

​While Clause 6, Planning, is an obvious reference to risks and opportunities, the concept of risk-based thinking is present throughout the Standard.  Where is risk addressed in ISO 9001:2015?

Introduction - the concept of risk-based thinking is explained.

Clause 4 – the organization is required to determine its QMS processes and to address its risks and opportunities.

Clause 5 – top management is required to
·      Promote awareness of risk-based thinking
·      Determine and address risks and opportunities that can affect product /service conformity.

Clause 6 – the organization is required to identify risks and opportunities related to QMS performance and take appropriate actions to address them.

Clause 7 – the organization is required to determine and provide necessary resources (risk is implicit whenever “suitable” or “appropriate” is mentioned).

Clause 8 – the organization is required to manage its operational processes (risk is implicit whenever “suitable” or “appropriate” is mentioned).

Clause 9 – the organization is required to monitor, measure, analyze and evaluate effectiveness of actions taken to address the risks and opportunities.

Clause 10 – the organization is required to correct, prevent or reduce undesired effects and improve the QMS and update risks and opportunities.

​​When reading the requirements of ISO 9001:2015, pay close attention to the way each clause is worded.  There are several verbal forms used intentionally throughout the standard, each with a specific meaning:

• "Shall": Indicates a requirement;
• "Should"; Indicates a recommendation;
• ​"May": Indicates a permission;
• "Can": indicates a possibility or capability.

​You may also see the term "NOTE" in various sections during  your review. Where used, the information that follows is used for guidance in understanding or in clarifying the associated  requirement.

​Following from last week's tip, let's look at determining the "organization's context".

​Until now, most Quality Manuals were very similar in nature: a paraphrasing of the ISO 9001 Standard with a cover page showing the Company Name and address, followed by a introduction or preface endorsed by Top Management.

​It was never a requirement of the ISO Standard for Quality Manuals to follow that format.  So now, there is no requirement for a Quality Manual - however, the organization has to determine its "context".

​The new ISO 9001:2015 Standard is very much aligned with strategic management concepts - finally an opportunity to put those business school concepts and theories into use.  Determining context is a great place to share the organizations vision, mission and values. 

• ​Vision is related to Quality Objectives - i.e. what it is the company wants to achieve.
• ​Mission is related to Context - i.e. what the company does, who the company does it for, etc.
• ​Values are related to the Quality Policy - i.e. what the company and its employees believe.

​So finally, strategic management  and quality management come together as one as part of determining the organizations context.

It's rare to ever hear an organization complain that their certification audit wasn't long enough.
​
The duration of QMS and EMS certification audits is defined in IAF MD 5:2013, IAF Mandatory Document for Duration of QMS and EMS audits.

​This document, published by the International Accreditation Forum (IAF), provides the framework to be used by IAF accredited certifying bodies to establish audit duration within their own documented procedures to ISO 17021. 

​For more information, this standard is available on the IAF's website:
​http://www.iaf.nu/upFiles/IAFMD5QMSEMSAuditDurationIssue311062015.pdf

​ISO 9001:2015 no longer requires a quality manual, but the standard does not say you can no longer have one.

​Consider documenting your context (ISO 9001:2015, Section 4.0) and using this information as a replacement for the "old" manual. Include as follows:

4.1 - Context of the organization
4.2 - Interested parties
​4.3 - Scope of the Quality Management System
​4.4 - QMS and it's processes.

​From our experience with this standard (and we've had a lot), this method works very well. All of the information you need will be in one central location, and can be readily accessed when needed. As an "added bonus", you still have a quality manual if requested by a customer.

​Cheers.

​Wishing all of our Friends and Clients a Happy Fourth of July!