ISO 9001:2008 Requirements

in Plain English
With links to supporting documents

Created by Larry Whittington

www.whittingtonassociates.com/index.shtml

Distributed by www.the9000store.com

ISO 9001:2008 Requirements

(Purchase a copy of the ISO 9001:2008 standard for a complete description of the requirements)

4. Quality Management System

4.1 General Requirements
Establish, document, implement, and maintain a quality management system. Continually improve its effectiveness in accordance with ISO 9001 requirements. Implement the system to:

Determine processes needed for the quality management system (and their application throughout the organization) Determine process sequence and interaction Determine criteria and methods for process operation and control Ensure resources and supporting information are available Monitor, measure where applicable, and analyze these processes Implement actions to achieve planned results and continual process improvement

Manage these processes in accordance with ISO 9001 requirements. Define the type and extent of control applied to any outsourced processes that affect product conformity to requirements. NOTE 1: Processes needed for the quality management system include the processes for management activities (see 5), provision of resources (see 6), product realization (see 7), and measurement, analysis, and improvement (see 8). NOTE 2: An outsourced process is a process the organization needs for its quality management system, and which the organization chooses to have performed by an external party. NOTE 3: Ensuring control over outsourced processes does not absolve your organization of the responsibility to conform to all customer, statutory, and regulatory requirements. The type and extent of control applied to an outsourced process can be influenced by factors such as: Potential impact of the outsourced process on your organization's capability to provide product that conforms to requirements Degree to which the control for the process is shared Capability of achieving the necessary control through the application of 7.4

Requirements V7.2

Whittington & Associates, LLC

Page 1

ISO 9001:2008 Requirements

4.2 Documentation Requirements
4.2.1 General Requirements Include in the quality management system documentation:

Documented statements of a quality policy and quality objectives A quality manual Documented procedures and records required by ISO 9001 Documents and records determined by the organization to be necessary for the effective planning, operation, and control of its processes

NOTE 1: Where documented procedure appears within the Standard, this means that the procedure is established, documented, implemented, and maintained. A single document may address the requirements for one or more procedures. A requirement for a documented procedure may be covered by more than one document. NOTE 2: The extent of the quality management system documentation can differ from one organization to another due to:

Size of the organization and type of activities Complexity of processes and their interactions Competence of personnel

NOTE 3: The documentation can be in any form or type of medium.

4.2.2 Quality Manual Establish and maintain a quality manual with:

Scope of the quality management system Details and justification for any exclusions Procedures or references to the procedures Description of interaction between processes

4.2.3 Control of Documents Control the documents required by the quality management system. Records are a special type of document and must be controlled as required by clause 4.2.4.

Requirements V7.2

Whittington & Associates, LLC

Page 2

ISO 9001:2008 Requirements

Establish a documented procedure to:

Approve documents for adequacy prior to issue Review, update as necessary, and re-approve documents Identify the changes and current document revision status Make relevant documents available at points of use Ensure the documents remain legible and readily identifiable Identify external documents and control their distribution Prevent obsolete documents from unintended use Apply suitable identification if obsolete documents are retained

4.2.4 Control of Records Establish and control records as evidence of conformity to requirements and to demonstrate the effective operation of the quality management system. Establish a documented procedure to define the controls needed for record:

Identification Storage Protection Retrieval Retention Disposition

Keep records legible, readily identifiable, and retrievable.

5. Management Responsibility
All requirements in clause 5 are the responsibility of top management.

5.1 Management Commitment

Provide evidence of management commitment to develop and implement the quality management system, as well as, continually improve its effectiveness by:

Expressing the importance of meeting requirements Establishing the quality policy and quality objectives Conducting management reviews Ensuring the availability of necessary resources

Requirements V7.2

Whittington & Associates, LLC

Page 3

ISO 9001:2008 Requirements

5.2 Customer Focus
Ensure customer requirements are determined and met in order to improve customer satisfaction.

5.3 Quality Policy

Ensure the quality policy is:

Appropriate to the purpose of the organization Focused on meeting requirements and continual improvement Used as a framework for quality objectives Communicated and understood at appropriate levels Reviewed for continuing suitability

5.4 Planning
5.4.1 Quality Objectives Ensure quality objectives, including those needed to meet product requirements, are established at the relevant functions and levels within the organization. Ensure quality objectives are measurable and consistent with the quality policy. 5.4.2 Quality Management System Planning Ensure that planning for the quality management system:

Meets the general requirements (4.1), as well as, quality objectives (5.4.1) Maintains the system integrity when changes are planned and implemented

5.5 Responsibility, Authority, and Communication

5.5.1 Responsibility and Authority Ensure responsibilities and authorities are defined and communicated within the organization.

Requirements V7.2

Whittington & Associates, LLC

Page 4

ISO 9001:2008 Requirements

5.5.2 Management Representative Appoint a member of your management who, irrespective of other duties, has the responsibility and authority to:

Ensure the needed processes are established, implemented, and maintained Report to top management on quality management system performance Report to top management on any need for improvement Ensuring the promotion of awareness of customer requirements

NOTE: The responsibility of a management representative can include being the liaison with external parties on matters relating to the quality management system. 5.5.3 Internal Communication Ensure the appropriate communication processes are established and carried out within the organization regarding the effectiveness of the system.

5.6 Management Review

5.6.1 General Review the quality management system at planned intervals to:

Ensure a suitable, adequate, and effective system Assess possible opportunities for improvement Evaluate the need for any changes to the system Consider the need for changes to the quality policy and objectives

Maintain records of the management reviews. 5.6.2 Review Input Inputs for management review must include information on:

Results of audits Customer feedback Process performance and product conformity Status of preventive and corrective actions Follow-up actions from earlier reviews Changes that could affect the quality system Recommendations for improvement

Requirements V7.2

Whittington & Associates, LLC

Page 5

ISO 9001:2008 Requirements

5.6.3 Review Output Outputs from the management review must include any decisions and actions related to:

Improvement of the effectiveness of the quality management system and its processes Improvement of product related to customer requirements Resource needs

6. Resource Management
6.1 Provision of Resources
Determine and provide the resources necessary to:

Implement and maintain the quality management system Continually improve the effectiveness of the system Enhance customer satisfaction by meeting customer requirements

6.2 Human Resources

6.2.1 General Ensure people performing work affecting conformity to product requirements are competent based on the appropriate education, training, skills, and experience. NOTE: Conformity to product requirements can be affected directly, or indirectly, by personnel performing any task within the quality management system. 6.2.2 Competence, Training, and Awareness The organization must:

Determine the competency needs for personnel Provide training (or take other actions) to achieve the necessary competence Evaluate the effectiveness of the actions taken Inform employees of the relevance and importance of their activities Ensure they know their contribution to achieving quality objectives Maintain education, training, skill, and experience records

Requirements V7.2

Whittington & Associates, LLC

Page 6

ISO 9001:2008 Requirements

6.3 Infrastructure
Determine, provide, and maintain the necessary infrastructure to achieve product conformity. Infrastructure includes, as applicable:

Buildings, workspace, and associated utilities Process equipment (both hardware and software) Supporting services (such as transport, communication, or information systems)

6.4 Work Environment

Determine and manage the work environment needed to achieve product conformity. NOTE: The term work environment relates to those conditions under which work is performed, including physical, environmental, and other factors such as noise, temperature, humidity, lighting, or weather.

7. Product Realization
7.1 Planning of Product Realization
Plan and develop the processes needed for product realization. Keep the planning consistent with other requirements of the quality management system and document it in a suitable form for the organization. Determine through the planning, as appropriate, the:

Quality objectives and product requirements Need for processes, documents, and resources Verification, validation, monitoring, measurement, inspection, and test activities Criteria for product acceptance Records as evidence the processes and resulting product meet requirements

NOTE 1: A document specifying the processes of the quality management system (including the product realization processes), and the resources to be applied to a specific product, project or contract, can be referred to as a quality plan. NOTE 2: The organization can also apply the requirements given in 7.3 to the development of product realization processes.

Requirements V7.2

Whittington & Associates, LLC

Page 7

ISO 9001:2008 Requirements

7.2 Customer-Related Processes
7.2.1 Determination of Requirements Related to the Product Determine customer requirements:

Specified for the product (including delivery and post-delivery activities) Not specified for the product (but needed for specified or intended use, where known)

Determine:

Statutory and regulatory requirements applicable to the product Any additional requirements considered necessary by the organization

NOTE: Post-delivery activities include actions under warranty provisions, contractual obligations such as maintenance services, and supplementary services such as recycling or final disposal. 7.2.2 Review of Requirements Related to the Product Review the product requirements before committing to supply the product to the customer in order to:

Ensure product requirements are defined Resolve any requirements differing from those previously expressed Ensure its ability to meet the requirements

Maintain the results of the review, and any subsequent follow-up actions. When the requirements are not documented, they must be confirmed before acceptance. If product requirements are changed, ensure relevant documents are amended and relevant personnel are made aware of the changed requirements. NOTE: In some situations, such as internet sales, a formal review is impractical for each order. Instead, the review can cover relevant product information such as catalogs or advertising material. 7.2.3 Customer Communication Determine and implement effective arrangements for communicating with customers on:

Product information Inquiries, contracts, or order handling (including amendments) Customer feedback (including customer complaints)

Requirements V7.2

Whittington & Associates, LLC

Page 8

ISO 9001:2008 Requirements

7.3 Design and Development
7.3.1 Design and Development Planning Plan and control the product design and development. This planning must determine the:

Stages of design and development Appropriate review, verification, and validation activities for each stage Responsibility and authority for design and development

The interfaces between the different involved groups must be managed to ensure effective communication and the clear assignment of responsibility. Update, as appropriate, the planning output during design and development. NOTE: Design and development review, verification, and validation have distinct purposes. They can be conducted and recorded separately or in any combination, as deemed suitable for the product and the organization. 7.3.2 Design and Development Inputs Determine product requirement inputs and maintain records. The inputs must include:

Functional and performance requirements Applicable statutory and regulatory requirements Applicable information derived from similar designs Requirements essential for design and development

Review these inputs for adequacy. Resolve any incomplete, ambiguous, or conflicting requirements. 7.3.3 Design and Development Outputs Document the outputs of the design and development process in a form suitable for verification against the inputs to the process. The outputs must:

Meet design and development input requirements Provide information for purchasing, production, and service Contain or reference product acceptance criteria Define essential characteristics for safe and proper use Be approved before their release

NOTE: Information for production and service can include details for product preservation.

Requirements V7.2

Whittington & Associates, LLC

Page 9

ISO 9001:2008 Requirements

7.3.4 Design and Development Review Perform systematic reviews of design and development at suitable stages in accordance with planned arrangements (see 7.3.1) to:

Evaluate the ability of the results to meet requirements Identify problems and propose any necessary actions

The reviews must include representatives of the functions concerned with the stage being reviewed. Maintain the results of reviews and subsequent follow-up actions. 7.3.5 Design and Development Verification Perform design and development verification in accordance with planned arrangements (see 7.3.1) to ensure the output meets the design and development input requirements. Maintain the results of the verification and subsequent follow-up actions. 7.3.6 Design and Development Validation Perform validation in accordance with planned arrangements (see 7.3.1) to confirm the resulting product is capable of meeting the requirements for its specified application or intended use, where known. When practical, complete the validation before delivery or implementation of the product. Maintain the results of the validation and subsequent follow-up actions 7.3.7 Control of Design and Development Changes Identify design and development changes and maintain records. Review, verify, and validate (as appropriate) the changes and approve them before implementation. Evaluate the changes in terms of their effect on constituent parts and products already delivered. Maintain the results of the change review and subsequent follow-up actions.

7.4 Purchasing
7.4.1 Purchasing Process Ensure that purchased product conforms to its specified purchase requirements. The type and extent of control applied to the supplier and purchased product depends upon the effect of the product on the subsequent realization processes or the final product. Evaluate and select suppliers based on their ability to supply product in accordance with the requirements. Establish the criteria for selection, evaluation, and re-evaluation. Maintain the results of the evaluations and subsequent follow-up actions.

Requirements V7.2

Whittington & Associates, LLC

Page 10

ISO 9001:2008 Requirements

7.4.2 Purchasing Information Ensure the purchasing information contains information describing the product to be purchased, including the requirements for:

Approval of product, procedures, processes, and equipment Qualification of personnel

(Also include quality management system requirements in the purchasing information) Ensure the adequacy of the specified requirements before communicating the information to the supplier. 7.4.3 Verification of Purchased Product Establish and implement the inspection or other necessary activities for ensuring the purchased products meet the specified purchase requirements. If the organization or its customer proposes to verify the product at the supplier location, state the intended verification arrangements and method of product release in the purchasing information.

7.5 Production and Service Provision

7.5.1 Control of Production and Service Provision Plan and carry out production and service provision under controlled conditions to include, as applicable:

Availability of product characteristics information Availability of work instructions, as necessary Use of suitable equipment Availability and use of monitoring and measuring equipment Implementation of monitoring and measurement activities Implementation of product release, delivery, and post-delivery activities

7.5.2 Validation of Processes for Production and Service Provision Validate any production or service provision where subsequent monitoring or measurement cannot verify the output. This validation includes processes where deficiencies may become apparent only after product use or service delivery. Demonstrate through the validation the ability of processes to achieve the planned results.

Requirements V7.2

Whittington & Associates, LLC

Page 11

ISO 9001:2008 Requirements

Establish validation arrangements including, as applicable:

Criteria for process review and approval Approval of equipment Qualification of personnel Use of defined methods and procedures Requirements for records Re-validation

7.5.3 Identification and Traceability Identify, where appropriate, the product by suitable means during product realization. Identify the product status with respect to monitoring and measurement requirements throughout product realization. Where traceability is a requirement, control the unique identification of the product and maintain records. NOTE: In some industry sectors, configuration management is a means by which identification and traceability are maintained. 7.5.4 Customer Property Exercise care with any customer property while it is under the control of, or being used by, the organization. Identify, verify, protect, and safeguard customer property provided for use, or for incorporation into the product. Record and report any lost, damaged, or unsuitable property to the customer. NOTE: Customer property can include intellectual property and personal data. 7.5.5 Preservation of Product Preserve the product during internal processing and delivery to the intended destination in order to maintain conformity to requirements. As applicable, preservation includes:

Identification Handling Packaging Storage Protection

Also apply preservation to the constituent parts of the product.

Requirements V7.2

Whittington & Associates, LLC

Page 12

ISO 9001:2008 Requirements

7.6 Control of Measuring and Monitoring Equipment
Determine the monitoring and measurements to be made, and the required equipment, to provide evidence of product conformity. Use and control the monitoring and measuring devices to ensure that measurement capability is consistent with monitoring and measurement requirements. Where necessary to ensure valid results:

Calibrate and/or verify the measuring equipment at specified intervals or prior to use Calibrate the equipment to national or international standards (or record other basis) Adjust or re-adjust as necessary Identify the measuring equipment in order to determine its calibration status Safeguard them from improper adjustments Protect them from damage and deterioration

Assess and record the validity of prior results if the device is found to not conform to requirements. Maintain records of the calibration and verification results. Confirm the ability of software used for monitoring and measuring for the intended application before its initial use (and reconfirmed as necessary). NOTE: Confirming the ability of software to satisfy the intended application would typically include its verification and configuration management to maintain its suitability for use.

8. Measurement, Analysis, and Improvement

8.1 General
Plan and implement the monitoring, measurement, analysis, and improvement processes needed to:

Demonstrate conformity to product requirements Ensure conformity of the system Continually improve effectiveness

Determine through planning the need for, and use of, applicable methods, including statistical techniques, as well as, the extent of their use.

Requirements V7.2

Whittington & Associates, LLC

Page 13

ISO 9001:2008 Requirements

8.2 Monitoring and Measurement
8.2.1 Customer Satisfaction Monitor information on customer perception as to whether the organization is meeting requirements (as one of the performance measurements of the quality management system). Define the methods for obtaining and using this information. NOTE: Monitoring customer perception can include obtaining input from sources such as customer satisfaction surveys, customer data on delivered product quality, user opinion surveys, lost business analysis, compliments, warranty claims, and dealer reports. 8.2.2 Internal Audit Conduct internal audits at planned intervals to determine if the quality management system:

Conforms to planned arrangements (see 7.1) Conforms to requirements of ISO 9001 Is effectively implemented and maintained

The organization must:

Plan the audit program Consider the status and importance of the audited areas Consider the results of prior audits Define the audit criteria, scope, frequency, and methods Select and use impartial and objective auditors (not audit their own work)

Establish a documented procedure to address responsibilities and requirements to:

Plan audits and conduct audits Establish records and report results

Maintain records of the audits and their results. Ensure management of the audited areas takes actions without undue delay to eliminate detected nonconformities and their causes. Verify through follow-up actions the implementation of the action and report the results. NOTE: See ISO 19011 for audit guidance.

Requirements V7.2

Whittington & Associates, LLC

Page 14

ISO 9001:2008 Requirements

8.2.3 Monitoring and Measurement of Processes Apply suitable methods for monitoring and, where applicable, measurement of the quality management system processes. Confirm through these methods the continuing ability of each process to satisfy its intended purpose. When the planned results are not achieved, take correction and corrective action, as appropriate. NOTE: When determining suitable methods, consider the type and extent of monitoring or measurement for each process in relation to its impact on product conformity and on the effectiveness of the quality management system. 8.2.4 Monitoring and Measurement of Product Monitor and measure product characteristics to verify product requirements are being met. Carry out the monitoring and measuring at the appropriate stages of product realization in accordance with planned arrangements (see 7.1). Maintain evidence of conformity with the acceptance criteria. Record the person responsible for authorizing release of product for delivery to the customer. Product release and service delivery cannot proceed until all planned arrangements (see 7.1) have been satisfactorily completed, unless otherwise approved by a relevant authority, and where applicable, the customer.

8.3 Control of Nonconforming Product

Ensure any nonconforming product is identified and controlled to prevent its unintended use or delivery. Establish a documented procedure to define the controls and related responsibilities and authorities for dealing with nonconforming product. Where applicable, deal with the nonconforming product by one or more of the following ways:

Take action to eliminate the detected nonconformity Authorize its use, release, or acceptance by concession Take action to preclude its original intended use or application Take action appropriate to the effects, or potential effects, of the nonconformity when nonconforming product is detected after delivery or use has started

Maintain records of the nature of the nonconformity, and any subsequent actions, (including any concessions). When the nonconformity is corrected, re-verify it to show conformity.

Requirements V7.2

Whittington & Associates, LLC

Page 15

ISO 9001:2008 Requirements

8.4 Analysis of Data
Determine, collect, and analyze appropriate data to demonstrate the suitability and effectiveness of the quality management system, as well as, evaluate where continual improvement of the effectiveness of the quality management system can be made. Include in the analysis the data generated by monitoring and measuring activities and from other relevant sources. Analyze this data to provide information on:

Customer satisfaction (see 8.2.1) Conformity to product requirements (see 8.2.4) Characteristics and trends of processes and products, including opportunities for preventive action (see 8.2.3, 8.2.4, and 8.5.3) Suppliers (see 7.4)

8.5 Improvement
8.5.1 Continual Improvement Continually improve the effectiveness of the quality management system through:

Quality policy Quality objectives Audit results Analysis of data Corrective and preventive action Management review

8.5.2 Corrective Action Take corrective action to eliminate the causes of nonconformities and prevent recurrence. Corrective action must be appropriate to effects of the problem. Establish a documented procedure for corrective action that defines requirements to:

Review nonconformities (including customer complaints) Determine the causes of nonconformities Evaluate the need for actions to prevent recurrence Determine and implementing the needed action Maintain records of the results of the action taken Review the effectiveness of corrective action taken

Requirements V7.2

Whittington & Associates, LLC

Page 16

ISO 9001:2008 Requirements

8.5.3 Preventive Action Determine the action to eliminate the causes of potential nonconformities in order to prevent their occurrence. Ensure preventive actions are appropriate to the anticipated effects of the potential problem. Establish a documented procedure for preventive action to define requirements to:

Determine potential nonconformities and their causes Evaluate the need for actions to prevent occurrence Determine and implementing the needed action Maintain records of the results of the action taken Review the effectiveness of preventive action taken

Purchase a copy of the ISO 9001:2008 standard for a complete description of the requirements. For training on the requirements, see our list of classes at <www.WhittingtonAssociates.com>.

Requirements V7.2

Whittington & Associates, LLC

Page 17