ISO 9001 Support Processes
In our last article, we looked at a couple of key ISO 9001 support processes, namely Documented Information and Change Management. Now, let’s take a closer look at the remaining ISO 9001 support processes. Bear in mind that there is no way to fully explore all remaining support processes in one article. The EBS ISO 9001 eCoach learning system provides significant additional guidance and tools to fully understand and implement these processes within your organization.
The ISO 9001 support processes are those that are generally focused on supporting all aspects of the organization. These processes are really ISO 9001 resource management processes as they define requirements for managing and control various core resources within your company. These processes are applicable to most organizations, and most companies probably already have established processes which come close to meeting the ISO requirements. Let’s take a closer look at each process:
People / Competence:
In many organizations this function is often referred to as Personnel or Human Resources (HR) and deals with attracting and retaining the talent, skills, and personnel needed to execute and control the organization’s processes. This includes everybody from the executive level administrative personnel to support personnel to the line staff who produce products or deliver services to the customer.
ISO’s intent is that you hire and retain competent employees, train them appropriately, and provide clear communication to all levels of your organization. Most organizations probably already do the things required by this clause by defining the competencies required for jobs and positions within the organization, hiring people who can adequately fill those competencies, and where needed, address any competency gaps through training and employee development activities.
We often include two additional ISO 9001 requirements within the competency process and procedure: Awareness and Communication.
Your ISO 9001 processes and procedures must ensure that employees are sufficiently aware of:
- The quality policy,
- The quality objectives,
- How they, as employees, contribute to the effectiveness and overall performance of the management system,
- The benefits to the organization for improving system performance, and
- The consequences of not adhering to and following the ISO 9001 requirements.
ISO 9001 requires the organization to establish some level of communication strategy or plan. Your communication must cover information relevant to the management system but may include other topics which are important to the organization. ISO 9001 states that you must determine:
- What to communicate,
- When to communicate,
- With whom to communicate,
- How to communicate,
- Who communicates.
Did you notice that some of the awareness and communication requirements are related to and can also help fulfill some of the Leadership requirements defined in section 5 of the ISO standard? Be sure to use communication activities to satisfy other key ISO 9001 requirements where applicable.
This ISO clause is all about your physical plant, equipment, technology, utilities, etc. You most likely already have an established place of business and the appropriate equipment to produce and deliver your products and/or services. As long as you have considered buildings, utilities, equipment, technology (hardware & software), transportation, information, and communication, then you have satisfied clause 7.1.3. Remember to address things like pest control and facility cleanliness where applicable.
Along with provision of adequate physical resources, you also need to consider and establish appropriate processes to assess, maintain, and repair infrastructure and equipment where needed. This is a preventive maintenance process which ensures that equipment, buildings, fleets, etc. are serviced at appropriate frequencies and according to proper methods to ensure long-term reliability and provision of compliant products and services. Service companies should consider delivery vehicles and fleets, 3D printers, copiers, and computers and technology including software upgrades. Look at all the equipment that is required to deliver your products or services to end customers and ensure that appropriate maintenance activities have been established.
The specific maintenance requirements can be obtained from the manufacturer of the equipment (owners or service manuals, websites, etc.) and these requirements should be followed accordingly. You should also consider using a predictive maintenance approach and adjusting maintenance requirements based on your own observations and data concerning the performance of equipment, nonconformities, and unscheduled equipment breakdowns and failures. This information should also be considered to estimate equipment lifecycle and planning for major refurbishments and/or replacement.
In addition to the equipment and facility needs, ISO 9001 requires that you consider and establish a work environment that is appropriate to provide products and services to end customers. Consideration should be given to the physical environment (temperature, humidity, lighting, venting, noise levels, etc.) but also to the social and psychological environment. This includes factors such as discrimination, confrontation, stress, employee burnout, and emotional issues experienced by employees. Whatever environment or culture is established, it should be appropriate for your organization, personnel, and the products and services you provide. Just consider the environmental differences generally experienced in a large machine shop versus a law office.
Again, consider the need for documentation. When manufacturing and production facilities require specific environmental conditions such as temperature, humidity, cleanliness, etc., specifications and requirements should be documented, and appropriate controls and records should be retained demonstrating that products were produced under acceptable conditions. These records are often retained with or linked to product batch or job records.
Note that infrastructure and environment are two separate requirements in the ISO 9001 standard, but just like Competence, Awareness, and Communication, we’ve lumped these two requirements together as they are closely related.
Monitoring and Measuring Resources
This is another set of resource-oriented requirements with a focus on controlling and managing measuring equipment (devices) used to ensure product or service compliance. This section is often referred to as Calibration or Metrology.
In general, you need to provide monitoring and measuring resources (equipment) that are suitable and appropriate for their specific application and the equipment must be maintained to ensure it operates properly. You must retain documented information (records) demonstrating that equipment was properly maintained and operating per specifications.
Where and when needed, you must verify and/or calibrate your equipment periodically to ensure that it is operating within allowable parameters. Equipment calibration records must be kept and equipment must be appropriately identified and labeled.
When equipment is damaged or determined to be outside acceptable calibration limits, action must be taken to verify previous measurements and action taken to address any potential nonconformity.
Note that there may be a few rare organizations that do not have a need for measurement resources such as certain service-oriented companies. If your organization cannot identify specific measuring device, instruments, or equipment to be controlled, you can certainly claim an exemption from this ISO clause.
Organizational knowledge is an entirely new clause and set of requirements for the 2015 version of the ISO 9001 standard. And to be honest, everyone is still trying to figure out what exactly it means and the how to satisfy the requirements. Even auditors we have talked to aren’t sure what or how to audit this clause. The bad news is that we don’t know how exactly to address this clause. The good news, is that just about anything you establish will probably be considered acceptable. If you google this topic, twenty “experts” will give your twenty different answers (opinions) on how to satisfy the requirements. So, this is what we do know:
- Knowledge must be maintained (documented information?),
- Knowledge can be obtained from both internal and external sources,
- Knowledge must be made available (communicated and disseminated) where and when it is needed throughout the organization,
- Knowledge needs must be evaluated and updated with changes.
So how should your go about meeting these requirements?
Knowledge management as a discipline has been around for many years, but it has generally been associated with larger corporations and academic institutions. The trick now is for smaller organizations to determine how best to manage these new requirements without going overboard on systems and tools that just aren’t needed. We recommend that you start small and simple and gradually grow into a system that works best for you and your company.
Understand that the knowledge required and maintained by your organization should be commensurate to the context of your organization, the industries in which you operate, the competitive nature or your markets, etc. For some organizations, knowledge may be a significant differentiator and competitive advantage, while for others operating in more stable environments, knowledge may not play such an important role. Figure out what knowledge is important to the ongoing success and growth of your organization, processes, and people, and establish a simple process to continuously acquire, analyze, retain, and share this knowledge throughout the organization.
It is important as changes are assessed, reviewed, and implemented at all levels of the organization, that the need for new or additional information is evaluated. Be sure to incorporate a trigger or mechanism for this assessment into your Change Management process.
Don’t feel that your organizational knowledge process needs to be perfect and fully encompassing right out of the gate. If you are implementing a new management system and don’t already have a robust knowledge management system within your organization, determine the most obvious and rewarding areas to implement a basic method. Then over time, use your continual improvement process to further develop and refine the methods and tools for organizational knowledge.
Information doesn’t become knowledge until it is analyzed, retained or documented, made available where it is needed, and effectively utilized. As you identify new organizational knowledge, consider how information can be assessed and analyzed to determine what is valuable and worth keeping and what doesn’t really need to be maintained. Too much information or poor information may actually be worse than not enough.
Just about every organization will need to address all the requirements defined in the ISO 9001 support processes (section 7). As we stated earlier these will touch just about every person and function within the company. Be sure to consider how these processes impact all aspects of your organization and be sure to include input from all applicable functional areas and personnel when developing associated procedures and controls.