Although the process approach was introduced in the 2000 version of the ISO 9001 standard, implementing it continuous to be highly confusing. Although the language surrounding the requirements was rewritten for new ISO 9001:2015 standard, this did not do much for clarity. Some might even argue that the requirements are less clear than ever.
In this article, we’ll have a look at the process approach and explain how it can be implemented for the first time.
Identifying Quality Management System Processes
A process is simply any activity that will convert inputs to outputs. Everything humans do are in fact processes, e.g. breathing, walking, eating, etc. With this definition, it should be clear that that everything an organization does is also a process – sorting files, answering a phone, making coffee for employees, manufacturing car parts, etc. This obviously makes it very difficult, if not impossible, to manage all processes.
As the requirements for the process approach can be found in clause 4.4, it makes sense to only refer to a “process” when talking about an activity that should be managed as per the requirements listed in sub clause 4.4.1 points (a) to (h). To avoid confusion, refer to anything other than what is managed with your QMS as something else – use words like operation, work step, or activity. Make sure that even though ISO 9001 uses the word out of context in other clauses, your company only uses the word process to describe those activities that you want to manage as per the requirements of clause 4.4. Sub-clause 4.4.1 actually even states that the organization must determine which processes are required for the QMS.
Although the requirements for processes are not difficult to understand, the sequence in which the standard lists them causes some of the confusion surrounding the process approach. In order to clear things up, we’ll therefore look at the requirements in logical order, rather than in the order in which they appear in the standard:
- Clause 4.4.1 point b: “Determine the sequence and interaction of these processes.” For this requirement it’s easy to create a complete process flow, presenting all the processes in a diagram, complete with the process sequence. Order Receipt would for example always come before Shipping. This single process flow chart should be part of the quality system documentation. For small and medium companies, this step is normally very simple.
- Clause 4.4.1 point a: “Determine the inputs required and the outputs expected from these processes.” Once you have defined which processes you want to manage and have your overall process flow, you can look at the individual processes and identify its inputs. This would typically be things like information required, materials, equipment, personnel, etc. You should also define the outputs, typically items such as completed service, finished products, etc. You can represent these inputs and outputs in a diagram (there are plenty of software programs available to do this) or, if you prefer, use a “Process Definition” approach which uses text-based descriptions. This step will also capture information needed for other points in this clause.
- Clause 4.4.1 point d: “Determine the resources needed for these processes and ensure their availability.” In this step you need to define the facilities, equipment and personnel needed for each process. It makes sense to do this in the same document you used to define the inputs and outputs.
- Clause 4.4.1 point e: “Assign the responsibilities and authorities for these processes.” Determine not only who will “own” the process, but also who will be responsible for carrying out the activities related to it.
- Clause 4.4.1 point c: “Determine and apply the criteria and methods (including monitoring, measurements and related performance indicators) needed to ensure the effective operation and control of these processes.” This is perhaps the most tricky step, as it involves developing process measurements, also often referred to as key performance indicators (KPIs), for each process. How to do this this is discussed later in this post.
- Clause 4.4.1 point g: “Evaluate these processes and implement any changes needed to ensure that these processes achieve their intended results.” Once the measurements have been established, they should be done and the results reported to management. This is typically done daily, and then evaluated formally during regular management reviews.
- Clause 4.4.1 point f: “Address the risks and opportunities as determined in accordance with the requirements of 6.1.” It is likely that analyzing the data measured will highlight problems, or areas that can be improved. The problems can be captured as risks, which should be analyzed as per clause 6.1. A review of each process to identify potential risks as well as opportunities should however also be conducted before any process measurements are done.
- Clause 4.4.1 point h: “Improve the processes and the quality management system.” The data collected should be used together with corrective actions to improve processes that don’t meet the objectives of the process.
You can see that there is a lot of work to do for each process and you definitely don’t want to follow these steps for each and every process in the company. It therefore becomes very important that you define exactly which of your processes you want to treat as core QMS processes.
This will differ for each company, and it is normal for small and medium sized organizations to have less than 10 processes. A small manufacturing company could for example have these processes:
- Quoting
- Order entry
- Purchasing
- Receiving
- QA
- Manufacturing
- Packaging
- Shipping
You may want to combine some of these depending on how big and complex your company is. You could for example treat Quoting and Order entry as one process, or treat QA as being part of the actual Manufacturing process. Smaller companies often join Shipping and Receiving. If your Manufacturing process is complex, it might make sense to split it into a number of smaller processes that can be measured and monitored more effectively.
Although processes will often align to the departments in a company, you should not use only departments as a guide when determining which activities will be made processes.
Adding a number of administrative processes to your QMS will make it more effective and easier to manage. These will be discussed below.
Assign Clauses
Although ISO 9001 does not specifically require it, you should make sure that your processes encompass all the clauses in ISO 9001. To do this, create a table with all the processes and link the ISO 9001 clause that applies to that process. The “Design” process would for example be linked to clause 8.3, while the “Purchasing” process would be linked to clause 8.4.
Once you have done this, you’ll see that there are a number of ISO 9001 clauses that are not yet covered. To cover clauses 4 to 7, and 9 and 10, you have to develop additional QMS oversight processes.
Companies often create a single “QMS Administration” process to cover all the management activities mentioned in clauses 4 to 6. A “Resources” process will take care of clause 7, while an “Improvement” process can be used to cover clauses 9 and 10. Companies often have a separate Internal Auditing process to make auditing easier. If your company has a big document libraries and intricate configuration management, it makes sense to make “Document Control” a separate process. You need to do what works best for your company, but try to limit your upper level processes, as it can become uncontrollable quickly.
Remember that each of the quality management system processes also needs be measured. The “QMS Administration” process might be measured by looking at the total compliance to the standard, or by measuring the effectiveness of all other processes, while the “Resources” process could be measured by tracking employee turnaround, equipment downtime, or whichever other metric you feel would add value.
Internal Auditing
Although ISO 9001 requires that you audit every clause, or requirements of the standard, it makes sense to conduct internal audits by process. This will make audits easier to manage, and audit results will show process problems and inefficiencies. As you have assigned clauses to all your processes, and then created additional administrative processes for those clauses not covered, by the time you’ve audited every QMS process, all the ISO 9001 clauses will have been covered.
Risk and Opportunity
The daily running and management of your QMS system should include identifying opportunities and risks. These should not only relate to things like contracts, products, or customers, but also to the upper level processes.
Management Review
Remember that each process’ performance will be measured and compared to its objectives daily. This data is then reported to management at periodic management reviews.
One method of doing management reviews is to let process owners explain the data to the top leadership. If process goals aren’t met, management may decide to request corrective actions, or change the goal. When goals are not met, action must be taken, and this must be recorded during the management review.
It makes sense to structure the management review around analyzing each process, including the results of the internal audits done on the process. This will allow top management to see the processes that are working effectively and more importantly, identify those that are not, allowing them to make educated decisions on which processes should be corrected or improved, while leaving the processes that perform well as is.
Conclusion
Always remember that your QMS is simply a system that consists of a number of processes. This system can’t operate properly if any of the processes is not doing what they should. By using a solid process approach with the QMS, management will be enabled to manage the processes, and this will capture the QMS’ performance against the requirements and clauses of ISO 9001.
ISO 9001 quality management systems (QMS) are implemented using Effivity software in Chongqing ( China), while ISO 14001 & OHSAS 18001 Health Safety Management Systems (HSE) are implemented with Effivity in Lagos ( Nigeria).
