SP65:

1998

HANDBOOK ON IS/IS0 9000 FOR SMALL BUSINESSES

ICS 03.120.10

0 BIS 1998 BUREAU

MANAK

OF
BHAVAN,

INDIAN
9, BAHADUR

STANDARDS
SHAH ZAFAR MARG

NEW DELHI 110 002

December 1998

Price Rs 210.00

SP 65 : 1998

HANDBOOK ON IS/IS0 9000 FOR SMALL BUSINESSES

ICS 03.120.10

0 BIS 1998 BUREAU

MANAK

OF

INDIAN
9, BAHADUR

STANDARDS
SHAH ZAFAR MARG

BHAVAN,

NEW DELHI 110 002

SP 65 : 1998
First Published December 1998

0 BUREAU OF INDIAN STANDARDS

ICS 03.120.10 ISBN 8 l-706 l-050-8 Price Rs 210.00 Published by Bureau of Indian Standards, New Delhi- 110002 Laserset by Paragon Enerprises, 1 Ansari Road, Daryaganj, New Delhi-l 10002 Printed by Printograph, 2966/40 Beadon Pura, Karol Bagh, New Delhi-l 10005

NATIONAL

FOREWORD

This Special Publication which is identical with the ISO Handbook IS0 9000 for Small Businesses, What to do-Advice from ISO/TC 176 issued by the International Organization for Standardization (ISO), was adopted by the Bureau of Indian Standards on the recommendation of the Quality Management Sectional Committee (MSD 2) and approval of the Management and SystemsDivision Council. The IS0 Handbook referred above has been prepared under the auspices of ISOlTC 176 - Quality management and quality assurance technical committee of ISO, which is responsible for developing and maintaining the IS0 9000 family of International Standards. India has made significant contribution in finalization of this Handbook. This publication is not a normative document and is not, therefore, an additional International Standard of the IS0 9000 family. The document is informative in intent and status, and seeks to provide advic~e for small businesses on the interpretation and application of the IS0 9000 quality system standards. This Handbook has been adopted as Special Publication in the light of problems encountered by Indian Industry in small scale sector, while implementing IS/IS0 9001,9002 and 9003. The guidance provided takes into account constraints of small scale industry, for example, in terms of cost, time and resources. The text of this IS0 Handbook has been approved as suitable to be published Certain conventions arc, as Special Publication without deviations. however, not identical to those used in Indian Standards and Special Publications. Attention is particularly drawn to the following: Wherever the words International Standard appear, they should be read as Indian/International Standard. In the adopted Handbook, normative references appear to certain International Standards for which Indian Standards also exist. The corresponding Indian Standard which is to be substituted in its place is given below along with its degree of equivalence for the edition indicated:

International Standard IS0 8402 : 1994

Corresponding Indian Standard IS/IS0 8402 : 1994 Quality management and quality assurance - Vocabulary @rst revision)

Degree of Equivalence Identical

In the adopted Handbook, informative references appear to certain International Standards for which Indian Standards also exist. Each of these standards has been adopted by BIS under dual numbering scheme in IS/IS0 9000 or IS/IS0 10000 series. The list of standards thus adopted is given below: International Standard IS0 9000-I : 1994 Corresponding Indian Standard IS/IS0 9000-l : 1994 Quality management and quality assurance standards - Part 1 : Guidelines for selection and use (first revision) IS/IS0 9000-2 : 1993 Quality management and quality assurance standards - Part 2 : Ge~neric guidelines for the application of IS0 900 I, 9002 and 9003 IS/IS0 9000-3 : 199 1 Quality management and quality assurance standards - Part 3 : Guidelines for the application of IS0 9001 to the development, and supply maintenance of software Degree of Equivalence Identical

IS0 9000-2 : 1993

do

IS0 9000-3 : 1991

do

IS0 9000 - 4 : 1993 IS/IS0 9000-4 : 1993 Quality management and quality assurance standards Part 4 : Guide to dependability programme management.

do

International Standard

Corresponding

Indian Standard

Degree

of

Equivalencr

IS0 9001 : 1994

IS/IS0 9001 : 1994 Quality systems - Model for quality assurance in design, development, production, installation and servicing (first
revision)

Identical

IS0 9002 : 1994

IS/IS0 9002 : 1994 Quality systems - Model for quality assurance in production, installation and servicing
(first revision)

do

IS0 9003 : 1994

IS/IS0 9003 : 1994 Quality systems Model for quality assurance in final inspection and test (first revision) ISO/ISO 9004-l : 1994 Quality management and quality system elements - Part 1 : Guidelines
(fourth revision)

do

IS0 9004- 1 : 1994

do

IS0 9004 -2 : 1991 IS/IS0 9004-2 : 1991 Quality management and quality system elements - Part 2 : Guidelines for services IS0 9004-3 : 1993 IS/IS0 9004-3 : 1993 Quality management and quality system elements - Part 3 : Guidelines for processed materials IS/IS0 10005 : 1995 Quality management - ~Guidelines for quality plans IS/IS0 10007 : 1995 Quality management - Guidelines for configuration management

do

do

IS0 10005 : 1995

do

IS0 10007 : 1995

do

International Standard

Corresponding

Indian Standard

Degree

of

Equivalence

IS0 10011 - 1 : 1990 IS0 10011 - 2 : 1991

IS/IS0 1001 1- 1 : 1990 Guidelines for auditing quality systems - Part 1 : Auditing IS/IS0 1001 l-2 : 1991 Guidelines for auditing quality systems - Part 2 : Qualification criteria for quality systems auditors IS/IS0 1001 l-3 : 1991 Guidelines for auditing quality systems - Part 3 : Management of audit programmes IS/IS0 10012-l : 1992 Quality assurance requirements for measuring equipment - Part 1 : Metrological confirmation system for measuring equipment IS/IS0 10013 : 1995 Guidelines for developing quality manuals

Identical

do

IS0 10011 - 3 : 1991 IS0 10012-l : 1992

do

do

IS0 10013 : 199s

do

In Annex A of IS0 Handbook, under ~Guidance, the designation of IS0 Standard, IS0 9000-3 : 1987 may be read as IS0 9000-3 : 1991. In the adopted handbook, informative reference appears to ISO/TR 13425 : 1995 Guidelines for the selection of statistical methods in standardization and specification. The concerned Sectional Committee has reviewed the provisions of this technical report and has decided that it is acceptable for use in conjunction with this handbook.

Table of contents

National Foreword ................................................................................... About this Handbook ............................................................................... Quality systems ....................................................................................... What are thevq , . .......................................................................................... Why have one? ......................................................................................... What are the IS0 9000 standards?. .......................................................... How to start.. ........ . .................................................................................. First steps.. ............................................................................................... Whats next?. ..................... . ..................................... .._.............................. Going ahead ............................................................................................. Do it yourself ........................................................................................... Use of a consultant ................................................................................... What does certification/registration mean?. .............................................

3 9 11 11 II 13 15 15 16 16 .17 19 21

Guidance on IS0 9001, IS0 9002 and IS0 9003.. .............................. .23 _... .25 Introduction.. ....................................................................................... ..2 7 Scope.. .................................................................................................... 30 Normative reference ................................................................................ 31 Definitions ............................................................................................... 33 Quality system requirements.. .................................................................. 33 Manngement responsibility ...................................................................... 39 Quality system .......................................................................................... _........... .A6 Contract review .......................................................................... 48 Design control ......................................................................................... 59 Document and data control .... ................................................................. 64 Purchasing.. ............................................................................................. 70 ..................................................... Control of customer-supplied product 71 Product identification and traceability ....................................................

Process control.. ...................................................................................... Inspection and testing.. ............................................................................. Control of inspection, measuring and test equipment ............................. Inspection and test status ....................................................................... Control of nonconforming product.. ........................................................ Corrective and preventive action.. ........................................................... Handling, storage, packaging, preservation and delivery ..................... Control qf quality records.. ..................................................................... Internal quality audits. ......................................... ................................. Trffining.. ................................................................................................ Servicing.. .............................................................................................. Statistical techniques.. ............................................................................ Annex A Bibliography.. .........................................................................

.73 78 .84 .9 1 93 96 10 I 106 .108 112 .114 115 1I 9

Annex-I How the key quality system standards compare.. ................... .I27 Annex II Explanation of terms used .................................................... Annex III Steps towards a quality system ............................................ Annex IV Brief outline of certification/registration .I29 .135

.............................. 149

SP 65 : 1998

About this Handbook

Most businesses have some problems with putting a quality system in place. In a small business these problems are potentially greater due to :
.
l

minimal available resources, difficulty in understanding and applying the standard, and costs involved in setting up and maintaining a quality system.

This handbook gives guidance to a small business on putting an IS0 9000 quality system in place. It explains how quality system standards apply to the-small business sector and also explains the requirements of such standards. However, this advice does not set any requirements, or add to, or otherwise change the requirements of the standards. For you, the small business manager, implementing a quality system costs time and money and should be looked at in the same way as any other investment you make. For it to be viable, you have to be able to achieve a return for your time and effort, through improvements in marketability and/or internal efficiency. Your decisions at the early stages of introducing/developing your quality system will have a major influence in these areas. Avoiding mistakes at an early stage is essential and an aim of this Handbook is to give you a better understanding of what you have to do and what you dont need to do. For the purposes of this Handbook, a small business is not a matter of the number of employees, but rather a philosophy of the way the business is run. With only a few people involved, communications can be simple and more direct. Individuals are expected to undertake a wide varitety of tasks

sP65: 1998

within the~business. Decision making is confined to a few people (or even one). The advice given has been developed with the above features in mind. Much of it will also be relevant to larger organizations. However, caution should be exercised, since the features on which the advice is based may not exist in larger organizations. It is not expected that you will sit down and read this Handbook in one sitting. It is broken up into sections to be read and used separately and referred to as the need arises. The sections are : Quality systems This section gives an overview of what an IS0 9000 quality system is. How to start This gives some practical advice on different options, should you wish to introduce a quality system into your business. Guidance on IS0 9001, IS0 9002 and IS0 9003 This is a major part of the Handbook and includes the text of IS0 9001 itself. It provides guidance on the interpretation of the requirements, together with extensive examples and suggestions of how these could be met. Annexes A, I, II, III and IV The annexes are intended to supplement the main section. Annex III, in particular, offers a practical step-by-step approach to implementing a quality system. Throughout the Handbook some words are shown in bold italics. These have special meanings and are explained in Annex II, Explanation of terms used. Titles of standards, clauses and annexes are shown in italics but are also accompanied by the standard, clause or annex number. They should not be confused with special meaning words. We hope you find this Handbook useful. 10

SP 65 : 1998

Quality Systems

What are they?

All businesses, large and small, already have an established way or system of doing business. In a small business, the likelihood is that the system is quite effective, but informal and probably not documented. Quality system standards identify those features which can help a business consistently meet its customers requirements. They are not about imposing something totally new. Quality systems are about evaluating how and why things are done, writing down how things are done and recording the results to show they were done. Many small businesses will already be carrying out many of the operations which the standards specify.

Why have one?

Some customers in both the private and public sectors are looking for the confidence that can be given by a business having a quality~system. While meeting these expectations is one reason for having a quality system, there may be others, which could include the following: -0 Improvement of performance, coordination and productivity.
l

Greater focus on your business objectives customers expectations

and your

11

SP 65 : 1998 .

Achievement and maintenance of the quality of your product) to meet the customers stated and implied rieeds. Management confidence that the intended quality is being achieved and maintained. Evidence to customers and potential customers of the organizations capabilities. Opening up new market opportunities market share. or to maintain

. .

Certification/Registration. Opportunity to compete on the same basis as larger organizations ( e.g. ability to tender or submit price quotations). NOTE - A customers order does not always provide all the requirements that need to be met. For example when booking a room in a hotel, the customer expects, on entering the room, that it will be clean, tidy and properly made up. However, this requirement is seldom, if ever, stated to the hotel.

While the quality system can help in achieving these expectations, dont forget that it is only a means and cannot take the place of the goals you set for your business. You should regularly review and upgrade your quality system to ensure that worthwhile and economically viable improvements are achieved. In the 1~994editions of the IS0 9000 standards there is a thread of quality improvement requirements which can be used as a basis for improvement programmes. A quality system, on its own, will not automatically lead to improvement of work processes or yourgroductquality. I) Words in bold italics have special meanings and are explained in Annex II, Explarratinn ofterms used. However, to assist in gemeral understanding, the term products and services is used where helpful in the context. 12

SP 65 : 1998

It wont solve all your problems. It is a means for you to take a more systematic approach to~your business. Quality systems are not just for big companies. Since quality systems are about how the business is managed, they can be applied to all sizes of companies and to all aspects of management, such as marketing, sales and finance, as well as the basic business. It is up to you to decide the extent of application. Quality system standards should not be confused with product standards. Most-organizations, new to the concepts of quality systems and in particular the IS0 9000 series of standards, confuse product quality with the concept of quality management. The use of product standards, quality system standards and quality improvement approaches are all means of improving your customers satisfaction and the competitiveness of your business and they are not exclusive of each other. Quality systems should not result in excessive bureaucracy or paperwork or lack of flexibility. Remember all businesses already have a management structure and this should be the basis on which the quality system is built. You may find that you are already carrying out many of the requirements included in these standards but have not recorded how. Changes or additions should be made only if they are necessary to meet the requirements of the standard or are otherwise helpful to the business.

What are the IS0 9000 standards?

The IS0 9000 series, which has gained international recognition and acceptance, is a set of standards some of which specify requirements for quality systems (IS0 9001, IS0 9002 and IS0 9003), and others which provide guidance to aid in the interpretation and implementation of the quality system (e.g. IS0 9000-2, IS0 9004-l).

13

SP65:1998

IS0 9001 sets out the requirements to be met where a business is involved in design and development, production, installation and servicing. IS0 9002 gives the equivalent requirements where a business does not undertake design and development. IS0 9003 is the equivalent model where design control, process control, purchasing or servicing are not required and basically inspection and testing are used to ensure that final products and services meet specified requirements. IS0 9001 is not higher in level than either IS0 9002 or IS0 9003. For each small business, one of the three standards will be the most appropriate. The standard selected should be the one that best suits your operations. (See Annex III for more guidance.) Other quality system standards which may be relevant are listed in Annex A to IS0 9001 and a brief description of their contents is given in the guidance to this part of the standard. Two standards, which may be of particular use are:
l

IS0 9000- 1: 1994, Quali~ mnnagement and quality assurance standards - Part 1: Guidelines for selexztion and use. IS0 9004-I : 1994, Quality management and quality system elements - Part 1: Guidelines.

If your business is providing service, you may also find that IS0 9004-2, Quality manugement and quality system elements -Part 2: Guidelinesforservices, is a worthwhile reference. You may find that a combination of this Handbook and one of the guidance standards listed in Annex A to IS0 9001 provides a sufficient basis for putting a quality system in place.

14

SP 65 : 1998

How to start

First step

This Handbook is written particularly for a small business wishing to put a quality system in place. The first step is to use this Handbook to give yourself an understanding of what quality systems are and what the requirements are. Since it is not the purpose of the quality system standards to impose a totally new way of managing your business, the next step is to look at what is being done now. This does not necessarily mean you having to change your business activities or introduce new paperwork. You should look at what is already being done and what documentation and forms already exist. In many cases, minor modifications can lift a current practice to a level that will satisfy the requirements of the standard. You will then need to decide what standard applies to your business. Annex I lists the requirements given in each quality system standard. IS0 9000-I also gives further guidance on how to select the appropriate standard. The guidance given under clause 1, Scope (in the section Guidance on IS0 9001, IS0 9002 and IS0 9003), may also help provide assistance to make this selection. Having made this selection, you will need to see what requirements of the standard your business is already meeting and also those it is not yet meeting. An approach which might prove helpful is given in Annex III.

15

SP 65 : 1998

Whats next?

Do you need more information? Some sources that you may be able to use for advice are:
. .

industry or professional associations; government departments, particularly those specializing in small business affairs and business development units; self-help groups; Internet Web Pages; other businesses putting in a quality system; IS0 9000 News, published by IS0 Central Secretariat, includes IS0 9000 case studies from different business sectors around the world; certification/registration bodies;

.
l

standard bodies which are members of ISO; consultancies; customers.

Ask your customers if they have any particular requirements that you might need to consider for inclusion in your quality system.

Going ahead

After all this research, you should have some idea of how much work needs to be done to put a quality system in place. The important decision you need to reach now is whether you are going to go ahead. If the decision is yes, the next question is How much can I do myself? If you feel you are going to need assistance, the list above can be used to identify possible sources and associated costs.

16

SP 65 : 1998

You will need to establish what personnel and time resources you have available since this will determine~how much assistance you are going to need. Because most small businesses will not always have sufficient resources, they may need to consider using external assistance. There are many sources of assistance available, such as training courses, seminars, computer packages and financial support, as well as those described under whats next (on previous page). The key issue that you need to recognize in using external assistance is that it is your business approach and quality system that has to be developed. Be wary of off-the-shelf solutions that cannot be tailored to your business, whether these are offered by a computer package or a consultant. If you have some resources available but not sufficient to put all aspects of a quality system in place at the same time, a step-by-step approach is often used. Depending on the nature and activities of your business, it may be appropriate to take the requirements of one or two clauses and fully implement these and then move on to additional clause requirements. The order in which the clauses are selected for implementation is a matter for you to decide, but the most effective approach would be to first put in place those which have the greatest benefit to the business. A grouping of requirements given at the end of Annex III may be of assistance for this purpose.

Do it
yourself

The section entitled Guidance on IS0 9001, IS0 9002 and IS0 9003 will prove helpful here. You can use this section to identify what the standard requires and how these requirements relate to what your business actually does. This comparison should identify the areas where you need

17

SP 65 : 1998

to further develop your quality system. Probably many of the requirements are already being achieved or perhaps partially achieved. Sole traders or small partnerships may find that if !hey write out all the things they do in running the husiness, including the ones not commonly thought about, the significance of the requirements of the various clauses becomes more relevant. For example, when placing job advertisements for personnel, you are, in a sense, writing a job description. When placing an order with one of your suppliers, you already have some idea of that suppliers capability to supply what you ordered. When you write down an instruction on how you want something done, you are creating what might be a procedure, a quality plan or a check-list. Having determined how the requirements of the standard apply to your business, the next step is to look at your activities and record what is actually being done. These activities should be generally written out as procedures, instructions or whatever name you like to callthem. These procedures are then evaluated against what the relevant clauses of the standard require. Usually there is a need for upgrading some of your practices to meet these requirements. More detail is given in Annex III, Steps towrds a quality system There are many ways of preparing or presenting procedures or instructions. You should use whatever method, style, layout or format that is most suitable for you. This may range from a formal style, to a note-like approach listing the relevant points, to a flowchart. The main thing is to keep them as simple as possible and avoid writing unnecessary procedures and instructions.

18

SP 65 : 1998

For a multi-cultural workforce, simple pictorial representations may be a more appropriate way of presenting procedures and instructions. If the costs can be justified, you may even wish to consider the use of videos or computer-generated graphics. An important requirement information is presented, describe how to perform procedures or instructions. is that, whichever way the it should be adequate to the tasks covered by the

The extent of documentation could be very simple for a sole trader, or a partnership, but may need to be more detailed where more employees are involved. Also, it is important to realize that there should be no reason for you to substantially change the way your business is run. The quality system standards set out what needs to be done. They require you to decide how you are going to do it.

Use of-a consultant

If you decide to engage a consultant, it is essential that the work to be done is agreed by both parties and that a realistic time-table is set. You might also want to ask the consultant to carry out a survey or preliminary assessment of your existing practices. The following are some of the actions that should be considered in engaging a consultant:
l

Talk to several consultants. Choose your consultant carefully, experience and references. check credentials,

Ensure that the full scope of thebusinesss activities and objectives is understood by the consultant. Commit the necessary resources for the time needed as agreed.

19

SP 65 : 1998
l

Takea personal interest in what is being done; after all, it is your quality system. Explain what your customers expect and why you are seeking to implement a quality system.

When a consultant has been selected, it is a good idea to establish what the consultant is expected to do and what you are expected to do or provide. The use of a consultant should not be regarded as an exercise in pushing the responsibility of establishing a quality system on to someone else. Effective use of a consultant requires two-way communication between the consultant and yourself. The consultant needs to work with you and your workforce to build a quality system which is based on your businesss activities and practices. If required, many consultants will include training on the quality system for everyone involved. The consultant should work with the various individuals in your business to ensure that the necessary procedures are in place to meet the requirements of the relevant IS0 9000 standard. The consultant should be able to provide input and guidance to ensure that these are simple, easily understood and that they contribute to helping you and your people do their job rather than create unnecessary paperwork and documentation. An effective quality system is one that is written about the way your business operates. Small businesses~are advised to be careful of any consultant offering to put a ready-made quality system in place. This is unlikely to succeed, other than for a short time, and much time and effort will have been wasted until a quality system that meets your needs is subsequently developed.

20

SP 65 : 1998

When your personnel are involved with the development land implementation of the quality system, they can develop a sense of ownership and this may provide an easier path to making the quality system work. it may be difficult to inspire ownership with a quality system developed by a consultant working in isolation. Cost is an important consideration. In deciding to engage a consultant, you should explain your needs and expectations and you may ask the consultant to set these out in a proposal or specification. You may also wish to get proposals from other consultants. It is not only the consllltants costs that must be considered when you are making your final choice. The consultant should spend time with you and time observing the business operations. The effect of these time-costs on your business will also need to be taken into account. There is no short way to the development and documentation of a quality system. It takes your time and effort as well as the consultants. If the consultant is to write procedures or instructions on your behalf, then you w~ill need to be involved. Without your inputs, at best the resulting procedures will be the consultants interpretation of what makes your business run. In the worst case, they will be a copy of somebody elses procedures and instructions which have nothing in common with what you do.

What does
certification/
registration

mean?

Certification may be regal-ded as the formal recognition by others of your quality system. In some other countries, certified quality systems are considered to be registered and the term registration is used instead of certification. Certification/registration is not a mandatory requirement of-implementing IS0 9001, IS0 9002 or IS0 9003, but may

SP 65 : 1998

be required of you by some of your customers. Your decision regarding certification/ registration may also be influenced by your competitors or by regulatory or statutory requirements. If you are considering this option, your first step is to contact several certification/registration bodies to find out what offered, what the~likely costs are, the period for which the certification/registration will apply and how frequently they will want to look at your quality system. Some bodies may include an initial pre-assessment in their offer. This can be of major benefit in finding out what needs to be done. Before the actual certification/registration, it is essential to have all aspects of the quality system in place and running for several months. you can then see the quality system in operation and have the opportunity to improve it. Any improvements you can achieve at this stage can simplify the certification/registration process. This can save you time and money. Certification/registration bodies do not operate on the principle of what is going to happen. They want to see what has happened. You will need sufficient records to demonstrate that your quality system has become established and effective.
.

Annex IV briefly describes the certification/ registration process and gives you some idea of what to expect.

22

SP65:

1998

Guidance on IS0 9001, IS0 9002 - and IS0 9003

Introduction
Whether you are using a consultant or putting a quality system in place yourself, a good understanding of the detailed requirements for a quality system is necessary. Many of the IS0 9000 series of standards provide guidance in this respect, particularly IS0 9000-2 and IS0 9004-l. These and other various guidance standards have been used as sources of input in compiling this section of the Handbook, which is based around IS0 9001, IS0 9002 and IS0 9003, since these are the standards that are most frequently encountered by small businesses. Advice on the interpretation and application of these three standards is given by first listing the full text of each clause of IS0 9001 (in the shaded sections, marked Standard) followed by relevant guidance. You should read the guidance in conjunction with the clause, since in cases where the text of the clause is clear, only limited advice is given. IS0 9001 and IS0 9002 are identical except for clause 4.4, Design control, which does not apply to the latter. Some IS0 9003 clauses are less comprehensive and the guidance will give an indication of the nature and extent of the difference. However, IS0 9003 should be referred to for the precise details of the relevant clauses. Examples have been used wherever possible as an aid to understanding. These have been selected with a view to their suitability to small businesses and to reflect that many small businesses are service providers rather than manufacturers. Much of the guidance given may also be relevant to a larger business. It should be noted, however, that specific advice relating to small businesses is based on the existence of simple and effective communications

23

SP 65 : 1998

and famitiarity with all parts of the business. Accordingly, it may not always be as appropriate to a larger organization. When reading a quality system standard such as IS0 9001, you should note that certain words and phrases have particular significance or meaning. Some explanation of the more important of these is given below:
Supplier

Whenever this word is used in the standard, it means you, the small business. This means the individuals or organizations that you purchase goods and services from and whom you normally refer to as your suppliers . This means a requirement has to be followed whenever it occurs in the standard. These terms are normally used to suggest or recommend a course of action. They are never used to indicate a requirement that must be followed.

Subcontractor

Shall

Should/may/ can

(as)

Where these or similar terms occur, you need to decide how (as) appropriate the requirements apply to your business, and in some cases, (as) necessary how they may not. (as) needed

24

SP 65 : 1998

Standard

Introduction
This International Standard is one of three International Standards dealing with quality system requirements that can be used for external quality assurance ,purposes. The quality assurance models, set out in the three International Standards listed below, represent three distinct forms of quality system requirements suitable for the purpose of a supplier demonstrating its capability, and for the assessment of the capability of a supplier by external parties. a) IS0 9001, Quality systems - -Model for quality assurance in design, development, production, installation and servicing for use when conformance to specified requirements is to be assured by the supplier during design, development, production, installation and servicing. b) IS0 9002, Quality systems - Model for quality assurance in production, installation and servicing for use when conformance to specified requirements is to be assured by the supplier during production, installation and servicing. c) IS0 9003, Quality systems -- Model for quality assurance infinal inspection and test for use when conformance to specified requirements is to be assured by the supplier solely at final inspection and test. It is emphasized that the quality system requirements specified in this International Standard, IS0 9002 and IS0 9003 are complementary (not alternative) to the technical (product) specified requirements. They specify requirements which determine what elements quality systems have to encompass, but it is not the purpose of these International Standards to enforce uniformity of quality systems. They are generic and independent of any specific industry or economic sector. The design and implementa-

25

SP 65 : 1998 tion of a quality system will be influenced by the varying needs of an organization, its particular objectives, the products and services supplied, and the processes and specific practices employed. It is intended that these International Standards will be adopted in their present form, but on occassions they may need to be tailored by adding or deleting certain quality system requirements for specific contractual situations. IS0 9000- 1 provides guidance on such tailoring as well as on selection of the appropriate quality assurance model, i.e. IS0 9001, IS0 9002 or IS0 9003.

Guidance

The three quality system standards and their intended application Much of the above is self-explanatory. You will have to choose which of the-standards is applicable to your business and advice in this regard is given in the subsequent pages. Clause 4 of each of standard describes the requirements which make up the quality system. You need to decide whether all of these requirements are relevant to your operations in light of the standard selected. This is referred toas tailoring. Tailoring is adding to or omitting the requirements of IS0 9001, IS0 9002 or IS0 9003 to reflect the particular circumstances of your business. Applicable requirements should not be ignored or omitted. You cannot discard as irrelevant a requirement of any of these standards just because you do not want to do it. Just because you have not done it before does~not mean that it is not applicable to your business. If you question a requirement, ask yourself :
l

What is the idea or principle behind this requirement? What kind of problem could be prevented by meeting this requirement? Why would meeting the requirement give confidence to the customer?

SP 65 : 1998

Scope

Standard

1 Scope
This International Standard specifies quality system requirements for use where a suppliers capability to design and supply conforming product needs to be demonstrated. The requirements specified are aimed primarily at achieving customer satisfaction by preventing nonconformity eat all stages from design through to servicing. This International Standard is applicable in situations when design a> is required and the product requirements are stated principally in performance terms, or they need to be established, and

b) confidence in product conformance can be attained by

adequate demonstration design, development, servicing. of a suppliers capabilities in production installation and

NOTE 1 For informative references, see Annex A2)

Guidance

Where the standard applies

The Scope requirements vary from IS0 9001 to IS0 9003. The key differences between the three standards are the quality system requirements described in clause 4 of each
2) This is Annex A to IS0 900 1 and appears on page

I 19.

27

SP 65 : 1998

standard. Clause 4 contains 20 subclauses (4.1 to 4.20), although the number of subclauses that apply is different for each standard. The guidance given in this Handbook highlights the major differences where they exist. Further comparison of the differences between the three standards is given in the table included in Annex I. IS0 9001 : 1994 is titled Quality systems - Model for quality assurance in design, development, production, installation and servicing. All 20 subclauses apply. If your need to carry out design and development in order to meet yourcustomers requirements, then IS0 9001 is the relevant standard for your business. This standard provides for production, installation and servicing where these operations are part of your business activities. It apphes to those service-providing businesses whose product is a design or could be described as intellectual property, e.g. consultants, design engineers, architects and similar professions. Development is considered to be part of design control and is covered by the guidance given in 4.4, production and installation is covered under processs control in 4.9, and servicing is covered in both 4.9 and 4.19. Installation includes the situation where aproduct is produced at your premises and is subsequently installed at a location specified by the customer. This could include, for example :
l

a manufactured

item to be installed in a customers plant, e.g. a plastic shredder to be installedin arecyclers plant;

a software programme to be installed in a customers computer network; a training programme to be integrated into a customers training system.

28

SP65:1998 IS0 9002 : 1994 is titled Quality systems -

Model for quality assurance in production, installation and servicing. Only 19 subclauses (which are identical to those in IS0 900 1) apply. It omits clause 4.4, Design control. This standard is to be used where a small business is producing goods and delivering services. It also applies when instaliation and/or servicing are included as part of the contract. IS0 9003 : 1994 is titled Quality systems - Mod for quulity assurance in fmal inspection and test. Only 16 subclauses apply, omitting clause 4.4, Design control, clause 4.6, Purchasing, clause 4.9, Process control, and Clause 4.19, Servicing. This standard is aimed primarily at product conformance by final inspection and testing. Consequently, some of the subclauses have a reduced scope compared with the other two standards. Where this situation arises, it will be indicated in the guidance on the relevant clause. This standard applies generally where the business is supplyingproducts on the basis of established inspection and test capabilities. These could include: subcontract machining services; photocopy/print shops;

secretarial services; car valet services.

29

SP 65 : 1998

Normative reference

Standard

2 Normative reference The following standard contains provisions which, through reference in this text, constitute provisions of this International Standard. At the time of publication, the edition indicated was valid. All standards are subject to revision, and parties to agreements baskd on this international Standard are encouraged to investigate the possibility of applyin, 0 the most recent edition of the standard indicated below. Members of IEC and IS0 maintain registers of currently valid International Standards. IS0 8402: 1994, Quality assurance - Vocabulary marlngemerlt and quality

Guidance

Other references The normative reference clause is ~included in all the IS0 quality system standards so people will know which standards are mentioned as references. This clause will normally be of little concern of most small businesses. The reference to IS0 8402 directs you to that standard as a source of definitions for some of the quality terminology used in IS0 9001, IS0 9002 and IS0 9003.

30

SP 65 : 1998

Definitions

Standard

3 Definitions For the purposes of this International Standard, the definitions given in IS0 8402 and the following definitions apply. 3.1 product : Result of activities or processes. NOTES 2 A product may include service, hardware, processed materials, software or a combination thereof. 3 A product can be tangible (e.g. assemblies or processed materials) or intangible (e.g. knowledge or concepts), or a combination thereof. 4 For the purposes of this International Standard, the term product applies to the intended product offering only and not to unintended by-products affecting the environment. This differs from the definition given in IS0 8402. 3.2 tender : Offer made by a supplier in response to an invitation to satisfy a contract award to provide product. 3.3 contract : Agreed requirements between a supplier and customer transmitted by any means.

31

SP 65 : 1998

Guidance

Explanation

of terms

This clause provides definitions of certain terms used in IS0 9001, IS0 9002 and IS0 9003. The term product is defined in IS0 8402, but one of the IS0 8402 notes is slightly modified for the purposes of these standards. Further explanation of-these and other terms used in this Handbook as they relate to small businesses, are given in Annex II, Explanation of terms used. Whileproduct is used in this Handbook in the sense of the above definition and includes service, to assist in general understanding, the term products and services is used where it is helpful in the context.

32

SP 65 : 1998

Quality system requirements

Management responsibility
Standard
4 Quality system requirements 4.1 Management responsibility 4.1.1 Quality policy The suppliers management with executive responsibility shall define and document its policy for quality, including objectives for quality and its commitment to quality. The quality policy shall be relevant to the suppliers organizational goals and the expectations and needs~of its customers. The supplier shall ensure that this pohcy is understood, implemented and maintained at all levels of the organization.

Guidance

A commitment

to quality

This clause requires the business toput its quality policy in writing. The quality policy establishes: a commitment to quality; what the quality objectives are; and how the objectives relate to your customers expectation$. Your commitment to quality is written to describe your overall vision of what quality means to your business and your customers.

33

SP-65 : 1998

To make that commitment understandable, you will need to identify overall quality goals for your business to achieve, usually in a given time frame. It is important that these goals are not vague but address whats important to you and your customer. To do this successfully, you will need to establish what your customer expects of you. This could involve:
l

talking to your customers; carrying out market/customer access to industry reports; and identification of niche marketing opportunities. surveys;

Management commitment for quality should be visible and active. For example, a publicly displayed copy of the quality policy signed by the companys owner is one method which may be used to show that commitment to both employees and customers. All employees need to understand the quality policy, how it affects them and their role in the quality system. The manager should decide how this is to be achieved.

Standard

4.1.2 Organization 4.1.2.1 -Responsibility and authority

The responsibility, authority and the interrelation of personnel who manage, perform and verify work affecting quality shall be defined and documented, particularly for personnel who need the organizational freedom and authority to: a) initiate action to prevent the occurrence of any non-conformities relating to the product, process and quality system;

34

SP 65 : 1998

b) identify and record any problems product, process and quality system; c) initiate, recommend designated channels; or provide

relating

to the through

solutions

d) verify the implementation

of solutions;

e) control further processing, delivery or installatiottof nonconforming product until the deficiency or unsatisfactory condition has been corrected.

Guidance

Who is responsible for what? In a small business, as there is a limited number of people available to carry out the tasks described in the clause, there will frequently be a need to share duties and responsibilities and for people to be able to do each others jobs. Everyone should know what they are expected to do (responsibilities) and allowed to do (authorities) and this needs to be written down. The descriptions do not have to be elaborate or complex. It is important that the descriptions clearly reflect the real life situation and allow for flexibility. One method of identifying and recording the responsibilities and authorities is a job description. This might be supplemented by a simple organization chart. Other methods which suit your way of working are e~qually satisfactory, provided the responsibilities and authorities are defined. The specific requirements listed in items a) to e) will need to be addressed to the extent that they are relevant. NOTE - In item c) of the clause, designated channel means you and who you provide the information to; are covered in 4.13 and 4.14 and nonconformities explained in Annex II, Explanation of terms used.

35

SP 65 : 1998

IS0 9003 : 1994 has reduced requirements. Item a) refers only to those who conduct final inspection and tests while item b) refers to ensuring that finished product~that does not conform to specified requirements is prevented from being used or delivered. There are no items c), d) ore).

Standard

4.1.2.2 Resources The supplier shall identify resource requirements and provide adequate resources, including the assignment of trained personnel (see 4.18), for management, performance of work and verification activities including internal quality audits.

Guidance

What is needed? The intent of this clause is to make sure you have the resources needed to carry out the work required in the time agreed with your customer. These resources cover both~personnel and equipment. For example, it may be necessary to:
l

train or retrain personnel (4.18) to acquire the necessary skills; seek additional personnel either on a temporary or permanent basis, to acquire the necessary skills; Jc\ elop new processes or new working methods; obtain additional equipment, leased or purchased. which could be rented,

Alternatively, it may be more cost-effective to acquire~the resources and skills through subcontracting. It is probably a good idea to review resources on a regular basis, perhaps in conjunction with the management review (4. I .3). A review of resources may also be necessary when a new tender or contract is being considered (4.3).

36

SP 65 : 1998 The requirements for internal auditing are discussed in 4.17 and these should also be considered in any resource review.

Standard

4.1.2.3 Management

representative

The suppliers management with executive responsibility shall appoint a member of the suppliers own management who, irrespective of other responsibilities, shall have defined authority for a) ensuiring that a quality system is established, implemented and maintained in accordance with this International Standard, and b) reporting on the performance of the quality system to the suppliers management for review and as a basis for improvement of the quality system. NOTE 5 The responsibility of a management representative may also include liaison with external parties on matters relating to the suppliers quality system

Guidance

Who looks after the quality system? The requirement is that you nominate someone with management authority to take overall responsibility for the quality system. This person can carry out other duties as well, but must have the necessary authority within the business to make sure the quality system is working properly. In a small business, it may be appropriate for the manager to assume these duties. One of the key duties of the management representative is to be aware of the performance of the quality system and possibilities for improvement. Where this job is not done by the manager, the manager should be kept informed.

37

SP 65 : 1998

Standard

4.1.3 Management

review

The suppliers management with executive responsibility shall review the quality system at defined intervals sufficient to ensure its continuing suitability and effectiveness in satisfying the requirements of this International Standard and the suppliers stated quality policy and objectives (see 4.1 .l). Records of such reviews shall be maintained (see 4.16).

Guidance

Is the quality system working? You should review the quality system on a regular basis; annually could be acceptable for an established quality system. Where changes are planned or being implemented, more frequent review periods may be needed. To ensure that the entire quality system is covered, a standard procedure or agenda should be followed. This agenda should include:
l

quality problems and actions taken; customer complaints; how the quality system is working and whether objectives are being met; quality audit reports (both internal and external); areas for improvement/changes outstanding actions; relevance of quality policy and objectives to current needs. needed;

Other items which may be helpful to consider include:

l

training needs; supplier problems;

38

SP 65 : 1998
l

equipment, problems.

working

environment,

and maintenance

Identifying the issues to go under these headings may allow you to develop and revise your own quality, strategic and business plans for future activities. For example, as improvements are achieved and problems eliminated, you may need to review -your inspection controls and other controls adopted. Are they still essential or can some savings be made since the cause of the problem has been addressed? Reviews and audits are not the same. This is best understood from the fact that the results of audits are part of the management review. (see also Annex II, Explanation of terms used.) Records of the review need to be kept which address all points of the agenda together with any action points and target dates allotted. The records can be in any form that suits your business, such as notes in a daybook, formal meeting minutes or notes, produced, distributed and stored on a paper or electronically (computer data.)

Quality system
Standard 4.2 Quality system 4.2.1 General The supplier shall establish, document and maintain a quality system as a means of ensuring that product conforms to specified requirements. The supplier shall prepare a quality manual covering the requirements of this International Standard. The quality manual shall include or make

39

SP 65 : 1998 reference to the quality system procedures and outline the structure of the documentation used in the quality system. NOTE 6 Guidance IS0 10013. on quality manuals is given in

Guidance

Write down what you do Where this clause says eatablish, document and maintain, it means having put the quality system in place, write down what is done, and keep it up to date. You will need to have a quality manual which either includes your quality system procedures (4.2.2) or says where they are located. The quality manual can also be used to record the principal characteristics of your quality system. As such, the quality-manual can be considered as the road-map of the quality system. It is the place where you might choose to document or reference the following:
l

The quality policy. The activities of your business. How the documentation works and where people look to find information on how to do things. An outline of the procedures which document relevant requirement as-it is performed. each

A definition of any terms having a unique meaning to your business. Statements on responsibility and authority.

If any of the above are not included in the quality manual, it is acceptable for the quality manual to indicate where they may be found. You are free to choose whichever format for the quality manual you consider most appropriate for your business.

40

SP 65 : 1998 For example, it is equally acceptable for the quality manual to follow your normal work processes rather than the clause of the IS0 9000 series of standards. If you choose a format that does not follow the clauses of the applicable IS0 9000 standard, it is advisable to create a cross-reference matrix between your manual and the standard to ensure you have not missed anything and to act as a signpost to others reading your quality manual. NOTE - Advise on writing a quality manual is given in IS0 10013, Q ua lty I manuals - Guide to preparation. Additonally, you may tailor the quality system by only including the clauses which actually apply to your businesss operations. If, for example, one or more of the clauses of the selected standard are not relevant to the operations, the quality manual should indicate this. However, if the quality system is to be certified/registered, the certification/registration body will need to see the reasons why a particular clause was excluded. You may also include additional material in your quality manual if you choose. However, again for certified/ registered quality system, certification/ registration bodies will check that you are actually doing what the quality manual describes. This means that the quality manual should be regarded as a real working document and not just a show-piece to impress customers. IS0 9OQ3 : 1994 has a reduced requirement in that the quality sy-stem relates to theproduct on completion.

Standard

4.2.2 Quality system procedures The supplier shall a) prepare documented procedures consistent with the requirements of this International Standard and the suppliers stated quality policy, and 41

SP 65 : 1998

b) effectively implement the quality documented procedures.

system

and its

For the purpose of this International Standard, the range and detail of the procedures that form part of the quality system shall be dependent upon the complexity of the work, the methods used, and the skills and training needed by personnel involved in carrying out the activity. NOTE 7 Documented procedures may make reference to work instructions that define how an activity is performed.

Guidance

Having procedures and following them Documented procedures are a written description of what is being done. sometimes they will need to be very detailed. Often they can be very simple, e.g. flowcharts. The form they take may vary enormously: from separate formal documents, to technical notes incorported into a drawing, or to an equipment instruction manual. You should examine the need for quality system procedures to describe how your business operations are performed. Existing documentation may be adequate and can be simply referenced in the quality manual. Procedures should indicate who does what, where, when, why and how. Some organizations may prefer to describe how in a different type of document, such as a work instruction, or an operational manual referenced from the procedure. Many of the clauses in this standard have requirements for documented procedures. However, this does not mean you need to have a special procedure for each requirement. The amount of detail your procedures and instructions contain will depend largely on the methods used, the skills needed, the training undertaken and the extent of

42

SP 65 : 1998

supervision required. Excessive detail does not necessarily give you more control of the activity and should be avoided where possible. Training may reduce the need for detailed instructions, provided everybody has the information they need to do their job correctly. Where there are language difficulties, procedures or instructions could be given in graphic form or on video. Frequently, a simple set of pictures can convey the requirement more accurately than a lengthy detailed description. Procedures and instructions should not be a wish list of what you would like to happen in your business. They should accurately reflect what really happens. To this extent, they should be clear and cover all the requirements to complete the differing tasks within your business. The quality system and the writing of procedures needs to involve all your personnel. It cannot be driven by one person acting in isolation. The earlier, and the more people involved, the better will be their understanding, involvement and sense of ownership.

43

SP55 : 1998

Standard

4.2.3 Quality planning The supplier shall define and document how the requirements for quality will be met. Quality planning shall be consistent with all other requirements of a suppliers quality system and shall be documented in a format to suit the suppliers method af operation. The supplier shall give consideration to the following activities, as appropriate, in meeting the specified requirements for products, projects or contracts: a) the preparation of quality plans; b) the identification and acquisition of any controls, processes, -equipment (including inspection and test equipment), fixtures, resources and skills that may be needed to achieve the required quality; c) ensuring the compatibility of the design, the production process, installation, servicing, inspection and test procedures and the applicable documentation; d) the updating, as necessary of the quality control, inspection and testing techniques, including the development of new instrumentation; e) the identification of any measurement requirement involving capability that exceeds the known state of the art, in sufficient time for the needed capability to be developed; f) the identification of suitable verification at appropriate stages in the realization of product; g) the clarification of standards of acceptability for all features and requirements, including those which contain a subjective element; h) the identification and preparation of quality records (see 4.16) NOTE 8 The quality plans referred to [see 4.2.3 a)] may be in the form of a reference to the appropriate documented procedures that form an integral part of the suppliers quality system.

44

SP 65 : 1998

Guidance

How are we going to do it? The business needs to consider each of the requirements of a) to h) above and decide what is the best way to address them. This planning may be carried out at the time of establishing the quality manual and procedures, and the results will be reflected in their contents. NOTE - Item g) refers to setting the basis for accepting or rejecting aproduct. For businesses whose product and service is routine and highly repetitive, reference to the quality manual and procedures may be sufficient to meet the quality planning requirements, providing these documents are reviewed periodically to ensure they are still adequate. In some types of business, it may be necessary to repeat this planning approach for each new order or project. For others, it may only be appropriate where there are non-routine products or activities. forthese businesses it may be appropriate to draw up specific quality plans. If, as part of your planning approach, you decide quality plans are needed, they can be as brief as a check-list or flowchart which may include references to existing documents. For complex activities, quite detailed plans may be more appropriate. (Reference could be made to IS0 10005: 1995, Quality munagement - Guidelines for qualig plans, and IS0 9004- 1, Quality management and quality system elements - Part 1: Guidelines.) IS0 9003 : 1994 has reduced requirements in that quality planning activities relate to ensuring that the requirements for quality of the finished product will be met .

45

SP65: 1998

Corztmct review
Standard 4.3 Contract review 4.3.1 General The supplier shall establish and maintain documented procedures for contract review and for the coordination of these activities. 4.3.2 Review Before submission of a tender, or the acceptance of a contract or order (statement of requirement), the tender, contract or order shall be reviewed by the supplierto ensure that: are adequately defined and requirements a) the where no written statement of documented; requirement is available for an order received by verbal means, the supplier shall ensure that the order requirements are agreed before their acceptance. between the contract or order b) any differences requirements and those in the tender are resolved; c) the supplier has the capability to meet the contract or order requirements. 4.3.3 Amendment to a contract

The supplier shall identify how an amendment to a contract is made and correctly transferred to the functions concerned within the suppliers organization. 4.3.4 Records Records 4.1.6). of contract reviews shall be maintained (see

NOTE 9 Channels for communication and interfaces with the customers organization in these contract matters should be established. 46

SP 65 : 1998

Guidance

Make sure you understand customers requirements

and can meet

your

Contracts may vary in form and may be, for example, a written order, a verbal agreement or a telephone order. Contract review focuses mainly on theproduct or service to be provided. However, do not forget that the contract also may cover additional factors, such as delivery schedules and conditions of payment. All parts of the contract need to be reviewed to ensure that you can meet your commitments. One of the most common problems encountered is misunderstanding what was ordered. Good communication between you and your customer is essential to resolve any misunderstandings. Written orders, such as those received by mail or facsimile, provide a permanent record of the order details. Where telephone and direct computer link orders are received, special provisions need to be made to record and confirm the order. Methods of handling these could be as follows:
l

One approach to telephone orders is to provide a pad (these could even be preprinted forms) for the order receiver to record the details of the order and read it back to the customer, asking for confirmation. Alternatively, the details may be faxed back to the customer. Where electronic media are involved, two options exist: either save permanently on disk or print out the details.

Contract review is the appropriate time to determine if there are any design requirements in the order and whether the requirements of 4.4, Design control, are to apply. An appropriate person in the organization should review the order to ensure that the requirements listed in 4.3.2 a)

47

SP65 : 1998 to c) can be met. In a small business, the appropriate person is frequently the manager. The record of the review can be as simple as a notation on the order, confirming that it can be fulfilled, with the signature of the reviewer and the date. Where a more complex review is called for, how the review is recorded is at your discretion. When the situation arises that you are required to tender for a contract, the same approach should be taken. When differences between the tender offer and the contract occur, these should be resolved before proceeding with the order. NOTE proposal. In some countries, a tender is referred to as a

Where changes to an order or tender, or both, arise for whatever reason, the changes should be reviewed and agreed in exactly the same manner as the original order/tender. If the changes are accepted, it is essential that everyone in your business who is affected by the changes is informed. Any tenders and customers orders, and any amendments to these, are quality records and should be handled in accordance with the requirements of 4.16.

Design control
Standard
4.4 Design control 4.4.1 General The supplier shall establish and maintain documented procedures to control and verify the design of the product in order to ensure that the specified requirements are met.

48

SP 65 : 1998

Guidance

Providing a disciplined approach to design This requirement is relevant to IS0 9001 only. It is important to understand that this is intended to provide controls for the design process and in no way attempts to restrict the creativity of the designer. The basic requirements of the clause are clearly stated, in that you should have suitable documented procedures for design control. The main aim of these procedures is to establish a disciplined approach to the design process. This should ensure that all aspects needing consideration are identified and, where relevant, taken into account in the design. Design control and the corresponding procedures generally cover the following:
l

establishing the design aims, planning how the design is to proceed, and who is to carry out the design (4.4.2 and 4.4.3); establishing what is needed to be known for the design to proceed (4.4.4); establishing (4.4.5); the form of the output from the design

reviewing, on completion of the design, whether it has achieved what was wanted (4;4.6,4.4.7 and 4.4.8); modifying the design to include changes, which may occur at any stage of the process and for any reason (4.4.9).

IS0 9002 : 1994 and IS0 9003 : 1994 contain this clause only to maintain clause numbering uniformity between the three standards. This requirement is therefore not relevant to any IS0 9002 or IS0 9003 quality system.

49

SP 65 : 1998

Standard

4.4.2 Design and development

planning

The supplier shall prepare plans for each design and development activity. The plans shall describe or reference these activities, and define responsibility for their implementation, The design and development activities shall be assigned to qualified personnel equipped with adequate resources. The plans shall be updated as the design evolves.

Guidance

Who is going to do what? You need to plan what is to be done and who is going to do it in relation to the design. Responsibilities for design should be clearly assigned and the methods for the development and updating of the design plans should be established. It is not essential to identify whether an activity is design or development since the standard treats these as part of the same continuous process. Design control covers this entire process from the initial concept through to final acceptance of the resulting product and the control of subsequent changes. Frequently, in a small business, there may be only one designer, unless the principal business activity is actually design. However, where there is more than one designer and/or the design lends itself to being broken into identifiable stages, then the possibility exists of assigning stages to different designers (who could be subcontractors -see 4.6.2). When this happens, it should be shown in the design plan and recorded. Design plans do not have to be complex. They can be as simple as a flowchart, showing the steps to be taken and who is to do them.

50

SP 65 : 1998

As part of the requirements, you should also plan how the design review (4.4.6) verification (4.4.7) and validation (4.4.8) activities are to be carried out.

Standard

4.4.3 Organizational

and technical interfaces

Organizational and technical interfaces between different groups which input into the design process shall be defined and the necessary information documented, transmitted and regularly reviewed.

Guidance

Who do we need to talk to? In a large company, there are usually lots of people and departments involved in the design process. Control of the relationships and communications between them is obviously important. Most small companies will not encounter this situation. However, even if the small business designer is the sole designer, there are some relationships and communications with other parties which are important. Thesecould include customers, regulatory bodies, subcontractors and similar. You will need to establish which of these are critical to the design and decide how to establish good communication with these parties. It is important that the design records show what information has passed between you and the other parties and that it has been reviewed and acted upon.

Standard

4.4.4 Design input Design input requirements relating to the product, statutory and regulatory including applicable requirements, shall be identified, documented and their selection reviewed by the supplier for adequacy. Incomplete, ambiguous or conflicting requirements shall

51

SP 65 : 1998 be resolved with those responsible requirements. for imposing these

Design input shall take into consideration the results of any contract review activities.

Guidance

What do we need to consider? All the things to be taken into account in producing the design should be carefully considered and written down. There needs to be a check to make sure that none of these requirements conflict. A major consideration is the customers needs, which may not always be clearly stated. It is often just as important to be aware of the customers unstated expectation, which may be even more critical to the design. For example, a clients specification to an architect on the type of house to be built may not include any statements regarding the structural soundness of the house or the need to comply with any statutory or legal requirements. These may be considered as unstated requirements, which will be a major consideration in the design. The review may result in additional information to be considered. Other factors that may be considered and documented include the following:
l

statutory and regulatory requirements, such as health and safety requirements and environmental consideration; other legal requirements; market surveys; industry practice and standard; past experience.

52

SP 65 : 1998

Standard

4.4.5 Design output Design output shall be documented and expressed in terms that can be verified and validated against design input requirements. Design output shall: a) meet the design input requirements; b) contain or make reference to acceptance criteria; c) identify those characteristics of the design that are crucial to the safe and proper functioning of the product (e.g. operating, storage, handling, maintenance and disposal requirements). Design output documents shall be reviewed before release.

Guidance

What have we done? You need to ensure, after spending the time and money on the design process, that the results meet the intended requirements. The design output may take a number of forms, for example:
l

an engineering design would generally take the form of drawings and calculations; a fashion design would be in the form of sketches and a specification relating to material to be used; a graphics art design could take the form of a particular layout to be used in a publication; a food product design might be in the form of a recipe; or an advertising agency design could be in the form of a plan for the marketing campaign.

53

SP 65 : 1998 The design ~plan should describe what form your output should be and how you intend to check that the requirements have been met. In deciding what form your output should take, you will need to consider who is going to make use of it and in what circumstances. For example, a regulatory authority may have a specific format,-which needs to be complied with. In some cases, the design output may be the actualproduct of the business. Architects, design engineers and graphic artists are all examples of professions or businesses where the design can be the actualproduct. Design output documents must be reviewed prior to issue and controlled (4.5 and 4.16).

Standa-rd

4.4.6 Design review At appropriate stages of design, forma1 documented reviews of the design results shall be planned and conducted. Participants at each design review shall include representatives of all functions concered with the design stage being reviewed, as well as other specialist personnel, as required. Records of such reviews shall be maintained (see 4.16).

Guidance

Are we on track? Design review is the forma1 checking of the design to confirm its adequacy to meet the customers needs and other design inputs, to identify problems and to develop solutions. Design review can take place at any stage. For relatively simple designs one review may be sufficient. For complex designs, several reviews may be required. In the design of software, there may need to be frequent reviews throughout the design involving consultation with the customer. In the design of a simple heating and ventilation

54

SP 65 : 1998

air- conditioning system, review may be needed only once as part of design completion. In deciding how many reviews you will need, you need to consider:
l

Are there obvious phases or natural breaks in the design? If something is going wrong, which is not detected until a much later stage, what are the likely consequences? The time scale of the design.

Other people should be included in the design review. Not only just the person who did the design but also the key people who will be involved in making the product or delivering the service. This should include not only people within the business but, where relevant, those outside such as the customer and any subcontractors involved. You need to keep records of such reviews using an appropriate recording method. For example, a complex design may be reviewed in a formal meeting, and the minutes of such a meeting would constitute the record. The review for a simple design may be less formal, and the record might consist of a notation on the plan, confirming that the review has been carried out, signed off by the reviewer and dated. While the aims of design review (4.4.6), design verification (4.4.7) and design validation (4.4.8) are different, there may be considerable overlap and interrelation between them. In many instances an activity will be relevant to all three requirements, e.g. prototype testing and evaluation of test results make a major contribution to all three. Figure 1 is a diagrammatic representation of the relationship between review, verification and validation and is presented to aid in the understanding of the connection between these three.

SP 65 : 1998

Verification j[* FIGURE I Simplified diagram of the relationship between design review, design verification and design validation

Standard

4.4.7 Design verification

At appropriate stages of design, design verification shall be performed to ensure that the design stage output meets the design stage input requirements. The design verification measures shall be recorded. (see 4.16). NOTE 10 In addition to conducting design, reviews (see 4.4.6), design verification may include activities such as - performing alternative calculations, -comparing the new design with a similar proven design, if available, - undertaking tests and demonstrations, and

- reviewing the design stage documents before release.

Guidance

Have we got it right?

Verification is checking that the results at the end of the design process meet the requirements identified as necessary at the beginning of the design process. For larger projects, the design process is often broken into stages and

56

SP 65 : 1998 design verification may be carried out on a stage-by-stage basis. The design plan should identify the verification method to be used, including who is to carry it out, how it is to be performed and what records are to be kept. There are many ways to verify the design (some of which amgiven in Note 10 of 4.4.7) and you should determine which are appropriate and effective. Sometimes, regulatory agencies will describe the means required to verify the design. The customer may need to be involved in the verification process.

Standard

4.4.8 Design validation Design validation shall be performed to ensure that product conforms to defined user needs and/or requirements. NOTES 11 Design validation verification (see 4.4.7). follows successful design

12 Validation is normally operating conditions.

performed

under defined

13 Validation is normally performed on the final product, but may be necessary in earlier stages prior to product completion. 14 Multiple validations may be performed different intended uses. if there are

Guidance

Does it work? Validation is the process of checking that the finalproduct will be capable of meeting or does meet the customers needs in use.

57

SP 65 : 1998

This may include marketing trials or operational testing. It is the final stage in the design process and is an important opportunity to prevent serious financial loss by failure to supply acceptable product. The results of the verification and validation processes can be fed back into each stage of the design p_rocess, leading to modifications and improvements or even the next design revision or product generation. For many products, validation is a relatively simple process. An example could be a new design of garden furniture, which could be validated by testing of the prototype, followed by test marketing. For other types of products, the validation of the total performance range cannot be achieved until the actual conditions occur. For example, the performance of an air-conditioning system under the extremes of maximum and minimum external design temperatures cannot be validated until those extremes actually occur. If these are based on once-in-l 00 years occurrence, the performance at the extremities of the design range may never be validated. In some cases, the product is the design itself. Take the example of an architect who may not necessarily validate the final construction, but can check that the plans, sketches and specifications describe the construction that the customer asked for in the contract. The architect might also use a scale model or models, or might use a virtual reality computer programme to validate that the product, i.e. the design, meets the customers requirements. Validation at this stage is consistent with Note 13 of 4.4.8. It is also acceptable for the customer to perform the validation and to provide feedback of the results to the designer. Many software projects are validated-in this way.

58

SP 65 : 1998

Standard

4.4.9 Design changes

All design changes and modifications shall be identified, documented, reviewed and approved by authorized personnel before their implementation.

Guidance

Controlling changes
For a small business, change is a way of life. Design changes occurring due to the customer, market, design review, verficstion or validation activities must be recorded, reviewed and approved. The extent to which the design needs to be modified as a result of the changes needs to be considered. It may be necessary to carry out the steps described in 4.4.2 to 4.4.8 to the extent required as a result of these changes. The quality system has formal requirements for document and change control which must be followed. Design changes may also require you to reconsider the contract review with your customer (4.3). The design change control process may need to be no more complicated than the system described in 4.5 to control other documents. In other situations, the controls may need to be more complex, e.g. those involved in software design may have to be involved in configuration management. Further advice on this specialization can be obtained in IS0 10007, Quality management - Guidelines for configuration tnanagemetzt.

Document and data control

Standard 4.5 Document and data control 4.51 General
The supplier shall establish and maintain documented procedures to control all documents and data that relate to

59

SP 65 : 1998 the requirements of this International Standard including, to the extent applicable, documents of external origin such as standards and customers drawings. NOTE 15 Documents and data can be in the form of any type of media such as hard copy or electronic media. 4.5.2 Document and data approval and issue The documents and data shall be reviewed and approved for adequacy by authorized personnel prior to issue. A master list or equivalent document control procedure identifying the current revision status of documents shall be established and be readily available to preclude the use of invalid and/or obsoletedocuments. -This control shall ensure that: a) the pertinent issues of appropriate documents are available at all locations where operations essential to the effective functioning of the quality system are performed. b) invalid and/or obsolete documents are promptly removed from all points of issue or use, or otherwise assured against unintended use; c) any obsolete documents knowledge-preservation identified. retained for legal and/or purposes are suitably

4.5.3 Document and data changes Changes to documents and data shall be reviewed and approved by the same functions/organizations that performed the original review and approval, unless specifically designated otherwise. The designated functions/organizations shall have access to pertinent background information upon which to base their review and approval.

60

SP 65 : 1998

Where practicable, the nature of the change shall be identified in the document or the appropriate attachments.

Guidance

Providing people with the information

they need

Document control is basically about making sure that the document which is in use is the right document, approved as necessary. That is, it is the applicable document (normally the latest issue) for the work being done. This is important if people are to have the information they need in order to do the job. The term document is employed in the context of whatever means are used to contain the information and, for example, could include written documents; documents held on computer hard disks, diskettes or CD-ROM, video, audio tapes or graphic posters. Essentially, documents are used to describe or control how things are to be done and are capable of being revised to reflect changing circumstances. These could include internal documents, such as drawings, procedures and instructions, and external documents, such as statutory regulations, standards, codes and specifications. These should not be confused with records. Records are generated as a result of some activity and are a statement of facts existing at the time and cannot be revised. Superseded documents (or revised documents) can become records. This clause describes document control; record control is covered by 4.16. You should always try to keep the number of copies of these documents to an absolute minimum. Access to common documentation is much simpler in a small

61

SP 65 : 1998

business where there is less formality, fewer potential users and smaller, often single, sites. If everybody has easy access to a central copy, the need for complex controls may be eliminated and arrangements for controlling changes simplified. Your procedure should ~describe how control is exercised on those documents for which it is considered necessary. You should try to avoid finishing up with complex arrangements -for updating and retrieval. The standard requires information to be up to date, but does not specify how this should be done. By taking advantage of the flexibility allowed in the clause and adopting the simplest and most practical methods, some of the bureaucracy and costs associated with implementing a quality system can be avoided. Where there are relatively few employees, a list could be kept of who has what documents. If there is a change, one person could be assigned to collect the old document and issue the new one. A suitable note to this effect could be made in an appropriate logbook or computer record. Before any documents are issued, they should be reviewed and approved by an appropriate person to ensure that they are suitable for their intended purpose. The document control procedure should identify who conducts the review. In a small business, it would probably be the manager. On the other hand, the manager may authorize someone to carry out the review and approval of documents. A further requirement is that any changes to controlled documents should be approved by an appropriate person. Again, in a small business this will probably be the manager. Signatures on written documents are only one way of indicating approval.

62

SP 65 : 1998

In the case of documents on computer, the use of password-controlled access, combined with date of approval, is also a way of indicating approval. It is recognized that sometimes superseded documents are retained for a variety of reasons. (Retention for legal or reference purposes are the two examples given.) If this is the case, you will need to have a method to identify such documents (to prevent their accidental use in place of the current documents), and record the reasons for, and the period of retention. The standard also refers to data. Data is information which may be stored in any form. Where failure to keep data up to date would adversely affect quality, it needs to be controlled in accordance with the requirements of this standard. The type of data that would be controlled under this clause is revisable data, such as:
l

supplier listings -- including name, address, telephone and facsimile numbers, contacts andproducts approved for supply; customer listings - including name, address, delivery address( delivery restrictions, telephone and facsimile numbers, contacts and contracts, orders or products purchased; stock information products held. such as inventory of stock or

Controllable data is distinguished by its ability to be revised, updated and re-issued. In the above examples, telephone numbers and contacts are likely to change relatively frequently. Non-controllable data is usually a record, i.e. not revisable. For example, the quantity delivered on a given day is data but it is not revisable. If you delivered 100 items last

63

SP 65 : 1998 Tuesday, you cannot go back and change the record to say that 200 items were delivered. IS0 9003 : 1994 has a less demanding requirement for document control. While the wording of the clause is identical to that of IS0 9001, since the quality system is related to product on completion, the extent of documents that may need to~be controlled is reduced accordingly.

Purchasing
Standard
4.6 Purchasing 4.6.1 General The supplier shall establish and maintain documented procedures to ensure that purchased product (see 3.1) conforms to specified requirements.

Guidance

Avoiding bought-in problems Remember that the term supplier means you. This should not be confused with the people you purchase from. They are referred to in the standard as subcontractors (see Annex II, Explanation of terms used). The intent of this clause is to ensure that when you buy something, you get what you want. The risks of your business and your customer not getting what was wanted will be increased by any failure to state your requirements fully and accurately and the use of unsatisfactory subcontractors. IS0 9003 : 1994 contains this clause only to maintain clause numbering uniformity between the three standards and it is therefore not relevant to any IS0 9003 quality system.

64

SP 65 : 1998

Standard

4.6.2 Evaluation of subcontractors The supplier shall: evaluate and select subcontractors on the basis of their ability to meet subcontract requirements including the quality system and any specific quality assurance requirements; define the type and extent of control exercised by the supplier over subcontractors. This shall be dependent upon the type of product, the impact of subcontracted product on the quality of final product and, where applicable, on the quality audit reports and/or quality records of the previously demonstrated capability and performance of subcontractors; establish and maintain quality records of acceptable sub-contractors (see 4.16).

Guidance

Who do we get it from? You will need to identify those materials and services that you buy which can affect the quality of yourproducts. You will then need to select from subcontractors who can supply these materials and services, those you intend to use. Remember that subcontracted services such as design, transport and delivery, calibration services, etc, may affect quality and may need to be considered. Most businesses usually have a number -of reasons why they deal with a particular subcontractor. You can continue to use existing subcontractors when developing your quality system. The standard simply requires that selection be carried out in a controlled manner. When you decide why a particular subcontractor is to be used, you should write down the criteria and basis for the

65

SP 65 : 1998

selection. Questions you may wish to ask in selecting subcontractors may include one or more of the following:
l

How reliable are they? Can they supply what you want? Do they have the necessary resources, e.g. equipment and personnel? Is the quoted delivery time and price acceptable? 1 Do they have a quality system? Have you used them before successfully? Have they a good business reputation?

Where a proprietary or brand name product is to be purchased, an obvious source may be a wholesale or retail outlet offering an off-the-shelf or self-selection service. A wide range of products are available from such sources, such as electrical supplies, plumbing supplies, general engineering supplies, food for catering services, etc. In these circumstances, the criteria for subcontractor selection and the associated records may be minimal. You may wish to consider buying for a trial period, with a review at the end of the period to establish the acceptability of the supplied product or the supplier. As well as maintaining records of approved subcontractors and basis of approval, you should also regularly monitor the performance of those subcontractors to ensure that they still meet the selection criteria. However, as a small business, you need to be aware that your purchasing power is limited, and threats to~remove subcontractors from your supplier approval system may be ineffectual. This is particularly true where you are obtainingprodcts from very large national or international organizations. Your quality manual needs to reflect the real life situation. 66

SP 65 : 1998 The extent to which you monitor subcontractors performance depends on how critical the product being supplied is to the quality of yourproduct. For example, in a printing business, the paper quality could be very critical. A travel agency might use normal, commercial stationery, which would not need any quality-related purchasing controls. The printing business may monitor the performance of its paper suppliers very closely to ensure that the quality of its printedproduct remains at the expected level.

Standard

4.6.3 Purchasing data Purchasing documents shall contain dataclearly describing the product ordered, including where applicable: a) the type, class, grade or other precise identification; b) the title or other positive identification, and applicable issues of specifications, drawings, process requirements, inspection instructions and other relevant technical data, including requirements for approval or qualification of product, procedures, process equipment and personnel; c) the title, number and issue of the quality standard to be applied. system

The supplier shall review and approve purchasing documents for adequacy of the specified requirements prior to release.

Guidance

Stating purchasing requirements In order to get what you need, the purchase instructions should leave no doubt about what it is you want. Instructions are preferably given as a written order.

67

SP-65 : 1998

that phone instructions are open to Remember misunderstanding by your subcontractor and you may need to take additional precautions to ensure that your instructions are understood. Irrespective of ~whether the order is written or verbal, you will need to keep a record of what was ordered so you can confirm that you got what you asked for. This part of the purchasing requirement deals with the details that you should include, as appropriate, in advising your purchase requirements. The extent to which the details listed in items a) to c) apply depends on the extent that the goods and services being ordered affect the main business and the quality of yourproduct. It is essential that all relevant details of the items or services wanted are clearly stated at the time of ordering. These may include drawing, catalogue or model numbers and required delivery date and place. In some cases, the complete description may be covered by a catalogue number, or a part number. While it is essential to fully describe what you want, unnecessary detail can lead to misunderstanding and incorrect delivery. The written purchase order should be checked prior to issue. In a small business, it would probably be the person who does the buying who would do the checking for adequacy. This may simply involve reading the order, initialling and dating it.

Standard

4.6.4 Verification

of purchased

product premises

4.6.4.1 Supplier verification at subcontractors

Where the supplier proposes to verify purchased product at the subcontractors premises the supplier shall specify verification arrangements and the method ~of product release in the purchasing documents.

68

SP 65 : 1998

Guidance

Ensuring your access to subcontractors

premises

If you order goods or services, or both, from a subcontractor, and wish to inspect the goods or services, or both, at the subcontractors premises, the arrangements for such an inspection need to be agreed and included in your order to the subcontractor. Some examples of this requirement are:
l

an interior decorator taking delivery; do-it-yourselfpurchasing monitoring employees organization

viewing curtain fabrics before

at wholesale or retail outlets; being trained at a training

Standard

4.6.4.2 Customer product

verification

of

subcontracted

Where specified in the contract, the suppliers customer or the customers representative shall be afforded the right to verify at the subcontractors premises and the suppliers premises that subcontracted product conforms to specified requirements. Such verification shall not be used by the supplier as evidence of effective control of quality by the subcontractor. Verification by the customer shall not absolve the supplier of the responsibilty to provide acceptable product, nor shall it preclude subsequent rejection by the customer.

Guidance

Ensuring premises

your customers

access to subcontractors

If your customer wants to visit your subcontractors premises to check the product, this needs to be stated in

69

SP 65 : 1998

both the customers order to you and in your order to the subcontractor. Whether or not the customer actually does this, you are still responsible for ensuring that all theproducts obtained from subcontractors meet the requirement of the customers order.

Control of c~uytomer-supplied product

Standard 4.7 Control of customer-supplied product

The supplier shall establish and maintain documented procedures for the control of verification, storage and maintenance of customer-supplied product provided for incorporation into the supplies or for related activities. Any such product that is lost, damaged or is otherwise unsuitable for use shall be recorded and reported to the customer (see 4.16). -Vt-rification by the supplier does not absolve the customer ot the responsibility to provide acceptable product.

Guidance

Lonkirq after what your customer gives you Occ,lsions may arise where the customer gives you matensl or equipment to be used in prodacing the items or delivering the service. Examples could include:
l

a dressmaker being provided with material the customer wants made up into a dress;

e a roll of film provided for a film processor to develop and provtde prints; * a landscape gardener being provided with the stone flagging which is to form the pathways;

70

SP 65 : 1998
l

instruments provided by the customer for measurement purposes; tools; a training room provided by the customer; a motor vehicle left for service or repair; a domestic appliance, e.g. a washing-machine, repair. left for

The relevant procedure should describe how a customer-supplied product is identified and how it is cared for. The-procedure could simply reference other in-house procedures you use, such as incoming inspection (4.10) and handling, storage, packing, preservation and delivery (4.15). If the customer-supplied goods are damaged, lost or otherwise unsuitable for use, you should tell the customer. IS0 YO03 : 1994 requirements cover customer-supplied product as it relates to incorporation into the finished product. Otherwise the requirements are identical to the above.

Product identij?cation md traceabiiiry

Standard
4.8 Product identification and traceability

Where appropriate, the supplier shall establish and maintain documented procedures for identifying the product by suitable means from receipt and during all stages of product, delivery and installation. Where and to the extent that traceability i(; a specified requirement, the supplier shall establish and mamtain documented procedures for unique identification of

71

SP 65 : 1998

individual product or batches. This identification shall be recorded (see 4.16).

Guidance

Keeping track of what youve got Identification is knowing what the product is. Where you need to identify product, the methods used and the records to be kept need to be defined. The recording of part numbers, job numbers, bar-codes, colour-codes or the revision status and version number of a software package being developed are just some examples of identification. Traceability is knowing where the product came from and where it is now. Most businesses, irrespective of size, will have a need in some stage of their operations to keep track of what goes where. Where traceability is a requirement, typical methods used include:
l

job card entries; tagging; computer tracking.

Some of the above techniques may also be used for identification. You need to be aware that the requirements for traceability ~may result in additional paperwork and costs. Reasons for having identification and traceability varied; some applications are found:
l

are

in the clothing industry, where materials from the same dye lot are usually processed as a batch to avoid colour mis-match problems; in a courier service, where there is a need to keep track of items being picked up and delivered to maintain delivel;jl commitment and schedules.

72

SP 65 : 1998

You need to establish what your internal requirements are and documented them. In some industries, identification and traceability are specified requirements either by regulation or contract. Pressure vessel manufacture and boatbuilding are two good examples where activities in these industries are frequently carried out under subcontract arrangements to a small business. For example, in pressure vessel manufacture, it is common for the identification of a given material to be recorded and traced through all manufacturing stages. Thus the end component can be traced to the original material certificate. Here, the identification and traceability requirements should be notified in the customers order and should have been taken into account during contract review (4.3). Records which provide the traceability (including customers order) should be retained (4.16). the

EGO 9003 : 1994 has a reduced requirement in that only the second paragraph of the clause applies.

Process Control
Standard 4.9 Process control The supplier shall indentify and plan the production, installlation and servicing processes which directly affect quality and shall ensure that these processes are carried out under controlled conditions. Controlled conditions shall include the following: a) documented procedures defining the manner of production, installation and servicing, where the absence of such procedures could adversely affect quality;

73

SP 65 : 1998

b) use of suitable production, installation and servicing equipment, and a suitable working~environment; c) compliance with reference standards/codes, plans and/or documented procedures; quality

d) monitoring and control of suitable process parameters and product characteristics; ej the approval appropriate; of processes and equipment, as

f) criteria for workmanship, which shall be stipulated in the clearest practical manner (e.g. written standards, representative samples or illustrations); g) suitable maintenance or equipment continuing process capability. to ensure

Where the results of processes cannot be fully verified by subsequent inspection and testing of the product and where, for example, processing deficiencies may become apparent only after the product is in use, the processes shall be carried out by qualified operators and/or shall require continuous monitoring and control of process parameters to ensure that the specified requirements are met. The requirements for any qualification of process operations, including associated equipment and personnel (uee 4. I S), shall be specified. NOTE 16 Such processes requiring pm-qualification of their process capability are frequently referred to as special processes. Records shall be maintained for qualified processes, equipment and personnel, as appropriate (see 4.16).

74

SP 65 : 1998

Guidance

Controlling what you do

This requirement is about controlling those operations within your ~business which affect the quality of the product. In many companies, the requirement for planning is usually addressed through drawings, production schedules, internal orders, service specifications, operator instructions, etc. The requirement for written procedures and work instructions applies only where their absence would affect quality. One of the key issues h&e is that it is not necessary to write a procedure with all the details which a competent operator would be expected to know. For example, it is not considered necessary to describe to a trained forklift driver how to operate a forklift. If the operator cannot operate the forklift, the answer is not written instructions but training (4.18). However, the procedure might detail the stacking arrangements, handling restrictions and routine maintenance. Control of operations will require you to ensure that your equipment is fit for purpose and that there are no problems due to the work area, e.g. in a bakery, the ovens should be capable of producing an evenly cooked product and the working areas should not constitute a risk to hygiene. Many of the requirements for equipment control and working environment may be specified by your customer or~by regulation and will need to be reflected in your own procedures. These procedures should also include how the process condition or the product itself is to be monitored, e.g. the baker may monitor the oven temperature or the colour of the loaves or both. To assist, there may be charts or photographs available to indicate the acceptable oven temperature range, or the preferred colour and shape of the loaves.

75

SP 65 : 1998

When product quality is dependent on avoiding any deterioration of the condition of process equipment, you need to establish arrangements for maintenance of that equipment, e.g. spot welding equipment may-only continue to produce good welds if there is periodic maintenance of electrode conditions. Some processes require that operators have extra training or be specially qualified, or the process itself have specific approval. Records of these need to be kept. An example of a personal qualification is welding, where test techniques for soundness of the weld metal give no information on weld strength. The welder is required to be trained and qualified to perform the weld according to a weld procedure in order to provide the assurance of weld strengths. An example of a pre-qualified process is the pouring of a concrete slab. The properties of the concrete are not known at the time of pouring. To get the required strength, the amount of cement, aggregate and water needs to be accurately controlled, the mixing and delivery phases controlled, and the pouring and working needs to be carried out by trained people. Concrete does not gain its full strength for several weeks. For many service industries, the service provided is instantaneous, which does not readily allow inspection before delivery of that service. A typical example might be a small travel agency providing advice on travel arrangements, flight tickets or train times. Failure by the individual giving advice to access and interpret information correctly or to take account ofpotcntial delays are only likely to be discovered by the customer after having attempted to travel. In such circumstances, the extratraining of individuals, the availability of up-to-date databases and following

76

SP 65 : T998

systematic procedures are critical to consistent customer satisfaction. This situation exists whenever customer order and service delivery are simultaneous and is a common feature in many retail service businesses. IS0 9003 : 1994 contains this clause only to maintain clause ~numbering uniformity among the three standards. This clause is therefore not relevant to any IS0 9003 quality system.

77

SP 65 : 1998

Inspection
Standard

clml festing
4.10 Inspection and testing

4.10.1 General
The supplier shall establish and maintain documented procedures for inspection and testing activities in order to verify that the specified requirements for the product are met. The required inspection and testing, and the records to be established, shall be detailed in the quality plan or documented procedures. 4.10.2 Receiving inspection and testing

4.102.1 The supplier shall ensure that incoming product

is not used or processed (except in the circumstances described in 4.10.2.3) until it has been inspected or otherwise verified as conforming to specified requirements. Verification of conformance to the specified requirements shall be in accordance with the quality plan and/or documented procedures. 4.10.2.2 In determining the amount and nature of receiving inspection, consideration shall be given to the amount of control exercised at the subcontractors premises and the recorded evidence of conformance provided. 4.10.2.3 Where incoming product is released for urgent production purposes prior to verification, it shall be positively identified and recorded (see 4.16) in order to permit immediate recall and replacement in the event of noncon-

formity to specified requirements. 4.10.3 In-process inspection and testing

The supplier shall: a) inspect and test the product as required by the quality plan and/or documented procedures;

78

SP 65 : 1998 b) hold product until the required inspection and tests have been completed or necessary reports have been received and verified, except when product is released under positive-recall procedures (see4.10.2.3). Release under positive-recall procedures shall not preclude the activities outlined in 4.10.3a). 4.10.4 Final inspection and testing The cupplier shall carry out all final inspection and testing in accordance with the quality plan and/or documented i*r!>cedures to complete the evidence ofconf ormancc of the tlnished product to the specified requirements. The quality plan and/or documented procedures for final inspection and testin g shall require that all specified inspection and tests, including those specified either on receipt of product or in-process, have been carried out and that the results meet specified requirements. No product shall bc dispatched until all the activities specified in the quality plan and/or documented procedures have been satisfactorily completed and the associated data and documentation are available and authorized. 4.10.5 Inspection and test records

The supplier shall ectablish and maintain records which pro\,ide evidence that the product has been inspectrd and/or tested. These records shall show c tearly whether the product has passed or failed the inspections and/or tests according to defined acceptance criteria. Where the product fails to pass any inspection and/or test, the procedures for control of nonconforming product shall apply (see 4.13). Records shall identify the inspection authority responsible for the release of the product (see 4.16).

79

SP 65 : 1998

Guidance

Checking things are right The requirements on inspection and testing break this operation into the following three inspection and testing phases:
l

Receiving inspection and testing. In-process inspection and testing. Final inspection and testing.

The distinction between these three phases is not always clearcut and the general requirements are very similar. Inspection and testing are used as terms to cover any type of operation which basically determines whether something is acceptable. Some examples include:
l

measuring dimensions; proofreading publications; tasting sauces; matching colours;

. carrying out chemical analyses; and

l

looking at things anddeciding if they are what was asked for.

You need to decide what your inspection and testing requirements and how they are to be carried out. People inspecting and testing need to be trained for w~hatthey are doing. You also need to decide and record who has the authority to say a job is finished and the product can be delivered. Individuals may check their own work, without secondary checking by another person. Such flexibility is essential in a small business where excessive duplication of effort should-be avoided. 80

SP 65 : 1998

Verification, i.e. examining something to see if it meets requirements, is also an inspection and testing operation. In some industries, such as the book publishing industry, visual verification may be the main form of inspection and testing carried out. Most businesses have some form of incoming inspection, even if it is simply an employee checking the delivery docket and signing it to confirm that goods were delivered. A further check is that goods are what was ordered. However, you need to decide whether the goods and services you receive should be inspected, by whom and how. Where a subcontractor has a quality system in place, it may be possible to reduce the extent of inspection and test. The extent of inspection and test also depends on the nature of the goods being received; e.g. the inspection of office supplies may be simply a verification that the quantity ordered was delivered. The delivery docket, signed by the employee, may be all the documentation required. The reputation of a restaurant depends on the quality of the food and the service it provides. Inspection of the ingredients it purchases is vital to the continued success of the business. In fact, the restaurant typifies the need, not only for inspection of incoming foods but also for inspection during the in-process phase and for final inspection. Inspections durin g the food processing and preparation stages could include not only the quality of the food but also cleanliness and hygiene considerations. There are various regulations which apply to restaurants and the inspection and testing procedures should take these into account.

81

SP 45 : 1998

Before the meal or course is served to the customer a check should be made that the course is, in fact, what the customer ordered, and that the course has been prepared and presented to the standard the restaurant has set. This check may be made~by the chef or even by the waiter. Somebody has to be responsible for the actual inspection and testing. The person does not have to have a staff or managerial status. For example, in small machine shops with only a few employees, it is common practice for machine operators to inspect their own work before passing it on to the next machining station. A job card usually follows the work, and the operator signs off the work performed on the job card. This works well because the work of the next operator down the line is affected if the incoming work is not correct. The final inspection phase includes not only checking the finished product or service, but that all inspections and tests that ought to have been done, have in fact been done and that if any paperwork is to go with the product or service, that it has been prepared and is satisfactory. In other words, if you were the customer these are all the things you would like to know have happened before you took delivery of the-product. The inspections and tests to be carried out may be listed in a number of ways, such as:
l

a quality plan; a sampling plan; an inspection and test plan; a procedure; an instruction; the customers order.

SP 65 : 1998

There needs to be aconsistent method ofrecording that the inspections and tests are carried out. The person servicing the rooms in a hotel could note that rooms have been serviced and sign them off. The foreman could sign off a job card to show all the inspections have taken place. A more formal method could involve a prepared check-list and the results of inspections and tests recorded; e.g. dimensions, temperature, physical properties andchemical analysis. Sometimes it is difficult to determine at which point final inspection takes place. For example, in a restaurant a head waiter may check with the customer on leaving that both the meal and service were satisfactory. However, this could be considered to be after the event with respect to the meal (but not the overall service) and is usually dealt with by the head waiter monitoring the activities in the restaurant to ensure effective service delivery. It can happen that you have product that has to be dispatched before inspection is complete, e.g. at the customers request. An example is, before the results of tests can be available, food items must be delivered to the customers cold storage to prevent deterioration. If this happens, your quality system should be capable of identifying the job and include a procedure to recall the job if the item subsequently proves defective. You need to have a system for keeping the necessary testing and inspection records or have other means of showing that the inspections have taken place. (Records are discussed further in 4.16.) Your records of inspection and testing should indicate whether any failures occurred and the proposed action. Inspection and test failures should not be confused with normal processing activities to bring the product within

83

SP 65 : 1998

specification before it is released as good to the next stage of operations. The former will be required to be dealt with by the procedures for the control of nonconforming product (see 4.13), whereas the latter will be addressed within the normal process control requirements. A typical example might be an air-conditioning engineer who measures, adjusts and readjusts fan speeds and air flows until the requked performance is achieved. Such an iterative approach does not constitute an inspection failure. However, if the engineer signs the system off as meeting specification, and it is subsquently found to be outside specification, this is a nonconformance and 4.13 applied. IS0 9003 : 1994 requirements for inspection and testing are limited to ensuring that specified requirements for finishedproduct are met.

Control of inspection, measuring and test equipment

Standard
4.11 Control ment 4.11.1 General The supplier shall establish and maintain documented procedures to control, calibrate and maintain inspection, measuring and test equipment (including test software) used by the supplier to demonstrate the conformance of product to the specified requirements. Inspection, measuring and test equipment shall be used in a manner which ensures that the measurement uncertainty is known and is consistent with the required measurement capability. Where test software or comparative references such as test hardware are used as suitable forms of inspection, they of inspection, measuring and test equip-

84

SP 65 : 1998 shall be checked to prove that they are capable of verifying

the acceptability of product, prior of release for use during production, installation or servicing, and shall be rechecked at prescribed intervals. The supplier shall establish the extent and frequency of such checks and shall maintain records as evidence of control (see 4.16). Where the availability of technical data pertaining to the inspection, measurin g and test equipment is a specified requirement, such data shall be made available, when required by the customer or customers representative, for verification that the inspection, measuring and test equipment is functionally adequate. NOTE 17 For the purposes of this International Standard, the term measuring equipment includes measurement devices. 4.11.2 Control procedure The supplier shall: a) determine the measurement to be made and the accuracy required, and select the appropriate inspection, measuring and test equipment that is capable of the necessary accuracy and precision; b) identify all inspection, measuring and test equipment that can affect product quality, and calibrate and adjust them at prescribed intervals, or prior to use, against certified equipment having a known valid relationship to internationally or nationally recognized standards. Where no such standards exist, the basis for calibration shall be documented; c) define the inspection, details of location, process employed for the calibration of measurin g and test equipment, including equipment type, unique identification, frequency of checks, check method,

85

SP 65 : 1998

acceptance criteria and the action to be taken when results are unsatisfactory; d) identify inspection, measuring and test equipment with a suitable indicator or approved identification record to show the calibration status; e) Maintain calibration records for inspection, measuirng and test equipment (see 4.16); f) assess and document the validity of previous inspection and test results when inspection, measuring or test equipment is found to be out of calibration; g) ensure that the environmental conditions are suitable for the calibrations, inspections, measurements and tests being carried out; h) ensure that the handling, preservation and storage of inspection, measuring and test equipment is such that the accuracy and fitness for use are maintained; i) safeguard inspection, measuring and test facilities, including both test hardware and test software, from adjustments which would invalidate the calibration setting. NOTE 18 The metrological confirmation system for measuring equipment given in IS010012 may be used for guidance.

Guidance

Having confidence in the equipment used to check your work This clause is only applicable to those industries or businesses where measuring or testing equipment (including test software) is used to check that what you are providing meets your customers requirements. If, for example, your inspection method is visual inspection, you

86

SP 65 : 1998

may not need to have any measuring equipment instruments and this clause does not apply.

or

However, if use is made of measuring and testing equipment for checking compliance with your customers requirements. You will need to consider how it is controlled, stored, used and its accuracy maintained at the level needed. It should be emphasized that the requirement applies only to equipment which can affect quality. If you are using measuring and test equipment for indication purposes only, it does not necessarily have to be calibrated. The key message here is do not automatically calibrate everything. Calibration is the process of periodically comparing your equipment against a reference standard to determine how accurate it is and whether or not it is still capable of meeting the accuracy required for the measurements made with it. Periodically can be on a time basis (monthly, annually) or a usage basis (before each use or after a number of times used). The reference standard may have been provided with the equipment. For example, a paint thickness meter is normally supplied with a set of thickness standards. In other instances, you may have to have access to a suitable reference standard by buying one or using a subcontractor. For a reference standard to have validity, it needs to be traceable back to an appropriate recognized accurate source. This will normally be ~anational or international standard. There are cases where a national standard does not exist. In these cases, the sources or frame reference need to be described. An example is chemical analysis of samples used in round robin laboratory testing forming the basis for calibration.

87

SP 65 : 1998

You also need to take into account just how accurate the measurements need to be. How accurate your equipment needs to be will depend upon how much tolerance is permissible in what you are measuring. A measuring device usually has to be capable of measuring to a much closer tolerance than the tolerance specified for the item being measured. However, there is no point in having measuring devices calibrated to unnecessarily high precision if you do not need that precision for your operations. Allied with these factors is how skilled the personnel need to be to use the equipment. For example, a motor mechanic setting clearances in an engine may need to measure to an accuracy of one tenth of a millimetre (+ 0.1 mm), a dressmaker may require an accuracy of one milhmetre (4 1 mm) and a road builder may have a tolerance of + 50 mm on the width of a road. To make sure the measuri-ng equipment operates effectively and gives reliable results, you need to:
l

Make sure it is looked after, regularly calibrated and adjusted as needed. Describe how this will be done so that records are available which show calibration is traceable to national or international standards. Make sure it is possible to identify which equipment has been calibrated and that it is suitable for use (e.g. label the equipment)

If equipment is found to be faulty, you need to find out at what stage it went wrong. You need to decide whether you need to do anything about product you have passed using that equipment. The results of any review may indicate that no action is required or that a product recall is required. Other possible courses of action are listed in 4.13.1 and 4.14.2.

88

SP 65 : 1998

Test software needs to be subject to some form of validation to make sure that it can perform the required measurements. One way is to ensure that this software can accurately and reliably identifyprodtccts with a known set of faults and deficiencies. The details of how the test software is validated should be documented. Unlike hardware test equipment, test software does not experience drift or ageing, so periodic revalidation may not appear to be necessary. However, software can be subject to unintended errors. Therefore the purpose of revalidating test software is to ensure its continuing ability to perform the required measurements. Some type of secure write protection should be used, in the same manner as seals are used on hardware calibration adjustments, to minimize inadvertent adjustments. Small businesses are usually faced with the choice of carrying out the calibration themselves or having someone else do it for them. If you decide to carry out your own calibrations, you will need to have procedures for calibrating each type of equipment you use. If you decide to use a subcontractor, in addition to the points raised in 4.6.2, some additional points you will need to consider are:
l

Ideally, the organization should be endorsed calibrating service by a suitable certifying body.

as a

The organization should issue a certificate of calibration, which states the uncertainty of measurement. (This is another way of stating just how accurately the instrument can measure.) The certificate should indicate that the organization can trace your calibration back to a national or international standard. 89

SP 65 : 1998

You are free to use an organization which has not been endorsed as described above to carry out your own calibration if this is practical, e.g. original equipment manufacturer or neighbouring company. However, the resulting records must confirm that the reference standards used for calibration are of known accuracy, normally traceable to a national or international standard. It may be possible, if you have several measuring instruments of a similar type, for the most accurate of these to be calibrated by a subcontractor, then used as the basis for calibration of the others. For example, an accurately calibrated digital thermometer may be suitable as a reference standard for other less accurate temperature measuring equipment. Calibration is an expensive operation. For a small business, the costs of calibration can be considerable. You should ensure, therefore, that you know the difference between checking that process control equipment is fit for purpose and calibrating equipment which is required to give confidence in your inspection and test measurements. You need to make sure that the calibration frequency, and standards of accuracy specified are appropriate to the actual equipment usage and not excessive. Once having determined the initial calibration procedure it does not have to remain fixed forever; it can be adjusted in light of experience. In some industries, it is common practice for employees to use their own persona1 measuring equipment; steel tapes, micromometers and Vernier callipers are typical examples. When this occurs, it does not absolve the business from ensuring That such measuring equipment is calibrated where it is used for release ofproduct. The solutions are to either ban the use of employee measuring equipment or to calibrate it. The employee should be asked to consent for calibration of the equipment. 90

SP 65 : 1998

In addition to calibrating equipment, records need to be kept to show:

l

When the equipment was last calibrated, who did it, the calibration procedure, the acceptance criteria, what the result was, its acceptability and how this affects the equipment suitability (calibration status); and when the next calibration is due-the period is dependent on the type of_equipment,~its usage and how critical the measurements are to the process.

Measuring equipment needs to be suitably stored when not in use, toprotect it from damage or deterioration. It should also be suitable for use in the proposed operating environment. These precautions apply even more so to any master measuring equipment or reference standards used for calibration purposes. IS0 9003 : 1994 includes a requirement for this which is confined to equipment (including software) used for final inspection and testing.

Inspection and test status

Standard
4.12 Inspection and test status

The inspection and test status of product shall be identified by suitable means which indicate the conformance or nonconformance of product with regrad to inspection and tests performed. The identification of inspection and test status shall be maintained, as defined in the quality plan and/or documented procedures, throughout production, installation and servicing of the product to ensure that only product that has passed the required inspections and tests [or released under an authorized concession (see 4.13.2)] is dispatched, used or installed.

91

SP 65 : 1998

Guidance

Knowing whats ready to go Most businesses have some method which shows them whats been done and what has still to be completed. For example, in a hotel, as each room is made up after the preceding guests have departed, the room status is changed from not ready to ready. The room service personnel normally ring the reception desk to give this advice, which is noted by some suitable method. In servicing a car, the status of each operation on the service check-list is changed from to be done to done by ticking off each operation on completion. In a phone-answering service, the status of messages taken is initially message received. On passing the message on to the client, the status changes to message delivered. The phone answering service would have some suitable means of identifying the status. All of these are different forms of inspection and test status. Methods that are frequently used to identify inspection and test status of manufactured goods include:
l

the use of markings, tags, labels or similar; the use of routing cards, inspection records, job cards and similar; the use of a physical location.

A status tag or use of a physical location could be used to show, for example, that aproduct:
l

is awaiting inspection; has been inspected and accepted: has been inspected, rejected and put on hold until a decision is made regarding future action;

92

SP 65 : 1998 has been inspected concession; and released under authorized

has been inspected and rejected.

The method(s) you adopt as being most suited to your business should be described (e.g. in your procedures) so that everybody knows how it works. IS0 9003 : 1994 requirements are related to final inspection only, to ensure that only conformingproduct is delivered.

Control of nonconforming product

Standard
4.13 Control of nonconforming 4.13.1 General The supplier shall establish and maintain documented procedures to ensure that product that does not conform to specified requirements is prevented from unintended use or installation. This control shall provide for identification, documentation, evaluation, segregation (when practical), disposition of nonconforming product, and for notification to the functions concerned. 4.13.2 Review proudct and disposition of nonconforming product

The responsibility for review and authority for the disposition of nonconforming product shall be defined. Nonconforming produet shall be reviewed in accordance with documented procedures. it may be: a) reworked to meet the specified requirements, b) accepted with or without repair by concession, c) regraded for alternative applications, or

93

SP 65 : 1998

d) rejected or scrapped. Where required by the contract, the proposed use or repair of product [see 4.13.2 b)] which does not conform to specified requirements shall be reported for concession to the customer or customers representative. The description of the nonconformity that has been accepted, and of repairs, shall be recorded to denote the actual condition (see 4.16). Repaired and/or reworked product shall be reinspected in accordance with the quality plan and/or documented procedures.

Guidance

Sorting out your product problems

In the course of business, problems will occur. You will need to decide what to do about them. The standard requires you to have ways to identify the product nonconformity3), deciding what to do about it and, where possible, keeping it separate from acceptable product. You also need to keep records as you deal with it that show what happened along the way and any decisions made. Everybody affected by the problems needs to be kept informed of what happened. The method of recording the information is up to you. Daybook notes may be adequate. Be wary of any~approach that requires the issue of several forms to control any nonconformity. In a quality system, process control (4.9) and inspection and testing (4.10) are the most likely internal sources to show up problems with your products. Customer complaints and warranty claims are the most common external indications, which will enable you to target where attention is needed.
3) Nonconformity is a term used to describe any form of problem and is explained further in Annex II, Explunufion c~~fermsused.

94

SP 65 : 1998

Depending on the nature of the nonconformingproduct, it should be isolated pending a decision on what to do (see 4.13.2). Techniques such as tags or physical location An 4.12 will be useful in controlling preferred nonconformingproduct. When anonconformingproductis detected, there are some options on what could be done; 4.~13.2a) to d) lists them. Your management representative .(see Guidance on 4.1.2.3) or some other person, having the necessary authority, has to decide which of these four options will be applicable to each instance of a nonconforming product. Some customers may require notification of any nonconformingproduct and approve what steps should be taken. If this is the case, it will be necessary to notify the customer following detection of the nonconforming product. You may wish to include the steps you propose taking along with the notification. Records will need to be kept of any decision made, approval given by the customer, any rework or repair proeedure, and the results of the inspection and testing on any rework or repair. If, for example, a catering company discovers that it has inadvertently used processed meat which was well past its use-by date (or shelf-life) to make sandwiches for contract customers (retail chain storesj, a number of actions might be required to fix the problem:
l

investigation to find out the extent of the problem: segregation and quarantine of the remaining processed meat from that consignment; segregation and quarantine of affected awaiting delivery to the retail outlets; sandwiches

recall from the retail outlets those sandwiches likely to be similarly affected.

95

SP 65 : 1998

Depending on the potential risks, there may be a need to involve regulatory authorities and to make the public aware of the problem. IS0 9003 : 1994 has reduced requirements for control of nonconforming product relating generally to finished product.

Corrective m&preventive action

Standard 4.14 Corrective 4.14.1 General The supplier shall establish and maintain documented procedures for implementing corrective and preventive action. Any corrective or preventive action taken to eliminate the causes of actual or potential nonconformities shall be to a degree appropriate to the magnitude of problems and commensurate with the risks encountered. The supplier shall implement and record any changes to the documented procedures resulting from corrective and preventive action. Guidance Fixing the causes of problems Both corrective and preventive action can be seen as steps in a quality improvement cycle. The need for corrective action can arise when an internal nonconformity @roduct or quality system) occurs, or from external sources such as a customer complaint or warranty claim, or problems encountered with a subcontractor. Corrective action involves finding the cause of the particular problem and then putting in place the necesssary actions to prevent the problem recurring. 96 and preventive action

SP 65 : 1998

Preventive action starts with considering and analysing all the incidences of nonconformities, all the customer complaints, all the warranty claims, al&he problems with subcontractors as well as any other sources of problems to find out if any trend is occuring. Where this analysis shows that the potential for problems exists, preventive action then involves putting in place the necessary steps to eliminate these potential causes. The procedures for both corrective and preventive actions should define the responsibilities and authorities for these activities. IS0 9003 : 1994 has reduced requirements. The clause is titled 4.14 Corrective action. It relates to corrective action only, based on final inspection and test reports and customer complaints.

Standard

4.14.2 Corrective

action

The procedures for corrective action shall include: a) the effective ~handling of customer reports of product nonconformities; complaints and

b) investigation ofthe cause of nonconformities relating to product, process and quality system, and recording the results of the investigation (see 4.16); c) determination of the corrective action needed eliminate the cause of nonconformities; to

d) application of controls to ensure that corrective action is taken and that it is effective.

Guidance

Fixing the cause of known problems There is a difference between carrying out corrective action and fixing a nononformity. Fixing a nonconformity

97

SP 65 : 1998

(the standard calls it disposition) is about making good the problem either by reworking, replacing or any of the other activities described in 4.13. A corrective action is concerned with finding out why the nonconformity occurred and making sure that the problem does not occur again. The need for corrective action could be indicated by a number of factors, some of which could be:
l

customer complaints; nonconformances; rework of repairs; audit reports (see also guidance on 4.17 for internal audit reports).

Analysis of the causes may suggest some solutions such as retaining employees or amending an operating procedure. The action taken should be in line with the size of the problem and the likely risks associated with not implementing any corrective action. If corrective action is taken, it should be documented and followed up within a reasonable period to find out whether it has worked. It may be necessary to change the quality manual, procedures, instructions and any other relevant documentation. Changes should be made in accordance with the provisions of 4.5, Document control. In the case of the catering company with the processed meat past its use-by date, the investigation of the cause may show that there was a stock rotation problem, either in the caterers storage or the subcontractors storage. Another cause that might be found is a lack of operator awareness of the meaning of use-by dates. The actions to be taken would depend on the actual cause(s) found.

98

SP 65 : 1998

Records of the problem and the action taken should be made. You should follow up the action after a suitable period to make sure that it has been effective.

Standard

4.14.3 Preventive

action

The procedures for preventive action shall include:

a) the use of appropriate sources of information such as

processes and work operations which affect product quality, concessions, audit results, equality records, service reports and customer complaints to detect, potential causes of and eliminate analyse nonconformities;

b) determination
initiation -c>

of the steps needed to deal with any problems requiring preventive action; of

of preventive action and application controls to ensure that it is effective:

4 ensuring that relevant information on actions taken is

submitted for management review (see 4.1.3).

Guidance

Fixing the causeof

potential

problems

You should use yourrecords to see if any trends exist which show a potential problem could arise. Typical examples of where information might be found and used for such ~analysis are from such sources as: difficulties with suppliers or subcontractors; in-process problems, rework rates, wastage levels; final inspection failures; customer complaints and customer surveys; warranty claims;

99

SP 65 : 1998
l

service reports; the need for concessions.

Other sources might include market surveys, sales figures, audit reports and quality records. Where a potential problem is identified, a course of action may need to be developed and put in place to reduce or eliminate the risk of the problem. If preventive action is found to be necessary, it should be documented and followed up within a reasonable period to find out whether it has worked. As a result of preventive action, the quality manual, procedures, instructions and any other relevant documentation may need to be changed. Changes should be made in accordance with the provisions of 4.5. Examples include:
l

of where preventive

action may be applied situations and imto prevent product

identifying plementing damage;

possible hazardous working practices

review of sales figures may indicate customer dissatisfaction with existing levels of service; feedback from personnel may indicate a more efficient process; and re-assessment of tools and materials.

In a small business, there is little justification in separating management review arrangements from long-term corrective and preventive action. Where there are few personnel and the same people are involved in both activities, an artificial separation may result in duplication of effort. If this approach is taken, it should be included in the quality manual.

100

SP 65 : 1998

The catering firm, as a result of the processed meat problem, may undertake an analysis of delivery times, storage conditions and use-by-dates to find if potential problems exist with other fillings it handles, and adopt the necessary actions to avoid these potential problems.

Handling, storage, packaging,

Standard 4.15 Handling, delivery 4.151 General

preservation and delivery

preservation and

storage, packaging,

The supplier shall establish and maintain documented procedures for handling, storage, packaging, preservation and delivery of product. Looking wafter the product Depending on the nature of the business, some or all of the requirements of this clause may apply. Where they do apply, the arrangements for handling, storage, packaging, and delivery should be recorded in preservation procedures. The requirements for each of these processes are given in 4.15.2 to 4.15.5, inclusive. The requirements of this clause could also apply to customer supplied product (4.7). For example, this clause could be applied to the autompbile left at a service centre by a customer for servicing. IS0 9003 : 1994 has very simplified requirements, limited to the completed product after final inspection and test and this appliesfrom 4.15.1 to 4.15.6 inclusive.

Guidance

101

SP 65 : 1998

Standard

4.152

Handling

The supplier shall provide methods of handling product that prevent damage or deterioration.

Guidance

Handlingproducts

properly

There are a number of areas of materials handling where problems affecting the quality of the product can arise. Some examples are found the following areas:
l

Stacking of materials using forklifts, where incorrect operating procedures can cause damage; exceeding the recommended stack heights can result in crushing. ~Mostcopper-based metals, e.g. copper, brass and bronze are susecptible to corrosion from finger-marks. Where corrosion may affect performance, such as in printed circuit boards or decorative applications, gloves need to be worn to prevent such marking. Liquids handling, where washing out of liquid-carrying tankers, prior to filling with a different liquid, is necessary to prevent contamination. Food handling, where cleaning of utensils after use is a very necessary requirement in food handling for health reasons. Electrical and electronic equipment, where safe handling practices are required to avoid damage from electrostatic discharges.

These. are some common examples of where special handling techniques are required for a particular industry. You will need to examine your operations to determine to what extent specific handling procedures are needed and to document them.

102

SP 65 : 1998

Standard

4.15.3 Storage The supplier shall use designated storage areas or stock rooms to prevent damage or deterioration of product, pending use or delivery. Appropriate methods for authorizing receipt to and dispatch from such areas shall be stipulated. In order to detect deterioration, the condition of product in stock shall be assessed at appropriate intervals.

Guidance

Using the right storage conditions Like handling, the storage requirements vary from industry to industry. Examples of storage conditions include:
l

cold storage of food; segregation of corrosive substances (such as acids and caustic materials) from other materials; and storage of magnetic media (such as video tapes, audio tapes and computer disks) in a non-magnetic environment;

Consideration should be given to the effect of stack height, light, temperature, humidity, vibration, etc, which may affect the product. In many instances, there can be a requirement that the stock is turned over on a regular basis or that it has a limited shelf-life. An example is food which frequently carries a use-by date . The term first in, first out is often used to describe the approach. For financial reasons, most businesses already have a stock control system. During stocktaking it is usually possible to check the condition of products. You need to identify the storage requirements for your products and assign

103

SP 65 : 1998 appropriate storage areas. Each product necessarily require a separate storage area. does not

A periodic check of the condition of the product in stock is also a requirement. The frequency is dependent on the nature of the product, with robust types requiring a less frequent check than perishable or fragile products.

Standard

4.15.4 Packaging The supplier shall control packing, packaging and marking processes (including materials used) to the extent specified necessary to ensure conformance to requirements.

Guidance

Use suitable packaging Packing should be appropriate for the materials. In many cases, little or no packaging will be required. Bulk materials, such as sand, gravel, coal, wheat, sugar and timber, are examples where packing consists simply of filling the carrying container. Even for such bulk transport, there needs to be a check that the container is suitable and does not contaminate the product. Large fabricated components may be simply loaded onto a truck and strapped down. Other materials may have minimal packing, such as strapping to a pallet or bulk delivery in open drums. You should make sure that where packaging and marking materials are used, they are compatible with the products being packaged or ~marked. Marking materials can cause corrosion or otherwise damage products and should be selected with care. Packaging should be appropriate for the product, the intended transport and the end use. The likelihood of

104

SP 65 : 1998

contact of the packaging with, for example, water, should be assessed and the packaging selected accordingly. Additionally, you should be aware if any regulations exist regarding packaging. These could require use-by dates, handling instructions or specific information regarding the contents to be displayed on the package.

Standard

4.15.5 Preservation The supplier shall apply appropriate methods for preservation and segregation of product when the product is under the suppliers control.

Guidance

Avoid deterioration Preservation is essentially using the necessary practices to ensure that the product does not spoil, deteriorate or become contaminated while under your control. Aspects of product preservation have already discussed in the guidance to 4.15.3 and 4.15.4. been

If packaging is used, it can also be used to provide identification, preservation and segregation. If there are further preservation requirements, then you need to identify what they are and develop the necessary procedures. For products, there may be regulatory -and legislative requirements or the preservation system may be specified in the customers order.

Standard

4.156

Delivery

The supplier shall arrange for the protection of the quality of product after final inspection and test. Where contractually specified, this protection shall be extended to include delivery to destination.

105

SP~65: 1998

Guidance

Getting theproduct

to your customer

If you have met the requirements of 4.15.4 and 4.15.5, the first part of the requirements of this clause would normally be met. The key issue is that if it is part of the customers order, the protection of quality of the product after final inspection and test extends to include delivery to destination. You may need to carry out a subcontractor assessment as required by 4.6.2. This may involve you in taking responsibility for the transport. In such cases, you would need to be aware of any legislation or regulations which might apply.

Control of quality records

Standard
4.16 Control of quality records The supplier shall establish and maintain documented procedures for identification, collection, indexing, access, filing, storage, maintenance and disposition of quality records. Quality records shall be maintained to demonstrate conformance to specified requirements and the effective operation of the quality system. Pertinent quality records from the subcontractor shall be an element of these data. All quality records shall be legible and shall be stored and retained in such a way that they are readily retrievable in facilities that provide a suitable environment to prevent damage or deterioration and to prevent loss. Retention times of quality records shall be established and recorded. Where agreed contractually, quality records shall be made available for evaluation by the customer or the customers representative for an agreed period.

106

SP 65 : 1998

NOTE 19 Records may be in the form of any type of media such as hard copy or electronic media.

Guidance

Managing your records

Records exist in all companies. These records can provide you with information to help you manage your business effectively. Throughout the standard there are references to the need for records. You will need to show that you have actually done something, recorded certain information or met a particular requirement. These are known as quality records. This clause deals with how you manage those records. It is important that a small business does not burden itself with piles of paper that serve no purpose. You should decide what quality records are required in relation to your business. You should identify how long each type of record needs to be kept, where it will be found and how it is to be disposed of. Only keep what needs to be kept. These should not be kept just to satisfy an auditor. In some instances, the retention period may be dictated by statutory or regulatory requirements, financial requirements or by customers specifications. These details should be recorded in the documented procedure. A number of clauses throughout IS0 9001 make reference to records and~to this clause (4.16). Some examples of what might constitute quality records are:
l

design-files, calculations; customers orders, contract reviews; meeting notes (e.g. management review); internal audit reports;

107

SP 65 : 1998 .

nonconformance records (service failure reports, warranty claims, customer complaints), corrective action records; files on suppliers and subcontractors (evaluation of subcontractors, subcontractor performance history); process control records; inspection and testing repcrts; training records; and records of goods received and delivered.

Records, indexing and filing can be in any appropriate form; hard copy or electronic. Storage needs to be appropriate for the medium and should be such that the risk of deterioration, damage or loss is minimized. You also need to identify and document who has access to the quality records and decide how readily available they need to be. If you use computer techniques to store records, be aware that developments and evolution of software programmes can result in difficulties in reading records made several years ago. It may be necessary to keep old software programmes to access these older records. IS0 9003 : 1994 has reduced requirements which relate only to records of finished product conformance and the operation of the quality system.

Internal quality audits

Standard
4.17 Internal quality audits The supplier shall establish and maintain documented procedures for planning and implementing internal quality

108

SP 65 : 1998

audits to verify whether quality activities and related results comply with planned arrangements and to determine the effectiveness of the quality system. Internal quality audits shall be scheduled on the basis of the status and importance of the activity to be audited and shall be carried out by personnel independent of those having direct responsibility for the activity being audited. The results of the audits shall be recorded (see 4.16) and to the attention of the personnel having brought responsibility in the area audited. The management personnel responsible for the area shall take timely corrective action on deficiencies found during the audit. Follow-up audit activities shall verify and record the implementation and effectiveness of the corrective action taken (see 4.16). NOTES 20 The results of internal quality audits form an integral part of the input to management review activities (see 4.1.3). 21 Guidance IS0 10011. on quality system audits is given in

Guidance

Are you doing what you said you would do and does it work? Audits are about getting information, in a planned way, from a variety of sources and comparing it all to confirm that things are being done propei.ly. The steps of gathering this information should include:
l

reading the procedures; observing the procedures being carried out; talking to the people carrying out the procedures; and

109

SP 65 : 1998
l

looking at the records.

All these need to tell the same story; i.e. that you are doing things right, the way you said you would. Even for a small business, where familiarity with the day-to-day activities is the norm, a properly conducted audit can be beneficial. You should use audits to stand back and look at your business objectively to confirm that the quality system is helping you do what you want to do and what you need to do. The information from internal audits should be used as part of your management review. The better your audit, the more useful your management review will be (4.1.3). Where an internal quality audit shows up nonconformances and inconsistencies, you need to develop the necessary corrective actions (4.1.4) and then put them in place. These may be as simple as:
l

writing or revising a procedure; redesigning a form to incorporate more information; and arranging foremployee retraining.

Audits should be scheduled to cover all the quality-related activities you undertake and all the requirements of IS0 9001, IS0 9002 or IS0 9003 as appropriate. In deciding how to manage the audit schedule and how often any particular aspect should be audited, the following factors may be considered:
l

Are there any complex procedures or processes which would justify individual audits? Are there any aspects or areas which have a history of problems?

110

SP 65 : 1998
l

Does your hands-on frequent audits?

approach indicate aneed for less

A report or summary of each audit should be made out, listing the findings and what action if any is to be taken. The record need not necessarily be complex. For example a simple entry in a daybook may be sufficient. If the previous audit recommended orrequired actionto be taken, the current audit should check how effective the change was and this should be recorded. There is a requirement that an audit be carried out by independent personnel of those having direct responsibility for the work being performed. For example, it is acceptable for the office personnel to audit the production/service activities and vice versa. This can provide benefits in developing an understanding of each others problems. In a small business where there may be only one or two people in the entire management structure, this requirement may not be achievable. It is suggested that in such cases, the manager, carrying out the duties of an auditor tries to step back from direct involvement in the business operations and be very objective about the audit. Another approach would be to seek the cooperation of another small business and each provide the internal quality audit facility for the other. This may prove attractive if there are good relations between the two businesses. Effective use of internal quality audits is an area which you may use to minimize the ongoing costs of certification/ registration. If the auditor from the certification/ registration body can see that internal quality audits are being used to effectively monitor and control the quality system, the auditor does not need to spend as much time verifying the quality system operation. What the auditor

111

SY 65 : 1998

will be seeking is objective internal quality audits.

evidence

with respect to

IS0 9003 : 1994 has similar requirements for internal audits but does not have specific requirements for audit procedures.

Training
Standard 4.18 Training The supplier shall establish and maintain documented procedures for identifying training needs and provide for the training of all personnel performing activities affecting quality. Personnel performing specific assigned tasks shall be qualified on the basis of appropriate education, training and/or experience, as required. Appropriate records of training shall be maintained (see 4.16).

Guidance

Training
You

yourself and your people

need to regularly review the experience, qualifications, capabilities and abilities of yourself and yourpeople relative to the skills and qualifications needed by the business for current and foreseeable activities. Based on this review, you should establish what training needs to be carried out and over what period. Management review (4.1.3), corrective action (4.14) and internal quality audit (4.17) are all likely to identify areas which may indicate a lack of training. The resource review (4.1.2.2) is one activity where training needs are required to be considered. Considerations of skills and aptitudes required under process control (4.9) may also indicate additional training needs.

112

SP 65 : 1998

Even for a small business it may be appropriate to have simple introductory training for new starters (including temporary and part-time employees as well as full-time employees). This could cover:
l

the nature of the business; the health and safety regulations; the quality policy; and the role of the new employee.

Training may be carried out in stages, consisting of a training period followed by a period of familiarization followed by further training and familiarization. Training in internal quality auditing is highly desirable, almost essential if full advantage is to be taken of the potential that rnternal auditing offers as a management tool. Training may be at the actual workplace, in-house or at some external location. Depending on the topics, attending a seminar can also provide worthwhile training. You need to maintain records to show what training an employee has received. The records that demonstrate successful completion of a training programme can be as simple or complex as you like to make them. At their simplest, the records may consist of sign-off to confirm that personnel can now use certain equipment, carry out specific processes or follow certain procedures. Training should be carried out by personnel with appropriate skills, qualifications and experience. You should maintain records to show the qualifications of personnel used for training purposes. IS0 9003 : 1994 requirements for training refer to the need for personnel carrying out final inspection and testing to be appropriately qualified or experienced or to receive

113

SP 65 : 1998

adequate training. There is no specific requirement documented procedures.

for

Servicing Standard
4.19 Servicing Where servicing is a specified requirement, the supplier shall establish and maintain documented.procedures for performing, verifying and reporting that the servicing meets the specified requirements.

Guidance

Associated maintenance

and support services

Many goods and services are sold with a commitment to provide associated maintenance and support as part of the overall contract. This clause applies in such instances. Remember that commitments made as part of a warranty also form part of the contract and again this clause is relevant. A typical example might be an air-conditioning engineer who, as a condition of the original contract, agrees to come back to check and adjust the system after it has run for a period. Another example might be a small software developer who, as part of the contract, has agreed to provide user help or an update service. In dealing with servicing activities, you will need documented procedures which address the following aspects:
l

general provisions of a servicing programme; planning the servicing activities; personnel needed and any training requirements;

114

SP 65 : 1998
l

spare parts management; preparation of servicing instructions; records of servicing activities.

When providing servicing, it is important to remember that any product nonconformances should be fed into the corrective action system so that the reason for the failure can be identified. Remember, if warranty repairs were required, the product did~not perform as intended and this is a form of nonconformance. The small business whose sole activity is the provision of a maintenance and support service must note that this clause is not the only one applicable to their business. The entire standard, with the probable exception of clause 4.4, Design control, would normally be applicable to their business. IS0 9003 : 1994 contains this clause only to maintain numbering uniformity between the three standards. This requirement is therefore not relevant to any IS0 9003 quality system.

Statistical techniques
Standard 4.20 Statistical techniques of need

4.20.1 Identification

The supplier shall identify the need for statistical techniques required for establishing, controlling and verifying process capability and product characteristics. 4.20.2 Procedures

115

SP 65 : 1998

The supplier shall establish and maintain documented procedures to implement and control the application of the statistical techniques identified in 4.20.1.

Guidance

Choosing and using statistical techniques The requirement is that you identify whether you need to use any statistical techniques. If there is no such need, then 4.20.2 does not apply. Statistical techniques may be beneficial, even in the smallest business. If you need to use such techniques to collect and analyse data as part of your arrangements for design or process control, or to confirm that your product is satisfactory, you need to describe the techniques used in procedures. The successful use of statistical techniques depends on the selection of the right technique for your needs. You may wish to seek specialist advice in this area. Your procedures need to cover how each technique is effectively applied in practice; e.g. there is no point in using complicated double sampling plans when no one is sure how to use a sampling plan. Some of the statistical techniques that may be used include:
l

graphical methods which help diagnose problems, e.g. Pareto charts or scatter plots; control charts for monitoring production, e.g. average and range charts; sampling plans; regression analysis; failure mode analysis.

Statistical techniques may be used singly or in combination to measure and control process capability and may be

116

SP 65 : 1998

referred to under the name of statistical process control (SPC). Other areas where statistical techniques could be used are:
l

analysis of market research; stock control; and design of experiments.

Sampling plans are used when the nature of the product precludes the use of 100% testing. There are many products made where a sampling procedure is used and the batch passed or re_jected on the basis of the sample. The detection of nonconforming product does not necessarily mean the sampling procedure is incorrect. However, a continuing and perhaps higher than expected level of nonconformances may suggest that the sampling plan or procedure, or both, may need investigating. Alternatively, if your samples are indicating a satisfactory product, and you are receiving a high level of customer complaints, your sampling plan may well be inappropriate and need investigating. IS0 9004-4 : 1593 contains a number of examples of statistical techniques and may provide a useful reference. IS0 9003 : 1994 has reduced requirements, applying to product characteristics only, and omitting process capability. The requirement to establish and maintain documented procedures has also been omitted.

117

As in the Original Standard, this Page is Intentionally Left Blank

SP 65 : 1998

Annex A Bibliography

Standard

Annex A (informative) Bibliography [ 11 IS0 9000- 1: 1994, Quality management and quality assurance standards Part 1 : Guidelines for selection and use. [2] IS0 9000-2:1993, Qdity management and quality ossuronce standards - Part 2 : Genericguidelinesfor the npplic~ltion of IS0 9001, IS0 9002 and IS0 9003. p] IS0 9000-3: 199 1, Quality management and quality assurance standards - Part 3: Guidelines for the upplication of IS0 9001 to the development, supply und maintenance of software.

[4] IS0 9002: 1994, Quality systems - Model for quality assurance in production, installation and servicing. [5] IS0 9003: 1994, Quality systems - Modelfor assurance infinal inspection and test. quality

[6] IS0 1001 1-1: 1990, Guidelines for auditing quality systems - Part 1 : Auditing. [7] IS0 1001 1-2: 199 1, Guidelines for auditing quality systems - Part 2 : Qualification criteria for quality systems auditors.

119

SP 65 : 1998

PI IS0 100 1l-3

systems -

: 199 1, Guidelines for auditing quality Part 3: Management of audit programmes.

[91 IS0 10012- 1 : 1992, Quality assurance requirements ,for measuring equipment - Part 1: Metrological cor@wzation system for measuring equipment. [ 101IS0 100 13 : 1995, Guidelines for developing quality manuals. [ 1 I ] ISO/TR 13425 : 1995, Guidelines for the selection of statistical methods in standardization and specification.

Guidance

References listed in IS0 9001:1994 The above Annex is part of IS0 9001 (updated to include subsequent publication dates)and lists the references in the standard. The following text gives some additional details about the standards listed and also some others that may prove useful. These standards are often referred to as the IS0 9000 family. The terms normative and informative are often used to describe annexes. A normative annex is an integral part of the standard, whereas an informative annex is only for information and guidance. In this Handbook the annexes are informative.

Standard : 1994

Title

Brief description contents management and

of

ISO9000-1

Quality

quality assurance standards - Part 1 : Guidelines for

selection aild use

Provides guidance for the selection and use of IS0 9000 family of International Standards on quality management and quality assurance. Clarifies the principal quality-related

120

SP 65 : 1998 Title Brief description contents of

concepts needed for effective understanding and application of the standards, and the distinctions and interrelationships between them. ISO9000-2:1993 Quality management and quality assurance standards - Part 2 : Generic guidelines ,for the application of IS0 9001, IS0 YOO2and IS0 9003 Provides guidelines to enable users to have consistency, improved precision, clarity and when understanding applying the requirements of the IS0 9000 series of standards. Provides guidelines to software developers, suppliers and maintainers and to purchasers in the specification and implementation of IS0 9001 quality system requirements as applied to software. Specifies quality system requirements for use when conformance to specified requirements is to be assured during design, development, production, delivery and servicing. It provides a quality assurance model for demonstration by a supplier of its capability and for assessment by external parties.

IS0 9000-3:1991

Quality management and quality assurance standards - Part 3 :Guidelines for the application of IS0 9001 to the development, supply and maintenance of software

1s09001:1994

Quality systems - Model for quality assurance in design, development, production, irlsrallatiorl and servicing

121

SP 65 : 1998 Standard IS0 9002: 1994 Title Quality sytems - Model for qualit) assurance in production, installation arld servicing Brief description contents of

Specifies quality system requirements for use when conformance to specified requirements is to be assured by the supplier during production, installation and servicing. It provides a quality for assurance model demonstration by a supplier of its capability and for assessment by external parties. Specifies quality system requirements and a quality assurance model for use where a suppliers capabilty to detect and control the disposition of any product nonconformity during final inspection and test needs to be demonstrated. Provides guidelines on quality management for use within an organization in the development and implementation of a comprehensive and effective system designed to satisfy customers needs and expectations while servicing to protect the organizations interests. Provides guidelines for the establisment of a quality system for services with the primary objective of preventing unsatisfactory services.

IS0 9003: 1994

Quality systems - Model for quality assurance in final inspection and test

IS0 9004-l: 1994

Quality management and qualiq spsrem elements Part 1 : Guidelines

ISO9004-2:1991

Quality management arzd quality system elements Part 2 : Guidelines for services

122

SP 65 : 1998 Standard ISO9004-3:1993 Title Quality management and qualip system elements for Part 3: Guidelines processed materials Brief description contents of

Provides a guide to quality system elements applicable to processed materials, such as bulk products, and discusses means of ensuring effective quality management. Provides a set of management guidelines for implementing continuous quality improvement within an organization. Describes tools and techniques for a quality improvement methodology based on data collection and analysis. Provides guidance to assist suppliers in the preparation, review, acceptance and revision of quality plans, which~provide a mechanism to tie specific requirements of a product, project or contract to existing quality system procedures. Provides guidelines for configuration management. This is a management discipline that is applied over the life cycle of a product to provide visibility control of its and functionality and physical characteristics. The activities described are a way of satisfying certain

IS0 9004-4:1993

Quality management and quality system elements Part 4 : Guidelinesfor qualiv improvement

IS0 looo5:1995

Quality management Guidelines for quality plans

IS0 10007: 1995

Quality management Guidelines for configuration management

123

SP 65 : -1998 Standard Title Brief description contents of

requirements found in other International Standards in the IS0 9000 family. IS0 1001 l-l:1990 Guidelines for auditing qualify systems - Part 1: Auditing Provides guidelines for establishing, planning, carrying and out documenting audits of quality systems as well as providing basic audit principles, criteria and practices. It allows users to adjust the guidelines to suit their own needs. Sets out qualification criteria for the selection of auditors to perform quality audits in systems accordance with IS0 1001 l-l. Provides basic guidelines for managing quality system audit programmes. These guidelines can be used to establish and maintain an audit programme function when performing quality system audits in accordance with IS0 1001 l-l and IS0 1001 l-2. Specifies quality assurance requirements for a supplier to ensure that measurements are made with the intended and contains accuracy, guidance on implementation; also specifies the

IS0 1001 l-2:1991

Guidelines for auditing quality sytems - Part 2: Qualification criteria for qualiq systems auditors

IS0 1001 l-3:1991

Guidelines for auditing quality systems - Part 3: Management of audit programmes

IS0 10012-1:1992

Qualit) assurance requirements for measuring equipment Part 1: Metrological co@rmation system for measuring equipment

124

SP 65 : 1998 Standard Title Brief description contents main features of confirmation system measuring equipment. IS0 10013:1995 Guidelines for developing qualit? nurnl~als of the for

This standard provides guidelines for the development, preparation and control of quality manuals which will reflect documented quality system procedures, as required by the IS0 9000 family of standards, and which can be tailored to suit the specific needs of suppliers of goods and services.

125

As in the Original Standard, this Page is Intentionally Left Blank

SP 65 : 1998

Annex I How the key quality system standards compare

IS0 9000-2 provides guidance on all of the subclauses of IS0 9001 and has been utilized in the preparation of thisHandbook. IS0 9004-l provides guidance on quality management, much of which is relevantto the quality assurance requirements of IS0 9001 and this also has been considered in the preparation of this Handbook. Should readers wish to consult IS0 9004- 1, the comparison table below may be of assistance.
Corresponding Title IS0 9001 Management responsibility 4.1 . 4.2 4.3
l l

clause numbers Guidance

Requirements

IS0 9002 IS0 9003 IS0 9004-I 4.1 . 4.2

l

4.1 0 4.2 o 4.3 4.4 4.5 4.6 l

4 5 8 5.3;11.5 9 11.2

Quality system requirements Gontract review Design control Document and data control Purchasing Control of customer-supplied product Product identification trace ability and

4.3 g 4.4 4.5 . 4.6 4.7 4.8

l

4.4 g 4.5
l

4.6 . 4.7 4.8

l

4.7 g 4.8 o

Equivalent requirements in IS0 9001, IS0 9002 and IS0 9003 are shown by ...................l Where IS0 9003 has a different requirement to IS0 9001, this is shown by ..................... 0 For IS0 9001, IS0 9002 and IS0 9003, where there is no requirement, this is shown by ....... Since IS0 9004 I provides guidance, the clause number indicates its presence; absence is indicated by ........................................................................................................ -

127

SP 65 : 1998 Corresponding Title IS0 9001 Process control Inspection and testing Control of inspection, measuring and testing equipment Inspection and test status Control of nonconforming product Corrective and preventive action Handling, storage, packaging, preservation and delivery Control of quality records 4.11
l

clause numbers Guidance

Requirements

IS0 9002 IS0 9003 IS0 9004-l 4.9 4.10

l l

4.9 * 4.10
l

4.9

IO;1 1 12

4.10 0

4.11 ~* 4.12 . 4.13 4.14

l l

4.11 . 4.12 . 4.13 0

13 11.7 14 15 10.4;16.1: 16.2 5.3;17.2; 17.3 5.4 18.1 16.4 20 6 19

4.12 . 4.13 4.14 4.15

l l l

4.~140 4.15
l

4.15 .

4.16 .

4.16 .

4.16 o

Internal quality audits Training Servicing Statistical techniques Quality economics Product safety Marketing

4.17 4.18 4.19 4.20

l l l l

4.17 . 4.18 . 4.19

l

4.17 0 4.18 o 4.19 4.20 o

4.20 . -

Equivalent requirements in IS0 9001, IS0 9002 and IS0 9003 are shown by .. .... .... ... .. ... . l Where IS0 9003 has a different requirement to IS0 9001, this is shown by . .. .. .. .... .... ... ... 0 For IS0 9001. IS0 9002 and IS0 9003, where there is no requirement, this is shown by . .. .... .. .. Since IS0 9004-l provides guidance, the clause number indicates its presence; absence is indicated by . .._.._....___........................................................................................... -

128

SP 65 : 1998

Annex II Explanation of terms used

This Annex contains explanations of some commonly used terms in this Handbook as they relate ro small businesses. they should not be confused with the formal definitions given in IS0 8402: 1994. (where there is a formal definition given in IS0 8402 or IS0 900 1, it is shown under the explanation in snlnll italic rypcr. Note that when clause numbers are given in IS0 8402 or IS0 9001 text, these ~Cer to the clause numbers in those standards.)

Audit
(Qidity) (90t

also Review)

Thib t~:r!il may bc considered as a systematic examination to find OUI ii the actual quality activities and associated results XC in line with those expected or planned for. IS0 8402:1994 Clause 4.9 quality audit - systematic crnd independent cxtmination to dertermine whether quuliq (2. I) trc*Gritic.y and related results comply with planned arru,lgements rrrd whether these crrrcrngements are irnljirrrlc~rlrllil t:@cri\Jrly and are suitable to achieve ol?jectives.

I The ~/ui!lity audit typically applies to, but is not limited lo, L~ ,!rrarity .cystem (3.6) or elements thereoi to processes (1.2) or ICYservices (1.5). Such u&its are often called clutrlitr s?lstem LlLtLlit, process quality audit, product c@ity audit or service quality audit .

129

SP 65 : 19% 2 (zuillity edits are carried out by stajfnot havirly direct responsibility in the areas being audited but, prejkmbly, L~~orking in cooperation with the relevant personnel. 3 OIW I3urpose ofa quality audit is to evaluate the rleedfor improvemerzt or corrective action (4.14). An alrdit shorrld riot be confused with quality surveillance (4.7) or insprctioll (2.15) ncti\Gties performed for the purposes oj process c.o~lftd or product acceptance. 4 Qucrlity adits purposes. can be corducteclfor itzternal or exterd

Contract

This term applies to all transactions between a customer and small business. It may be verbal or documented. Examples include the following:
0 a purchase order;

.
l

a telephone order; a verbal order in a restaurant.

IS0 9001:1994 Clause 3.3 contract - agreed requirements between supplier and customer transmitted by any means.

Manager

This term is used in the Handbook to describe, as appropriate in the context, the person who is exercising authority, taking responsibilities, making decisions and fulfilling similar managerial functions on behalf of the business. It includes, as appropriate, any of thcfollowing: 0 single owner;
l

partner; managing director; director;

130

SP 65 : 1998

* general manager;
l

manager; senior executive.

Nonconformity

This term is used to describe any instance of failure to meet a specified requirement. It may be failing to meet a customers requirement, a problem with aproduct or service, a deficiency in the quality system or any other situa~tion where what happened was not what was required. IS0 8402:1994 Clause 2.10 nonconformity nonfulfilment of a specified requirement. -

Objective evidence

IS0 8402:1994 objective evidence - information which can be proved true, based on facts obtained through observation, measurement, test or other means.

Procedures

This term is used generically to describe by whom, with what, when, where and how processes are carried out. they can include, as appropriate, any of the following:
l

quality system procedures; manufacturing procedures; service delivery procedures; work instructions; maintenance procedures. 1.3 procedure - specified way to

IS0 8402:1994%lause pe$orm an activity. NOTES

I Irl many cases, procedures are documented [e.g. quality systern(3.6)procedures].

131

This term is used throughout this Handbook to describe any form by which a business can provide a saleable outcome of its activities to meet a customers requirements. for L3ample:
u physical

products, either as assemblies

or processed

material;
e provision of services;

design output,

* computer software; e raw materials. dSla 8402:1994 Clause 1.4product I ri^pi;/<:.i,ils ( 1.2). :vo I-Es
? A ptw!llc:t may include service, motcrinls, 2 A
prOc/iicT st~fl

-- rcsrrlt qfactivities

hurdware, processed

\vare or a combinatiori thrreof:

mu

be tatcllgible (e.g. assemblies or processed

r?ltrtcricrl.\) or i/l:angihle (e.g. krzobvledge or concepts), or a corilbirlaiior~thei.eojI 3 A product eflect,s). NOTE ~- 111 IS0 9001:1994 Clause 3.1, unintended product is
~xcl~rded from tlut Starzdmd.

call be either

intended

[e.g.

ojjfering to

customers (l.Y)] or unintended (e.g. pollutant or unwanted

I 65 : 1998

Review (SW
also Audit)

This term is used in three situations; contract review and design review.

management

review,

In each context. of the activities IS0

it can be taken to mean the broad overview relevant to that situation.

8402: 1994 Clause 3.9 management review --fort& evcllrtcrtion by top management of the status and adeq~r~~~ ofthe yucrli[y syslern (3.6) in relution to quality poiicy /_?.I) and objectives.

NOTES I Management policy. review may inch& review

of- lJv qiiullt\,l

IS0

8402:199-I Clause 3.10-contract review - SyStel?it7Pi(: acti\Gtio.s carried out by the supplier h@re signing tJrl contract to ensure thut requirements,for quality (2..? 1arc ndcqucltely defined, free from ambiguity, docurnrtzlcd nrrd cat1 be realked by the supplier (1. IOj.

I 771~ contract review is the responsibility qfthe supplier brtt ccm be curried out jointly with the customer { 1.9).

2 A contruct review may be repeated at di$zrent phnses of the contract as needed. ISO8402:1994Clause3.11 design review-documented, comprehensive and systematic examination of LIdesigl:IIto evclllmte its capnbili5 to fulfl the requiretnents for qucrlitj, (2.3), identify problems, if nrzy, ~rld propose til:- development ofsolutions.

SP 65 : 1998

NOTE - A design review can be conducted at any stage of the design process (1.2) but should in any case be conducted at the completion of this process.

Small business

For the purposes of this Handbook, a small business is not a matter of the number of employees, but rather a philosophy of the way the business is run. A small business is usually managed by a very small number of people. The single owner, two or three people in partnership, a company with three or four executives are typical examples. This explanation should not deter anybusiness from using the guidance given here,~if it is appropriate to the businesss situation.

Subcontractor

This term is used in quality system standards and in this Handbook to describe any organization from which a small business purchases products or services, or both. It includes such commonly used terms as supplier or vendor. IS0 8402:1994 Clause 1.13 - organization provides a product (1.4) to a supplier (1.10). NOTES 1 in English, the subcontractor subsupplier. may also be called the (1.7) that

2 In French, the sous-contractant may also be called, as appropriate, sous-traitant or sous- commandier .

Tailoring

This term describes the selection of the applicable requirements from the standard which are relevant to the small business. Sometimes, not everyrequirement or part of any given requirement is appropriate to the -activities being carried out by the small business.

134

SP 65 : 1998

Annex III

_-

__._..~_

Steps towards a quality system

Introduction

There are many ways a small business may go about implementing a quality system. This Annex is intended to provide one such example of implementation by 2% <mail business. NOTE - It is provided solely as an example :i~i.t L,i-i<>nid not be regarded as the only method of implernentarton not the best method of irnplementatiort. The approach given consists of three stages as foilowz:
l

considering what happens in your business; improving the quality system.

0 implementing the quality system;

l

These stages are achieved via a number of steps, as follows:

Considering 1 Consider your main business activities, i.e. the different flows of work through your business, and list them. what happens 2 With this list in mind, choose the quality system standin your ard most appropriate to your business activities. business Implementing 3 Get people involved by writing down what tht:ir,i~~~h~ cover. the quality Collate this together in sequences relevant list of main 4 system
business activity you made earlier.

SP 65 : 1998

5 Identify where the standards and this list of your main business activities link together. 6 Apply the standard and the quality system. 7 Keep the quality system simple and functional, relevant to the business operations. i.e.

Improving the quality system

8 Consider the feedback of information from the quality system to lead to improvement in activities.

9 Monitorand~measure the changes so you know what you have gained by it all! NOTE - In some instances, in providing guidance on . implementation, some of the advice is specific to particular sectors, such as manufacturing or service industries.

Considering
what happens

in your business

Now that you have determined that you would like to analyse your business and would like to work in a more efficient manner, where do you start?

Thestages and their associated steps hxqe already been

olltlines, so lets walk through them.

Step 1 +

Consider what your main business activities are and list them

You and, if appropriate, your partner or business associates should discuss and jot down what your main business activities are.

136

SP 65 : 1998

Depending on the type of industry sector you belong to, this may vary and some examples are shown below. Mmufacturing:
l

If you are a manufacturer, you may have a single product or you may have a range of products you manufacture. You may warehouse and distribute.

Stockist/distribuior/agent:
l

You may carry a single product

or aproduct range.

You may purchase components and repackage them or assemble them into varied lots to satisfy customers needs. You may supply an information service on the use of the goods to clients; so as well as being a provider of raw materials, you are also a consultancy service.

You may be buying aproduct or warehousingproducts manufactureed by somebody else. You may carry arange ofproducts which are perishable and need to be monitored and rotated regularly. You may provide a transport/distribution goods. service for the

Repair or after sales service agency:

l

You may perhaps service a range of products but you need to consider if your servicing is conducted differently for different clients. You may also provide equipment and parts and participate in the actual delivery of the service.

SP 65 : 1998

Professional consultancy:
l

You may provide initial research for clients. You may actually design the concepts and develop the project plan. You may also provide project management and provide ongoing consultancy services throughout the life of the project.

All of the above industries or service business may subcontract out components of their activities or use subcontract labour. This needs to be identified and noted against the relevant process areas when jotting down your main business activities as the standard requires you to manage your subcontract suppliers. Further into the development of your quality system, you will apply specific treatment to the management of subcontractors supplying your raw components.

Step 2 *

Now you are ready to use the IS0 9000 quality system standards most appropriate to your business activities Look at the list of main business activities you have jotted down. Do any of the activities require you to do design work? Design means taking raw ideas or concepts and, either through design drawing, computer design or academic thought processes, developing a product or service design or project plan to suit the needs of your customer. If you do, you will need to address:
l

IS0 9001, Quality systems - Model for quality assurance in design, development, production, installation and servicing.

138

SP 65 : 1998

If you dont design and the manufacturing activities or service delivery is done against tried and previously developed standards or specifications, then you will need to address:
l

IS0 9002, Quality systems - Model for quality assurance in production, installation and servicing.

If you provide a very simple service or product with no intricate components or activities and the product can be fully verified by completing some simple tests or final visual inspection, then you would address:
l

IS0 9003, Quality systems - Model for assurance infinal inspection and test.

quality

Implementing the quality system

To achieve the next step, you need to keep the list of main business activities you initially thought through, firmly fixed in your mind.

It may help at this stage to take each of the main business activities you listed originally and produce them in the form of a flowchart. Display this in your office or at home for easy reference and look at it regularly to remind you what it is you are attempting to develop a quality system around. The purpose of setting out your business activities like this is so you can:
l

identify the different components of your business and decide if they all fit together well, or if, in fact, you need to change something to make the whole process work better; and identify where and if~the elements of the standard are covered in your business activities.

139

SP 65 : 1998 NOTE - Do not make the changes yet. This is covered later in Step 5. Note for service industries a) Before attempting to do this activity, you need to stop, think - question: what is my product, i.e. what services do I deliver? For example, is it: legal advice; property advice; educational and/or training; public relations; media placement; graphic design; specialist electronic design; or individual specialist consultancy services? b) Remember that: The idea of a quality system is not to inhibit the academic/intellectual or creative processes involved in any of the above services. Rather, the idea is to think about the framework and structure within which your business operates and to ensure all activities are known and repeatable. This will allow you to provide consistent goods or services each time you deliver to your customers.

Step 3 -9

Getpeople involved by writing down what their-jobs cover Now is the time to get everyone concerned involved in writing down how they carry out the parts of the business activities they are responsible for, stating:

140

SP 65 : 4998
l

who is activities;

responsible

for

performing and checking

where the activity takes place; when it will happen; and what happens, that is, how the activity is performed.

Some important points you will need to think about are: a) If it is a job done by a trained apprentice or specialist, it may well be that you will only need to reference the type of person and the qualifications, rather than a detailed description of the job; for example, graphic designer/welder/visiting professional consultant. b) If, however, the work is done by casual labour, or there are specific in-house requirements, more detail may be required. cj The sequence of the activities may still need to be defined, for example: * How the initial enquiry is recorded.
l

How a file is initiated. How does the work get started? Who monitors the progress? How is the work processed and inspected? Who decides when the work is finished?

* How is delivery made?

l

What follow-up action is needed and who does it? What records are kept and who keeps them?

If your organization already has its details written down as operating or work instructions, your job is already half done. Dont rewrite what is already documented, make a

141

SP 65 : 1998

note of the name and title of the document so it can be controlled and if necessary referenced in other quality system documentation at a later date. d) Most important SIMPLE! . .. . Keep written documentations

Step 4 -9

Collate this together in sequences relevant to the list of business activities (Step I) Once everyone has written down, or collected previously written, work instructions relevant to his or her part of the activity or particular job responsibilities, you as manager should take time out with someone else from the business to look at:
l

what has been written; satisfy yourself that it all fits together; and deal with any gaps or inconsistencies.

By appointing someone to assist you, you have basically appointed a quality representative, or if you are doing most of this yourself as manager, you have assumed the role of management representative. You have now addressed one of the first requirements of the standard. By collalting all these documents, you now have a procedures manual, which is another requirement of the standard. Yotrmay wish to adopt aconsistent style for these documents which you and your people are comfortable with. This may provide an opportunity to review and improve the procedures themselves. Step 5 + Zdentify where the standards and this list ofyour business activities link together You or your quality representative need to go through the documented procedures with a copy of the standard beside 142

SP 65 : 1998

~you and determine if the requirements of the standard have been covered. If you identify an area of the standard you have not addressed, you will need to consider how your business covers that particular requirement. You may need to add some detail to one of the existing procedures to ensure the requirement is met. It may require some additional documentation, but be careful, make sure it is relevant to your organization. You may have to use external documents in your business activities. Some examples are dealers manuals, maintenance manuals and installation manuals. It is not necessary to rewrite these to include them in your quality system. All that is needed is to make an appropriate reference to the procedure in your manual.

Step 6 *

Apply the standard and the quality system If you continue to involve others in your organization, they are more likely to grow with the quality system and have input. The quality system will then reflect reality rather than become irrelevant paperwork. The following points shoud be noted:
l

Do not unnecessarily create paperwork, forms, and the like. Look at what is currently done and write your procedures to show how the job is done, not how you wish it was done or should be done. Only create ~a form if it is going to capture a critical activity or is going to help someone. A signature on, or an extension to, an existing form may suffice. Remember, keep a record when:
l

a problem arises; a good suggestion is raised, or 143

SP 65 : 1998
l

a customer or employee expresses a need for action.

If the business is a partnership, this may be just a notepa. which each partner looks at regularly. They can then discuss and agree on appropriate action for the situations which arise.
l

To implement the quality system, everybody needs :I be shown their relevant procedures and given som insight into how the quality system works and why, for example, document control ensures that they have the latest copies of information relevant to theirjobs and can rely on making decisions on up-to-date information. Everybody needs to be trained to understand how to keep the quality system up-to-date themselves, if changes take place in areas they are responsible for. Everybody needs to know how to make changes to the quality system as well as noting problems and putting forward ideas for improvement. Remember that you need to approve any procedures or changes to procedures before they are put in place.

Step 7 3

Keep the quality system simple, functional to the business operations The following points are worth noting:
l

and relevant

The purpose of implementing a quahty system is to ensure that the business activities are operating in a controlled manner and the people responsible for the various activities know and understand their roles and responsibilities. Quality system documentation should be a ready reference point to identify how, when, where and sometimes, why a job should be done, or an activity managed. For that reason, the wording should be simple and in the language used in the workplace on a daily basis.

144

SP 65 : 1998
l

Documentation should be in a format that is easily used in the organization. For example: . if computers are available, itmay be easier to have a computerized system, rather than a paper system; . where there may be language or other differences in the workforce, it may be necessary to use pictures or several translations of the documents;

Documentation should reflect what is currently happening in the business. During the audit process, questions will be asked and objective evidence sought, to show that personnel are using and understanding the quality system. The objective evidence is provided by the documentation.

Improving the qua.ity system

Step 8 +

An effective quality system uses feedback loops to improve how you go about doing things, which in turn should lead to an improvement in product quality.

Consider the feedback of information from the quality system to lead to improvement in ideas and activities Many small busisnesses do not consider that they are in a on major quality improvement position to take programmes. You are in fact able to commence these activities in your own time and in your own way. By noting areas of concern fromcotrective action activities (step 6), you will gather data, or note trends which you can look at and consider for improvement, Improvements may be simple and easily achieved in the initial stages but may become more challenging once the obvious opportunitiesfor improvement have been~taken. It is worthwhile persevering with a systematic approach to

145

SP 65 : 1998

quality improvement, considerable.

since

the

benefits can be

Normally, improvements are adopted over a period of time as money and resources become available. A realistic approach and steady progress will build confidence and -maintain enthusiasm.

Step 9 4

Monitor-and measure the changes so you know whatyou have gained It is important to remember to measureyour progress. One way of doing this is to monitor mistakes and their cost. This gives you the opportunity to identify areas where cost savings may be made. Measurements may also be obtained by noting how long or how many resources are spent on an activity or service delivery. This should always be recorded on any activity that has been chosen for improvement, prior to commencement and compared again at the end - even though the activity may be small and simple. The various requirements of IS0 9001 should all combine together to support the achievement of the businesss quality goals. However, it may be useful to categorize these according to their particular relevance to different aspects of the business, since this may influence the order in which you may wish to introduce these requirements. As might be expected, many requirements are relevant to more than one aspect of the business and appear in more than one group below.

a) Those which relate to the overall management of the business:

l

management responsibilty

(4.1)

146

SP 65 : 1998
l

quality system document and data control control of nonconforming product corrective and preventive action control of quality records internal quality audits

(4.2) (4.5) (4.13) (4.14) (4.16) (4.17)

b) Those which relate to the businesss activities:

l

contract review design control purchasing control of customer-suppliedproduct process control inspection and testing handling, storage, packaging, preservation and delivery servicing

(4.3) (4.4) (4.6) (4.7) (4.9) (4.10) (4.15) (4.19)

c) Those which provide support to the business activities:

l

product

identification and traceability product

(4.8) (4.7) (4.11) (4.12) (4.18) (4.20)

control of customer-supplied

control of inspection, measuring and testing equipment (calibration) inspection and test status training statistical techniques

d) Those which may directly involve the,customer:

l

contract review design control control of customer-supplied product product identification and traceability

(4.3) (4.4) (4.7) (4.8)

147

SP 65 : 1998
l

inspection and testing control of nonconforming product corrective and preventive action handling, storage, packagiig, preservation and delivery

(4.10) (4.13) (4.14) (4.15)

Conclusion

Remember: small, steady changes, leading to improvements, well-thought-out long-term advantages. and effective, are going to have

These nine steps can help you take advantage of the quality system approach and allow it to contribute to the growth of your business.

148

SP 65 : 1998

Annex IV Brief outline of certification/registration

Certification/registration of a quality system is not mandatory but the following provides a brief outline for those wishing to follow this path.

Who does the There are two types of certification/registration:

certification/
registration?

one is carried out by your customer(s) and the other by an independent party. The outline below is based on that typically adopted by independent, third-party certification/registration bodies.

Brief outline The process generally takes the form of the following
steps: You make a formal application to the certification/registration body. The application normally includes a description of your business activities, the product range, and any other information requested. The certification/ registration body may ask for a questionnaire to be filled out. Next, the certification/registration body will review your quality manual. What it will be looking for is how well the quality manual describes what you say happens against what the standard says should happen. Where there are deficiencies, the certification/ registration body will indicate where the problems are. Amendments

149

SP 65 : 1998

to the quality manual will usually overcome most problems, but you may also have to develop additional procedures. A further review of any changes is carried out and is often combined with one of the subsequent stages. The certification/registration body may then hold a pre-assessment check or go straight to the certification/ registration audit. In the certification/registration audit, the auditor (and there may be more than one) will use the quality~manual and any procedures as a guide to how your business operates. The auditors operative words will be Show me. The auditor will be looking for records, documents, or other objective evidence to see that you are doing what your quality manual/procedures say you do. Where inconsistencies (nonconformities) are found, the auditors actions depend on how serious these are. For major nonconformities, the certification/registration could be with-held pending rectification. For minor nonconformities, a quality certification/registration might be issued, pending rectification by the next compliance audit. Once certification/registration is granted, the certification/ registration body will carry out surveillance audits of the quality system over the period for which the certification/ registration is valid. These audits are not as comprehensive, in that the full quality system is not necessarily assessed at each surveillance audit. If nonconformities are found during a surveillance audit and not rectified within specified times, certification/ registration may be withdrawn, Minor nonconformities will be required to be rectified by the next surveillance audit, which under these circumstances may seem to come round very quickly.

150