Recently we conducted workshops on the ISO 9001:2015 Standard. A point of interest to all, was the new increased emphasis and requirement of “Top Management Involvement” contained in clause 5.1, Leadership of the Draft International Standard published.

As quality professionals and prior quality managers, we and you have shared the frustration on the lack of top management commitment, and specifically lack of hands-on involvement with the company Quality Management System. Sure, the process of management review meetings does require top management involvement, however too may times we have witnessed the Quality Manager as the delegated source of data, measurement representation, and communication to all management review attendees of the quality system effectiveness.

Real involvement stems from top management when they realize the quality department is not a departmentalized function, but a interwoven unit of established controls and monitoring methods. These methods are monitored against defined criteria which are aligned with company business objectives. 

Let’s take a look at the significant leadership differences in the future new standard:

1. Take accountability for the effectiveness of the quality management system.
2. Ensure that the quality policy and quality objectives are established for the QMS and are compatible with the context of and strategic direction of the organization.
3. Ensure the integration of the QMS requirements into the organization’s business processes.

Requires leaders to take accountability for the effectiveness of the quality management system.

Attention: This will promote and require discussion and integration of the quality group and top management team. Having accountability requires this – let’s face it the standard has not had any new requirements in 15 years!  Meaningful involvement and learning from the quality group for top management will be required in the early stages of this transition, an essential step. When your leaders are accountable they will want to know, need to know all the new requirements which will take their attention, time, and resources necessary.

Requires leaders to establish a quality policy and objectives compatible with the context and strategic direction of the organization.

Compatibility in this context drives integrating quality into business processes as process objectives must now be more clearly aligned with your company strategic direction (a.k.a. long-term business goals). This will most clearly require top management involvement with this new requirement.  Can a Quality Manager define the company context -scope and purpose, strategic direction, interested internal and external parties and review of requirements? Let’s not forget the identification of “Risks” which can affect the organization ability to meet these objectives; another top management requirement of the future standard.

Requires leaders to integrating quality management system requirements into your business processes.

This requirement will never be successful without engagement between top management and the quality group.  Question: Is their a wide gap of distinction in your company between quality processes and business processes? Our experience tells us that  wide gaps do exist in some organizations.  This can include information on quality performance, measurement methods used, trends and indicators, responsiveness. An aggressive company business plan should also include the numerous quality-related preparations and controls required to expand operations and opportunities, and still maintain quality excellence.  

Clause 5.1 of the ISO 9001:2015 revision contains seven more requirements of leadership that are either new or improved from the ISO 901: 2008 revision. This clause, and others in the future standard (projected published date September 2015) will require direct involvement from your organizations leadership. Quality and operational professionals – It’s time to prepare. 

We are here to support you and your organization with all your transition needs. We will be offering training, onsite evaluations to determine needs, documentation development and improvement, pre-assessment auditing, and internal audit support.  Contact us to discuss your planning needs.     

We received great reader response from our April 2015 Newsletter on risk management and are continuing with this topic. 

ISO/DIS 9001:2015 states that risk is the “effect of uncertainty on an expected result”, and that the concept of risk-based thinking has always been implicit in the ISO 9001 Standard; general opinion, not shared by many.

ISO/DIS 9001:2015 states: An “effect” is a deviation from the expected, and can be positive or negative. The term “uncertainty” is the state, even partial, of a deficiency of information related to the understanding or knowledge of an event, its consequence, or likelihood.

Risk is often expressed in terms of a combination of the consequences of an event, including changes in circumstances and the associated likelihood of occurrence.  The term “risk” is sometimes used when there is only the possibility of negative consequences.

ISO/DIS 9001:2015 makes risk-based thinking more explicit and incorporates it into the requirements for the establishment, implementation, maintenance, and continual improvement of the quality management system. Organizations are not required at this time to have a formal risk-based approach according to the draft ISO 9001:2015 standard, however, the ISO 31000 standard is mentioned as providing guidelines on formal risk management which we feel is an appropriate method to consider. How would  you audit a undocumented formal risk-based approach?  

Using “risk-based thinking” means to consider risk qualitatively in relationship to the organization’s context when defining the degree of formality needed to plan and control the system, and its component processes and specific business requirements.

ISO/DIS 9001:2015 in its requirements section, clauses 4 through 10, mentions the terms risk or risks 14 times. The main requirements related to risk are stated in clause 6.1 of the current draft standard.

6.1 Actions to Address Risks and Opportunities

6.1.1 When planning for the quality management system, consider the issues referred to in 4.1, and the requirements referred to in 4.2, and determine the risks and opportunities that need to be addressed to:

• give assurance that the quality management system can achieve its intended results;
• prevent, or reduce, undesired effects;
• achieve continual improvement.

6.1.2 Plan actions to address these risks and opportunities and how to:

• integrate and implement the actions into its quality management system processes (see 4.4);
• evaluate the effectiveness of these actions.

Take actions to address risks and opportunities that are proportionate to the potential impact on the conformity of products and services.

Annex A does provide a clarification of the draft standard’s new structure, terminology, and concepts. Annex A.4 states that the draft standard requires the organization to understand its context and determine the risks and opportunities that need to be addressed (see clause 6.1).

We will continue to discuss this topic and other new requirements of the future standard. Specific questions in mind, let us know!

Reducing, anticipating and managing risk are all part of the daily grind for organizations that have integrated risk management into their business strategy. That’s why they often turn to ISO 31000 on risk management to support themselves in this task.

Risks affecting organizations can have consequences in terms of economic performance and professional reputation, as well as environmental, safety and societal outcomes. Therefore, managing risk effectively helps organizations to perform well in an environment full of uncertainty.

ISO 31000:2009, Risk management – Principles and guidelines, provides principles, framework and a process for managing risk. It can be used by any organization regardless of its size, activity or sector. Using ISO 31000 can help organizations increase the likelihood of achieving objectives, improve the identification of opportunities and threats and effectively allocate and use resources for risk treatment.

ISO 31000 provides guidance for internal or external audit programs . Organizations using it can compare their risk management practices with an internationally recognized benchmark, providing sound principles for effective management and corporate governance.

A number of other standards also relate to risk management.

• ISO Guide 73:2009, Risk management – Vocabulary complements ISO 31000 by providing a collection of terms and definitions relating to the management of risk.

• ISO/IEC 31010:2009, Risk management – Risk assessment techniques focuses on risk assessment. Risk assessment helps decision makers understand the risks that could affect the achievement of objectives as well as the adequacy of the controls already in place.  ISO/IEC 31010:2009 focuses on risk assessment concepts, processes and the selection of risk assessment techniques.

You can purchase any of these at the ANSI Standards Store.

View all our online Courses

Don’t see a course or schedule that fits your needs?  Contact us.