ISO 9001:2008 Procedures; 6 Mandatory Procedures

ISO 9001:2008 is an international standard that defines the requirements for a quality management system, the system by which your company can ensure that all of your processes are controlled and repeatable to ensure the quality of your products and services.

Your processes are normally controlled through the presence of and the audit of written quality procedures which define what has to be done.ISO 9001 defines best practice for each process within your organization to ensure control, however it only defines 6 mandatory procedures that you must have.

A procedure is a statement of what will be done, when it will be done, and by whom. It is a set of instructions and intent that anyone in the company can follow (Not a top secret company document for management eyes only as one quality manager once told me!)  It is a specific way to carry out a process, a set of clear instructions that the staff can refer to help them understand and conduct their daily work in an efficient and repeatable manner.

ISO 9001 says that only certain requirements within your quality management system have to have a documented procedure, other procedure requirements depend on the size and complexity of the processes and the overall system as well as the competence of the staff.

A procedure does not have to be a hundred page document telling the individual how and when to pick up a pen, check that there is ink of the correct hue before forming letters in the specifically highlighted box on form no.XYZ. Too many people and organizations over-complicate their ISO 9001 procedures.

If you split your procedures and work instructions then the procedures themselves can be very simple, remember that they only have to contain the right amount of information for the people doing the job to do it efficiently and in the best proscribed way. If your people are of high quality, well trained, experienced, or the process is very simple and obvious then there may be no need for a procedure at all.

I prefer to use simple flow charts to create procedures, use software such as Visio in the office suite of programs. They need to be just simple step by step instructions saying what is to be done, then the next step in the sequence. They do not have to be overly complex.

For work instruction level there is also the opportunity to clarify the process using things like photographs to highlight and clarify specific things.

Far too many organizations go over the top with regard to their ISO 9001 procedures, thinking that the weight of their procedure manual is a reflection of the effectiveness of their system. Too many, too complicated procedures just leads to confusion and the likely hood that the system will never be read and followed.

Within ISO 9001 there are only six procedures that are mandatory, you must document these six. This does not mean that you can get away with just these six, the procedures you need will very much depend on the size and complexity of your organization, these six however are the ones that you must have.

4.2.3 – Control Of Documents

A written procedure to control the approval and re-approval of procedures prior to issue as well as ensuring that the current revision status is displayed. To ensure that documents are legible and that the current versions are available at point of use. To also ensure that obsolete documents are controlled and documents from external parties such as your customers.

4.2.4 – Control of Records

A procedure to control the identification, storage, protection, retrieval, retention and disposal of records.

8.2.2 – Internal Audits

A procedure to define a planned program of audits to ensure that your processes meet both ISO 9001 requirements and your own requirements. Also for the reporting, follow up and records of these audits.

8.3 – Control of Non-conforming Product

A procedure to ensure that non-conforming product is not used and action is taken.

8.5.2 - Corrective Action

A written procedure to ensure that root causes of problems are identified and actions taken to correct them, actions must be verified to ensure effectiveness

8.5.3 – Preventive Action

A written procedure similar to that for corrective action but the organization should take steps to identify POTENTIAL problems and eliminate them before a problem occurs.

A procedure can come in many different forms, it can be an overview of a process stating purely what is to be done, by whom and when or it can be specific detailed instructions. Most companies try to separate the two levels of documentation for the sake of clarity, having procedures and then standard operating instructions, work instructions, or other detailed documents at a lower “local” level in the system with the detailed “how to” instructions.

A procedure should detail out a few simple sections before the actual detail of what the procedure actually is so that you can maintain control of the specific procedure;

Scope; What is the area covered by the procedure, i.e. Incoming delivery of consumable items, not including intercompany items.”

Responsibility; Who is the owner and responsible person for this procedure, after all these are process specific documents so the quality manager is not responsible for approving and creating the purchasing procedures for example, that would be the place of the head of purchasing!

Control or Issue; What is the issue date, approval etc. You have to maintain control of your procedures, they need to be approved, people must be able to be sure that this is the current revision etc.

References or Related Documents; List out the other documents and forms that may be related and relevant to this procedure.

After these sections would come the actual body of the procedure;

If you are going to develop your ISO 9001 quality management system procedures you might want to consider an alternative to producing every thing from scratch. There are many systems that you can buy that have generic procedures and forms already designed and formatted. By entering your company name and other information they can create basic documents that meet the requirements of ISO 9001.

These systems are OK as a starting point to save you the effort of designing from nothing, they will also ensure that you cover all ISO 9001 procedural requirements including the mandatory procedures. Most consultants experienced in installing ISO 9001 systems will use something like this, either a purchased package or something home made.

Beware of companies that advertise to create all of your procedures and provide you with a certificate to say that you meet the requirements of ISO 9001, many of these companies are scams and the certificates are worthless. Unless they are registered with UKAS (link below) then they are not an accredited body that can issue an ISO 9001 certificate.

The following are some useful links that will help you gain additional information regarding the ISO 9000 standards;

International Organization for Standardization; ISO website where you can find out about other international standards and monitor changes and developments in the standards.

Lloyds Register Quality Assurance; Lloyds Register Quality Assurance are about the oldest of the certification bodies in existence, they can audit your procedures as well as offer training and other services.

British Standards Institute; British Standards Institute are another well established certification body operating globally, they too can offer certification audits and training to help you implement your ISO 9001:2008 procedures.

The American Standards Organization; (ANSI) American Standards Organization can help you implement your ISO 9001 procedures in much the same way as Lloyds and BSI above.

International Register of Certified Auditors (IRCA); The International Register of Certified Auditors is where you go to check the qualifications of an individual trainer or auditor.

UKAS; The United Kingdom Accreditation Service is responsible for accrediting the certification bodies to be able to conduct ISO 9001 audits. They have a list of all accredited bodies that are able to provide valid ISO 9001 certification of your ISO 9001 procedures.

Chartered Quality Institute (CQI); The Chartered Quality Institute (Formerly the Institute of Quality Assurance.) They are able to provide much support in all quality related areas, if you are a quality professional I would recommend membership.

American Society for Quality (ASQ); The American society for quality can help you in the same way as the CQI can help you in the UK.

The above links can help with ISO 9000 Standards, ISO 9001, ISO 9004, Certification, auditing, Training, quality management systems, procedures, continuous quality improvement, etc.