Organisations are required by ISO 9001:2015 to implement production and service provision under controlled conditions.

These conditions must include, as applicable:

1. The availability of documented information that defines the characteristics of the products to be produced, the services to be provided, or the activities to be performed and the results to be achieved,
2. The availability and use of appropriate monitoring and measuring resources,
3. The implementation at appropriate stages of monitoring and measurement activities to verify that criteria for control of processes or outputs, and acceptance criteria for products and services, have been met,
4. Appropriate infrastructure and environment for the operation of processes,
5. The appointment of competent persons, including any required qualification,
6. In instances where the resulting output cannot be verified by subsequent monitoring or measurement, the validation, and periodic revalidation, of the ability to achieve planned results of the processes for production and service provision,
7. The implementation of actions to prevent human error.
8. The implementation of release, delivery and post-delivery activities.

Comment:

1: “Results achieved” may be a significant additional requirement for some organisations. IE Current documented information (work instructions / procedures) may not contain this requirement.

2: “The availability and use of appropriate monitoring and measuring resources” was “monitoring and measuring equipment” in the 2008 release of ISO 9001. This is to emphasise the fact that monitoring may be being carried out by personnel as well as by equipment. (See also article 7.1.5 Monitoring and measuring resources.)

3: There is an explicit requirement for “the implementation at appropriate stages of monitoring and measurement activities.”

4: “Appropriate infrastructure and environment” expands on the ISO 9001:2008 requirement of “suitable equipment”. (See also article 7.1.4 - Environment for the operation of processes.) 5: “Competent persons” are referred to as throughout the standard, to emphasise competency rather than just qualification of personnel.

6: “In instances where the resulting output cannot be verified by subsequent monitoring or measurement.” These are sometimes referred to as “special processes.” For these processes, the standard requires the process itself to be initially validated and then periodically re-evaluated. EG: Though initial process capability studies and subsequent ongoing controls such as Statistical Process Control (SPC.) Examples of “special processes” may include: Welding, painting, plating, heat treatment, casting, soldering, sealing / gluing etc. (See also Audit Check notes.)

7: “The implementation of actions to prevent human error” can be addressed on several levels. IE:

• By ensuring personnel involved are competent as per point 5. (IE: have the appropriate abilities, knowledge, skills and training and equipment,)
• Communicating the importance of “getting it right”. (See article 7.3 Awareness.)
• By adopting a risk based approach when designing processes involving human input. (IE use of tools such as Failure Mode Effects Analysis.) This may result in a reduction on human inputs through careful specification of equipment to be used in the process. IE automation.
• The employment of Poke-Yoke (Mistake Proofing) devices and methods can be use in both product and service based processes. EG: Automatic cut off if process parameters are outside of acceptable limits, scripts and checklists for personnel dealing directly with the end user.
• Reducing process variation through tools such as Process Capability Studies / ongoing Statistical Process Control and Gauge Repeatability and Reproducibility studies. IE: By reducing opportunities to “get it wrong,” resultant errors can be reduced.

8: All steps must be defined and controlled. EG:

• Release: Any final inspection and test requirements / authority to release,
• Delivery: Shipping / Transport / Collection arrangements,
• Post-delivery activities: Warranty, servicing, spares, end of life recycling requirements etc. (See also article 8.5.5 Post-delivery activities.)

Audit Check:

Point 6: “Special Processes.”

Note that processes may be deemed to be “special” and the approach detailed under point 6 required, if the output of the process cannot be confirmed as meeting requirements. EG: Without some form of destructive testing.

However, although preventive action is now no longer specifically referred to in the 2015 release of ISO 900e, it is embedded throughout the updated standard in the form of risk based thinking and process controls are a good example of risk reduction. Post production / processing testing, can at best only capture and contain defects already produced.

Organisations should then consider appropriate validation (often overlooked) and subsequent appropriate control for any processes within their scope, not just those falling under the definition of Point 6, as over reliance of post-production / processing inspection and test only, could be interpreted as not taking the risked based approach to prevent nonconformities.

Businesses engaged in activities /processes which require personnel to monitor / measure processes and products as opposed to instrumentation and equipment (IE service orientated organisations, those whose outputs require human assessment) should note Point 2 & 3 and ensure that competency, availability and use, can be demonstrated.