ISO 9001:2015 requires changes to be “carried out in a planned manner,” when the organisation establishes the need for changes to the Business Management System. (See also article 4.4.) In addition, when planning for change, the organisation is required to consider:

1. Why the changes are required and potential consequences (both positive and negative,)
2. Maintaining the integrity of the management system,
3. Resources requirements,
4. Responsibilities and authorities allocation, or reallocation (temporary or otherwise.)

Comment:

Risks mitigation and maximisation of opportunities as stipulated by ISO 9001:2015 (see article 6.1) may require change management, as may many other internal or external contextual factors affecting the management system.

External factors might include shifting markets or new opportunities, exploitation of new technology and processes, customer feedback (positive or negative,) and supplier performance.

Internal considerations might be innovations in processes, equipment, products or services, business restructuring, management review output, monitoring of Quality Objectives and business Key Performance Indicators, employee survey feedback, internal audits results etc.

Depending on the complexity of the change, the Plan, Do, Check, Act methodology can again be employed as part of this process:

IE:

• Plan the change
• Do, implement the plan
• Check the change has had the desired effect
• Act to embed the new state or revisit the PDCA cycle if the desired state has not been achieved.

More complex changes may require more structured approaches such as Project Management or 6 sigma methodology. (See also article 6.1 Planning - Actions to address risks and opportunities where the P.D.C.A. cycle is explored in a little more depth.)

Audit Check:

As discussed in article 4.4 (Quality Management System and its processes) documented information is required to “support the operation of processes.” Auditors will therefore look for evidence to determine if organisations have followed an appropriately structured, change management process including identification of changes required / to be managed, resource considerations, identification of intended and potential unintended consequences, responsibilities, how the change will be implemented and the effectiveness of the change is monitored.

It is worth noting that post certification when conducting routine follow up visits, auditors will usually ask in the opening meeting what significant changes have taken place in the organisation since their last visit. You have been warned!