ISO 9001:2015 requires organisations to undertake the following specific steps to effectively operate their management system processes and to achieve conformity of products and services:

1. Determine the knowledge necessary,
2. Maintain (preserve) this knowledge,
3. Make it available to the extent necessary,
4. Consider current knowledge when addressing changing needs and trends and;
5. Determine how to acquire or access any necessary additional knowledge and required updates.

The standard recognises that organisational knowledge is specific to each organisation, that it is generally gained by experience and is information that is used and shared to achieve the organisation's objectives.

Some examples are also given of potential sources of organisational knowledge. IE:

Internal:

Intellectual property, experience, lessons learned from failures and successful projects, capturing, and sharing undocumented knowledge and experience and the results of improvements in processes, products and services,

And

External:

Standards, academia, conferences, and the gathering of knowledge from customers or external providers.

General Comment:

There is no explicit obligation for organisational knowledge to be held as documented information, (see articles 7.5.1, 7.5.2 and 7.5.3,) however, knowledge sources could still include such documents as standards, manuals etc. Organisations need also to include tacit ("implied or inferred without direct expression") collective and individual experience as a resource and manage it accordingly.

If suitable mechanisms are not already in place, the Plan, Do, Check, Act, model can again be effectively employed to address the requirements of the standard, as implied by the structure of the steps in the clause. However, in many businesses existing processes (formal and documented or otherwise, depending on the context and size of the organisation,) such as change management, succession planning and mentoring, may already be in place and address much of these requirements.

Comment on SMEs: (Making Clause 7.1.6 add value to your business.)

The requirement for businesses to consider knowledge as an important resource, is very relevant and possibly most critical, to Small and Medium sized Enterprises (SMEs.)

Consider that by their very nature, SME's have limited (human) resources and are therefore most vulnerable to any changes in the organisation which could result in a loss of knowledge. Changes may be a result of planned restructuring or unplanned losses due to career changes, retirement or ill health for example. (The Covid-19 pandemic unfortunately made the latter most likely for many organisations of course.)

It is the unplanned changes of course, which often offer the highest level of risk and to which SMEs are most vulnerable. Whilst larger organisations may have elaborate and comprehensive staff development / succession planning processes and a large pool of personnel ripe for development to pick from, small businesses often do not have such formal procedures in place and of course may not have the luxury of someone suitable “waiting in the wings” to be developed to take on a highly specialised role.

So what is to be done?

Of course, planning, as required by the standard, is the first and most vital step to take. For a mature SME business, an initial brainstorm to establish what knowledge is currently required for specific roles within the business and critically, how it is currently held is a good start. For example, for a production operative using basic tools working to an established process, much of the required knowledge to perform the task may be held in the form of Standard Operating Procedures or may be imparted as a learned skill as a result of a comprehensive induction training programme. Either approach could be equally effective.

This exercise should be carried out for all key roles and levels within the organisation. Eg: Supervisory and Management as well as Indirect Staff and Direct Employees. A simple skills matrix can be built on excel to document the exercise if you wish. Any current gaps (risks) identified should also be noted as they can also be addressed in the mitigation phase.

Once the required knowledge and its current format (Eg: external standards, internal procedures and instructions, on the job experience, trained skills, etc) is established, comes the potentially frightening part: The “What if” game…

You can choose the “run over by a bus” or the “won the lottery” approach, depending on your general demeanour, (I am a glass half full person myself – so I use the lottery!) but the general process remains the same: For each identified role, consider the impact on the business should that person not turn up for work tomorrow or the following days. The outcome will always be a problem, but it is crucially how big a problem and what impact it would have on the normal operation of the business / quality of product or service, which we are trying to determine. IE: Are there others who can quickly take up the slack whilst you back-fill? Or are you faced with the loss of a critical set of skills which are virtually impossible to replace?

Mitigation:

Once we have a list of these “the vital few” critical roles, we can start to plan how to mitigate the risk. Succession planning backed up by suitable personnel development plans is of course a great way to ensure continuity with the minimum of disruption, but as discussed, this may not always be possible for a smaller organisation. Structured cross-training between functions and departments may be an option but also a challenge for organisations with a “Silo” mentality, but this approach can also have the added advantages of increased moral and less problems during holiday periods / sick days.

Switching the emphasis from learned skills to documented information may be a viable option for some roles such as our production operative example above. This would also have the added advantage of reducing induction training duration and in theory, improving quality, as operations are standardised. Other options may include employing temporary agency, contract or interim management. There is some overlap here with contingency planning and of course, cost may also be a factor when considering how to mitigate the risk for each scenario.

Plans should also be made at this time to address any current knowledge gaps identified in the initial step of the process.

Execution:

Once mitigation plans have been made they should be put into place and carefully monitored and revised / adjusted, if not seen to be working or as the needs of the business evolve (Plan-Do-Check-Act.) Management review is an ideal time to take a step back and see how things are going.

This approach is not mandated by the standard, but if you are an SME, I hope this article has not given you too many nightmares but encouraged you to look at knowledge in a slightly different light. Of course, if you need any further assistance or guidance, I am happy to help.

Audit Check:

We can expect auditors to check to ensure that:

The organisation has processes in place to identify and acquire the organisational knowledge necessary to ensure ongoing conformity of products and services and that this knowledge is distributed as necessary within the organisation.

That knowledge is being maintained and protected and:

That a suitable change control process is operating to ensure that organisational knowledge is considered as part of the process for any modifications made to the management system. (See also articles 6.3 Planning of changes and 7.2 Competence.)

In summary, auditors are asking to see evidence that organisations have recognised and addressed the clause. It may not be a bad idea to reference what Organisational Knowledge means to your organisation within your Business Management System such as in the Quality Manual if you have one.