ISO 9001:2015 requires organisations to plan, implement and control their processes as required for the provision of products and services, and to implement the actions determined in planning activities. (See Planning articles 6.1, 6.2 and 6.3)

To achieve this, organisations must first determine the requirements for the products and services to be provided and establish criteria for both the processes, and the acceptance of the products and services.

In addition, organisations must:

1. Establish the resources required to achieve conformity to the product and service requirements,
2. Control the processes in accordance with the established criteria,
3. Determine, maintain, and retain documented information appropriately, in order to have confidence that the processes have been executed as planned and to demonstrate the conformity of products and services to identified requirements.

The output of this planning must be appropriate to the organisations specific operations and any changes must be planned and controlled. In addition, reviews must be conducted into the consequences of unintended changes, including the taking of any necessary action to mitigate any adverse consequences.

Note: Outsourced processes must also be controlled. (See article 8.4.1, 8.4.2 and 8.4.3)

Comment :

Section 8.0 of ISO 9001:2015 is primarily concerned with the operational "Do" part of the Plan, Do, Check, Act cycle.

To summarise clause 8.1, organisations must:

Establish their product and service requirements, and then look at the relevant processes to determine how they will be controlled and measured. IE: Specifications, tolerances, targets, values, Key Performance Indicators. In addition, resources necessary to ensure conformity to product / service requirements need to be established.

Consideration should be given to all processes (direct and indirect,) required to deliver products and services that meet customer requirements. At an operational level, the automotive industry (and increasingly, other sectors also) has pushed product and operational planning with its suppliers for many years through the Advanced Product Quality Planning process (APQP) and other similar methodologies. The output of the APQP process includes requirements for a risk identification and mitigation step (Failure Mode Effects Analysis) for both products and processes which feeds into the process planning stage (Process Flow Diagrams) and monitoring and control methods (Control Plans.) Such tools are outside the scope of these articles, but there are many sources available which explain these methodologies in depth if they are appropriate to your organisations (or your customers) specific requirements.

Audit Check:

Auditors may seek to verify that organisations have planned their processes – certainly for any processes recently introduced. IE documented evidence that inputs and outputs, process controls and criteria have been established. That process monitors and performance indicators have been identified and that appropriate resources have been included in the planning process.

As the identification and mitigation of risk now permeates the standard, organisations should also expect also to be asked to demonstrate how their process planning has identified and addressed risk.