Organisations are required by ISO 9001:2015 to apply appropriate controls to the design and development process. These controls must ensure:

1. That the results to be achieved are adequately defined,
2. Reviews are executed appropriately to assess the ability of the results of the design and development to meet specified requirements,
3. Suitable verification activities are carried out to ensure that the design and development outputs meet the input requirements,
4. That validation activities are conducted to check that the resulting products and services can meet the requirements for the intended application and use,
5. All appropriate actions are taken to resolve problems determined during reviews, verification, or validation activities,
6. That documented information is retained on all of the above.

The standard goes on to note that design and development reviews, verification, and validation each have distinct purposes and that they can be conducted separately or in any combination, as appropriate to the specific products and services of the organisation.

Comment:

The purpose of this clause is to provide assurance that the outputs of a design and development activities have met the input requirements. Note that there is no specific reference as to who should participate in design reviews. (Organisations will still of course need to demonstrate that all appropriate personnel / functions are involved.)

Organisations will need to ensure that validation activities are planned in at the appropriate stage of the process for the specific product or service under consideration. (See also Audit Check notes below.)

To clarify some terms:

Design and development verification.

Appropriate verification activities should be planned in to provide assurance that the outputs of a design and development activity will meet the input requirements. EG:

• Alternative calculations,

• Comparing a new design with a similar proven design,

• Building and testing of prototypes or computer simulations,

• Checking of drawings / specifications or other documents prior to issue.

Design and development validation

In simple terms, confirms that the final product and /or service will or does, meet the customer's requirements when it is in use.

As for verification, validation methods should be considered and determined in the design and development planning phase. Methods might include:

• Testing of initial samples of the final design by the organisation responsible for the design,

• Initial capability studies and endurance or "life" testing,

• Testing by an approved and agreed independent third party, such as a lab or test facility,

• Testing with the customer as part of a commissioning activity.

Audit Check:

Auditors will wish to check documented information (records) to verify that reviews, verifications, validations and any subsequent required actions have been executed satisfactorily. EG:

Design reviews:

• Adequate documented information (records) are maintained of reviews,

• Reviews are conducted to plan, at predetermined design process stages,

• Appropriate representatives, relevant to the phase of the project are involved in reviews. (EG: Cross Functional Teams.)

• All specified design inputs have been included in the process,

• Reviews indicate that stated design objectives are being achieved.

Verification activities

• Adequate documented information (records) are maintained of Verifications activities,

• Verifications activities have been planned, are appropriate and are being executed to plan,

• Verification results indicate input requirements are being met, or if not, that appropriate corrective actions have been identified and executed appropriately.

Validation activities

• Adequate documented information (records) are maintained of Validation activities,

• Validation activities have been planned to be executed at appropriate project phases. (IE wherever practical, prior to delivery to the customer,) are suitable to demonstrate capability and are being executed to plan,

• Validation results indicate that the product and / or services are capable of meeting the specified requirements or if not, that appropriate corrective actions have been identified and executed.