I think I may be in a pickle of a situation here so I'm posting here to try to get some help.

I've just finished university and have scored a 3 month contract (which should lead into full time work) with a small pharmaceutical company. The contract pretty much states I need get the company ready for ISO 9001:2000 certification.

My major problem is the timeline, as I said before I have 3 months to get it done and because I've never worked for the company, I don't know anything about how they function. The plus side is that the company has 4 people in it and from what preliminary information i gathered so far, the company's operations aren't too complicated and are on a small scale.

So considering all that, here is my generic plan of attack on completing this project.

1. Find out how the business operates:
- find out on a general level what the company does
- find out the core business functions
- determine interactions between core business functions
- map out all processes and procedures within and between each function
2. Find out which one of these processes/procedures have been documented
3. Create a flow chart of ISO 9001:2000 requirements
4. Find out what process/procedure documents are missing
5. Create these missing documents
6. Plan to address and complete ISO 9001:2000 requirements section by section (i.e. sections 4-8

I know this is a very sketchy plan but its the best I can come up with considering this will be the first full time role I've had (fresh university graduate) and I have close to no idea how the company operates imtimately.

Any help or amendments to my plan would be greately appreciated.

There are lots of 'How to Implement ISO 9001' threads here.

And have you taken a look through How to Implement a Quality Management System (http://elsmar.com/Imp/)?

In general your list looks OK to me. But I think it will be less of a documentation issue than you might think. Your Step 2 is essentially a 'Gap Analysis'.

Also remember that ISO 9001 compliance is more than the 'required' documents. There are required systems that there are no specific documentation (as in procedures) for.

Have you read, and do you have a good understanding of, ISO 9001?

I'm pretty sure I have a good understanding of ISO 9001:2000 from reading the manual and a guide book (400 pages for a 14 page standard) written for the manual by Jay Schlickman. I also have acquired a quality manual from a hosiptal to help me along.

I know its more than documented procedures (from reading back I didnt write about my situation very clearly) but Ii thought it would be a good to start off with documented processes/procedures and move from there. I think this will give me a good understanding of how the company works and will be easier for me to create/apply the other non-documented requirements of the standard to the company.

What about GMP and related drug requirements?

Marc posts a good question. Applicable regulatory and statutory requirements must also be satisfied within the scope of the QMS.

Are they producing product? Where are their products sold?

It could help if you give us a general idea of what they do, for instance, are they developing pharma, producing pharma, or perhaps related things like making those little cellulose pill bodies?

Sounds like you've got a good foundation of understanding ISO 9001:2000. I recommend purchasing a copy of ISO 9001:2000 and ISO 9000:2005 (definitions of words and concepts). I also recommend process mapping the organization as a first step, which can be helpful to develop a focus on the processes and objectives right off the bat.

Welcome to The Cove and I wish you good work.

Thanks for the feedback.

I know its a bit of a pain trying to get help without explain what the company does but one of their competitive advantages lies in the business model, hence my reluctance to give any information out. I have considered GMP regulations and they don't apply as the company wholesales goods and does not manufacture. I just had a meeting with one of the employees giving me a brief overview of the company and I think, as atetsade mentioned, a process mapping exercise is the best approach for someone in my situation. I think i will then overlay ISO requirements on top of that.

Thanks for the quick responses and I'm sure to come back for more help as you guys are so helpful and fast with responses. Theres nothing better than having a flock of mentors at your disposal :).

Excellent.

There's a really good thread running that you might want to read, as well.

http://elsmar.com/Forums/showthread.php?p=156264

Feel free to post more questions, especially as you progress.

Are they planning to register in 3 months? This is not likely.

Are they planning to register in 3 months? They would like to but I have no idea how long the audit process takes or how far in advance you have to book? Why do you think this is not a possibility?

Are they planning to register in 3 months? They would like to but I have no idea how long the audit process takes or how far in advance you have to book? Why do you think this is not a possibility?

I for one would seriously doubt that it would be possible, provided that the QMS should give a true picture of the processes in the company. It is possible to produce a Quality Manual largely by "copy-paste" but if you want a version that is true to the company it would take a lot longer. I would venture a guess of no less than 6 months and up to 1 year.....:notme:

I for one would seriously doubt that it would be possible, provided that the QMS should give a true picture of the processes in the company. It is possible to produce a Quality Manual largely by "copy-paste" but if you want a version that is true to the company it would take a lot longer. I would venture a guess of no less than 6 months and up to 1 year.....:notme:


don't registrars like to see at least 3 months of records to show evidence that the system is functioning?

don't registrars like to see at least 3 months of records to show evidence that the system is functioning?

Honestly, I'm not sure. If, for instance, you opened a new factory then you couldn't provide 3 months of records, but I believe that you could have your system approved anyway, provided that you could establish that the manual were appropriate and training had been conducted. Then again, it wouldn't be a true picture that had been established but a baseline. I think some registrars might buy into that.

Any estimate has to be based on the conditions. Three months to registration is too short based on any conditions.

Your next step is to ask a registrar how mature a system they will assess in this given situation. Get quotes while you're at it. Discordian is correct that registrars have requirements for system maturity, and 3 months of records is often stated. When I talked to registrars, they have given different guidelines for system maturity, more detailed, like have 3 completed corrective actions and a management review, etc.

If this were my assignment, I would ensure that the implementation were my only responsibility for 3 months solid. Then I would test the waters with a Gantt chart showing all the steps, and run by that. In 3 months a system could be complete and active, PERHAPS, and a registration audit scheduled 5 months in.

However, if they think they can bring in someone and get registered in 3 months, it's possible they don't understand what's involved or what will be required of them, in which case it wouldn't be worth the effort.

Why do they want to be registered to ISO 9001:2000?

Why do they want to be registered? Streed Cred. They are a pretty small company competing against other companies so large they have their own in house testing and are TGA approved to make their own stuff too. My boss thinks that it will give them credibility and possibly open up more opportunities.

Good.

Hopefully you will be able to explain what is involved and alter the project somewhat. Get a registrar to tell you how long a system must be matured before a 3rd party audit, and you'll have the right info for them.

This is what I would do:

Get the documents ISO 9000:2005 and ISO 9001:2000
Obtain registration quotes from registrars
Process map the company's major processes
Establish objectives for each process (look into turtle diagrams)
Audit the company yourself (gap analysis)

Work like **** to bring the system in line with the standard

Hire a good consultant to do a full audit in 3 months
Hire a registrar to audit in 5.

Still, and for a first time implementation, that's just a bit too fast really.