Hi Mannu,
Here are some suggestions. (There is no one-size-fits-all way.)
My organisation is going for ISO 9001:2000 certification. I was going through the training material on ISO 9001:2000.
I have a few questions:
1. What could be the approach to do a ISO 9001:2000 Gap Analysis for an organisation?
1. Assess the gap "on paper' between your written processes and the ISO 9001 requirements.
2. Assess the gap between your written processes and what you actually do.
3. Plan to close the gaps by prioritising those that will bring most benefit to your business performance and giving them most effort and attention: aim to sail way over the bar rather than merely to comply, using ISO 9001 certification to propel your business forward. Then it will become a return-on-investment project, not just a "cost of doing business", and it will be easier to sustain management commitment when the going gets tough.
2. How to perform a Gap Analysis for ISO 9001:2000? Do we go by the clauses? or do we go by the departments/ Process Areas?
By department or process areas, identifying the relevant clauses on the way in. Some clauses will be relevant to many departments, and not always implemented the same way. Doing it by clauses fragments the management system, in my experience. You'll miss the gaps between process hand-offs and these are often the biggest bang for the buck in terms of return on the ISO 9001 investment (aside from getting the certificate, that is).
(Doing doc control, for example, the same way everywhere isn't mandatory, and not even always efficient. Software engineers might find it convenient to keep docs in configuration management tools while sales people might be at the 'controlled shared filesystem" stage.)
3. If we have to do a Gap Analysis of an Outsourcing/ Vendor management department, How can we go about it? What can be the clauses we can look for?
Formally you can only audit your outsourcing and vendor management against 7.4.1, 7.4.2 and 7.4.3. The trick is in how you determine criteria for buying from them and how you monitor and improve their performance.
Typically you'll have performance monitoring and, in your contracts, a method for initiating and monitoring corrective actions when necessary.
If you're out-tasking to them (they operate processes that you define) then still, your ISO 9001 audits are limited to section 7.4. You could, however, choose to write into their contracts that their enactment of processes you define are audited either by external auditors or your own, in which case all relevant clauses of ISO 9001 would apply.
Hope this helps,
Patrick
