A.2Planning.(s.4.3)
A.2.1General
The success of the whole project will depend on the initial planning process. There is a need to identify what the IMS is intended to support, what is to be done, by whom, how and when, and what resources will be needed. Above all there will need to be a commitment by management at all levels to the development of the system. Training will be needed for people to be able to operate the system, and also to enable key employees to take part in its development in identifying hazards and opportunities and assessing the risks. The programme of implementation can in itself be a valuable aid to making all employees aware of the principles of risk and risk management as well as the specifics of safety, quality, etc.
Having defined the policy stating what is intended, the next logical step is to plan how it is to be put into practice. The Framework lists the following subjects which should be covered:
a) Identification of aspects and risks;
b) Selection of significant issues to be addressed;
c) Objectives and targets;
d) Identification of resources;
e) Identification of organizational structure, roles, responsibilities and authorities;
f) Planning of operational control;
g) Contingency preparedness for foreseeable events.
This last should be extended to cover specifically disaster recovery and business continuity.
In any sizeable organization the project will be a large one, involving many people and considerable time, and benefit may be obtained from using a formal project management system.
The integrated system will be process based, and the initial step should be to identify the processes and sub-processes involved in the business. If the business has adopted ISO 9001 this will have been done already, at least for those processes which affect the quality of the output.
For each process there then needs to be:
a) Identification of the inputs and outputs
b) Identification of the aspects and impacts associated with the process.
The best people to do this are those actually engaged in the process, suitably trained and assisted by managers as necessary.
This needs to be followed by
a) Identifying those aspects that could have a significant impact, and prioritizing them;
b) Deciding on control measures and implementing them.
For each process the aspects need to be identified which could have an impact on each of the disciplines that are to be brought within the integrated system. For example:
a) In the input stage, is there anything that might significantly affect:
- the quality of the output?
- the environment?
- occupational health and safety?
b) In the output stage, is there anything that might significantly affect:
- the quality of the output?
- the environment?
- occupational health and safety?
This demonstrates, incidentally, one of the advantages of an integrated system. In a traditional system these questions would be considered separately, at different times and quite possibly by different groups of people. In an integrated system, all these aspects (and others, such as customer satisfaction or information security) can be considered at the same time by the people who are actually involved in the process. There is, however, no requirement to have an integrated approach to identifying and prioritising aspects. The simple approach described above is offered only as an example of what might be adopted.
