ISO 9001:2000 - Required Procedures or minimum required number?

[hokieman]

Where is this

Take a look at Doc_Matrix.pdf in the pdf files directory. It shows how simple documentation can be in a small company.

Mark:

Can you tell me where to find this directory! Thanks!!

 

[ricky]

Marc,

Can you tell me how to access this directory?

"Take a look at Doc_Matrix.pdf in the pdf files directory."

 

[Al Rosen]

Marc,

Can you tell me how to access this directory?

"Take a look at Doc_Matrix.pdf in the pdf files directory."

Free Files Directory

 

[Aalawgele]

madam / sirs

according to my information the ISO 9001-2008 requires 6 written procedures as minimuim (Control of Non-Conformance products/preventive action /corrective action/control of documents/control of quality records/internal audit)

and according to the size of your company you will or will not need to extra written procedures or work instruction.

 

[Chris_Anderson]

Paula,
Should have read further. (42 is the answer to life, the universe and everything - not 6)

There has been considerable discussion on this point, one example being:
ISO 9001:2000 Documentation Requirements

My offering in that thread was:
“It's intersting that these relate back directly to those areas that typically the "Quality Section" of a company is responsible for. This kind of suggests that it is the bare bones approach, and that if you do anything that adds value, beyond the QA stuff mentioned, then you'd better be able to back them up with something as well.”

This bare-bones SIX approach is crap, you could roll them all into one procedure if you wanted to, but you wouldn’t, because it doesn’t make for concise, compartmentalized reading, comprehension and adherence/compliance (or even auditing).

Martin, please tell us what your IQA tutor said about what should be in a quality manual - I can’t wait to hear that one! No wonder consultants have such a bad rep when they sprout garbage.

As you can tell this is an emotive subject for me. Why? Because quality systems (and quality managers) have been losing their credibility thanks to inexperienced low IQ consultants who flog generic management systems to unsuspecting companies and the companies are in turn registered/certified by corrupt registrars.

My new employer is ISO9001:1994 certified, and a great case in point. They have next to no objective evidence, a very thin collection of system procedures (4 of which cover the same topic under different headings) and next to no control over anything. They want to expand the certification to a global one for all their offices (my job). I’ll be busy righting past wrongs – and with a different third party auditor – AND I’LL BE USING MORE THAN SIX PROCEDURES.

ISO should come up with a scheme to reinforce the validity of a certificate/registration - oh, that's right, they're the third party auditors, D'oh, click, bang .......


------------------




[This message has been edited by David Mullins (edited 04 January 2001).]

In my experience, more than six procedures is crap. There are 21 records identified and the focus of your ISO system should be on the 21 records and not on 42 procedures.

More procedures do not make for a more stable ISO system. Most people don't read, understand, or follow the procedures in the first place. Having more procedures just creates more audit findings, more documents to control, and more documents to update.

What you want your people doing is measuring and monitoring processes by collecting transaction data (records) to understand product and process nonconformances. These records should then be analyzed in run charts or pareto charts in order to take corrective or preventive action. That is why you need the six required procedures and nothing else.

Once you get rid of those other procedures you can start focusing on the effectiveness of the system instead of blindly following (or not) procedures.

 

[Chris_Anderson]

There are 135 "shall" statements in ISO 9001:2008. Obviously you have to address every shall statement. But that does not mean they must be addressed in the Quality Manual directly. To me, the Quality Manual is a table of contents. It defines the scope, with exclusions, the procedures, or a reference to them, and a description of the processes. That's it. The remaining 135 shall statements can all be addressed through demonstrated actions, the 21 records, and other optional documents (i.e. training plan, skill matrix, realization, etc.). The idea is demonstrate a working system not talk about it in a quality manual. If you are not conforming to ISO then no amount of text in the quality manual will help you conform. It is all about your actions not your words.

 

[Big Jim]

In my experience, more than six procedures is crap. There are 21 records identified and the focus of your ISO system should be on the 21 records and not on 42 procedures.

More procedures do not make for a more stable ISO system. Most people don't read, understand, or follow the procedures in the first place. Having more procedures just creates more audit findings, more documents to control, and more documents to update.

What you want your people doing is measuring and monitoring processes by collecting transaction data (records) to understand product and process nonconformances. These records should then be analyzed in run charts or pareto charts in order to take corrective or preventive action. That is why you need the six required procedures and nothing else.

Once you get rid of those other procedures you can start focusing on the effectiveness of the system instead of blindly following (or not) procedures.

A bigger determination of how may procedures are needed is how much structure, guidance, and help each individual organization needs. Most companies starting out need a lot more help that simply what to do on the six required topics.

 

[Big Jim]

There are 135 "shall" statements in ISO 9001:2008. Obviously you have to address every shall statement. But that does not mean they must be addressed in the Quality Manual directly. To me, the Quality Manual is a table of contents. It defines the scope, with exclusions, the procedures, or a reference to them, and a description of the processes. That's it. The remaining 135 shall statements can all be addressed through demonstrated actions, the 21 records, and other optional documents (i.e. training plan, skill matrix, realization, etc.). The idea is demonstrate a working system not talk about it in a quality manual. If you are not conforming to ISO then no amount of text in the quality manual will help you conform. It is all about your actions not your words.

Early in my career, one of the auditor's I worked with provided me with a spreadsheet detailing just how many shalls there really are in ISO 9001:2000. Accounting for the times that a shall statement has several topics included in it (a list of a, b, c, etc.) that list came up with many more the 135. It showed 284.

I have not tried to go through the exercise for ISO 9001:2008, but since there are no new requirements, the count should be the same.

And I absolutely agree that it would be cumbersome to account for all of them in a set of procedures (although I have met some quality professionals who seem to think it is necessary).

For what it is worth, API Q1 does require that the quality manual account for how every requirement is to be met, and it has a lot of enhancements above ISO 9001:2008. I don't know if any other standards require it though.

 

[Chris_Anderson]

There are 135 occurrences of the word "shall". Yes, there are a lot of sub elements to many of the "shall" statements. If you add up the elements then 284 sounds reasonable.

 

[Chris_Anderson]

A bigger determination of how may procedures are needed is how much structure, guidance, and help each individual organization needs. Most companies starting out need a lot more help that simply what to do on the six required topics.

The point is that if you focus on process outcomes then the process becomes effective.

For example: lets take training. It is not a required procedure but does contain a required record (or set of records). Do you really need a procedure that says you will create a skills matrix, review the matrix to develop a training plan, review employees outcomes to determine training effectiveness, etc. OR... do you need a process that demonstrates that these things are occurring. Post a skills matrix on the wall along with a training schedule of upcoming training. Posts defect rates or performance numbers and note changes before and after training. Demonstrating that the system works is more important than writing a procedure that is not used. Procedures don't drive conformance, management commitment drives performance. Which means, you have to show the system is used and management has to care that it is used.

I have build systems with six procedures that were far more capable and effective than systems using a lot of procedures.