ISO 9001 Implementation Time Frame

[BonusEventus]

Hi All,

I have been working in QMS development for about 10 years, but am just now making the leap into independent consulting. I've just about finalized a contract with my first potential client. Most of my experience is in 13485, but this initial client is a food manufacturer. They are looking to implement a QMS that is compliant with ISO 9000, but not necessarily looking to get it certified yet.

To finalize the contract, I need to give them the estimated project time frame and billable hours. I've never done an ISO 9000 system before, but based on previous experience with 13485 I think I could get it done in 120 hours over the course of a month. Does that sound overall reasonable to anyone with experience in this type of implementation?

Thanks!

 

[Jim Wynne]

Assuming that you're referring to ISO 9001, what does "...implement a QMS..." mean? The amount of time you'll have to spend is wholly dependent on several factors, including the company's current state of compliance. Have you done a gap analysis? 120 hours seems very optimistic, but without knowing what needs to be done it's impossible to provide a reasonable time frame.

 

[qualprod]

Hi All,

I have been working in QMS development for about 10 years, but am just now making the leap into independent consulting. I've just about finalized a contract with my first potential client. Most of my experience is in 13485, but this initial client is a food manufacturer. They are looking to implement a QMS that is compliant with ISO 9000, but not necessarily looking to get it certified yet.

To finalize the contract, I need to give them the estimated project time frame and billable hours. I've never done an ISO 9000 system before, but based on previous experience with 13485 I think I could get it done in 120 hours over the course of a month. Does that sound overall reasonable to anyone with experience in this type of implementation?

Thanks!

It depends of quantity of processes, people,if includes 8.3 the most important, other, top management involvement.
As an example: I have seen this, 6 months time frame, no design, 60 people, 10 processes, with assistances to the offices, twice a week and some support by email.

 

[Bill Levinson]

It depends on the size of the organization and the number of processes. I think a small shop would be doable in a month with this kind of intense effort. This is because, if they have any kind of QMS whatsoever, and it's hard to imagine them being in business without one, they probably have most of what they need, and just need to align it with ISO 9001:2015 by showing how their processes fulfill the clauses, and also the customer-supplier relationship between their processes. Using a Conformity Matrix to Align Processes to ISO 9001:2015 | Quality Digest but note the caveats given in the comments.

 

[Jim Wynne]

It depends on the size of the organization and the number of processes. I think a small shop would be doable in a month with this kind of intense effort. This is because, if they have any kind of QMS whatsoever, and it's hard to imagine them being in business without one, they probably have most of what they need, and just need to align it with ISO 9001:2015 by showing how their processes fulfill the clauses, and also the customer-supplier relationship between their processes. Using a Conformity Matrix to Align Processes to ISO 9001:2015 | Quality Digest but note the caveats given in the comments.

What about audits and competent auditors (as just one example)? A QMS is not the documentation. A map is not the territory.

 

[Bill Levinson]

What about audits and competent auditors (as just one example)? A QMS is not the documentation. A map is not the territory.

I was assuming that the processes of the QMS are documented (even though ISO 9001:2015 is somewhat looser on this than ISO 9001:2008--and IATF 16949 is not nearly as permissive). My own position is that the processes of the QMS should be documented regardless of what ISO 9001 says, although I am entitled to my own opinion but not my own standard. The organization will also need an internal auditor (ASQ CQA or equivalent) to meet the internal audit requirements.

E.g. if the organization has a material review board, and the policy is that the MRB reviews nonconformances, my own opinion is that this should be documented with specific identification of who (by job title) is on the MRB and what they are responsible for doing. Same for corrective and preventive action--what happens, and who does it?

 

[Randy]

"The organization will also need an internal auditor (ASQ CQA or equivalent) to meet the internal audit requirements."...

Nope, all that's required is that an auditor be competent and that's determined by the organization...No training, no certification, no nothing other than competent.

 

[Bill Levinson]

"The organization will also need an internal auditor (ASQ CQA or equivalent) to meet the internal audit requirements."...

Nope, all that's required is that an auditor be competent and that's determined by the organization...No training, no certification, no nothing other than competent.

That is actually correct, although your external auditor/certification body might ask, "How do you know your internal auditor is competent?" An internal training program (I went through a 2-day one at my last full time employer before I got the CQA credential) will work. If there is no training program, though, how do you know the auditor is competent? There might be other ways to achieve this, though.

 

[Jim Wynne]

That is actually correct, although your external auditor/certification body might ask, "How do you know your internal auditor is competent?" An internal training program (I went through a 2-day one at my last full time employer before I got the CQA credential) will work. If there is no training program, though, how do you know the auditor is competent? There might be other ways to achieve this, though.

If there is a training program, how do you know the auditor is competent? Training ≠ competence.

 

[Bill Levinson]

If there is a training program, how do you know the auditor is competent? Training ≠ competence.

There needs to be some kind of assessment (test or equivalent), to ensure that the person knows the job. This requirement applies to on-the-job training as well. The nice thing about the CQA (or equivalent, as might be issued by a training company) is that there has been some assessment of skills.