Quality management system

ISO 9001:2015
Eng. Mohamed Ysser
ISO 9001:2015
 Quality Management System (4)

Operations & its

Context Support &
(4) Operation
Plan (7, 8) Do
Customer
Satisfaction
Customer Leadership Performance
Planning Results of
Requirements (5) Evaluation
(6) The QMS
(9)
Products &
Services
Act Check
Needs and Improvement
Expectations of (10)
Relevant interested
Parties (4)
Annex SL - A high level structure for all future ISO standards
A new High Level Structure (HLS) for all future ISO standards
1. Scope
2. Normative references
3. Terms and definitions
4. Context of the organisation (P)
5. Leadership (P)
6. Planning for the management system (P)
7. Support (P, D)
8. Operation (D)
9. Performance evaluation (C)
10. Improvement (A)
CLAUSE 4 : Context of the
Organisation

4.1 Determining the internal &

external issues

4.2 Understanding the needs and

expectations of interested parties

4.3 Determining the scope of the

Quality management system

4.4 Quality management system

CLAUSE 5 : Leadership and
commitment
5.1.1 General
5.1.2 Customer focus
5.2 Quality Policy
5.3 Organizational roles,
responsibilities, accountabilities
& authorities
CLAUSE 6 : Planning
6.1 Actions to address risks and opportunities
6.2 Quality Objectives and Planning to Achieve Them
6.3 Planning of changes
 Risk thinking

What is Risk thinking and its relation with

process approach and PDCA Model
for ISO 9001:2015 ?
Risk Management Process

• Risk
• Uncertain or chance events that planning can not
overcome or control.
• Risk is the possibility of events or activities
impeding the achievement of an organization’s
strategic and operational objectives.
• Risk Management
• A proactive attempt to recognize and manage
internal events and external threats that affect
the likelihood of a business's success.
Risk Management’s Benefits

• A proactive rather than reactive approach.

• Reduces surprises and negative
consequences.
• Prepares the project manager to
take advantage of appropriate risks.
• Provides better control over the future.
• Improves chances of reaching project performance objectives
within budget and on time
What is “Risk-Based” Thinking

• Risk-based thinking is something we all do automatically and

often sub-consciously
• The concept of risk has always been implicit in ISO 9001 – the
2015 revision makes it more explicit and builds it into the
whole management system
• Risk-based thinking is already part of the process approach
• Risk-based thinking makes preventive action part of the
routine
• Risk is often thought of only in the negative sense. Risk-based
thinking can also help to identify opportunities. This can be
considered to be the positive side of risk
Why Should I adopt
“Risk-Based Thinking”?
• To improve customer confidence and
satisfaction
• To provide confidence in the organization’s
ability to consistently provide customers with
conforming goods and services
• To establish a proactive culture of prevention
and improvement
• Successful companies intuitively take a risk-
based approach
What Should I Do? (1/2)

1- Identify what the risks and opportunities

are in your organization – it depends on
context, interested parties needs and
expectations, and the nature of the process.
–ISO 9001:2015 will not automatically require
you to carry out a full, formal risk
assessment, or to maintain a “risk register”
–ISO 31000 (“Risk management — Principles
and guidelines”) will be a useful reference
(but not mandated)
What Should I Do? (2/2)
2- Analyze and prioritize the risks and opportunities in
your organization
– what is acceptable?
– what is unacceptable?
3- Plan actions (Contingency Plan) to address the risks
– how can I avoid or eliminate the risk?
– how can I mitigate the risk?
4- Implement the plan – take action (Do)
5- Check the effectiveness of the actions – does it
work?
6- Learn from experience – continual improvement (Act)
Contingency Planning
• Contingency Plan
• A plan of actions that will reduce or mitigate the
negative impact (consequences) of a risk event.
• An alternative plan that will be used if a possible
foreseen risk event actually occurs.
• Risks of Not Having a Contingency Plan
• Having no plan may slow managerial response.
• Decisions made under pressure can be
potentially dangerous and costly.
 Key Points to Remember

oRisk Based Thinking = Preventive Action

oRisk Based Thinking is everybody’s
business!
– Risk Based Thinking is not just the
responsibility of management
– Risk Based Thinking must become an
integral part of the organizational culture
Risk Parameters

Risk can be defined by two (2)

parameters
– Severity
This is the Seriousness of the harm
– Probability
This is the Probability that the harm will
occur
Risk Assessment
SEVERITY
S1 S2 S3 S4 S5

High O5

PROBABILITY
Medium
O4
Low

O3

O2

O1
Risk Acceptable Regions
SEVERITY
Generally
S1 S2 S3 S4 S5 Un-Acceptable

O5
PROBABILITY

O4
GU
O3
ALARP
O2
As Low As
“Reasonably”
O1
Generally
GA Practical
Acceptable
CLAUSE 7: Support
7.1 Resources
7.2 Competence
7.3 Awareness
7.4 Information and Communication
7.5 Documented information
CLAUSE 8: Operation
8.1 Operational planning & control
8.2 Requirements for products and services
8.2.1Customer communication
8.2.2 Determining the requirements for products and services
8.2.3 Review of the requirements for products and services
8.2.4 Changes to requirements for products and services
CLAUSE 8: Operation
8.3 Design and development of products and
services
8.3.1 General
8.3.2 Design and development planning
8.3.3 Design and development inputs
8.3.4 Design and development controls
8.3.5 Design and development outputs
8.3.6 Design and development changes
CLAUSE 8: Operation
8.4 Control of externally provided
processes, products and services
8.4.1 General
8.4.2 Type and extent of control
8.4.3 Information for external providers
CLAUSE 8: Operation
8.5 Production and service provision
8.5.1 Control of production and service provision
8.5.2 Identification and traceability
8.5.3 Property belonging to customers or external
providers
8.5.4 Preservation
8.5.5 Post-delivery activities
8.5.6 Control of changes
CLAUSE 8: Operation
8.6 Release of products and services
8.7 Control of nonconforming outputs
CLAUSE 9: Performance evaluation
9.1 Monitoring, measurement, analysis
and evaluation
9.1.1 General
9.1.2 Customer satisfaction
9.1.3 Analysis and evaluation
9.2 Internal audit
9.3 Management review
CLAUSE 10: Improvement
10.1 General
10.2 Nonconformity and corrective action
10.3 Continual improvement