Demistfying ISO9001 Part 2

As a follow up to an earlier post about simplifying the terminology of ISO9001, I decided to pick another section that seems to give first timers a bit of grief and break it down into simpler parts.

Section 8.2.4 of the standard covers Monitoring and Measurement of Product. This is another section of the standard that can be quite difficult to apply to non-manufacturing industries.

Broken down into its individual parts though it is a bit more management.

Part 1:

"The organization shall monitor and measure the characteristics of the product to verify that product
requirements have been met."

Ok, so what this is asking you to do is determine what your customers require of your product/service, and how to prove that the requirements have been met. This is still quite a "manufacturing" style requirement but it can still be applied to other business types.

Lets take a construction company for example. By setting check points throughout the construction process, you can accurately determine your adherence to customer requirements without waiting till the end and having to make changes.

Part 2:

The second part of this requirement basically echoes what I said in part 1.

"This shall be carried out at appropriate stages of the product realization process in accordance with the planned arrangements (see 7.1). Evidence of conformity with the acceptance criteria shall be maintained."

What this is asking is that throughout your production/service delivery process, that you set checkpoints (where you see fit) throughout the process to ensure that you are still meeting requirements and keep evidence of it.

So in the case of the construction company, keeping evidence of each verification stage (ie. customer
sign off on decisions) would meet this requirement.

Part 3:

The last part is pretty straightforward


"Records shall indicate the person(s) authorizing release of product for delivery to the customer (see 4.2.4). The release of product and delivery of service to the customer shall not proceed until the planned arrangements
(see 7.1) have been satisfactorily completed, unless otherwise approved by a relevant authority and, whereapplicable, by the customer."

This basically just says whoever is responsible for approving your finished product needs to keep records of approval that all requirements have been met before handing it over to the customer.

Hopefully this makes this section a bit more digestible.

Three Things that Most Certified Businesses are Terrible At

There are three specific ISO9001 requirements that I find most businesses I visit are terrible at.

These are:

- Document Control
- Corrective & Preventative Action; and
- Management Review

I'm not entirely sure why it is, but I think its because it takes a real drive from the top to make it work. Funnily enough the businesses that do it well are generally the ones where the business owner or General Manager has taken a really active role in developing and implementing the Management System.

Implementing Document Controls is an absolute pain when starting to develop a new Management System. Everyone loves to keep a copy of forms in their own personal folder so they don't have to keep looking for them when they're needed. People also love creating their own forms to suit their needs without going through any approval process. This is where the drive from senior management is required. If the boss is strict on document control then everyone tends to fall in line.

Corrective and Preventative Action is also a requirement that tends to get overlooked until right before an audit or until a major issue has occurred. By rewarding identification of potential and actual issues rather than punishing non-conformance it changes the culture of corrective and preventative action. People will be much more inclined to report issues if they won't get in trouble for it and there is an incentive to do so.

Lastly Management Review is probably the most poorly handled ISO9001 requirement that I see on a regular basis. It is rare to see a properly minuted, detailed and beneficial Quality Management Review that covers all of the agenda input items required by ISO9001. The majority I see are done purely to meet auditor requirements and provide no real benefit to the business whatsoever. This is one requirement that really needs a strong leader to ensure it gets done and gets done well.