Audit Of Electronic Documents In ISO 9001 Standards

Audit Of Electronic Documents In ISO 9001 Standards

Electronic documents that establish management system policies and procedures can be in a variety of file formats depending on the software applications that are utilized by the organization to generate the documents. Electronic file formats include, Text, HTML, PDF, etc. Spreadsheets and databases formats are also considered to be electronic “documents” subject to the control elements of the management system to being audited.

Given the relative ease with which users can now create electronic spreadsheets and other electronic documents, auditors (either internal or external) should ensure that policies governing the controls that apply to management system documentation in-general are also employed for electronic documents through appropriate procedures.

Organizations need to employ suitable and effective methods within the electronic environment for ensuring the adequate review, approval, publication and distribution of its management system documentation. These should be consistent with the methods for the development and modification of electronic documents.

In many cases document control measures may also be standard features of software applications used for their creation. Therefore auditors should understand these application-specific controls to the degree that these are utilized as a basis for conformance to the applicable management system standard.

Given the increased capacity to modify, update, reformat and otherwise improve documents within an electronic-based management system, auditors should pay particular attention to control elements such as document identification and document revision level.

As electronic media facilitates an increased rate of document modifications, auditors should verify that the controls being employed for the management of obsolete documents are considered within the organizations’ document control policies and procedures.

Auditors should verify that electronic-based documentation exists to provide orientation to users with regard to the functional and control aspects associated with electronic documents. Additionally, “Point-of-use” requirements associated with the applicable management system standards will typically be addressed in part by the organization’s document access policies. Auditors should understand the organization’s policies and procedures regarding user privileges as these become important factors for properly realizing the organization’s processes.

External electronic communication with suppliers, customers and other interested parties may involve the exchange of documents. Given that these external documents may contain key parameters that specify the functioning of the organization’s processes, auditors should verify the degree to which these documents are formally introduced and controlled within the electronic-based management system.

ISO 9001 Standards & ISO 14001 Standards

In order to assist organizations to have a full understanding of the new ISO 9001:2008, it may be useful to have an insight on the revision process, how this revision reflects the inputs received from users of the standard, and the consideration given to benefits and impacts during its development.

Prior to the commencement of a revision (or amendment) to a management system standard, ISO/Guide 72:2001 Guidelines for the justification and development of management system standards recommends that a “Justification Study” is prepared to present a case for the proposed project and that it outlines details of the data and inputs used to support its arguments. In relation to the development of ISO 9001:2008 user needs were identified from the following:

-the results of a formal “Systematic Review” on ISO 9001:2000 that was performed by the members of ISO/TC 176/SC2 during 2003-2004
-feedback from the ISO/TC 176/Working Group on “Interpretations”
-the results of an extensive worldwide “User Feedback Survey on ISO 9001 and
The Justification Study identified the need for an amendment, provided that the impact on users would be limited and that changes would only be introduced when there were clear benefits to users.

The key focuses of the ISO 9001:2008 amendment were to enhance the clarity of ISO 9001:2000 and to enhance its compatibility with ISO 14001:2004.

A tool for assessing the impacts versus benefits for proposed changes was created to assist the drafters of the amendment in deciding which changes should be included, and to assist in the verification of drafts against the identified user needs. The following decision making principles were applied:

1) No changes with high impact would be incorporated into the standard;

2) Changes with medium impact would only be incorporated when they provided a correspondingly medium or high benefit to users of the standard;

3) Even where a change was low impact, it had to be justified by the benefits it delivered to users, before being incorporated.

The changes incorporated in this ISO 9001:2008 edition were classified in terms of impact into the following categories:

-No changes or minimum changes on user documents, including records

-No changes or minimum changes to existing processes of the organization

-No additional training required or minimal training required

-No effects on current certifications

The benefits identified for the ISO 9001:2008 edition fall into the following categories:

-Provides clarity

-Increases compatibility with ISO 14001.

-Maintains consistency with ISO 9000 family of standards.

-Improves translatability.

Origin Of ISO 9000 Standards

The story of ISO 9000 Standards is a story of standards, methods and regulation. The brief
history that follows is in no way comprehensive but is intended to illustrate
four things:
1. that ISO 9000 standards are an ancient concept that survived several millennia;
that a means of verifying compliance often follows the setting of
standards;
2. that the formalizing of working practices is centuries old and seen as a
means to consistently meet standards;
3. that market regulation (relative to the standard of goods and services) has
been around for centuries for the protection of both craftsmen and
traders.
4. ISO 9000 is a symptom of practices that were around centuries before anyone
coined the term quality management. It is in some respects a natural
progression that will continue to evolve. The story is told from a British
viewpoint.

ISO 9000 grew out of BS 5750, a standard published by the British Standards Institution (BSI) in 1979. Initially, it was used only in manufacturing industries. ISO 9000 is now employed across a variety of other types of businesses. It is a set of international standards of quality management systems. ISO 9000 has been accepted by more than 100 countries as their national quality assurance standard by the end of 1997.
The history of ISO 9000 Standards dates back to Mil-Q-9858a, the first quality standard for military procurement established in 1959 by the US. By 1962, NASA (National Aeronautics and Space Administration) developed its quality system requirements for suppliers. In 1965, NATO (North Atlantic Treaty Organization) accepted the AQAP (allied quality assurance procedures) specifications for the procurement of equipments.
During the 1970s, BSI published BS 9000 (the first UK standard for quality assurance) and BS 5179 (guidelines for quality assurance) norms. In 1979, it created BS 5750, a series of standards for use by manufacturing companies. They were enforced through assessments and audits. In 1988, ISO (International Standards Organization) adopted the BS 5750 standard without changes and published it globally under the name ISO 9000. The ISO adopted this standard with a view to create an international definition of the necessary characteristics of a quality system for all businesses, regardless of industry. In 1994, the ISO revised the ISO 9000 standard and published it globally.
In the beginning, ISO 9000 was implemented exclusively by large companies. But by mid-1990s, small and mid-sized companies began to increasingly implement these standards. In the United States, the total number of registrations increased from a little more than 2,200 in 1993 to more than 17,000 in 1998. Of these 17,000 registrations, almost 60 percent were held by businesses with annual sales of $100 million or less.

Document Review In ISO 9000 Standards

Document Review In ISO 9000 Standards

Top Management Commitment In ISO 9000 Standards

Top Management Commitment In ISO 9000 Standards

The top management (managing director or chief executive) should demonstrate a commitment and a determination to implement an ISO 9000 quality management system in the organization. Without top management commitment, no quality initiative can succeed. Top management must be convinced that registration and certification will enable the organization to demonstrate to its customers a visible commitment to quality. It should realize that a quality management system would improve overall business efficiency by elimination of wasteful duplication in management system.

The top management should provide evidence of its commitment to the development and implementation of the quality management system and continually improve its effectiveness by:

- Communicating to the organization the importance of meeting customer as well as statutory and regulatory requirements,

- Defining the organization’s quality policy and make this known to every employee,

- Ensuring that quality objectives are established at all levels and functions,

- Ensuring the availability of resources required for the development and

implementation of the quality management system,

- Appointing a management representative to coordinate quality management

system activities, and

- Conducting management review.

The top management should also consider actions such as:

a. Leading the organization by example,

b. Participating in improvement projects,

c. Creating an environment that encourages the involvement of people.

This type of top management commitment may be driven by:

a. Direct marketplace pressure: requirements of crucial customers or parent

conglomerates.

b. Indirect marketplace pressure: increased quality levels and visibility among

competitors.

c. Growth ambitions: desire to exploit market opportunities.

d. Personal belief in the value of quality as a goal and quality management systems as a means of reaching that goal.

The top management should identify the goals to be achieved through the quality

management system. Typical goals may be:

• Be more efficient and profitable

• Produce products and services that consistently meet customers’ needs and

expectations

• Achieve customers satisfaction

• Increase market share

• Improve communications and morale in the organization

• Reduce costs and liabilities

• Increase confidence in the production system

ISO 9000 Standards – Conducting Management Reviews

ISO 9000 Standards – Conducting Management Reviews

The ISO 9000 standards requires that top management conduct

management reviews.

The term review is defined in ISO 9001 as an activity

undertaken to ensure the suitability, adequacy, effective-

ness and efficiency of the subject matter to achieve

established objectives. The addition of the term manage-

ment means that the management review can be

perceived as a review of management rather than a

review by management, although both meanings are conveyed in the standard.

The rationale for this is that the examples given in ISO 9000 such as design

review and nonconformity review clearly indicate it is design and non-

conformity that is being reviewed. If the system was to be reviewed then the

action should be called a system review. It is no doubt unintentional in the

standard but, if the management system is perceived as the way in which the

organization’s objectives are achieved, a review of management is in fact a

review of the way achievement of objectives is being managed because the

organization exists to achieve objectives and so both meanings are correct.

Top management will not regard the management review as important unless

they believe it is essential to running the business. The way to do this is to treat

it as a business performance review. This is simpler than it may appear. If the

quality policy is now accepted as corporate policy and the quality objectives

are accepted as corporate objectives, any review of the management system

becomes a performance review and no different to any other executive

meeting. The problem with the former management reviews was that they

allowed discussion on the means for achieving objectives to take place in other

management meetings leaving the management review to a review of errors,

mistakes and documentation that no one was interested in anyway. The

management system is the means for achieving objectives therefore it makes

sense to review the means when reviewing the ends so that actions are linked to

results and commitment secured for all related changes in one transaction.

The requirement emphasizes that top management conduct the review – not

the quality manager, not the operational manager – but top management – those

who direct and control the organization at the highest level. In many ISO 9000

registered organizations, the management review is a chore, an event held once

each year, on a Friday afternoon before a national holiday – perhaps a cynical

view but nonetheless often true. The reason the event has such a low priority

is that management have not understood what the review is all about. Tell

them it’s about reviewing nonconformities, customer complaints and internal

audit records and you will be lucky if anyone turns up. The quality manager

produces all the statistics so the others managers are free of any burden. By

careful tactics, these managers may come away with no actions, having

delegated any in their quarter to the quality manager.

In order to provide evidence of its commitment to conducting management

reviews, management would need to demonstrate that it planned for the

reviews, prepared input material in the form of performance results, metrics

and explanations, decided what to do about the results and accepted action to

bring about improvement.

The ISO 9000 standards requires that top management conduct management reviews.

The term review is defined in ISO 9000 Standards as an activity undertaken to ensure the suitability, adequacy, effectiveness and efficiency of the subject matter to achieve established objectives. The addition of the term management means that the management review can be perceived as a review of management rather than a review by management, although both meanings are conveyed in the standard.

The rationale for this is that the examples given in ISO 9000 Standards such as design review and nonconformity review clearly indicate it is design and non-conformity that is being reviewed. If the system was to be reviewed then the action should be called a system review. It is no doubt unintentional in the standard but, if the management system is perceived as the way in which the organization’s objectives are achieved, a review of management is in fact a review of the way achievement of objectives is being managed because the organization exists to achieve objectives and so both meanings are correct.

Top management will not regard the management review as important unless they believe it is essential to running the business. The way to do this is to treat it as a business performance review. This is simpler than it may appear. If the quality policy is now accepted as corporate policy and the quality objectives are accepted as corporate objectives, any review of the management system becomes a performance review and no different to any other executive meeting. The problem with the former management reviews was that they allowed discussion on the means for achieving objectives to take place in other management meetings leaving the management review to a review of errors, mistakes and documentation that no one was interested in anyway. The management system is the means for achieving objectives therefore it makes sense to review the means when reviewing the ends so that actions are linked to results and commitment secured for all related changes in one transaction.

The requirement emphasizes that top management conduct the review – not the quality manager, not the operational manager – but top management – those who direct and control the organization at the highest level. In many ISO 9000 registered organizations, the management review is a chore, an event held once each year, on a Friday afternoon before a national holiday – perhaps a cynical view but nonetheless often true. The reason the event has such a low priority is that management have not understood what the review is all about. Tell them it’s about reviewing nonconformities, customer complaints and internal audit records and you will be lucky if anyone turns up. The quality manager produces all the statistics so the others managers are free of any burden. By careful tactics, these managers may come away with no actions, having delegated any in their quarter to the quality manager.

In order to provide evidence of its commitment to conducting management reviews, management would need to demonstrate that it planned for the reviews, prepared input material in the form of performance results, metrics and explanations, decided what to do about the results and accepted action to bring about improvement.

Origin Of ISO 9000 Standards Video

Origin Of ISO 9000 Standards Video