So we have determined what we do. We have tried to explain what we do. We have even taken into consideration what others, both internally and externally want to do. Now it is time to determine and possibly describe the length and breadth of the quality management system and its processes to enable us to do what we do and to continually do it better.
So easy, I hear you read. Well there is a beautiful caveat at the end of this post which will make it easy, but I won’t spoil it here.
And so the all the standard really wants is…. That your company has established, implemented, maintains and continually improves the Quality Management System, including the processes needed and their interactions with themselves, and finally in accordance with the requirements of the standard itself. Total quality speak. But it does go on to state that the company has determined the processes needed for the Quality Management System and their application throughout the company. Yes, the whole company. No longer can we ignore accounts, marketing, R&D and so many others.
So now that the standard has become all encompassing, it then goes on to require the following 8 criteria to make you compliant. Read on.
The first four and indeed the next following four is purely a list of actions for review. More specifically the first four are determinations. Have you determined; the inputs required and the outputs expected from these processes; the sequence and interaction of these processes; the criteria and methods (including monitoring, measurements and related performance indicators) needed to ensure the effective operation and control of these processes; and finally, the resources needed for these processes and ensure their availability. A bit of a checklist really and rather pointless as each is described and prescribed in at least one other clause or sub clause in the standard.
The next four have their very own action words to help us assess. These are, have you; assigned the responsibilities and authorities for these processes; do addressed the risks and opportunities as determined in accordance with the requirements of 6.1 (oh please the first double cross reference to stymie the uninitiated); evaluated these processes and implemented any changes needed to ensure that these processes achieve their intended results; and finally, improved the processes and the Quality Management System. Deep breath.
But then comes the caveat, and one buried deep in a sub sub sub clause of 18.104.22.168 the standard that goes on to say…to the extent necessary, your company maintains documented information (policy, procedure, instruction, etc) to support the operation of its processes; and retains documented information (records) to have confidence that the processes are being carried out as planned.
To the extent that is necessary. No requirements from the standard. No requirements from industry, market and let’s hope no perceived requirements from your chosen certification provider. I also hope the person you have chosen to design, implement and support your quality management system also has the commercial acumen to build you a system your company deserves to the extent that is necessary, not what is expected.