ISO9001 and the Operational, Planning & Control Requirements

If you think about the first 7 clauses of the ISO9001:2015 as building the framework of your Quality Management System then section 8 - Operation is very much about putting some substance on that framework.

Section 8.1 - Operational Planning and Control, that we will discuss here, gives the requirements for the organsiation to put into place the  processes, procedures and controls needed to ensure their products and services meets the requirements of their quality management system (see our post in section 4.4) and also to address the risks and change management elements that they have previously identified in section 6.

Determining the Requirements for Products & Services 

Meeting the requirements for part (a) of this section should be pretty simple for most organisations after all you know what products and services you are providing, you know what:

1. Your customers want from your products and services 
2. You understand what shape, size, colour or functional requirements there are for your product
3. You understand any legal or safety requirements
4. You know about the statutory requirements of you
   

Establishing Criteria

Implement Your Controls 

In the standard this section is actually listed after determining your resources, my view is how do you determine your resources if you don't know what your controls are going to be? So here is my tip, figure out first what your controls are then figure out the resources needed. As mentioned it doesn't matter if your organisation directly is creating the product or service or you have contracted another organisation the requirement if for you ensure that you or your supplier have implemented processes in accordance with the criteria you have set out for your product or service to meet.

Also, think about the fact you have opted to document this process or procedure, this would pull it into the requirement for say version control and change control documentation.

Determine Your  Resources

Just as you did previously you need to ensure that you have the resources required to implement your processes, procedures, and controls, after all, whats the point of coming up with a process that needs 100 people to comply with it when you have only 12 people in your organisations? Remember when we talk about resources it's people, equipment, training, power, lighting, facilities and so forth. Once again your resources don't need to be all within your organisation, they can be external experts or organisations but your organisations needs to maintain control over how they work. That means you need to be able to verify what they provide you meets all of your (and your customers) requirements.

Maintaining and Retaining Documented Information 

As an organisation you should determine what type of documented information, (processes, procedures, records etc) are needed to show that the processes you documented have actually occurred and the output from those processes has been a product or service that meets your acceptability criteria. A key point here is that you want to make sure that you are not creating mountains or paperwork or 74 hoops that people have to jump through to comply, they won't, in fact, to be fair they can't! so you will make it impossible to comply. You need to make sure anything you come up with is suitable for your organisation.

Keeping Control 

Again the organisations needs to ensure that changes to their processes is controlled. This is especially important for the operational planning and control of your products and services. These changes, intentional or unintentional need to be adequately controlled and reviewed to ensure that they don't have any unintended consequences to your delivered product or service with respect to your earlier defined criteria.