ISO9001 and the Operational, Planning & Control Requirements

If you think about the first 7 clauses of the ISO9001:2015 as building the framework of your Quality Management System then section 8 - Operation is very much about putting some substance on that framework.

Section 8.1 - Operational Planning and Control, that we will discuss here, gives the requirements for the organsiation to put into place the processes, procedures and controls needed to ensure their products and services meets the requirements of their quality management system (see our post in section 4.4) and also to address the risks and change management elements that they have previously identified in section 6.

Determining the Requirements for Products & Services

Meeting the requirements for part (a) of this section should be pretty simple for most organisations after all you know what products and services you are providing, you know what:

Your customers want from your products and services
You understand what shape, size, colour or functional requirements there are for your product
You understand any legal or safety requirements
You know about the statutory requirements of you

Knowing these things then lets you move on to the next stage, (b) Establishing criteria for the processes & acceptance of your products.

Establishing Criteria

Pro Tip!
When you are setting out your documented information about your processes, procedures and controls ensure it reflects what you actually do, not what you dreamed you wish you would be doing. Any audit, internal or external will find the gaps quickly and create improvement notices and audit fails.
If you want to change from what you are doing to a better process that's great, that's the continuous improvement loop at work! work through the right process of carrying out a change to your system and document the final real outcome when you get there.

While there is no requirement of within ISO9001:2015 to document the processes or procedures you need to create your product or service lets face it you really have to, it would be madness not to do it. How, for example, would you ensure consistency or quality or functionality, carry out training new people or even market what you have? By actually documenting the steps and processes required to produce your products or services you not only make it simple to determine that you are complying to the standard but you create the groundwork for your continuous improvement processes as well.

The other element is to determine the acceptance criteria of your products or service, i.e. how will you know that it works as intended and meets the applicable standards and expectations of your clients. This may require simple go / no testing, colour charts, electronic test systems or simulations. Whatever you determine it should be repeatable and provide clarity that it meets expectation, grey areas are not your friend here. Also, remember that the entire process should be centered around what your customer needs.

Implement Your Controls

In the standard this section is actually listed after determining your resources, my view is how do you determine your resources if you don't know what your controls are going to be? So here is my tip, figure out first what your controls are then figure out the resources needed. As mentioned it doesn't matter if your organisation directly is creating the product or service or you have contracted another organisation the requirement if for you ensure that you or your supplier have implemented processes in accordance with the criteria you have set out for your product or service to meet.

Also, think about the fact you have opted to document this process or procedure, this would pull it into the requirement for say version control and change control documentation.

Determine Your Resources

Just as you did previously you need to ensure that you have the resources required to implement your processes, procedures, and controls, after all, whats the point of coming up with a process that needs 100 people to comply with it when you have only 12 people in your organisations? Remember when we talk about resources it's people, equipment, training, power, lighting, facilities and so forth. Once again your resources don't need to be all within your organisation, they can be external experts or organisations but your organisations needs to maintain control over how they work. That means you need to be able to verify what they provide you meets all of your (and your customers) requirements.

Maintaining and Retaining Documented Information

As an organisation you should determine what type of documented information, (processes, procedures, records etc) are needed to show that the processes you documented have actually occurred and the output from those processes has been a product or service that meets your acceptability criteria. A key point here is that you want to make sure that you are not creating mountains or paperwork or 74 hoops that people have to jump through to comply, they won't, in fact, to be fair they can't! so you will make it impossible to comply. You need to make sure anything you come up with is suitable for your organisation.

Keeping Control

Again the organisations needs to ensure that changes to their processes is controlled. This is especially important for the operational planning and control of your products and services. These changes, intentional or unintentional need to be adequately controlled and reviewed to ensure that they don't have any unintended consequences to your delivered product or service with respect to your earlier defined criteria.