ISO/DIS 9001 - Context of the organization

ISO/DIS 9001 - Context of the organization

Keshav Ram Singhal

ISO/DIS 9001 mentions new requirements with regard to the context of the organization - clause 4.1 - understanding the organization and its context, and clause 4.2 - understanding the needs and expectation of interested parties. Now as per ISO/DIS 9001, an organization establishing a quality management system needs to understand the organization and its context by determining relevant internal and external issues, understand the needs and expectation of interested parties and their requirements.

Clause 4 of ISO/DIS 9001 provides requirements related to the context of an organization. Context of an organization means the business environment. Business environment of an organization may be the organizational environment or ecosystem of the organization that includes combination of internal and external factors and conditions. Internal and external factors and conditions can have an effect on the organization's approach to organization's products, services, investments and interested parties. Interested parties with respect to the organization may be persons or organizations, such as customers, owners, people in the organization, suppliers, bankers, unions, partners, or society including competitors or pressure groups. It is clarified that the requirements of this clause are applicable to no-for-profit organizations, public sector organizations and organizations seeking profits.

The relevant sub-clauses are as under:
4.1 - Understanding the organization and its context
4.2 - Understanding the needs and expectations of interested parties
4.3 - Determining the scope of the quality management system
4.4 - Quality management system an its processes

Understanding the organization and its context

The title for this sub-clause provides for alignment with other management system standards. The intent of this clause is to provide a clear understanding of the important issues that can affect (positively or negatively), the way the organization manages activities and responsibilities related to its quality management system. There may be some external and internal issues relevant to the purpose of the organization and also to the strategic direction to which the organization moves. Such issues are important topics for the organization including problems for debate and discussion, issues for changing circumstances that affect the organization's ability to achieve the intended outcomes it sets for its quality management system.

What is required to do? First, determine and understand external and internal issues, and second, monitor (means determine the status of) and review ( means determine the suitability, adequacy and effectiveness of) the information about the determined external and internal issues.

How to understand internal issues? This can be facilitated by considering issues related to values, culture, knowledge and performance of the organization.

How to understand external issues? This can be facilitated by considering issues arising from legal, technological, competitive, market, culture, social, and economic environments. These can be national, international, regional or local.

Important points:
(i) Determine - What are the internal issues?
(ii) Determine - what are the external issues?
(iii) Monitor and review all such determined issues.

Suggestion: The organization may document its knowledge of the organization's context as appropriate.

Understanding the needs and expectations of interested parties

The title for this sub-clause also provides for alignment with other management system standards. First understand who may be included in interested parties. Interested party of an organization includes person or organization that (i) can affect a decision or activity, (ii) can be affected by a decision or activity, or (iii) can perceive himself to be affected by a decision or activity. As such, interested parties of an organization may be customers, people in the organization, suppliers, bankers, unions, competitors, pressure groups or society. Interested parties may have impact or potential impact on the organization's ability to consistently provide products and services (that meet customer requirements and applicable statutory and regulatory requirements).

What is required to do? First, determine interested parties that are relevant to the organization, second, determine requirements of the determined interested parties, and third, monitor (means determine the status of) and review (means determine the suitability, adequacy and effectiveness of) the information about the interested parties and their relevant requirements.

Important points:
(i) Determine - Who are the interested parties relevant to the organization?
(ii) Determine - What are the requirements of interested parties in relation to the organization's quality management system?
(iii) Monitor and review the determined information.

Suggestion: The organization may document its knowledge of relevant interested parties requirements, as appropriate.

Determining the scope of the quality management system

To establish the scope of the quality management system, the organization needs to determine boundaries and applicability of the quality management system.

What is required to do? First, determine the boundaries (limits) and applicability (usefulness) of the organization's quality management system (by considering the internal and external; issues relevant to the organization's quality management system, the determined requirements of relevant interested parties, and the products and services of the organization), second, Make available and maintain documented (controlled) information of the scope of the quality management system (by mentioning the products and services covered by the organization and justification for any instance where the organization is not able to meet any ISO/DIS 9001 requirement), and third, make sure that the organization's ability or responsibility to ensure conformity of products and services is not affected if any ISO/DIS 9001 requirement cannot be applied.

Important points:
(i) What are the boundaries (limits) and applicability (usefulness) of the organization's quality management system
(ii) What are the products and services covered by the organization's quality management system
(iii) Justification for any instance where the organization is not able to meet any ISO/DIS 9001 requirement
(iv) Documented (controlled) information (data) of the scope

It should be noted that ISO/DIS 9001 no longer makes specific reference to 'exclusions' but continues to allow for exclusions (provided in clause 1.2 of ISO 9001:2008 QMS standard), but not restricted to the specific clause (as done in ISO 9001:2008 QMS standard: clause 7).

Quality management system and its processes

Requirements of this section are similar to those mentioned in clause 4.1 of ISO 9001:2008 with some editorial changes. According to the requirements of ISO/DIS 9001, the organization is required to:
* establish (set-up on permanent basis, install, or create) a quality management system, processes needed and their interaction
* implement (as established) the quality management system, its processes and their interaction
* maintain the quality management system, its processes and their interaction
* continually improve the quality management system, its processes and their interaction

What is required to do? Organization needs to do the following:
(i) Determine the processes needed for the quality management system and their application throughout the organization
(ii) Determine the inputs for the determined processes
(iii) Determine the outputs expected from the determined processes
(iv) Determine the sequence and interaction of the determined processes
(v) Determine the criteria, methods, measurements indicators and related performance indicators needed to ensure effective operation and control of the determined processes
(vi) Determine the resources needed and ensure their availability
(vii) Determine the assignment of responsibilities and authorities for the determined processes
(viii) determine the risks and opportunities (as per clause 6.1)
(ix) Determine methods for monitoring, measuring (as appropriate), evaluation of processes and, if needed, the change of processes
(x) Determine opportunities for improvement of the processes and the quality management system
(xi) Plan and implement the appropriate actions to address determined risks and opportunities
(xii) Ensure that the methods and processes achieve desired (intended) results
(xiii) Maintain and retain documented information that are necessary to support the operation of processes and that provide evidence (and confidence) that the organization is carrying out the processes as planned.

Important points:
(i) What are the processes (and their inputs, intended outputs, sequence and interaction)?
(ii) How to ensure effective operation and control of processes? Think: criteria, methods, indicators (for measurement and performance), planning and implementing
(iii) What are the resources needed to carry out determined processes? Also make available resources needed
(iv) Who are the responsible people and their responsibilities and authorities?
(v) What are the risks and opportunities? Also think: Plan and implement appropriate actions to address risks and opportunities
(vi) What are the output results?
(vii) Maintain and retain documented information

ISO/DIS 9001 makes risk-based thinking more explicit and incorporates it in requirements for establishing, implementing, maintaining and continually improving the quality management system. Understanding organizational context and risks is helpful for an organization for its preparation to pursue, retain or take the amount and type of risk. It is important to understand risk sources. A risk source is an element, which alone or in combination of other risk source/sources, has the intrinsic potential to give rise to risk, where 'risk' is 'uncertainty in achieving objectives'. A risk source in an organization can vary and affect organization's objectives, so there is need to plan and implement appropriate actions to address the risk and its source.

Note: The ISO 9001 revision process moves on to the next stage. Readers should note that there may be some changes in the requirements. The above article is for academic purpose. Readers' comments are invited. Thanks.