ISO 9001:2015 QMS Awareness – Operation – Control of externally provided processes, products and services

ISO 9001:2015 QMS Awareness – Operation – Control of externally provided processes, products and services

===========

Control of externally provided processes, products and services

 

Let us understand the terms ‘external provider’, ‘externally provided process’, ‘externally provided product’ and ‘externally provided service’.

 

Provider = Supplier = Contractor = A party, person or organization that provides a product or a service to the organization

 

A provider may be internal or external.

 

External provider = External supplier = A provider or supplier that is not part of the organization

 

Externally provided process = A process that is carried out by an external party, person or organization on behalf of the organization.

 

Externally provided product = A product that is provided by an external party, person or organization and used or incorporated into the organization’s own product/s or service/s. Raw material purchased from market is an externally provided product.  

 

Externally provided service = A service that is provided by an external party, person or organization to support the organization’s activities.

 

Examples of external provider – (i) Supplier of raw material, (ii) Supplier of components, (iii) Consulting organizations, (iv) Distributor, (v) Producer, (vi) Retailer, (vii) Vendor

 

Examples of externally provided process – (i) Calibration of testing equipment conducted by an external calibration laboratory, (ii) Information technology support provided by an external party, person or organization, (iii) Painting services outsourced to a professional painter, (iv) Employees’ trainings conducted by an external trainer or institute. 

 

Examples of externally provided product – (i) Raw material purchased from a supplier and used in the production of the organization’s product, (ii) Component purchased from a supplier and used in the production of the organization’s product, (iii) Software purchased from a software vendor and used in the organization’s systems, (iv) Safety equipment purchased from a supplier for use in the organization’s operation.

 

 

Examples of external provided service – (i) Consultation service provided by an external party, person or organization, (ii) Information technology services provided by an external party, person or organization.

 

Externally provided process / product / service may be through:

 

-        Purchasing from a supplier / vendor,

 

-        An arrangement with an associated organization,

 

-        Outsourcing process to an external provider.

 

Requirements

 

The organization needs to consider – (i) Potential impact of externally provided process / product / service on the organization’s ability to meet requirements (customer and legal), and (ii) Effectiveness of the controls applied by external providers.

 

The organization needs to determine – (i) Controls to be applied to the externally provided process / product / service, (ii) Criteria for evaluation, selection, performance monitoring and re-evaluation of external providers, (iii) Verification and other activities to ensure that externally provided process / product / service meets requirements. Clarification – It should be noted that controls to externally provided process / product / service are applicable (i) When product / service from the external provider is incorporated into the organization’s own product / service, (ii) When product / service is directly provided directly to the customer by the external provider on behalf of the organization, and (iii) When the organization decides to provide a process or part of a process by an external provider.

 

The organization needs to ensure – (i) Externally provided process / product / service conforms to requirements, (ii) Externally provided process / product / service does not adversely affect the organization’s ability to consistently deliver conforming product / service to customer, (iii) Externally provided process / product / service remain with the organization’s control, and (iv) Adequacy of requirements communicated to the external provider.

 

The organization needs to define – (i) Controls to be applied to external providers, and (ii) Controls to be applied to resulting output.

 

The organization needs to communicate to the external providers adequate requirements for the (i) Process / product / service, (ii) Product / service approval, (iii) Method / process /equipment approval, (iv) Release of products / services, (v) Required competence including qualification of persons, (vi) External providers’ interactions with the organization, (vii) Control and monitoring of the external providers’ performance to be applied, (viii) Verification and validation activities to be performed at the external providers’ premises by the organization or its customer.

 

The organization needs to apply – Determined controls, criteria and other activities.

 

The organization needs to retain documented information (records) – Evaluation, selection, monitoring of performance and re-evaluation of external providers and any action arising from these activities.

 

In short  

 

Clause 8.4 of ISO 9001:2015 QMS standard focuses on the control of externally provided processes, products and services. Here are a few examples of control that can be applied to meet the requirements of this clause:

 

1.     Supplier evaluation and selection – Implementing a well-defined process to assess and select suppliers based on their ability to meet the organization’s requirements. The process may include evaluating supplier’s quality management system or its certification, product / service quality, delivery performance, financial stability etc.

 

2.     Supplier performance monitoring – Regular monitoring and evaluating the performance of the supplier with reference to on-time delivery, product / service quality, compliance with requirements etc.

 

3.     Communication – Maintain effective communication with the supplier to facilitate a better and mutual understanding of requirements, changes, and any potential issues. Efforts can be made to conduct regular meetings and prompt communication with suppliers.

 

4.     Incoming inspection and verification – Establish procedure for inspecting and verifying externally provided process / product / service upon receipt.

 

Control on external providers’ property

 

Clause 8.5.3 of ISO 9001:2015 QMS standard stipulates requirements on property belonging to customers or external providers. Exercise following controls on the external provider’s property –

 

1.     Exercise with external provider’s property (such as material, components, tools, equipment, premises, intellectual property and personal data) while under the organization’s control or being used.

 

2.     Identify, verify, protect and safeguard the property provided for the use or incorporation into the product / service.

 

3.     Report to the external provider any property belonging to an external provider is lost, damaged or otherwise found to be unsuitable for use.

 

Think of the following Questions

 

(1)   What are externally provided processes, products and services?

 

(2)   Why an organization need to control externally provided processes, products and services?

 

(3)   What documented information you may need to retain for externally provided process / product / service?

 

Best wishes,

Keshav Ram Singhal

 

Please have your comments / reaction.

 

To train your employees with ISO 9001:2015 QMS Awareness, please supply them “TRAINING HANDBOOK ON ISO 9001:2015QMS AWARENESS” (ASIN: B093YFFY7Z), which is available worldwide at Amazon. Please search this Training Handbook in Amazon Website of your country. 

 

 You may also supply your employees following eBooks - (i) A Concise Guide on Creating and Updating Documented Information (eBook) https://store.pothi.com/book/ebook-keshav-ram-singhal-concise-guide-creating-and-updating-documented-information/ (ii) Applying Risk-based Thinking in an Organization Implementing ISO 9001:2015 QMS (eBook) https://store.pothi.com/book/ebook-keshav-ram-singhal-applying-risk-based-thinking-organization-implementing-iso-9001-2015-q/

 

Thanks.

 

ISO 9001:2015 QMS Awareness – Operation – Design and Development of Products and Services

ISO 9001:2015 QMS Awareness – Operation – Design and Development of Products and Services

===========

Design and Development of Products and Services

 

Design and development of a product / service is an important activity that includes a number of processes to convert the needs and expectations for an object / entity / product / service into more detailed requirements. The words ‘design’ and ‘development’ and the term ‘design and development’ are sometimes used synonymously.

 

ISO 9000:2015 Para 3.4.8 defines the term ‘design and development’. The term ‘design and development’ is a set of processes. The set of processes transform requirements (needs and expectations) for an object into more detailed requirements for that object. Design and development can be stated as a crucial activity that involves a series of processes having the goal (objective) of transforming the needs and expectations for an object, entity, product or service into more detailed requirements. It encompasses the planning, creation, testing and validation of product, service or process.

 

General Requirements

 

The organization needs to establish, implement and maintain – Design and development process (appropriate to product / service requirements) consisting of its planning, inputs, controls, outputs and changes.

 

Planning Requirements

 

The organization needs to consider for the design and development process – (i) Nature, duration and complexity of the process, (ii) Required process stages, (iii) Applicable reviews, (iv) Required verification activities, (v) Required validation activities, (vi) Responsibilities and authorities involved, (vii) Resource (external and internal) needs, (viii) Needs to control interfaces between persons involved, (ix) Need to involve customer / user, (x) Subsequent product / service requirements, (xi) Level of control expected by customers / interested parties, and (xii) Retaining documented information needs.

 

The organization needs to determine – (i) Stages and controls for design and development process, and (ii) Documented information needed.

 

Inputs requirements

 

The organization needs to consider – (i) Functional and performance requirements, (ii) Information from previous similar design and development activities, (iii) Legal requirements, (iv) Standards to follow / implement, (v) Codes of practice to follow / implement, and (vi) Potential consequences of failure.

 

Legal requirements = Statutory requirements + Regulatory requirements

 

The organization needs to determine - Requirements essential for the product / service to be designed and developed

 

The organization needs to ensure – Design and development inputs to be adequate, complete, clear and not vague.

 

The organization needs to resolve – Conflicting inputs.

 

The organization needs to retain documented information (records) on design and development inputs.

 

Controls requirements

 

The organization needs to apply – Design and development controls

 

The organization needs to ensure – (i) Defining results to be achieved, (ii) Conducting reviews to evaluate the ability of design and development results to meet requirements, (iii) Conducting verification activities to verify that outputs meet the input requirements, (iv) Conducting validation activities to ensure that resulting product / service meeting requirement for specified application / intended use, (v) Taking any necessary actions on problems determined during design and development reviews, verification and validation activities.

 

The organization needs to retain – Documented information (records) of control activities.

 

Outputs requirements

 

The organization needs to ensure that– (i) Design and development outputs meet the input requirements, (ii) Design and development outputs are adequate for subsequent activities, (iii) Design and development outputs include / mention appropriate monitoring and measuring requirements, (iv) Design and development outputs include / mention acceptance criteria, (v) Design and development outputs specify product / service characteristics (essential for intended purpose, safe and proper provision).

 

The organization needs to retain – Documented information (records) on design and development outputs.

 

Changes requirements

 

The organization needs to identify, review and control – Design and development changes. Purpose – To ensure no adverse impact to conformity on product / service.

 

The organization needs to retain – Documented information (records) on – (i) Design and development changes, (ii) Results of reviews, (iii) Authorization of changes, and (iv) Action taken to prevent adverse impact to conformity on product / service.

 

Examples of design and development

 

(1)   A manufacturing organization may decide to develop a new product line to meet the changing market demands. Here the design and development process may involve conducting market research, conceptualizing product ideas etc. To develop a new product line the design and development requirements mentioned in ISO 9001:2015 QMS standard are useful.

 

(2)   A service organization may aim to introduce a new service to expand its portfolio. Here also the design and development requirements mentioned in ISO 9001:2015 QMS standard are helpful to introduce new service.

 

(3)   An organization may identify the need to improve its existing process, product or service for which the design and development requirements mentioned in ISO 9001:2015 QMS standard are useful.

 

Think of the following Questions

 

(1)   What is design and development?

 

(2)   Why an organization need design and development of a product or service?

 

(3)    What documented information you may need to maintain for design and development?

 

(4)   What documented information you may need to retain for design and development?

 

Best wishes,

Keshav Ram Singhal

 

Please have your comments / reaction.

 

To train your employees with ISO 9001:2015 QMS Awareness, please supply them “TRAINING HANDBOOK ON ISO 9001:2015QMS AWARENESS” (ASIN: B093YFFY7Z), which is available worldwide at Amazon. Please search this Training Handbook in Amazon Website of your country. 

 

 You may also supply your employees following eBooks - (i) A Concise Guide on Creating and Updating Documented Information (eBook) https://store.pothi.com/book/ebook-keshav-ram-singhal-concise-guide-creating-and-updating-documented-information/ (ii) Applying Risk-based Thinking in an Organization Implementing ISO 9001:2015 QMS (eBook) https://store.pothi.com/book/ebook-keshav-ram-singhal-applying-risk-based-thinking-organization-implementing-iso-9001-2015-q/

 

Thanks.

 

ISO 9001:2015 QMS Awareness – Operation – General Information, Operational Planning and Control, Requirements for Products and Services

ISO 9001:2015 QMS Awareness – Operation – General Information, Operational Planning and Control, Requirements for Products and Services

===========

Clause 8 of ISO 9001:2015 QMS standard deals with support requirements.

 

Operation = An organized activity that carried out by many people in the organization doing many tasks

 

Operation is the action of functioning of the organization to achieve its objectives.

 

Operation = Operational planning + Operational control + Customer communication + Determining, review of and changes to requirements for products and services + Design and development activities (including planning, inputs, controls, outputs and changes) + Control of externally provided processes, products and services (including type and extent of controls, information for external providers) + Production and service provision (including control, identification, traceability, external providers’ property, preservation, post-delivery activities, control of changes) + Release of products and services + Control of nonconforming outputs.

 

Requirements for operation 

Requirements for support are mentioned in clause 8 of ISO 9001:2015 QMS standard. The relevant sub-clauses of Clause 8 of the standard are as under:

8 Support

 

8.1 Operational planning and control

 

8.2 Requirements for products and services

 

8.2.1 Customer communication

8.2.2 Determining the requirements for products and services

8.2.3 Review of the requirements for products and services

8.2.4 Changes to requirements for products and services

 

8.3 Design and development of products and services

 

8.3.1 General

8.3.2 Design and development planning

8.3.3 Design and development inputs

8.3.4 Design and development control

8.3.5 Design and development outputs

8.3.6 Design and development changes

 

8.4 Control of externally provided processes, products and services

 

8.4.1 General

8.4.2 Type and extent of control

8.4.3 Information for external providers

 

8.5 Production and service provision

 

8.5.1 Control of production and service provision

8.5.2 Identification and traceability

8.5.3 Property belonging to customers or external providers

8.5.4 Preservation

8.5.5 Post-delivery activities

8.5.6 Control of changes

 

8.6 Release of products and services

 

8.7 Control of nonconforming outputs

 

 

Operational Planning and Control

 

The organization needs to plan, implement and control – Processes (please refer to the requirements mentioned in clause 4.4).

 

The organization needs to implement – Actions determined in planning (Please refer to the requirements mentioned in clause 6).

 

The organization needs to determine – (i) Requirements for products / services, (ii) Resource needs, (iii) Documented information to retain and maintain to the extent necessary.

 

The organization needs to establish – (i) Criteria for processes, and (ii) Criteria for acceptance of products / services.

 

The organization needs to implement – Control as per established criteria.

 

The organization needs to control – (i) Planned changes, and (ii) Outsourced processes.

 

Outsourced processes = Processes done by others (people / organization)

 

The organization needs to review – Consequences of unintended changes.

 

Unintended = Not planned as a goal

 

The organization needs to take – Necessary action to mitigate (to make less severe) any adverse effects.

 

The organization needs to maintain documented information – As determined

 

The organization needs to retain documented information – As determined

 

We find that requirements for operational planning and control in ISO 9001:2015 QMS standard focuses on operational planning and control that requires the organization to plan, implement, and control the processes to meet its quality management system (QMS) requirements. A few real-life examples are mentioned below:

 

1.     Production Scheduling – A manufacturing organization is involved in production activities and is required to plan and control its production activities effectively. The organization may use techniques like production scheduling, capacity planning, resource allocation etc to ensure its production processes in a coordinated manner, which will help in meeting customer requirements, optimizing resources and minimizing delays in production.

 

2.     If an organization relies on external suppliers, then the organization needs to carefully select and evaluate its suppliers.

 

3.     When implementing change to processes, products or services, the organization must have effective control measures in place. By effective change management, the organization can minimize potential risks to its processes, maintain product / service as per requirements, and ensure a smooth change to processes, products or services.

 

4.     Operational planning and control must have risk-based thinking. The organization should identify and assess potential risks to their processes, products and services. The organization can develop mitigation strategies, implement controls and regularly monitor and review risk levels.

 

5.     By maintaining and retaining adequate documented information, the organization can have proper operational planning and control. Documented procedures provide clear instructions about the activities to be carried out, including control measures, responsibilities, and process flow.

 

 

Requirements for Products and Services

 

The organization needs to communicate with customers – (i) Providing information on product / service, (ii) Handling enquiries, (iii) With regard to contracts / orders, (iv) With regard to changes, (v) with regard to obtaining customer feedback / customer complaints, (vi) With regard to handling / controlling customer property, (vii) For establishing specific contingency action requirements, when relevant.

 

A few real-life examples of customer communication that involve providing information, handling enquiries, handling feedback and handling customer property are mentioned below:

 

1.     Providing Product / Service Information and Specifications – Customer communication involves providing detailed information about the features of the product / service, its specifications, usage guidelines, and any applicable warranties. This will help the customer to make an informed decision and will ensure the customer has a clear understanding of the product / service s/he is considering.

 

2.     Handling Enquiries and Requests – Customer communication also involves promptly addressing inquiries and requests from customers. This include responding to queries about product / service availability, pricing, delivery options, technical support etc. Timely and accurate response demonstrates better customer service and helps build customer trust and customer satisfaction.

 

3.     Resolving Customer Complaints – In situations where a customer raises a complaints and / or expresses dissatisfaction, effective customer communication plays a crucial role in building customer trust and customer satisfaction. Here the customer communication involves actively listening to the customer’s concerns, empathizing with the customer situation, and working toward a resolution. Keeping the customer informed throughout the complaint resolution process will help manage expectations of the customer and also demonstrate a commitment to the customer satisfaction.

 

4.     Collecting Customer Feedback – Collecting customer feedback is an essential part of customer communication. There are various methods for collecting customer feedback that may include survey, feedback form, or online platform to collect customer opinions and experiences. Customer feedback provides valuable insights for improvement and helps the organization identify areas for improvement.

 

5.     Handling Customer Property – There may be situations where customer property is entrusted to the organization for various purposes. A repair service may handle customer’s device. In such a case, effective customer communication involves providing clear information to the customer how customer’s property will be handled, stored, protected and applicable terms and conditions, if any.

 

6.     Order Tracking / Updating Status – Organizations dealing with product delivery or providing service, customer communication includes providing updates on order status, tracking information and expected delivery time.

 

7.     Service Renewal Reminder – Customer communication also involves informing customers about the service renewal, maintenance schedules etc. Sending timely reminder builds trust and relationship of the organization with the customer

 

The organization needs to ensure – (i) Defining product / service requirements (including legal and others considered necessary, and (ii) Organization’s ability to meet product / service requirements.

 

The organization needs to review (before commitment to supply the product / service to a customer) – (i) Customer requirements, (ii) Requirements for delivery, (iii) Requirements for post-delivery activities, (iv) Requirements not stated by the customer, but necessary for the specified / intended use, when known, (v) Requirements specified by the organization, (vi) Applicable legal requirements, and (vii) Changed contract / order requirements.

 

Legal requirements = Statutory requirements + Regulatory requirements

 

The organization needs to resolve – Changed contract / order requirements.

 

The organization needs to ensure – (i) Amendment of changed requirements in relevant documented information, (ii) Providing information of changed requirements to relevant persons, and (iii) Organization’s ability to meet changed requirements.

 

The organization needs to confirm (before acceptance) – Customer requirements, if customer does not provide documented information.

 

The organization needs to retain documented information (records) – (i) Review results, and (ii) New requirements for product / service.

 

It should be noted that where a formal review is impractical for each other, for example online sales, the review will cover product information / catalogue.

 

Think of the following Questions

 

(1)   What activities are involved in the operational planning and control?

 

(2)   How can you improve customer communication in your organization?

 

(3)    What documented information you may need to maintain for operational activities?

 

(4)   What documented information you may need to retain for operational activities?

 

Best wishes,

Keshav Ram Singhal

 

Please have your comments / reaction.

 

To train your employees with ISO 9001:2015 QMS Awareness, please supply them “TRAINING HANDBOOK ON ISO 9001:2015QMS AWARENESS” (ASIN: B093YFFY7Z), which is available worldwide at Amazon. Please search this Training Handbook in Amazon Website of your country. 

 

 You may also supply your employees following eBooks - (i) A Concise Guide on Creating and Updating Documented Information (eBook) https://store.pothi.com/book/ebook-keshav-ram-singhal-concise-guide-creating-and-updating-documented-information/ (ii) Applying Risk-based Thinking in an Organization Implementing ISO 9001:2015 QMS (eBook) https://store.pothi.com/book/ebook-keshav-ram-singhal-applying-risk-based-thinking-organization-implementing-iso-9001-2015-q/

 

Thanks.