ISO 9001 Standard / ISO 9001 Standards – ISO 9000 Standard / ISO 9000 Standards Certification & Implementation

One of the most important factors in determining the success of an ISO 9001 implementation is management commitment and management understanding of what makes a good quality systems. Our turnkey Quality Management System (QMS) gives you everything you need to educate your entire company from top to bottom.

Management review is one of the key elements to building a sustainable quality system. To do this, management must be committed. This means that the management must do more than just say they are committed, they must allocate the resources to make sure that the company can continuously improve quality. Most quality systems fail from the top down! That is why external auditor almost always review the management review documentation every audit. External ISO 9001 auditors look for this commitment by evaluating the management review records. Management reviews should focus on both the quality of the products and the quality of the QMS. In general, it is very simple to maintain compliance of the management review portion of the standard. It can be done with a simple notebook that is maintained as a quality record. The Management review procedure includes a list of documentation that should be included in management review meeting. Management reviews should be done a least once per year and auditors like to see them quarterly.

Under ISO 9001, executive management has defined responsibilities. Although most of the work required to implement and maintain ISO certification is done below the executive level, ISO requires involve of personnel at the top of the organization.

It is the leader of an organization that set the goals and objectives for the quality of the company. It is also the leader that assigns resources (responsibility and authority) throughout the organization. Because of this, the leaders must be kept aware of the status of the quality system and product/service quality so they make good decision.
Much of how the company accomplishes these tasks is covered in the quality manual. Here are the 8 areas that should be address in the quality system to assure compliance to the ISO standard.

Top Management must:

Show A Commitment To The Customer

This requirement includes maintain records showing their commitment to the a customer focus, the quality system and the continuous improvement system. The use of a customer survey program is an excellent way to meet the ISO requirements for a customer focus. It is also an excellent way to keep in touch with your customers.

Make Quality Important

This includes communicating to the organization the importance of meeting the customer regulatory, legal needs as well as their produce or service needs (customer focus). Training and posting quality information around the building can do this.

Establish A Quality Policy

This should include a concise quality statement in conjunction with quality goals and a quality manual. The policy verbiage should include a commitment to continuous improvement. This information must be communicated to and understood by the entire organization.

Establish, Monitor And Update Quality objectives

These objectives should be measurable and should be relevant to all levels of the company. I recommend that they be publicly posted where everyone can see them and their status may also be posted.

Assign Resources

Ensure that resources are available to achieve the quality goals. This is the area where many companies do not meet the requirements but it is very hard to audit this general statement. Resources should be identified and planned. Planning includes manuals, procedure, work instructions and quality plans.

Assign Responsibility And Authority

Ensure that responsibilities and authorities are assigned and communicated to individuals. Responsibilities can be assigned as part of the personnel records ( see training summary sheet). Having authority means that the individual must be empowered to make changes.

Designate A Management Representative

This person will report the QMS status at periodic management reviews and promote awareness of the importance of meeting the customers needs. This is usually the quality, engineering or production manager.

Conduct Periodic Management Reviews

Management review meetings should include inputs from audits, customer feedback, process performance analysis, preventive and corrective actions system, follow-up from previous management meetings and areas for improvement. The output from the management reviews should include resource assignments, action targeting improvement of the products, processes and QMS.

The records for the management review are frequently audited so I recommend keeping a organized notebook with tabs for each management review. The creation of a check sheet (listing all the reports to be shown to top management) will make this periodic task simple to maintain. The check sheet can also be used to keep track of attendance and log feedback that is generated during the meeting.

1. PURPOSE
The purpose of this procedure is to define the steps that <company> follows in planning, performing, reporting, recording, and following up on internal audits.
<Company> conducts internal audits to determine whether the quality management system:
- Conforms to planned arrangements, to the requirements of ISO 9001 and to the quality management system requirements established by <Company> (QMS Manual policies, procedures, work instructions, and forms)
- Is effectively implemented and maintained.

2. SCOPE
This procedure applies to all company personnel who are responsible for planning, development, use, and maintenance of the quality management system.

3. DEFINITIONS
None

4. REFERENCES
4.1 Quality Manual,
5. ASSOCIATED DOCUMENTS
5.1 Audit Check List,
5.2 ERC/ERO Procedure,
5.4 Audit Schedule,
5.3 Audit Notebook

6. PROCEDURE
NOTE 1: This procedure is typically initiated about four weeks prior to the execution of an internal audit as called for by <Company>’s audit schedule. The audit schedule is established and maintained by The Quality Assurance Manager.
NOTE 2: Every element in the quality system is audited on a regular basis and at minimum of once per year. Activities are audited more frequently if there are significant changes taking place (i.e., many new hires/high turnover of personnel, modified procedures and work instructions, etc.) or if there is a history of problems in that area.
NOTE 3: Only qualified personnel may perform internal auditing activities. These qualified personnel are classified as internal auditors and have received the following training as a minimum: 1 day training on internal auditing techniques, 1 day training on the ISO 9001 Standard, this training may be performed by previously trained internal auditors.

6.1 AUDIT PLANNING, COORDINATION, AND PREPARATION
6.1.1 The Quality Assurance Manager defines the specific criteria, scope, methods, and objectives for the upcoming internal audit based on the status, maturity, and importance of specific elements in <Company>’s quality system.
Audits shall be carried out to a defined scope and shall be as follows,
a) Planned: as per the internal audit plan
b) Unplanned: arising as a result of,
- Customer complaints
- Following the implementation of actions defined in a corrective action report
- Following the identification of additional or amended procedures for products
NOTE 4: In planning the particular audit, these activities include determining the extent and boundaries of the audit (locations, activities, processes); set of policies, procedures and/or requirements to be audited against; auditing methods; and audit objectives.
6.1.2 The Quality Assurance Manager selects the appropriate auditor to ensure objectivity and impartiality of the audit process.
6.1.3 The Quality Assurance Manager and the auditor review the proposed audit program to ensure that it is consistent with and effective for the defined audit criteria, scope, methods, and objectives.
6.1.4 Prior to the audit date, auditor reviews the appropriate quality system documentation, records of completed corrective and preventive actions, and past audit findings for the activities to be audited, and then develops a checklist covering the quality system elements and activities to be audited.

6.2 INTERNAL QUALITY AUDIT INVESTIGATION

6.2.1 The auditor will contact the personnel in the area being audited at the time indicated on the audit program, and briefly review the audit criteria, scope, methods and objectives with them.
NOTE 5: The checklists only serve as a guide to the auditors, and other areas may be investigated as deemed necessary by the auditors or as requested by the auditee.
6.2.2 When a nonconformance is identified, the auditor presents the nature of the nonconformity and the evidence to the personnel involved for verification, clarification, and addresses any questions or concerns that the personnel may have, as well as to give advice, when requested, regarding any problems which are uncovered.
6.2.3 If the nonconformance is confirmed, then go to step 6.2.5.
6.2.4 If the possible nonconformance requires further clarification the auditor will discuss the situation with the Quality Assurance Manager.
6.2.5 After the facts of the nonconformity are verified (or modified), the auditor either drafts nonconformance statement or documents the necessary information for writing one later.
NOTE 6: The nonconformance statement includes the nature of the nonconformity, the actual evidence obtained, and the nature of the requirement that is not being complied with (i.e., the appropriate ISO 9001 clause number, the appropriate quality system document section/page/paragraph, what the personnel says is the normal practice, contract requirements, statutory regulations, current standards, and any other relevant requirements).

6.3 REPORTING AND FOLLOW-UP
6.3.1 Within 2 weeks of completing the internal audit program, the auditor prepares a brief internal audit report and submits it to The Quality Assurance Manager for review and approval.
NOTE 7: The audit report includes the audit’s criteria, scope, methods and objectives, the names and titles of the audit team members, a summary of general observations (i.e., general degree of compliance and any significant problems encountered), all statements of nonconformities, weaknesses, and/or opportunities for improvement, and verification results for follow-up activities performed during the audit.
6.3.2 The Quality Assurance Manager reviews and approves the internal audit report, and then distributes copies of the report to senior management and the personnel of the audited areas that were directly involved in the audit.
NOTE 8: Any additional comments or observations of the Quality Assurance Manager can be attached to the report, but the auditor’s observations be will not be deleted or modified by The Quality Assurance Manager.
6.3.3 The Quality Assurance Manager request a Engineering Change Request for any nonconformity listed in the Internal Audit Report and for any weaknesses and “opportunities for improvement” identified and documented.
6.3.4 The Quality Assurance Manager updates and maintains the long-range audit schedule based upon the documented results of the audit and the planned corrective and preventive actions.
6.3.5 The Quality Manager shall maintain an audit notebook detailing all internal and external audits carried out.
- Long-range audit schedule
- Internal audit program
- Completed checklists- signed and dated by each auditor
- Audit report

7. REVIEW PROCEDURE
Any suggested improvements or modifications to this procedure are to be passed on to the Quality Assurance Manager for discussion at the next Quality Review Committee meeting.

Process Based Auditing Of Quality Management System

Any effective quality management system (including the subsystems) works as a control process, which has the ability to detect deviations and nonconforming products and assures that the corrective and preventive action measures are effective. The regulatory auditor should check that all subsystems and processes of the quality management system are structured as self-regulating control processes. For example Deming’s PDCA cycle demonstrates such a process with the following components:

i) Plan – Has the manufacturer established the objectives and processes to enable the quality system to deliver the results in accordance with the regulatory requirements?

ii) Do – Has the manufacturer implemented the quality system and the processes?

iii) Check – Has the manufacturer checked process monitoring and measurement results against the objectives and the regulatory requirements? Does the manufacturer evaluate the effectiveness of the quality system periodically through internal audits and management reviews?

iv) Act – Has the manufacturer implemented effective corrective and preventive actions? Confirm that the company is committed to providing high quality safe and effective medical devices, and that the company is conforming with applicable laws and regulations. These are generic questions that can be asked throughout the audit.

Sampling

In general there are two ways of sampling records for review which are useful in regulatory audits risk based and statistical. Where possible, auditors should select samples based on factors which are most likely to affect the safety of the patient. In this situation sampling tables are not necessary. The auditor may however decide to select a statistically valid sample. A sample can also be drawn using a combination of risk based and statistical sampling.

Audit Planning

i) Further to the requirements given in the chapter 11 of GHTF Guidelines for Regulatory Auditing of Quality Systems of Medical Device Manufacturers – Part 1:

General Requirements (SG4/N28R2), some more consideration should be given to the following points: Information from the Manufacturer Estimation of audit duration, frequency and targeted on-site auditing time Further points to consider are given in chapter 6. Information required from the manufacturer

ii) In the planning phase, the following information should be requested from the manufacturer to estimate the audit duration and to prepare the audit plan for Regulatory Auditing of Quality Systems of Medical Device: manufacturer’s name, address contact name, telephone, fax numbers and e-mail addresses ? total number of employees (all shifts) covered by the scope of the audit ? range and class of medical devices being manufactured types of devices? sold and/or planned to be sold in the countries and/or regions for which the regulatory requirements will be assessed, including a complete list of authorizations (e.g. licenses) issued for those devices (where applicable) location and function of each site to be included in the audit a list of activities on each site the involvement of any? special manufacturing processes, e.g. software, sterilization, etc. a list of the activities performed by subcontractors and their locations, including the type of control that is exercised over those outsourced operations any existing audit results from other auditing organizations e.g. from USA, Australia, Europe, Canada, Japan. do they install or service the medical devices produced changes since the last audit, if applicable.

ii) Audit frequency The audit frequency is dependent on the factors mentioned in Appendix 3, the regulatory requirements and history of the Manufacturer.

iv) Audit duration The audit duration has a significant effect on both regulatory agencies and industry. It is dependent on factors such as the audit scope and specific regulatory requirements to be assessed, as well on the range, class and complexity of devices, and the size and complexity of the manufacturer. If not specifically mentioned, the considerations in this section are applicable to initial, and surveillance audits.

v) Relation between audit frequency and audit duration Audit duration depends on the audit frequency. In the following an annual audit frequency is the baseline as reference in IAF Guidance on the Application of ISO/IEC Guide 62. For more or less frequent audits, audit duration should be adapted accordingly. vi) Method of estimating audit duration When auditing organizations are planning regulatory audits, sufficient time should be allowed for the audit team to establish the conformity status of a medical device manufacturer’s quality system with respect to the relevant regulatory requirements. Any additional time required to assess national or regional regulatory requirements must be justified.

Implementation of ISO 9000 affects the entire organization right from the start. If
pursued with total dedication, it results in ‘cultural transition’ to an atmosphere of
continuous improvement.
The process of implementing ISO 9000 depends on:
???? a. The sophistication of your existing quality program,
???? b. The size of your organization, and
???? c. The complexity of your process.

The 14 essential steps, briefly described below, are to be followed through in order to
implement ISO 9000 quality management system successfully.
Step 1: Top management commitment
Step 2: Establish implementation team
Step 3. Start ISO 9000 awareness programs
Step 4: Provide Training
Step 5. Conduct initial status survey
Step 6: Create a documented implementation plan
Step 7. Develop quality management system documentation
Step 8: Document control
Step 9. Implementation
Step 10. Internal quality audit
Step 11. Management review
Step 12. Pre-assessment audit
Step 13. Certification and registration
Step 14: Continual Improvement

Quality Management System Requirements
The ISO 9001:2008 standard is meant to be generic and applicable to all kinds of organizations. Therefore, organizations from both the public and private sectors, including non-governmental organizations can benefit from the ISO 9001 quality management system model, regardless of whether they are small, medium or large organizations. The immediate benefit that can be realized from the implementation of ISO 9001 is the collective alignment of the activities of internal processes that are focused towards the enhancement of customer satisfaction which will result in many other benefits, whether internal or external. The magnitude of these benefits are determined by how effective the processes are in achieving its objectives.

Implementing ISO 9000 Standards Quality Management System

TQM is infinitely variable and adaptable. Although originally applied to manufacturing operations, and for a number of years only used in that area, TQM is now becoming recognised as a generic management tool, just as applicable in service and public sector organisations. There are a number of evolutionary strands, with different sectors creating their own versions from the common ancestor.