ISO 9001 Implementation Guide

Implementing ISO 9001 can appear daunting — that's why we've written this ISO 9001 Implementation Guide. We aim to give you a framework for the different stages of implementation and a better understanding of the scope of the project.

You might be implementing ISO 9001 in a small company or a large organization; but in all cases the stages of implementation are identical. The process is the same.

Here is a detailed, 27 step implementation plan for achieving ISO 9001 certification.

Who Is This For?

  • Any type of organization - large or small
  • Companies who wish to implement ISO completely in-house themselves
  • Quality Managers who plan and manage ISO 9001 implementation
  • Project Managers managing external ISO consultants

Contents

  1. Top Management Buy-in & Financial Commitment
  2. Learn About ISO 9001
  3. Introductory Training
  4. Gap Analysis
  5. Strategy, Risks & Opportunities, Scope
  6. Quality Policy & Quality Objectives
  7. Documented Information Procedure
  8. Customer Satisfaction Procedure
  9. Nonconformity and Corrective Action Procedure
  10. Internal Audit Procedure
  11. Management Review 1
  12. Operational Procedures
  13. Purchasing and Procurement Procedure
  14. Competence and Awareness Procedure
  15. Implement the Supporting Processes
  16. Management Review 2
  17. Internal Auditor Training
  18. Start Internal Auditing
  19. Root-cause Analysis
  20. Corrective Actions Implementation
  21. Management Review 3
  22. Readiness Review
  23. Certification Body 1st Stage Audit
  24. Address 1st Stage Audit Findings
  25. Certification Body 2nd Stage Audit
  26. Address 2nd Stage Audit Findings
  27. Certification
  28. Looking for Less Detail? (for Top Management)

ISO 9001 checkmark

1. Top Management Buy-in & Financial Commitment

Top management must ensure that the finances to support the QMS will be available.

The first critical step in the development and implementation of a QMS is the formal endorsement and commitment of Top management. The proposed development and implementation of the QMS should be formally documented and include the proposed implementation strategy, a broad time-line and an estimated budget.

The appointment of a professional Quality Manager or Management Representative is a key factor successful QMS implementation. It is strongly recommended that a full-time staff member be appointed at a senior level, and it is beneficial for the implementation process if they have knowledge of the business.

Participants/Responsibilities

  • Top Management

Deliverables/Outputs

  • Implementation mandate is communicated and understood
  • Appropriate resources are made available
  • An appropriate budget is made available

2. Learn About ISO 9001

Purchase and read copies of ISO 9000:2015 and ISO 9001:2015 standard.

Read them both and make yourself familiar with their language and concepts. Although they are both written in a dense, formal language, the clause titles in ISO 9001:2015 are fairly self-explanatory.

Identify the processes that comprise your management system and determine which processes are responsible for meeting which requirements. Establish the QMS Implementation Team.

Learn about the Ten ISO 9001 clauses

Participants/Responsibilities

  • Top Management
  • Management Representative

Deliverables/Outputs

  • Requirement application and process matrix
  • Sequence and interaction of processes
  • Turtle diagrams and/or process maps
  • QMS Implementation Team

iintroductory training

3. Introductory Training

Provide an overview of the ISO 9001:2015 requirements to key personnel, including those taking part in the QMS Implementation Team.

An introductory training session for all staff involved in the QMS should be organized, starting with the QMS Implementation Team including Top management. A basic introductory ISO training course helps to ensure the successful implementation of a QMS by providing sound understanding of the principles and practices pertaining to ISO 9001. Ideally, this course should be provided by a registered training organization with expertise in this area.

If a staff member has to conduct the training session, they must have a sound and demonstrated background in the subject matter combined with, wherever possible, formal training skills.

Involve employees in developing and improving the system, through awareness sessions, flowcharting, team reviews and experience feedback.

Participants/Responsibilities

  • Whole Organization
  • Top Management
  • Management Representative
  • QMS Implementation Team

Deliverables/Outputs

  • Training presentations
  • Handouts
  • Briefing attendance records

4. Gap Analysis

Conduct a gap analysis of your current management system

Review all existing management system practices, controls and documentation using the requirements of ISO 9001:2015 as the criteria. Try to understand each business process in context of each of the requirements of the standards by comparing different activities and processes with what the standards requires.

A gap analysis is a technique to clearly identify which clauses of ISO 9001 are currently not being fully addressed (or not addressed at all) and to develop remedial actions. The gap analysis should be conducted by members of the QMS Implementation Team. Gap analyses should be conducted with small groups of staff, including the process owner of each process.

Participants/Responsibilities

  • All Managers
  • Heads of Department
  • Top Management
  • Management Representative
  • Process owners
  • QMS Implementation Team

Deliverables/Outputs

  • Completed gap analysis checklists
  • List of actions, owners and time-frames

5. Strategy, Risks & Opportunities, Scope

Establish the strategic direction of your company and implement the risks and opportunities procedure.

The organization has to establish its vision consistent with its mission and identify the strategic directions and interested party requirements consistent to its context. Identify the processes needed for the QMS.

The scope must set out what your company does and what it delivers. It should include products and services. It must be done with consideration to the context. Ensure staff understand the risks and opportunities that affect their work.

Participants/Responsibilities

  • Top Management
  • Management Representative
  • QMS Implementation Team

Deliverables/Outputs

  • Authorized and implemented procedure
  • SWOT & PESTLE Analysis
  • Internal and external issues identified
  • Risk and opportunity register
  • Quality manual scope

quality

6. Quality Policy & Quality Objectives

Establish and communicate the quality policy, objectives and performance indicators.

Review the quality policy to determine whether it is appropriate to the context of the organization and its purpose. Ensure the quality objectives are consistent with the quality policy. Set objectives per function and identify measurable performance indicators to enable tracking of their status. Staff must know the quality policy and how the objectives relate to their work.

Participants/Responsibilities

  • Top Management
  • Management Representative
  • QMS Implementation Team
  • Heads of Department

Deliverables/Outputs

  • Authorized quality policy and objectives
  • Quality objectives linked to indicators
  • Management plans specifying:
    · The activities to achieve the objectives
    · The resources needed and target dates

7. Documented Information Procedure

Implement the documented information procedure and train staff in its use.

Adjusting the QMS documents should also be expected as staff become accustomed to the requirements and begin to suggest improvements in usability.

Meet and discuss the requirements of ISO 9001 clause 7.5 and the quality management system and consider:

  • Amending and implementing the procedure
  • Review and approval forms
  • Agree document identification system and naming conventions
  • Establish filing system/Integrate with existing system
  • Ensure all staff know which forms to use, how to complete and process them
  • Ensure all staff know which types of documented information that applies to their work

Participants/Responsibilities

  • Document Control Team
  • QMS Implementation Team
  • Information Technology

Deliverables/Outputs

  • Authorized and implemented procedure
  • Signed briefing attendance sheets
  • Master Document & Record Index
  • Document Change Requests
  • Document Issue Sheets

quality

8. Customer Satisfaction Procedure

Implement the customer satisfaction procedure.

Meet and discuss the requirements of ISO 9001 clause 9.1.2 and the quality management system and consider:

  • Amending and implementing the procedure
  • Methods of capturing customer feedback and perceptions
  • Methods of complaint handling and product returns

Participants/Responsibilities

  • Management Representative
  • Operational Managers
  • Process Owners

Deliverables/Outputs

  • Authorized and implemented procedure
  • Customer Satisfaction Survey
  • Customer Feedback Log

9. Nonconformity and Corrective Action Procedure

Implement the nonconformity and corrective action procedure.

Meet and discuss the requirements of ISO 9001 clause 8.7 and 10.2 and the quality management system and consider:

  • Amending and implementing the procedure
  • Documented procedure
  • Nonconforming output log
  • Corrective action form and log
  • Root-cause analysis techniques
  • Train affected staff on how to report non-conformances and issues for corrective action

Participants/Responsibilities

  • Management Representative
  • Operational Managers
  • Process Owners
  • All Managers
  • Heads of Department
  • Affected staff

Deliverables/Outputs

  • Authorized and implemented procedure
  • Training presentations
  • Handouts
  • Training attendance records

internal audit procedure

10. Internal Audit Procedure

Implement the internal audit procedure.

Meet and discuss the requirements of ISO 9001 clause 9.2 and the quality management system and consider:

  • Amending and implementing the procedure
  • Selecting internal auditors
  • Devising an audit programme/schedule
  • Audit reporting records

Participants/Responsibilities

  • Management Representative
  • Internal Auditors

Deliverables/Outputs

  • Authorized and implemented procedure
  • Internal audit programme/schedule
  • Internal audit reports

11. Management Review 1

Undertake the first Management Review and select a Certification Body.

Top Management to perform a review of progress and to identify areas of weakness and take corrective action as required. Certification Body selection criteria may include:

  • Must have clients from our industry (i.e. our competitors)
  • Must offer CVs of their auditors for review
  • Must deliver well-crafted nonconformity statements

Information on selecting a certification body is available:
http://www.iso.org/iso/home/standards/certification.htm

Participants/Responsibilities

  • Top Management
  • Management Representative
  • Heads of Department

Deliverables/Outputs

  • Authorized and implemented procedure
  • Management review agenda
  • Management review minutes

operational procedures

12. Operational Procedures

Implement or document your operational procedures.

Meet and discuss the process requirements of ISO 9001 clause 8.0 and the quality management system and consider scheduling sessions with the authors of the operating procedures and other supporting documents to provide assistance in developing documents that are consistent with the set quality objectives and to the relevant requirements of ISO 9001 standard. If your operational procedures are effective and define how your key processes operate, keep them!

Participants/Responsibilities

  • Process Owners
  • All Managers
  • Heads of Department
  • Supervisors

Deliverables/Outputs

  • Authorized and implemented procedure
  • Inspection reports
  • Audit results
  • Process documentation

13. Purchasing and Procurement Procedure

Implement the purchasing and procurement procedure.

Meet and discuss the process requirements of ISO 9001 clause 8.4 and the quality management system and consider:

  • Amending and implementing the procedure
  • Methods for supplier evaluation, criteria, controls and records

Participants/Responsibilities

  • All divisions with contractors working for their behalf

Deliverables/Outputs

  • Authorized and implemented procedure
  • Approved supplier index
  • Supplier evaluation
  • Receiving inspection logs

competence

14. Competence and Awareness Procedure

Implement the competence and awareness procedure.

Meet and discuss the process requirements of ISO 9001 clauses 7.2 and 7.3 and the quality management system and consider:

  • Amending and implementing the procedure
  • Training plans, requests, reports, and evaluation records
  • Organization charts and Job Descriptions
  • Contracts

Participants/Responsibilities

  • Human Resources
  • Management Representative

Deliverables/Outputs

  • Authorized and implemented procedure
  • Competency reviews
  • Training matrix
  • Organization charts
  • Job descriptions and appraisals
  • Signed training attendance sheets

15. Implement the Supporting Processes

Meet and discuss the process requirements of ISO 9001 clause 7.1 and the quality management system and consider:

  • The capabilities of existing internal resources
  • The constraints on existing internal resources
  • What needs to be obtained from external providers

Participants/Responsibilities

  • Top Management
  • Management Representative
  • Accounting/Finance
  • Information Technology
  • Safety and Security

Deliverables/Outputs

  • Budgets, forecasts, etc.
  • Provide and maintain work environment
  • Determine and provide the man-power
  • Machines, equipment, hardware & software
  • Facilities, buildings and associated utilities
  • Monitoring and measuring resources

management review

16. Management Review 2

Amend the quality manual template and undertake the second Management Review.

Members of Top Management should assist the Management Representative in drafting the quality management system manual and preparing its scope.

If your existing quality manual fits your business and your customers require it, keep it! Top management to perform a review of progress and to identify areas of weakness and take corrective action as required.

Participants/Responsibilities

  • Top Management
  • Management Representative

Deliverables/Outputs

  • Authorized quality manual
  • Communicate the manual
  • Management Review Agenda
  • Management Review Minutes

17. Internal Auditor Training

Select external training providers and begin internal auditor training.

Discuss the requirements for internal auditing and teach the participants on how to audit a QMS. Based on education and experience auditors must pass 1-or 2-day external auditor course and exam.

Participants/Responsibilities

  • Internal Auditors

Deliverables/Outputs

  • Training presentations
  • Handouts
  • Training attendance records

internal audit

18. Start Internal Auditing

Begin internal auditing (See ISO 9001:2015 Clause 9.2)

Perform an elemental internal audit of selected functions and areas using the audit programme and audit checklists. Ensure that the auditors do not audit their own functions or processes. All staff should be provided with adequate lead time to prepare for the audit.

Participants/Responsibilities

  • Internal Auditors
  • Top Management
  • Management Representative

Deliverables/Outputs

  • Internal audit reports
  • Internal audit checklists
  • Corrective actions

19. Root-cause Analysis

Root-cause analysis workshop (See ISO 9001:2015 Clause 9.1.3)

Assist the process owners in determining root-causes and finding solutions through workshops and training on 5-Whys analysis, Fishbone Diagrams, or 8 Dimensions (8D) analysis techniques.

Participants/Responsibilities

  • Internal Auditors
  • Top Management
  • Management Representative
  • Process Owners & Personnel

Deliverables/Outputs

  • Signed briefing attendance sheets
  • Corrective action reports with root-cause analysis findings
  • Recommended corrective actions

corrective actions

20. Corrective Actions Implementation

Implement the corrective actions based on the internal audit findings.

The process owners should implement the corrective actions to address the audit findings. The documented corrective actions must be submitted to the Management Representative for approval.

Participants/Responsibilities

  • Process Owners
  • Management Representative

Deliverables/Outputs

  • Verification of completed corrective actions
  • Corrective action report/log

21. Management Review 3

Undertake the Third Management Review.

Top management to perform a review of progress and to identify areas of weakness and take corrective action as required.

  • Quality objective and their performance indicators
  • Verification of completed corrective actions
  • Results of internal audits and their analysis
  • Customer feedback/satisfaction
  • Performance evaluation
  • External providers’ performance, etc.

Participants/Responsibilities

  • Top Management
  • Management Representative
  • Heads of Department

Deliverables/Outputs

  • Management Review Agenda
  • Management Review Minutes

22. Readiness Review

Conduct a readiness review.

Once you have implemented the new key requirements and have dealt with any corrective actions, it is suggested that the Management Representative should carry out at least one other internal (element) audit in readiness for the Certification Body’s 1st stage audit.

Top Management should ensure that corrective action is undertaken on any adverse 1st stage audit findings without delay. Make any necessary changes to the quality management system and the documentation information.

Participants/Responsibilities

  • Top Management
  • Management Representative
  • QMS Implementation Team
  • Process owners

Deliverables/Outputs

  • Internal audit checklist
  • Process audit checklist
  • Audit reports
  • Schedule of corrective actions and close-out

audit report

23. Certification Body 1st Stage Audit

The organization should liaise with the certification body to establish dates for the audit that suit all concerned. All staff should be provided with adequate lead time to prepare for the audit. All documentation that may be needed during the 1st stage audit should be easily accessible.

Participants/Responsibilities

  • Management Representative
  • Certification Auditor(s)

Deliverables/Outputs

  • 1st Stage audit report
  • Schedule of corrective actions

24. Address 1st Stage Audit Findings

Top management should ensure that corrective action is undertaken on any adverse 1st stage audit findings without delay. Make any necessary changes to the quality management system and the documentation information.

The Management Representative should address the issues raised by the Certification Body to ensure a successful 2nd stage audit.

Participants/Responsibilities

  • Whole Organization
  • Management Representative
  • QMS Implementation Team

Deliverables/Outputs

  • Schedule of addressed corrective actions
  • Schedule of opportunities for improvement

25. Certification Body 2nd Stage Audit

Certification Audit by the Registrar. At this stage, you should receive a Recommendation for Certification to ISO 9001:2015.

All documentation that may be needed during the 2nd stage audit should be easily accessible.

Participants/Responsibilities

  • Whole Organization
  • Management Representative
  • Certification Auditor(s)

Deliverables/Outputs

  • 2nd Stage audit report

26. Address 2nd Stage Audit Findings

Top management should ensure that corrective action is undertaken on any adverse 2nd stage audit findings without delay. Make any necessary changes to the quality management system and the documentation information.

The documented corrective actions must be submitted to the Certification Body for approval.

Participants/Responsibilities

  • Management Representative
  • QMS Implementation Team

Deliverables/Outputs

  • Schedule of addressed corrective actions
  • Schedule of opportunities for improvement

certified stamp

27. Certification

Certification Body to verify and close-out 2nd stage audit findings

The documented corrective actions are verified by the Certification Body for final approval for certification to ISO 9001:2015.

It is imperative that the achievement of certification of compliance to ISO 9001:2015 is appropriately recognized by Top Management and celebrated by all staff.

Certification of compliance provides an excellent baseline on which to measure ongoing improvement of the organization.

Participants/Responsibilities

  • Whole Organization
  • Management Representative
  • Certification Auditor(s)

Deliverables/Outputs

  • ISO 9001:2015 Certification

 

Looking For Less Detail?

This Implementation Guide is for an ISO 9001 Project Manager or Quality Manager.

Our ISO 9001 Project Plan is an overview more suited to Top Management.

ISO 9001 Implementation

 

Updated: 15th February 2019
Author: Richard Keen

Richard Keen

Richard Keen

Richard is our Compliance Director, responsible for content & product development.
But most importantly he is ISO's biggest fanboy and a true evangelist of the standards.
Learn more about Richard