ISO 9001 FAQs

Annex SL is the single biggest change to the ISO 9001:2015 document. Our Gap Analysis Document provides more details on all of the expected changes as well as Annex SL.

NQA will still need a nominated contact for all matters related to certification and the organization of certification visits. NQA do not expect this to have much impact on our relationship with our clients.

Complete and accurately complete the export documentation. Full licences need to be in place.

Yes, and generally, price fluctuations may also be a risk or an opportunity.

Not complicated, but professionally challenging. There is much more high level, professional judgement required.

Yes, they can be covered in separate meetings. However, the requirement is to have a management review process, which may be a meeting or meetings, but could also take the form of other events or documentation. The requirement is to “…retain documented information as evidence of the results of management reviews.”

There are various ways of doing this – e.g. a risk register and mitigation actions, identification of risk points on a process flow, recognizing that your procedures are carried out in a particular way to reduce risk – see question above too.

Examples of requirements that relate to risk include, for example: 8.4.2 Type and extent of control The organization shall ensure that externally provided processes, products and services do not adversely affect the organisation’s ability to consistently deliver conforming products and services to its customers. And 6.3 Planning of changes When the organisation determines the need for changes…..it shall consider the purpose of the changes and their potential consequences…

Risks will influence the control parameters needed to reduce or mitigate that risk.

The process requirements are in reality no different to the 2008 standard. The determination of inputs and outputs, and the importance of processes are enhanced and made more explicit in the 2015 standard.

Agreed – the same approach can be used, although the specific risks may differ.

Yes you do need to identify your risks in some way. When you say “how” I assume this means document. If your processes are documented, it is useful to document the risks also.

It is not a requirement but it would be a very helpful thing to do.

The only requirements that have reduced are the requirements for documented procedures. There are still very specific requirements for documented evidence, (records). Any management system, whether highly documented or not, needs to be robust to be effective.

You maintain elements of the system, e.g. infrastructure and retain documented evidence, i.e. records.

Approach the requirements of the system from a risk perspective, (using the vocabulary of risk, but not necessarily the word “risk”), and you will very likely get a positive response. The management review or internal audit process might be a good place to start.

Management oriented processes relate directly to the overall system, e.g. management review. The support processes support the system, e.g. training and competence, document control, calibration.

NQA does not promote specific templates. It would certainly be helpful to include interested parties. The primary purpose of a risk register is to help the organization identify its own needs.

You do not have to renumber your QMS. There is no requirement, and never was a requirement to number your documentation as per the standard. You may well find it necessary and useful to expand your documentation to address the additional 2015 requirements.

We do not expect anything, other than whatever approach you use makes sense and is effective for your needs. In this case, a joint risk assessment approach would appear to make sense.

Visibility, inclusiveness and good communications. Employees should be aware of vision, mission, strategy, policy.

Our Assessors and Client Executives will be working closely with our clients to track your progression towards the new standard. You should speak to your Client Executive to establish exactly where you are in the transition process.

The introduction of Annex SL will aid the integration process for ISO 9001, ISO 14001 and ISO 45001. You will need to think about transition dates and transition plans carefully though due to the different publication dates.