• Guidance on ISO 9001:2008 Sub-clause 1.2 'Application'
• Guidance on the Documentation Requirements of ISO 9001:2008
• Guidance on the Terminology used in ISO 9001 and ISO 9004
• Guidance on the Concept and Use of the Process Approach for management systems
• Guidance on 'Outsourced Processes'

Document: ISO/TC 176/SC 2/N 524R6
October 2008

1.    Introduction

ISO 9001:2008 has been developed in order to introduce clarifications to the existing requirements of ISO 9001:2000 and to improve compatibility with ISO 14001:2004. ISO 9001:2008 does not introduce additional requirements nor does it change the intent of the ISO 9001:2000 standard.

No new requirements were introduced in ISO 9001:2008 edition but, in order to benefit from the clarifications of ISO 9001:2008, users of the former version will need to take into consideration whether the clarifications introduced have an impact on their current interpretation of ISO 9001:2000, as changes may be necessary to their QMS.

ISO 9001:2008 is intended to be generic and applicable to all organizations, regardless of type, size and product category.  It is recognized, however, that not all the requirements of this standard will necessarily be relevant to all organizations. Under certain circumstances, an organization may consider the exclusion of the application of some requirements of ISO 9001:2008 from its QMS. ISO 9001:2008 makes allowance for such situations, through sub-clause 1.2 Application.

This module of the ISO 9001:2008 Support Package has been developed by ISO/TC 176/SC 2 to provide users with information regarding the intent of ISO 9001:2008 sub-clause 1.2 Application, including some typical examples of its use in practical situations (see Annex A).

2.    The concept of exclusions

Sub-clause1.2 Application of ISO 9001:2008 states:

“1.2 Application

All requirements of this International Standard are generic and are intended to be applicable to all organizations, regardless of type, size and product provided.

Where any requirement(s) of this International Standard cannot be applied due to the nature of an organization and its product, this can be considered for exclusion.

Where exclusions are made, claims of conformity to this International Standard are not acceptable unless these exclusions are limited to requirements within clause 7, and such exclusions do not affect the organization's ability, or responsibility, to provide product that meets customer and applicable statutory and regulatory requirements.."

Therefore, an organization should consider whether all the requirements of the standard are relevant to its activities, based on the nature of the organization itself, its products, and the processes it uses to meet customer, statutory and regulatory requirements. In addition, the organization should take into account any commitments it has made in its quality policy and objectives and how these could affect the need to undertake particular realization processes. All of these can affect the scope of the organization’s QMS.

3.    Justification for exclusion

If an organization identifies requirements of clause 7 of ISO 9001:2008 that cannot be applied to its activities, the organization can consider exclusion of these requirements, provided there is valid justification.

The exclusion of requirements of clause 7 of ISO 9001:2008 is only acceptable if “such exclusions do not affect the organization’s ability or responsibility to consistently provide product that meets customer and applicable statutory and regulatory requirements.”  The appropriateness of the exclusion depends on considerations of items such as:

In some cases the exclusion may not be justified depending on who is the customer, and what is the product.

It should be noted that ISO 9001:2008 sub-clause 1.2 Application can be applied to individual requirements or sub-clauses of clause 7 Product realization. For example, an organization may exclude part of (f) of sub-clause 7.5.1 Control of production and service provision, if the organization has no accountability for post-delivery activities.

Sub-clause 4.2.2 Quality manual of ISO 9001:2008 states:

“The organization shall establish and maintain a quality manual that includes

(a) the scope of the quality management system, including details of and justification for any exclusions (see 1.2),..…”

All exclusions need to be expressed in the quality manual (with valid justifications) and have to be consistent with the scope of the organization’s QMS. Any publicly available documents, promoting conformance to ISO 9001:2008, should clearly state the scope of the QMS in a way that will not mislead customers and end users. This should ensure that the necessary information is available for the user to determine which categories of product and product realization processes are included. In addition, the scope of the QMS should be explicit in stating the responsibility for product design and development and other principal realization processes such as manufacturing, sales and services.

When an organization is evaluating whether it can exclude requirements from its QMS, it should carefully evaluate the impact of such exclusions from the viewpoint of its customer. If there is an impact on the customer, the exclusion would not be justified, since ensuring the conformity of delivered products to customer requirements is a key element of ISO 9001:2008.

Also, organizations considering exclusions should recognize that customers often have no knowledge of the internal operations of the organization from whom they purchase products (and really do not care how or where organizations design, manufacture or support products). The customer looks at the organization as an entity and expects all elements of the organization (e.g. design, manufacturing, purchasing, repair) to work together to ensure the conformity of its products.

4.    Claims of conformity

The final paragraph of sub-clause 1.2 Application of ISO 9001:2008 states:

“Where exclusions are made, claims of conformity to this International Standard are not acceptable unless these exclusions are limited to requirements within clause 7, and such exclusions do not affect the organization's ability, or responsibility, to provide product that meets customer and applicable statutory and regulatory requirements.”

If an organization excludes requirements from its QMS which do not meet the criteria presented in sub-clause 1.2 Application, conformity to ISO 9001:2008 should not be claimed or implied.  Examples of situations where conformity to ISO 9001:2008 should not be claimed are:

ANNEX A

Given below are a number of examples designed to show the reasoning used to determine which requirements of ISO 9001:2008 are applicable to an organization.  It is stressed that these are only hypothetical examples and that in reality each organization’s particular circumstances will have to be analyzed carefully.

The standard allows for the exclusion of either individual requirements, or where applicable, the requirements from entire sub-clauses.  

In all examples, it is assumed that the exclusions mentioned do not affect the organization’s ability or responsibility, to provide product that fulfills customer and applicable statutory and regulatory requirements.

Example 1 – Customer property (intellectual property) controlled by a bank.

Situation:

A bank provides a variety of services to its customers (i.e. personal and company bank accounts), but chooses to implement a QMS only for its Internet banking services.  For this service the bank has claimed conformity to ISO 9001:2008. The bank clearly states in its Quality Manual which services are covered by the QMS.  The bank applies all the requirements of ISO 9001:2008 for the realization of its Internet banking services, with the exception of sub-clause 7.5.4 Customer property. The bank does not feel that it has possession of any customer property as part of its Internet banking services and has stated this in the justification for the exclusion of sub-clause 7.5.4 Customer propertyfrom its QMS.

Issue(s):

Can the bank exclude sub-clause 7.5.4 Customer property from its QMS and claim conformity to ISO 9001:2008?

Analysis and Conclusion:

The decision made by the bank to exclude sub-clause 7.5.4 Customer property was not justified because the bank does receive information from its customers such as personal and confidential data. ISO 9001, 7.5.4 Customer property requires an organization to exercise care with customer property while it is under the organization’s control or being used by the organization. And the note of sub-clause 7.5.4 Customer property, clearly indicates “Customer property can include intellectual property and personal data”. In this situation, the bank’s customers provide important information in confidence when using the service, which constitutes “Customer property”. Therefore the bank has to address the requirements for customer property in its QMS.

Example 2 – Exclusion of design and development by a contract manufacturer

Situation:

XYZ Electronics is building a new factory to perform manufacturing of mobile phones, as a subcontractor.  It has only one customer and this customer maintains responsibility and authority for product design. XYZ Electronics is responsible for purchasing of all components and for performing the manufacturing activities. The customer provides XYZ with the manufacturing and parts specifications, and is also responsible for notifying XYZ of any design changes and providing the appropriate change information.

XYZ Electronics, in the development of its QMS, has excluded the requirements of ISO 9001:2008 sub-clause 7.3 Design and development. XYZ Electronics considers the customer specifications as a customer supplied product and therefore controls this according to ISO 9001:2008 sub-clause 7.5.4 Customer property.

Issue(s):

Can the XYZ Electronics exclude sub-clause 7.3 Design and development from its QMS and claim conformity to ISO 9001:2008?

Analysis and Conclusion:

XYZ Electronics was justified with its decision to exclude sub-clause 7.3 Design and development from its QMS since it does not have any authority or accountability for design of the mobile phone product.  Its customer provides the design.

Example 3 – Regulators permit the exclusion of design development

Situation:

KML designs and fabricates pressure vessels for electricity generating stations, in accordance with various mandatory pressure vessel regulations.

The regulatory authority has not yet revised its requirements to take ISO 9001:2008 into account, but has confirmed that it will continue not to require manufacturer’s QMSs to include design.  On this basis KML decides to exclude sub-clause 7.3 Design and development from its QMS and to claim conformity to ISO 9001:2008.

Issue(s):

Can KML exclude sub-clause 7.3 Design and development from its QMS and claim conformity to ISO 9001:2008?

Analysis and Conclusions:

This situation deals with the issue of claiming conformity to ISO 9001:2008 with the exclusion of sub-clause 7.3 Design and development because the regulatory authority does not require the fabricator to include design and development in its QMS.

KML’s claims of conformity to ISO 9001:2008 are not justified, because design and development can impact the organization’s ability to conform to customer requirements. Therefore, KML should not exclude sub-clause 7.3 Design and development, even if the regulatory body allows such exclusions.

Example 4 – Outsourced design and development activities

Situation:

CDH Construction Ltd. provides engineering and construction services for various developers, but does not have in-house design capabilities. The company employs a project manager who is responsible for the management of design activities. These activities are outsourced to TPL Engineering Ltd, an engineering consulting company.

The activities of TPL Engineering Ltd. are managed through the application of the requirements of sub-clause 7.4 Purchasing. The project manager of CDH Construction Ltd. oversees the design activities and is involved in design review meetings and design verification and validation activities. In addition, the project manager is responsible for ensuring that the design activities are carried out in accordance with the requirements of ISO 9001:2008 sub-clause 7.3 Design and development. However, CDH Construction Ltd. has excluded sub-clause 7.3 Design and development from its QMS, since the design activities have been outsourced.

Issue(s):

Can CDH Construction Ltd. exclude sub-clause 7.3 Design and development from its QMS and claim conformity to ISO 9001:2008?

Analysis and Conclusion:

CDH Construction Ltd cannot exclude sub-clause 7.3 Design and development since it has the responsibility for the design and development.

Note: See also the ISO 9000 Introduction and Support Package module: N630 R3 - Guidance on Outsourced Processes

Example 5 – Traceability

Situation:

AKP Corp. is a company that manufactures electric motors for sale by licensed distributors. Traceability of the component parts of the product is not an internal or external requirement of this company. The organization has excluded the traceability requirement of sub-clause 7.5.3 Identification and traceability from its QMS, while claiming conformity to ISO 9001:2008.

Issue(s):

Can AKP Corp. exclude the traceability requirement of sub-clause 7.5.3 Identification and traceability from its QMS and claim conformity to ISO 9001:2008?

Analysis and conclusion:

The organization’s decision to exclude the requirements for traceability is justified. However this exclusion is not necessary, since ISO 9001:2008 only requires traceability when it “is a requirement”.

Example 6 – Design of services

Situation:

JWB is a consulting firm that performs internal audits for small organizations that have implemented quality management systems that conform to ISO 9001:2008. JWB developed its methodology and tools for performing customer’s internal audits based on the guidance of ISO 19011:2002. It delivers a customized service that has as its output a written internal audit report and all the supporting data from the audit. The organization wishes to exclude clause 7.3 Design and development with the justification that, as a service provider, it cannot have any design and development activities.

Issue(s):

Can JWB exclude sub-clause 7.3 Design and development from its QMS and claim conformity to ISO 9001:2008?

Analysis and conclusion:

The organization is not justified in the exclusion of sub-clause 7.3 Design and development since it has developed a customized service to meet its customer’s requirements, including the development of its methodology and tools for performing the audits and delivery of a written report.

Example 7 – Post delivery activities

Situation:

The ABC consultancy organization provides financial auditing services to large manufacturing organizations. The product delivered to its customers is an internal financial audit report. Contracts for internal financial audit services state that a contract is completed when ABC has issued, clarified and reviewed its report with the customer, and that the customer has finally signed-off the report as being fully agreed; any activity beyond that the sign-off would be subject to a supplementary contract. The consulting firm claims its QMS conforms to ISO 9001:2008 with the exclusion of post-delivery requirement (f) of sub-clause 7.5.1.Control of production and service provision.

Issue(s):

Can the ABC consultancy organization exclude the post-delivery requirement in bullet (f) of sub-clause 7.5.1.Control of production and service provision from its QMS and claim conformity to ISO 9001:2008?

Analysis and conclusion:

The relevant parts of Sub-clause 7.5.1 Control of production and service provisionstate:
“The organization shall plan and carry out production and service provision under controlled conditions. Controlled conditions shall include, as applicable………………
f) the implementation of release, delivery and post-delivery activities.”

This is an example where the organization has chosen to exclude a single requirement of the Standard, contained within a sub-clause.

The organization is justified in its decision to exclude the post-delivery requirement in sub-clause 7.5.1(f) Control of production and service provision as all its contracts exclude any provision of follow up activities related to the delivered service.

Note also that sub-clause 7.5.1 only requires control of post-delivery activities “as applicable”, making a formal exclusion unnecessary. In addition, all the other requirements of bullet (f) for the "release" or "delivery" of product cannot be excluded.

Example 8 – Validation of processes

Situation:

A small garment manufacturer carries out cutting work on textiles that are delivered to an internal sewing department for the next phase of the process. The quality of the output of the cutting work can be checked after finalization of the work. It has implemented a QMS and claims conformity to ISO 9001:2008 , with the exclusion of sub-clause 7.5.2 Validation of processes for production and service provision.

Issue(s):

Can the small garment manufacturer exclude sub-clause 7.5.2 Validation processes for production and service provision from its QMS and claim conformity to ISO 9001:2008?

Analysis and conclusion:

The organization is justified in the exclusion of the requirements of sub-clause 7.5.2 Validation of processes for production and service provision since it can inspect the result of the cutting process to determine conformance or nonconformance to specification.

Example 9 – Monitoring and measuring devices

Situation:

A small training organization provides training to people who are not currently working and would like to upgrade their skills. The organization carries out practical skills training.  In this process the participants practice the use of simple measuring equipment such as rulers, spirit levels and plumb lines. The organization’s product is the skills development, and not the crafted items produced by the participants. The training organization has implemented ISO 9001: 2000 QMS and claims conformity to the standard with the exclusion of sub-clause 7.6 Control of monitoring and measuring devices.

Issue(s):

Can the small training organization exclude sub-clause 7.6 Control of monitoring and measuring devices from its QMS and claim conformity to ISO 9001:2008.

Analysis and conclusion:

In this example the simple measuring devices that have been mentioned (rules, spirit-levels and plumb lines) are a diversion and are not the correct items to be focusing on when considering the exclusion of sub-clause 7.6. Instead, it is the training that is the product being delivered and to which attention should be given. The organization should be controlling the monitoring and measuring devices that are needed to provide evidence of the conformity of the product (training/education) to requirements, e.g. tests and student satisfaction surveys, reports related to students finding jobs, etc. (In this instance, the necessary control may be demonstrated through verification or validation of the measuring and monitoring devices, e.g. though pilot testing of the survey questionnaires).  

The organization may be able to justify the exclusion of those requirements in the sub-clause that specifically relate to the calibration of measuring equipment [in 7.6 bullets (a) to (e)], if it decides that the simple measuring equipment does not need to be calibrated. It may however be necessary for the organization to provide the students with training in checking the accuracy of their equipment (rules, sprit levels etc.), in which case even these requirements could not be excluded.

In conclusion, sub-clause 7.6 could not be excluded in its entirety, only in part.

Example 10. Complex Organization (Global TV)

10.1    Introduction

This example illustrates some of the key issues a multinational organization with multiple work centres faces when implementing ISO 9001:2008 throughout the entire organization.

Global TV (GTV) is an organization that designs, manufactures, sells, distributes and services televisions (TVs) worldwide. GTV sells its product to retail outlets, which in-turn sell the TVs to end-user customers. Headquarters provides global support for quality management, all purchasing functions and sales and distribution contracts for its operations worldwide. GTV consists of a design centre, a sub-assembly plant, a manufacturing centre and a distribution centre, all of which are wholly owned by GTV.  

GTV management has decided to implement ISO 9001:2008 in all its facilities worldwide, and expects all facilities of GTV to have their own quality management system (QMS). However, not all facilities are required to obtain certification.  In addition, all facilities have to comply with the contents of the corporate quality policy, which is “To provide customers of GTV with products and services that meet their needs and expectations, and to continually improve the QMS”.

NOTE:  

1. For the purpose of simplifying the example for a complex organization, the number of centres and plants has been reduced to one of each (design centre, sub-assembly plant, manufacturing centre and distribution centre).
2. ISO 9001:2008 allows for the exclusion of any requirement(s) within clause 7, where such exclusions do not affect the organization’s ability or responsibility  to consistently provide product that meets customer and applicable statutory and regulatory requirements.
3. When applying clause 1.2 Application to a complex organization (Global TV) we have to take into consideration the organization’s customer.  Global TV’s ultimate customer is the end user who purchases the product from a retail distributor.  The customer of the individual centres and plants is the centre or plant that receives its product (i.e., the design centre’s customers are the sub-assembly plant and the manufacturing centre).

10.2    Manufacturing Centre (MC)

Situation:

MC receives orders from headquarters and delivers products to the distribution centre. It has established its QMS guided by, and in conformity with, the quality policy of GTV. All aspects of quality management required by ISO 9001:2008 are performed within the MC, with the sole exception of product design and development. The MC decided to exclude Sub-Clause 7.3 Design and development from the scope of its QMS since it performs no design activities. The MC does include a statement and justification in its quality manual that it is excluding the product design and development process and further indicates that a) its customer is Global TV headquarters who provide orders to the manufacturing plant, and b) Global TV headquarters is responsible for ensuring the Design Centre conforms to ISO 9001:2008.

Issue(s):

Can the MC exclude Sub-Clause 7.3 Design and development from its QMS and claim conformity with ISO 9001:2008?

Analysis and Conclusion:

The exclusion of Sub-Clause 7.3 Design and development is justified, since Global TV Headquarters (the customer) orders product to be manufactured in accordance with the design provided to the MC by the Design Centre. Global TV headquarters is responsible for ensuring that the Design Centre’s quality management system conforms to ISO 9001:2008 requirements. The manufacturing centre properly justified the exclusion by specifying that its customer is Global TV Headquarters. As such, any certificate of conformity for the GTV MC will reference the internal customer and will be of no direct value to the external customer of GTV, the end user customer who buys their TVs.

10.3    Global TV

Situation:

Global TV Headquarters distributes its products through retail outlets to the end user customer. The organization has implemented ISO 9001:2008 at it headquarters and has requested that all its facilities implement a quality management system conforming to ISO 9001:2008. To date the only facility that has not implemented a quality management system is the Design Centre. In its quality management system manual Global TV headquarters states that all of its facilities conform to ISO 9001:2008 and the organization has not taken any exceptions.

Issue(s):

Can Global TV claim conformity with ISO 9001:2008?

Analysis and Conclusion:

Global TV cannot justify its claim of conformity to ISO 9001:2008 since GTV is responsible for product design and development and its Design Centre has not implemented a quality management system that conforms to ISO 9001:2008.

10.4    Summary

Any complex organization (such as Global TV) has to be careful of its claim that its quality management system conforms to ISO 9001:2008. The organization has responsibility for all ISO 9001:2008 requirements that can affect the organization’s ability to provide products that meet its customer and statutory and regulatory requirements. Therefore, in order to claim conformity to ISO 9001:2008 at the corporate level, it has to ensure that all its relevant facilities are conforming to ISO 9001:2008. The organization’s individual facilities may exclude requirements within Clause 7 based on a justification making it clear that their customer is another division of the corporation, and not the end-user. The certificates of conformity referencing internal customers are of no direct value to the external customers of the organization.

Introduction and support package:
Guidance on the documentation requirements of ISO 9001:2008

Document: ISO/TC 176/SC 2/N525R2
October 2008

1.    Introduction

Two of the most important objectives in the revision of the ISO 9000 series of standards have been

• to develop a simplified set of standards  that will be equally applicable to small as well as medium and large organizations, and
• for the amount and detail of documentation required to be more relevant to the desired results of the organization’s process activities.

ISO 9001:2008, Quality management systems – Requirements has achieved these objectives, and the purpose of this additional guidance is to explain the intent of the new standard with specific regard to documentation.

ISO 9001:2008 allows an organization flexibility in the way it chooses to document its quality management system (QMS). This enables each individual organization to develop the minimum amount of documentation needed in order to demonstrate the effective planning, operation and control of its processes and the implementation and continual improvement of the effectiveness of its QMS.

It is stressed that ISO 9001 requires (and always has required) a “Documented quality management system”, and not a “system of documents”.

2    What is a “document”? - Definitions and references

The following are some of the main objectives of an organization’s documentation, independent of whether or not it has implemented a formal QMS;

a)    Communication of Information

• as a tool for information transmission and communication. The type and extent of the documentation will depend on the nature of the organization’s products and processes, the degree of formality of communication systems and the level of communication skills within the organization, and the organizational culture.

b)    Evidence of conformity

• provision of evidence that what was planned, has actually been done.

c)    Knowledge sharing

• to disseminate and preserve the organization’s experiences. A typical example would be a technical specification, which can be used as a base for design and development of a new product.

A list of commonly used terms relating to documentation is presented in Annex A (taken from ISO 9000:2005). It must be stressed that, according to ISO 9001:2008 clause 4.2 Documentation requirements documents may be in any form or type of medium, and the definition of “document” in ISO 9000:2005 clause 3.7.2 gives the following examples:

• paper
• magnetic
• electronic or optical computer disc  
• photograph
• master sample

Users are also referred to ISO/TR 10013:2001, Guidelines for quality management systems documentation for further guidance.

3    ISO 9001:2008 Documentation Requirements

ISO 9001:2008 clause 4.1 General requirements requires an organization to “establish, document, implement, and maintain a quality management system and continually improve its effectiveness in accordance with the requirements of this International Standard”

Clause 4.2.1 General explains that the quality management system documentation shall include:

• documented statements of a quality policy and quality objectives;
• a quality manual
• documented procedures required by this International Standard
• documents needed by the organization to ensure the effective planning, operation and control of its processes, and
• records required by this International Standard;

The notes after Clause 4.2 make it clear that where the standard specifically requires a “documented procedure”, the procedure has to be established, documented, implemented and maintained. It also emphasizes that the extent of the QMS documentation may differ from one organization to another due to:

• the size of organization and type of activities;
• the complexity of  processes and their interactions, and
• the competence of personnel.

All the documents that form part of the QMS have to be controlled in accordance with clause 4.2.3 of ISO 9001:2008, or, for the particular case of records, according to clause 4.2.4.

4    Guidance on Clause 4.2 of ISO 9001:2008

The following comments are intended to assist users of ISO 9001:2008 in understanding the intent of the general documentation requirements of the International Standard.

a)    Documented statements of a quality policy and objectives:

• Requirements for the quality policy are defined in clause 5.3 of ISO 9001:2008. The documented quality policy has to be controlled according to the requirements of clause 4.2.3. 
  Note: Organizations that are revising their quality policy for the first time, or in order to meet the amended requirements in ISO 9001:2008, should pay particular attention to clause 4.2.3 (c), (d) and (g).
• Requirements for quality objectives are defined in clause 5.4.1 of ISO 9001:2008. These documented quality objectives are also subject to the document control requirements of clause 4.2.3.

b)    Quality Manual:

• Clause 4.2.2 of ISO 9001:2008 specifies the minimum content for a quality manual. The format and structure of the manual is a decision for each organization, and will depend on the organization’s size, culture and complexity. Some organizations may choose to use the quality manual for other purposes besides that of simply documenting the QMS
• A small organization may find it appropriate to include the description of its entire QMS within a single manual, including all the documented procedures required by the standard.
• Large, multi-national organizations may need several manuals at the global, national or regional level, and a more complex hierarchy of documentation.
• The quality manual is a document that has to be controlled in accordance with the requirements of clause 4.2.3.

c)    Documented procedures:

• ISO 9001:2008 specifically requires the organization to have “documented procedures” for the following six activities:
  4.2.3 Control of documents
  4.2.4 Control of records
  8.2.2 Internal audit
  8.3 Control of nonconforming product
  8.5.2 Corrective action
  8.5.3 Preventive action
• These documented procedures have to be controlled in accordance with the requirements of clause 4.2.3
• Some organizations may find it convenient to combine the procedure for several activities into a single documented procedure (for example, corrective action and preventive action). Others may choose to document a given activity by using more than one documented procedure (for example, internal audits). Both are acceptable.
• Some organizations (particularly larger organizations, or those with more complex processes) may require additional documented procedures (particularly those relating to product realization processes) to implement an effective QMS.
• Other organizations may require additional procedures, but the size and/or culture of the organization could enable these to be effectively implemented without necessarily being documented. However, in order to demonstrate compliance with ISO 9001:2008, the organization has to be able to provide objective evidence (not necessarily documented) that its QMS has been effectively implemented.

d)    Documents needed by the organization to ensure the effective planning, operation and control of its processes:

• In order for an organization to demonstrate the effective implementation of its QMS, it may be necessary to develop documents other than documented procedures. However, the only documents specifically mentioned in ISO 9001:2008 are:
  - Quality policy (clause 4.2.1.a)
  - Quality objectives (clause 4.2.1.a)
  - Quality manual (clause 4.2.1.b)
• There are several requirements of ISO 9001:2008 where an organization could add value to its QMS and demonstrate conformity by the preparation of other documents, even though the standard does not specifically require them. Examples may include:
  - Process maps, process flow charts and/or process descriptions
  - Organization charts
  - Specifications 
  - Work and/or test instructions 
  - Documents containing internal communications
  - Production schedules
  - Approved supplier lists
  - Test and inspection plans
  - Quality plans
• All such documents have to be controlled in accordance with the requirements of clause 4.2.3 and/or 4.2.4, as applicable

e)    Records:

• Examples of records specifically required by ISO 9001:2008 are presented in Annex B.
• Organizations are free to develop other records that may be needed to demonstrate conformity of their processes, products and quality management system.
• Requirements for the control of records are different from those for other documents, and all records have to be controlled according to those of clause 4.2.4 of ISO 9001:2008.

5    Organizations preparing to implement a QMS

For organizations that are in the process of implementing a QMS, and wish to meet the requirements of ISO 9001:2008, the following comments may be useful.

• For organizations that are in the process of implementing or have yet to implement a QMS, ISO 9001:2008 emphasizes a process approach. This includes: 
  - Identifying the processes necessary for the effective implementation of the quality management system
  - understanding  the interactions between these processes. 
  - documenting the processes to the extent necessary to assure their effective operation and control. (It may be appropriate to document the processes using process maps. It is emphasized, however, that documented process maps are not a requirement of ISO 9001:2008.)
• These processes include the management, resource, product realization and measurement processes that are relevant to the effective operation of the QMS.
• Analysis of the processes should be the driving force for defining the amount of documentation needed for the quality management system, taking into account the requirements of ISO 9001:2008. It should not be the documentation that drives the processes.

6    Organizations wishing to adapt an existing QMS

For organizations that currently have a QMS the following comments are intended to assist in understanding the changes to documentation that may be required or facilitated by the transition to ISO 9001:2008

• An organization with an existing QMS should not need to rewrite all of its documentation in order to meet the requirements of ISO 9001:2008. This is particularly true if an organization has structured its QMS based on the way it effectively operates, using a process approach. In this case, the existing documentation may be adequate and can be simply referenced in the revised quality manual.
• An organization that has not used a process approach in the past will need to pay particular attention to the definition of its processes, their sequence and interaction.
• An organization may be able to carry out some simplification and/or consolidation of existing documents, in order to simplify its QMS.

7    Demonstrating conformity with ISO 9001:2008

For organizations wishing to demonstrate conformity with the requirements of ISO 9001:2008, for the purposes of certification/registration, contractual, or other reasons, it is important to remember the need to provide evidence of the effective implementation of the QMS.

• Organizations may be able to demonstrate conformity without the need for extensive documentation.
• To claim conformity with ISO 9001:2008, the organization has to be able to provide objective evidence of the effectiveness of its processes and its quality management system. Clause 3.8.1 of ISO 9000:2005 defines “objective evidence” as “data supporting the existence or variety of something” and notes that “objective evidence may be obtained through observation, measurement, test, or other means.”
• Objective evidence does not necessarily depend on the existence of documented procedures, records or other documents, except where specifically mentioned in ISO 9001:2008. In some cases, (for example, in clause 7.1(d) Planning of product realization, and clause 8.2.4 Monitoring and measurement of product), it is up to the organization to determine what records are necessary in order to provide this objective evidence.  
• Where the organization has no specific internal procedure for a particular activity, and this is not required by the standard, (for example, clause 5.6 Management Review), it is acceptable for this activity to be conducted using as a basis the relevant clause of ISO 9001:2008. In these situations, both internal and external audits may use the text of ISO 9001:2008 for conformity assessment purposes.

Annex A

Terms and Definitions relating to Documents

The following terms and definitions are taken from ISO 9000:2005:

Annex B

Records required by ISO 9001:2008