When pursuing ISO 9001:2008 certification, the first step should be to purchase and read the standard (www.iso.org). It is also helpful to look at ISO 9004:2009, the guide document for the standard and other information sources such as white papers, articles, books, and related reference material. Companies may also want to look at outside help such as training courses or consultants for help.
Most certification bodies have moved away from the checklist model and focus on a process-based approach to auditing. The process approach is more aligned with the intent of the standard and a truer reflection of the company’s scope and complexity. However, in the main focus areas of the standard there are questions you should be asking. While this is not an inclusive list, nor a guarantee of certification, some of the questions are:
Quality Management System
- Is the QMS established, effective, and uses a process approach in line with the standard?
- Are outsourced processes identified?
- Is there a quality manual that includes or references the procedures?
- Are the required procedures documented?
- Are documents and records controlled?
- What is the structure and objectives of the organization?
- What are the planning inputs and outputs?
- Is there a quality policy?
- How are processes monitored, measured, analyzed and determined effective?
- How are customer requirements met by the organization and communicated?
- How are management reviews conducted and how often?
- What are the management review inputs and outputs?
- How does the management review information affect planning?
- Are the necessary resources identified and made available?
- How are competencies determined?
- Are future resources considered and planned?
- How is training executed and determined effective?
- Are the records for education, training, skills, and experience available and maintained?
- Have infrastructure and work environment needs been determined to ensure product conformity requirements?
- How are quality objectives and requirements determined for the product?
- Is there identification traceability?
- How has the organization determined the requirements specified by the customer?
- Are their statutory and regulatory requirements related to the product?
- Is there a contract review process?
- How are changes handled and communicated?
- How does the organization plan and control the design and development of products?
- IF APPLICABLE: What are the design and development planning, inputs, outputs, review, verification, and validation?
- How does the organization ensure purchased product conforms to specified purchase requirements?
- How are suppliers controlled, evaluated, selected and re-evaluated?
- How does the organization plan and carry out production and service provisions under controlled conditions?
- How is product identified throughout the realization process?
- How is traceability controlled when required?
- How does the organization identify, verify, protect and safeguard customer property?
- How is product preserved through identification, handling, packaging, storage and protection?
- How has the organization determined the monitoring and measurements to be made?
- How were the appropriate monitoring and measuring devices selected?
- Is identified equipment calibrated or verified at defined intervals to national standards?
Measurement, analysis, and improvement
- How does the organization collect and validate data to ensure performance and improve effectiveness?
- How is customer satisfaction determined?
- What methods and frequency are used to determine customer perception?
- How does the organization conduct internal audits to determine conformity?
- How are the internal audits scheduled and recorded?
- What methods are used to monitor and or measure the process of the QMS?
- When results are not achieved for product conformity are there corrective actions taken?
- How are the characteristics of product monitored and or measured to demonstrate requirements have been met?
- How does the organization ensure product that does not conform to product requirements is identified and controlled to prevent its unintended use or delivery?
- How does the organization deal with nonconforming product?
- How has the organization determined, collected and analyzed data to demonstrate the suitability and effectiveness of the QMS?
- How has the organization demonstrated the continual improvement of the management system?
- Is there a methodology to use for continual improvement efforts?
- How does is corrective action used as a tool for improvement?
- Are there criteria for when a preventive action will be initiated?