Introducing ISO 9001: how to set up a quality management system

What ISO 9001 asks of you

The standard follows the familiar structure of ISO management systems: context, leadership, planning, support, operation, performance evaluation and improvement. The core is showing that your processes are controlled, that the customer is central and that you learn from nonconformities.

ISO 9001 does not prescribe fixed procedures. You decide how to set it up, as long as it suits your size, sector and risks.

So do not start with the documents, but with the question of what your organisation needs to serve customers well. The standard provides the framework, your practice provides the content.

Context, stakeholders and scope

Start with the environment you work in: market, legislation, technology and internal factors. Determine who your stakeholders are, such as customers, suppliers and employees, and what requirements they have.

Then record the scope: which products, services and locations fall under the system, and what you deliberately exclude and why. Have management approve the scope.

Process approach: from process map to risks

ISO 9001 calls for a process approach. Map your processes and divide them into management, core and support processes. Record for each process the input and output, the owner and how you measure performance.

Then assess risks and opportunities per process. What can go wrong, what is the effect on the customer and which measures are proportionate? A small organisation does not need an extensive risk analysis for every action.

Also include outsourced processes and suppliers. What you outsource remains your responsibility towards the customer, so record how you assess the quality of suppliers.

Quality policy and measurable objectives

A quality policy gives direction and is set and communicated by management. Work it out in objectives you can measure, such as customer satisfaction, lead time, error rate or on-time delivery.

Give each objective an owner, a measurement method and a deadline, and attach actions if you fall behind.

• Customer satisfaction and complaints
• Lead time and on-time delivery
• Nonconformities and rework costs
• Supplier performance

Documentation: as little as needed

The standard asks for documented information where needed to make the system work and to demonstrate it. Think of policy, procedures and work instructions for higher-risk processes, forms and records.

Make sure there is one current version, an approval route and a periodic review. People must know which version applies and that they have read it.

Spread the audits over the year rather than bunching them right before certification. This keeps the system alive and leaves time to resolve findings.

Internal audit and management review

Internal audits check whether the system works as intended and meets the standard. Set up an audit programme, use independent auditors and record findings with a measure, an owner and a deadline.

The management review follows. Management looks at audit results, customer feedback, process performance, objectives and risks, and decides on improvement and resources. Record the minutes, as they serve as evidence for the certification body.

Common mistakes with ISO 9001

The biggest pitfall is building a system for the auditor instead of for the organisation. The result is a thick manual nobody opens. For every document, check whether it helps someone do the job well.

A second mistake is closing complaints and nonconformities without investigating the cause. The same problems then return and improvement stays a slogan.

• Processes without an owner or measurement point
• Objectives that are not measurable
• Internal audits that only check paper
• Management review without decisions
• Outdated versions in circulation

A practical approach

Take a service provider with a complaints process as an example. You do not start with all processes at once, but with the process that touches the customer most. Record it clearly, measure it and improve it. The other processes then follow in the same form.

• Establish baseline and scope with management
• Define the process map and owners
• Record risks, objectives and measurement points per process
• Limit documents to what is needed
• Carry out an internal audit and resolve findings
• Hold the management review and request certification

Continual improvement with BrydgeOne

Improving means handling nonconformities and complaints systematically, removing causes and checking effectiveness. In BrydgeOne you record processes and scope, manage documents with version control, follow up quality reports and actions and plan audits. The management review gathers its input from the platform itself.

A gap analysis per standard gives you a baseline upfront. For certification you engage an accredited certification body.