ISO 9001 – 4.3 - Determining the scope of the quality management system

  

 

In this post we will analyze the Sub-clause 4.3 of the ISO 9001: 2015 standard, entitled: Determining the scope of the quality management system.

The requirements of this sub-clause are generally applied in a better way than those of the previous sub-clauses, 4.1 and 4.2, but even so it is common that organizations do not fully understand them, so it is common that not all the elements that lead to the compliance with those requirements are being properly controlled.

To carry out the analysis of this sub-clause, we are going to start by identifying the requirements that are established by it, following the methodology of identification, presentation and numbering of these requirements, as I have done in other entries. We must always keep in mind that it is important, first, to identify each one of the requirements established in the standard (and therefore in each clause, sub-clause or sub-section), in order to comply with them.

The group of requirements established in this Sub-clause 4.3 of the standard, are the following:

After having identified the various requirements established by this standard, it is important to understand the information provided by ISO/TS 9002: 2016 - Quality management systems - Guidelines for the application of ISO 9001: 2015.

This document (technical specification) has been developed to help users of standard ISO 9001:2015 Quality management systems – Requirements to apply the quality management system requirements. It provides guidance, with a section-by-section correspondence with Clauses 4 to 10 of ISO 9001:2015, but does not provide guidance for Annexes A and B of that standard.

This document provides us with examples of what an organization can do, but does not add any new requirements to ISO 9001. Those examples are not definitive and only represent possibilities, not all of which are necessarily suitable for all organizations.

In accordance with this technical specification, the intent of this section is to determine the boundaries of the quality management system so that it is defined in a way that helps the organization meet the requirements and intended results of the system.

For points a) to c) of Sub-clause 4.3 of ISO 9001:2015, the scope should be established based on:

a) The external and internal issues, as determined by the requirements of ISO 9001:2015, 4.1;

b) The relevant requirements of relevant interested parties (such as regulators as well as customers), as determined in accordance with the  requirements in ISO 9001:2015, 4.2;

c) The products and services provided by the organization.

This document tells us that when determining the scope, the organization should also establish the boundaries of the quality management system taking into account issues such as:

— the infrastructure of the organization;

— The organization´s different sites and activities;

— Commercial policies and strategies;

— Centralized or externally provided functions, activities, processes, products and services.

It also explains that all requirements of ISO 9001 are considered applicable unless they do not have an effect on the organization's ability to provide a product or deliver a service that meets  requirements or on its enhancement of customer satisfaction.

It clarifies that in determining the application of the requirements of ISO 9001, the organization should consider each individual requirement, and not simply decide that a whole clause is not applicable. At times some of the requirements may be applicable in a clause, or all the requirements within a clause may, or may not, be applicable.

Lastly, regarding this sub-clause, it tells us that the scope should be kept as documented information. The scope should include details of the products and services covered. It should also include justification for any requirements that are determined not to be applicable. This documented information can be maintained in whatever method the organization determines to meet its needs, such as a manual or a website.

In a complementary manner, Annex SL of Appendix 2 of the ISO/IEC Directives Part 1, of the ISO Consolidated Supplement, tells us that the intention of these requirements is to establish the physical and organizational limits to which the quality management system will be applied.

If we go now to the careful analysis of this subclause, as we see in its title, in order to comply with it, an organization should determine the scope of the quality management system. In order for us to analyze these requirements, it is important that we understand this concept.

For an organization to operate successfully, it must carry out a wide variety of processes and activities. It is common that not all these processes and activities have an impact or direct relationship with the quality management of the products and services provided by it. Under this consideration, it would be absurd that if that organization wants or needs to establish a quality management system, it is integrating some processes and activities that have no impact either on quality management, or on the quality of the processes that it wants to integrate into that system.

Trying to explain this point, it is good to remember that every organization is itself a system, regardless of its size, complexity, whether it is private, public or social. Regardless of the fact that an organization should always be well managed, in the best way that its top management can achieve it, there are certain disciplines or management aspects that can be supported by standards that contain requirements and be considered as standardized management systems within the management system of the organization, as would be in this case the quality management system, which, being considered contractual elements with its customers, or declared by the top management before its interested parties, become requirements whose compliance must be demonstrable by part of the organization and can be audited by external organizations (customers or certification bodies).

Various approaches can be used to identify and determine the scope of the quality management system.

a) One of these approaches to determine the scope of the quality management system is to consider the diversity of products supplied, to include in this scope those products in which it is relevant for the organization to demonstrate compliance with the requirements of ISO 9001.

b) Another approach for the definition and determination of this scope is to consider its diversity of managed processes, to include in the scope of its quality management system those processes that have an impact on quality management and those in which it is relevant, for the organization, to demonstrate compliance with the requirements of ISO 9001.

c) A third approach is that of the structure and lines of direction and organizational control, by means of which the organization can identify the areas or administrative units relevant to the quality management system.

d) A fourth approach, relatively similar to the previous one, is that of geographic distribution, through which the organization can define which of its regional divisions or production units will be within the scope of said quality management system, and where appropriate which of them not.

e) And a fifth approach that we can apply is the one that refers to the documents control. If we take into consideration that every organization that is systematically managed will have a series of documents in which a variety of relevant elements for that management have been established. This can be visualized as follows:

If we visualize the general management system of an organization in this way, we can identify that within this universe of documentation, there will be a set of documents that would be supporting the entire quality management system, which should be controlled in a very specific way, and a common element to be controlled in each document should be its particular scope, so from the controlled documentation approach in this quality management system, there we would see, as a whole, the scope of this system.

The scope of the quality management system (QMS) is in many cases self-evident and is defined by the activities that take place in a single location. That QMS scope will become more challenging in circumstances where there are:

• Outsourcing

• Logistics

• Multiple sites

• Service centers

• Service at the customer's premises

• Collaborative products and services

From a review of the nature of the organization's operations, products and services, the scope of the QMS should be clear. This should be expressed in the extent of the processes and controls that the organization has established.

And seeing from the audit approach, the scope of the QMS should be evident in the documented information that supports the process-based approach. Such documentation could include:

• process diagrams (input – process – output)

• diagrams showing the links of the process (inputs/outputs/customer)

• overlays showing activity locations

• identification of outsourced processes

• resource diagrams (eg capacity analysis, value stream mapping, "Lean"...)

• programs

When an organization decides to establish a quality management system, it should be logical that it has one or more reasons for making this decision. It could be to have better control of its processes and results, to satisfy a customer's requirement, to access or get a better position in a market, among others. Whatever the reasons on which the organization supports its decision to establish this quality management system, they should be considered in determining its scope.

If the organization is small in size, and its activities are focused on a single process, when establishing its quality management system you will not have any problem defining the scope of that system, since it will cover practically all or most of the organization's activities.

However, when an organization of medium or large size decides to establish a quality management system, one of the first strategic issues that must be decided is the scope of that system, since it will not necessarily have to cover all the processes and/or products, or all quality management activities of the organization. Its top management must assess and decide which processes, products, divisions or production units will be covered by this system. That would be the determined scope of the quality management system.

The determination of the scope of the quality management system is of great importance, since all the objectives that the organization establishes in this system should be able to achieve them through the application of controls for all activities, products and services framed in this management system. No activity, product or service relevant to the quality management system should be outside this scope.

After this general description, we now start with the analysis of each of the requirements of subclause 4.3 of ISO 9001.

In this requirement, the standard indicates that in the quality management system of an organization, when determining the scope, it should include all the activities, products and services that are within the scope. The importance of this requirement is to prevent the existence of processes, activities, or even worse, products and services, within the scope of the quality management system, but without the appropriate controls and monitoring by the organization.

When determining this scope, the organization:

a) should consider the external and internal issues indicated in sub-clause 4.1. To do this, among the most used tools for identifying these issues within strategic planning, are the so-called SWOT analysis (Strengths, Weaknesses, Opportunities and Threats), as well as the PESTAL analysis (Analysis of external factors as Political, Economic, Social , Technological, Environmental and Legal).

b) should consider the requirements of the relevant interested parties indicated in Sub-Clause 4.2. If you recall it, this requirement states that the organization should identify its interested parties, as well as determine the relevant requirements of those interested parties. It is important for the organization to consider if any actual customer, potential customer, final consumer, among other parties, requires a better performance in terms of quality, that a quality management system be established based on the ISO 9001 standard, as well as a certification of that system; and

c) should consider the organization's products and services, as well as its quality performance, to define which of them would be more profitable, beneficial or feasible to incorporate into the scope of the quality management system.

Once that scope is determined, it should be kept as documented information, in the form and means that the organization considers, and should be available to interested parties.

Although the standard has lost specificity in some aspects related to documentation, and now it is only established as "documented information", I suggest that this information, like all that relevant to describe the quality management system, be established in a "management quality manual", if this is the only management system that the organization has established, or where appropriate, in an "integrated management system manual", in which the relevant elements are documented to describe the different standardized management systems, including the quality one, established by the organization.

I think it is important to mention that in previous versions of the ISO 9001 standard, it was considered as a documentation requirement that the organization would have established a quality management manual. In the current version it is no longer considered a requirement, but not because it no longer generates value, but because the International Organization for Standardization (ISO) is promoting the conditions for organizations to establish integrated management systems, and obviously it is not reasonable that each management system standard establishes as a requirement the establishment of an equivalent manual, since then the organizations would have a multiplicity of management manuals, which would also lead to multiplying a large number of documents and records (documented information and documented information kept as conformity evidence) that would derive from each of these manuals, and it would be unmanageable to establish this type of integrated management systems. But it would be valid for the organization to establish a single standardized management manual, whether quality or integrated.

In order to establish the scope of the quality management system, the organization should determine the boundaries and should determine the applicability of the quality management system.

It is important for top management to ensure that the organization's key personnel are aware of which activities, products and services of the organization are within the scope of the quality management system, but they should also be aware, where applicable, which activities, products and services are outside the scope of said system. Those scope limits should be clearly identifiable. This will avoid a lot of confusion and waste of resources. Similarly, the organization should consider all the elements of the system within that scope in order to achieve the established quality objectives.

Similarly, the organization should comply with all the requirements of this standard if they are applicable in the determined scope of its quality management system.

The scope of the organization's quality management system should be available and should be maintained as documented information.

The scope should state the types of products and services covered, and provide justification for any requirements of this standard that the organization determines are not applicable to the scope of its quality management system.

Conformance (certification of compliance) with this standard can only be declared if the requirements determined to be non-applicable do not affect the organization's ability or responsibility to ensure conformity of its products and services and enhance customer satisfaction.

Author:

Ernesto Palomares Hilton