ISO 9001 - 4.4 - Part 2: Processes management



Welcome back to this blog, in which I analyze the different requirements of the ISO 9001:2015 standard, breaking them down individually to facilitate their understanding and application.


In this entry, I continue with the analysis of Sub-clause 4.4 of the aforementioned ISO 9001 standard. As I mentioned in the previous post, due to its own complexity, I am analyzing it in three parts. In that previous entry, the first of these parts, I analyzed the first four requirements of this Sub-clause, referring to aspects that an organization should comply with regarding the quality management system, that is, that the QMS should be established, should be implemented, it should be maintained and should be continuously improved. (If you want to access the entry of this firstpart, please click here).


In this entry, corresponding to the second part, I present a description of the approach to processes that the standard requires, as well as the description of what a process is, the elements that make it up, the line of action to establish a process, as well such as the Plan-Do-Check-Act (PDCA) Cycle that should be used to establish and document a process; and also in this entry I analyze the requirements of No. 32 to No. 37 according to the identification of requirements of this sub-clause.


And in the third part related to this topic, I am presenting you with a description of the remaining requirements corresponding to this sub-clause, which deal with the determination and application of various elements necessary for the process management. (If you want to access the entry of this third party, please click here).


We continue then, in this second part, with the analysis of the following six requirements, related to the process management that I am analyzing in this entry, and which are the following:

Before going to the next requirement, according to this identification, it is worth analyzing some information published by the same ISO  standards  and other documents regarding the processes and their management, related to this group of requirements.


Let's start by remembering that the use of the process approach is a requirement of ISO 9001:2015 standard.


Additionally, within the so-called "Quality management principles" indicated in ISO 9000:2015 standard, the following is included:


The ISO 9001:2015 standard itself, in Subsection 0.3.1. General, promotes the adoption of a process approach when developing, implementing and improving the effectiveness of a quality management system, to increase customer satisfaction through meeting customer requirements. Specific requirements considered essential for the adoption of a process approach are included in Sub-Clause 4.4.


It also explains that “understanding and managing interrelated processes as a system contributes to the organization´s effectiveness and efficiency in achieving its intended results. This approach allows the organization to control the interrelationships  and interdependencies between the processes of the system, so that the overall performance of the organization can be enhanced.


It also indicates that "the process approach involves the systematic definition and management of processes and their interactions, in order to achieve the expected results in accordance with the quality policy and the strategic direction of the organization. Management of the processes and the system as a whole can be achieved using the PDCA cycle (see 0.3.2) with an overall focus on risk-based thinking (see 0.3.3) aimed at taking advantage of opportunities and preventing undesired results”.


The description of the process approach in "Clause Introduction" of ISO 9001:2015 standard is purely informative and does not introduce any additional requirements on its own, but it is useful for understanding how the process approach is implemented in this standard. The following image (similar to figure 1 of this standard "Introduction") provides a good understanding description of a single process.

Sub-clause 4.4 sets out comprehensive requirements for an organization to determine and apply the processes needed for its quality management system, while considering the PDCA cycle for continual improvement and integrating risk-based thinking.


Consequently, when carrying out the systematic verifications of the quality management system, these audits should be oriented to analyze the organization`s processes. The "ISO 9001 Group of auditing practices", in its document "Guidelines on Processes", presents the following diagram, which may help those responsible for documenting processes and auditors to establish the sequence to elaborate, and obviously also, where appropriate, audit the organization`s processes.

The level of documented information required for processes (ie documents or records) should be determined by the organization itself, to the extent necessary to provide confidence that the QMS is effective, although the standard does not define any specific format or content.


Examples of possible documents are: process sheets, process maps, IT workflows, turtle diagrams, etc.


Applying the approach to processes in a quality management system allows:


a) understanding and consistency in meeting the requirements;


b) the consideration of the processes in terms of added value;


c) the achievement of effective process performance;


d) improvement of processes based on evaluation of data and information.


If we consider what TS ISO 9002:2016 Quality management systems — Guidelines for the application of ISO 9001:2015 indicates, as a support technical specification to understand the requirements of ISO 9001: 2015 standard, the intention of Sub-clause 4.4.- Quality management system and its processes, is to ensure that the organization determines the processes needed for its quality management system in accordance with ISO 9001. This includes not only the processes for production and services provision, but also the processes that are needed for the effective implementation of the system, such as internal audit, management review and others.


The level to which processes need to be determined and detailed can vary according to the context of the organization and the application of risk-based thinking – taking into consideration the extent to which the process affects the organization’s ability to achieve its intended results, the likelihood of problems occurring with the process and the potential consequences of such problems.


After presenting this general description of the process approach and some characteristics of processes, we return to the next requirement accordingly with the previously indicated order:


Requirement No. 32: "The organization shall determine the processes needed for the quality management system."


In order to properly apply this and the following requirements, we should first understand what the term "determine" means. In the ISO 9000:2015 standard we find the meaning of the term "determination": Activity to find one or more characteristics and their characteristic values.


As you can see, this definition is not useful in the text of this requirement. In a complementary way, if we consult the Merriam-Webster dictionary, we find out that the term "determine", as a transitive verb, means: 


To meet this requirement, the organization should establish the objectives of quality management system, and within its strategic and operational planning, establish the authority, responsibility and accountability for the management of the processes, carry out an effort to understand the capabilities of the organization as well as determine the resource constraints before acting to identify and formally determine which are the processes that are considered necessary to enable it to achieve the proper functioning of the quality management systemso that it can produce the intended results and achieve those objectives. In addition to this task, it should determine processes interdependencies and analyze the effect of modifications to individual processes on the system as a whole.


The organization should define the number and types of processes necessary to meet its business objectives. While these will be unique to each organization, it is nevertheless possible to identify typical processes, such as:


- Management processes. These include processes related to strategic planning, policy setting, objective setting, ensuring communication, making resources available for other quality objectives and desired organizational results, and for management reviews.


- Resource management processes. These include all processes that are necessary to provide the resources required for the organization's quality objectives and desired results.


- Realization processes. These include all processes that provide the organization's desired results.


- Measurement, analysis and improvement processes. These include the processes necessary to measure and collect data for performance analysis and effectiveness and efficiency improvement. They include processes for measurement, monitoring, auditing, performance analysis, and improvement. Measurement processes are often documented as an integral part of management, resource, and realization processes; while the analysis and improvement processes are frequently treated as autonomous processes that interact with other processes, receive inputs from measurement results and send outputs for improvement of those processes.

Organizations should establish and operate processes that can be defined, measured and improved. These processes would be interacting to provide results consistent with the objectives of the organization and cross functional boundaries. Some processes might be critical while others might not. Processes have interrelated activities with inputs which generate outputs. People collaborate in a process to carry out their daily activities. Some activities are prescribed and depend on the understanding of the organization's objectives, while others are not and react with external stimuli to determine their nature and execution.


The organization should determine the processes necessary to meet the objectives and policies and to produce the intended products. Every process has suppliers, customers, and other interested parties, who may be internal or external to the organization, with needs and expectations about the process, which define the required results of the process. That is why it should also identify all the inputs and outputs of the process, along with those suppliers, customers, and interested parties.


The outputs of one process can be the inputs of another process and are interconnected in a total network. Although it often appears to consist of similar processes, each organization is unique and so is its quality management system.


The ISO 9001: 2015 standard uses the process approach, which incorporates the Plan-Do-Check-Act (PDCA) cycle. This process approach allows an organization to plan its processes and their interactions.


The PDCA cycle enables an organization to ensure that its processes are properly resourced and managed and opportunities for improvement are identified and acted upon.


Requirement No. 33: "The organization shall determine the application of these processes throughout the organization."


In addition to the term “determine”, already defined, another term that the standard mentions and that is worth defining is that of “application”:


We can then understand that this requirement refers specifically to the action and effect of using or executing the processes.


As already mentioned, the “rationale” for the process approach further explains that “the quality management system consists of interrelated processes. Understanding how this system produces results allows an organization to optimize the system and its performance.


Top management will determine the processes necessary to achieve the intended results, which should include management, resources, operations, measurement, analysis and improvement.


So, in order to comply with this requirement, the organization should clearly or accurately indicate all the administrative areas or production units, in which processes will be operating, that is, using resources and carrying out activities related to the application of each one of those determined processes, including the responsibilities and authorities necessary for its application. For this, it is necessary to generate appropriate documented information. The level of documented information necessary for the processes (ie, documents or records) should be clearly indicated by the organization itself, to the extent necessary, to provide confidence that the QMS is effective, although the standard does not define any specific format or content.


Examples of possible documents are: process sheets, process maps, IT workflows, turtle diagrams, procedures, or other methods of identifying and describing the processes that make up the QMS, as established by the organization.


Requirement No. 34: “The organization shall determine the inputs required for these processes."


This requirement is a reinforcement of Requirement No. 32, previously presented, since when determining the necessary processes for the quality management system, the organization should also determine the required inputs of these processes. Using any of the documented information supports that the organization has established to determine the QMS processes, it should accurately indicate each of the required inputs of its processes, whether internal or external, as well as the provider of each input element; the required inputs for the processes should be considered from the point of view of what is required for the implementation of the processes as planned; Process inputs can be tangible (for example, materials, components, or equipment) or intangible (for example, data, information, or knowledge);


Requirement No. 35: “The organization shall determine the expected outputs of these processes.


This requirement is also a reinforcement of Requirement No. 32, previously presented, since in determining the necessary processes for the quality management system, the organization should also determine the required outputs of these processes. Similarly, using the documented information support that the organization has established to determine the QMS processes, it should accurately indicate each of the expected outputs of its processes; expected results should be considered from the point of view of what customers or downstream processes expect; and exactly in the same way than inputs, the outputs may be tangible or intangible.


Requirement No. 36: “The organization shall determine the sequence of these processes.”


The organization should define and develop a description of the process network. To do this, it should consider the following:

• The inputs and outputs of each process,

Optimum effectiveness and efficiency of the sequence.


The sequence indicates the successive order, in which the processes within the quality management system are operated, since some processes should be operated before others, or after others, or some could be operated simultaneously or that this order be irrelevant. That is why the organization should define and describe the process network.


Process sequences can be developed using tools such as models, diagrams, matrices, and flowcharts.


Requirement No. 37: “The organization shall determine the interaction of these processes.”


This requirement is closely linked to the previous one. The interaction indicates the action or influence that is practiced mutually and reciprocally between two or more processes. This interaction occurs when an input of one or more processes is the output of another or other processes. To achieve determination of these interactions, the organization should consider the following:


• The inputs and outputs of each process (which can be internal or external).

Interaction of processes and interfaces on which other processes depend or enable.

Risks to the effectiveness of the process interaction.


As an example, realization processes (such as those necessary to provide the delivered products or services to a customer) will interact with other processes (such as management, measurement, or acquisition in the provision of resources).


In order to clearly indicate both the sequence and the interaction of the processes that make up the quality management system, the links with the inputs and outputs of the previous and subsequent processes should be considered; The methods for providing details of that sequence and the interaction of the processes depend on the nature of the organization; Different methods can be used, such as retaining or maintaining documented information (eg, process maps, flow charts, procedures), or for small organizations, a simpler approach, such as a verbal explanation of the sequence of processes.


The customer of each process should be identified, as well as, where appropriate, other interested parties.

In the next entry I will continue with the analysis of the requirements of this Sub-clause 4.4.




Ernesto Palomares Hilton