ISO Audit - ISO 9001 & ISO 14001: September 2009

Wednesday, September 30, 2009

ISO 9001 & ISO 14001 Blog

Some of the new blogs on ISO 9001 Standards & ISO 14001 standards was found as below:
http://iso14000standards.blogspot.com/
http://iso-9001-standards.blogspot.com/
http://iso14001environmentmanagementsystem.blogspot.com/
http://iso9001qualitymanagementsystem.blogspot.com/
http://iso9001qualitymanual.blogspot.com/
http://iso9000standards.blogspot.com/
http://iso9001-standards.blogspot.com/
http://iso14001standards.blogspot.com/

ISO 9001 Standards – Document Repository

ISO 9001 Standards - Document Repository
All QMS and product realization documents can be stored electronically within the computerize Document Management System like ISO 9001 Document Control Sytem. This provides a set of category and sub-category headings that enable users to drill down intothe different levels of the documentation category tree.QMS documents are created and maintained within a top level category entitled “ISO 9001 Quality Management System (QMS)“. Documents in this category follow a 4-tier approach:• Quality Manual – company scope and process interactions within the QMS• Quality Procedures – responsibilities, controls and activities within the QMS that effect customer service• Records – objective evidence to demonstrate our goal in achieving customer satisfaction• Forms & Reports to support the QMS processesProduct realization documents are stored in categories corresponding to Products, Projects and Departments. Each document is unique, but can be accessed from multiple categories.Documents created within the FablessSemi Inc CogniDox system are assigned a unique identifier using the format “PO-NNNNNN-XX”; where the “PO” prefix identifies them as FablessSemi Inc documents, the “NNNNNN” is an automatically generated and uniquely assigned numerical ID, and the “XX” suffix indicates the document type.All Fabless Semi Inc personnel are responsible for creating document part numbers and uploading documents to an appropriate category. Selected users with additional system privileges are responsible for creating and maintaining document categories.

Useful Aids to Implement ISO 9001 Standards

Useful Aids To Implement ISO 9001 Standards
Many companies implement ISO 9001 without using all the available tools. As a result, some companies may not fully optimize their implementation. This issue could be manifested as confusion over terms, misunderstanding about requirements, and perplexity concerning intention.ISO, the International Organization for Standardization, based in Geneva Switzerland issues thousands of standards, but we limit our scope to ISO 9001:2008 and its immediate “family”.This includes ISO 9000:2005 and ISO 9004:20002. ISO 9001 is a general industry standard for quality management, but ISO also issues industry specific standards. Many of these standards, such as ISO 13485 for medical devices, are based on ISO 9001 and can also utilize these available tools.
In addition to the information discussed below, ISO also issues standards related to specific activities that may arises in a quality management system. The following lists these supporting documents.
Automotive ISO/TS 16949:2002Education IWA 2:2007Energy PC 242, ISO 50001Food safety ISO 22000:2005Information security ISO/IEC 27001:2005Health care IWA 1:2005Local government IWA 4:2005Medical devices ISO 13485:2003Petroleum and gas ISO 29001:2003Ship recycling ISO/PAS 30000:2008Supply chain security ISO 28000:2007

Process Approach In ISO 9001 Standards

Process Approach In ISO 9001 Standards
The process approach was introduced into ISO 9001 with the year 2000 version of the standards.Prior versions used an element approach. The document Guidance on the concept and use of the process approach for management systems describes to process approach and offers an implementation paradigm.1. Identification of processes of the organization1.1. Define the purpose of the organization1.2. Define the policies and objectives of the organization1.3. Determine the processes in the organization1.4. Determine the sequence of the processes1.5. Define process ownership1.6. Define process documentation2. Planning of a process2.1. Define the activities within the process2.2. Define the monitoring and measurement requirements2.3. Define the resources needed
2.4. Verify the process and its activities against its planned objectives3. Implementation and measurement of the process4. Analysis of the process5. Corrective action and improvement of the process ImplementationThis document explains the process used to evaluate changes to the 2008 version. In particular, it explains the revision process and illustrates the impact vs. benefit analysis used to evaluate potential changes.In addition to the guidance documents, ISO maintains a web site with “official interpretations” of ISO 9001. Currently, these interpretations only include ISO 9001:2000, but, because the changes to the 2008 version were limited, they are valuable.Consider a common question. An organization needs a documented procedure for preventive action (8.5.3), and must keep records of the results of preventive action (8.5.3.d). One of the interpretation requests asks, “Does sub-clause 8.5.3 a) require organizations to demonstrate, with objective evidence in the form of records, that they have undertaken actions to determine the existence of ‘potential nonconformities and their causes’?” The answer is “No”.Auditing PracticesThe ISO 9001 Auditing Practices Group maintains a website9 with guidance and information on auditing ISO 9001 quality management systems. It is an informal group of quality management system (QMS) experts, auditors, and practitioners drawn from the ISO Technical Committee 176 Quality Management and Quality Assurance (ISO/TC 176) and the International Accreditation Forum (IAF).The website, primarily aimed at QMS auditors, consultants, and quality practitioners, is an online source of papers and presentations on auditing a QMS and reflect the process based approach.The website contains almost forty guidance documents with practical advice ranging from “How to audit top management processes” to “The role and value of the audit checklist”.

Quality Planning

Whenever the term “product” is used within the ISO 9001 standard, it refers to both tangible goods and intangible services. The ISO 9001 standard is meant to be generic which means that it is suitable for all kinds of organization, whether commercial or otherwise. The purpose of the quality management system model that is being propagated by the standard is the fulfillment of customer requeirements and expectations in order to induce high levels of customer satisfaction. An unsatisfied customer is essentially a customer whose requirements or needs, and expectations of the level of services being granted upon him/her have not been met. We are all customers because we buy products all the time. So we know what it means to be a dissatisfied customer. The common reaction is to never to go back to that seller and look for other alternatives. A successful organization is one which understands what it takes to meet customer requirements in order to satisfy their needs and expectations. A specific process is thus necessary to resolve any customer complaint or dispute. This process should be geared towards satisfying the customer’s needs and expectations. The parameters of this process should be referenced from the terms of the sale and purchase. This is why it is necessary to review the customer’s requirements before committing to the sales contract. It is necessary that the customer understands what he/she is paying for and it is equally necessary for the organization to understand what it is supposed to deliver. When your organization has these processes in place, then the only thing to do next is to continually measure the effectiveness and subsequently take actions to continually improve the whole process.

ISO 9001 – Compatibility with other management systems

ISO 9001 – Compatibility with other management systems
ISO 9001 and ISO 9004 are quality management system standards which have been designed to complement each other, but can also be used independently.ISO 9001 specifies requirements for a quality management system that can be used for internal application by organizations, for certification, or for contractual purposes. It focuses on the effectiveness of the qualitymanagement system in meeting customer requirements.ISO 9004 gives guidance on a wider range of objectives of a quality management system than does ISO 9001, particularly for the continual improvement of an organizations overall performance and efficiency, as well as its effectiveness. ISO 9004 is recommended as a guide for organizations whose top management wishes to move beyond the requirements of ISO 9001, in pursuit of continual improvement of performance. However, it is not intended for certification or for contractual purposes.
During the development of this International Standard, due consideration was given to the provisions of ISO 14001:2004 to enhance the compatibility of the two standards for the benefit of the user community.This International Standard does not include requirements specific to other management systems, such as those particular to environmental management, occupational health and safety management, financialmanagement or risk management. However, this International Standard enables an organization to align or integrate its own quality management system with related management system requirements. It is possible foran organization to adapt its existing management system(s) in order to establish a quality management system that complies with the requirements of this International Standard.

ISO 9001 Standards In General

ISO 9001 Standards In General
The adoption of a quality management system should be a strategic decision of an organization. The design and implementation of an organization’s quality management system is influenced by— its business environment, changes in that environment, or risks associated with that environment,— its varying needs,— its particular objectives,— the products it provides,— the processes it employs,— its size and organizational structure.It is not the intent of this International Standard to imply uniformity in the structure of quality management systems or uniformity of documentation.The quality management system requirements specified in this International Standard are complementary to requirements for products. Information marked “NOTE” is for guidance in understanding or clarifying theassociated requirement.This International Standard can be used by internal and external parties, including certification bodies, to assess the organization’s ability to meet customer, statutory and regulatory requirements applicable to theproduct, and the organization’s own requirements.The quality management principles stated in ISO 9000 and ISO 9004 have been taken into consideration during the development of this International Standard.

Wednesday, September 16, 2009

Useful Aids to Implement ISO 9001 Standards

Costs and resources Of ISO 9001 Standards

Costs and resources Of ISO 9001 Standards
The largest cost of ISO 9001 is the involvement of company employees. The ‘ownership’ created by involving employees in designing the quality system maximises the chances of them accepting it. Reducing this cost by minimising employee involvement is a false economy. The next largest cost will be for designing and developing the system. This needs to be led by someone with experience in this particular field. You may have someone within your own organisation who has carried out this role, perhaps with a former employer. Your Business Link may offer free or subsidised advice and training, and will be able to provide names of approved consultants. Grants for work in this area tend to be directed through Business Links. Different areas have different grants, which depend on local conditions. A typical grant may cover up to 50 per cent of the cost of an approved consultant. Certification fees are around £800 for the smallest companies. Overall costs depend upon company size and the number of locations involved. Ask certification bodies for quotes for initial audits and surveillance visits. Many will give an all-inclusive price, including surveillance visits for three years. Typically, special rates will depend on how long the assessment is likely to take and what the company’s turnover is. Ask your certification body if it offers special rates for small companies. The standard requires that companies have trained internal auditors to conduct audits on the system. An internal audit can provide an effective means of monitoring the system and identifying areas for improvement. For further details, contact the International Register of Certificated Auditors.

Saturday, September 12, 2009

The Similarity between ISO 9001 and BS 7799-2

The Similarity between ISO 9001 and BS 7799-2
BS 7799-2:2002 is a specification for an Information Security Management System (ISMS). It is shortly to be upgraded to the status of a full
International Standard, and published as ISO/IEC 27001. The normative part of this standard has four sections and an annex . The requirements of the four sections are associated with the PDCA cycle. The annex defines all the controls that must be considered for generating the SOA. Thus the structure of BS 7799-2:2002, as will be ISO/IEC 27001, can be simply described as:
A PDCA framework;
An SOA.
ISO 9001:2000 is a specification for a Quality Management System (QMS). The normative part of this standard has five normative sections,
numbered 4 – 8. All of these requirements must be met in order to claim conformance with the standard, save for section 7 (Product Realisation),
where the standard states in paragraph 1.2 “Where exclusions are made, claims of conformity to this International Standard are not acceptable unless
these exclusions are limited to requirements within clause 7, an such exclusions do not affect the organisation’s ability, or responsibility, to provide
product that meets customer and applicable regulatory requirements”.
In Table 2 we relate the requirements of sections 4, 5, 6 and 8 to the PDCA framework. We treat section 7 as an SOA.
The BS 7799-2:2002 standard gives instruction on how the controls documented in BS 7799-2 Annex A are to be determined as being applicable or nonapplicable. In particular, if the control is applicable it must be justified in terms of the results of a risk assessment.
The controls listed in Section 7 of ISO 9001 may be excluded with justification. Thus, Section 7 of ISO 9001 may be treated in exactly the same manner as BS 7799-2 Annex A provided that applicable quality controls are also justified by
reference to a risk assessment. Conversely for an integrated MS, information security controls that are declared to be non-applicable should also be
justified as not applicable by reference to a risk assessment, in order to bring the two standards into line. Interestingly, this requirement was present in
BS 7799-2:1999 but was dropped in the 2002 revision.
The amalgamation of these two approaches in an integrated MS should not be seen as a disadvantage. The justification of non-applicable information security controls greatly simplifies the task of determining, given a change of threat or
business practice, whether a non-applicable control has now become applicable. The justification of Product Realisation controls by way of a reference to a risk assessment serves to remind us that, for many organisations, quality controls are not uniform across the whole organisation but are commensurate with the degree of risk involved.
For example, in the software business, a fixed price assignment with tight timescales to produce a bespoke software system has a greater risk than a
time and materials contract to supply programming staff, and the quality controls applied to management planning and reporting of the two projects would be very different.

BACKGROUND TO THE ISO 9001:2008 REVISION PROCESS

BACKGROUND TO THE ISO 9001:2008 REVISION PROCESS
In order to assist organizations to have a full understanding of the new ISO 9001:2008, it may be useful to have an insight on the revision process, how this revision reflects the inputs received from users of the standard, and the consideration given to benefits and impacts during its development.
Prior to the commencement of a revision (or amendment)to a management system standard, ISO/Guide 72:2001 Guidelines for the justification and development of management system standards recommends that a Justification Study” is prepared to present a case for the proposed project and that it outlines details of the data and inputs used to support its arguments. In relation to the development of ISO 9001:2008 user needs were identified from the following:
- the results of a formal “Systematic Review on ISO 9001:2000 that was performed by the members of ISO/TC 176/SC2 during 2003-2004
- feedback from the ISO/TC 176/Working Group on Interpretations,
- the results of an extensive worldwide “User Feedback Survey on ISO 9001 and ISO 9004″ by ISO/TC 176/SC 2/WG 18 and similar national surveys.
The key focuses of the ISO 9001:2008 amendment were to enhance the clarity of ISO 9001:2000 and to enhance its compatibility with ISO 14001:2004.
A tool for assessing the impacts versus benefits for proposed changes was created to assist the drafters of the amendment in deciding which changes should be included, and to assist in the verification of drafts against the identified user needs. The following decision making principles were applied:1) No changes with high impact would be incorporated into the standard;
2) Changes with medium impact would only be incorporated when they provided a correspondingly medium or high benefit to users of the standard;
3) Even where a change was low impact, it had to be justified by the benefits it delivered to users, before being incorporated.
The changes incorporated in this ISO 9001:2008 edition were classified in terms of impact into the following categorie
- No changes or minimum changes on user documents, including records
- No changes or minimum changes to existing processes of the organization
- No additional training required or minimal training required
- No effects on current certifications
The benefits identified for the ISO 9001:2008 edition fall into the following categories:
- Provides clarity
- Increases compatibility with ISO 14001.- Maintains consistency with ISO 9000 family of standards.
- Improves translatability.

Summaries of changes to ISO 14001

Summaries of changes to ISO 14001
ISO 14001 year 2004 changes are consider having some effect on EMS ISO 14001, the changes require reviewing the EMS and taking action for transition (information is under control of TC 207). Considering the most relevant changes in advancing / transition to ISO 14001 2004 standard includes (an overview for transition / implementation):
Clause 4.1, Scope – requires defining the scope of the EMS (environmental management system) linking to the organizations activities, products, and services (and processes). First consider defining the scope of the EMS within the “boundaries” of products, services, activities, and processes as these relate [for ISO 9001:2000 organizations consider requirement 4.1, and organizations implementing ISO 14001 may be helpful reading ISO 9001:2000 clause 4.1]. The previous indicates an overview on how the EMS fulfills ISO 14001 2004 [some thoughts are internal auditing, management system review providing that these link].
Clause 4.2, Policy – The scope of the EMS and its policy must be consistent. The requirements for the policy remains about the same, now explicitly indicating that must be developed by top management, and other explicit terms in tune with the 1996 version.
Clause 4.3.1, Environmental Aspects Identification – Changes involve in assisting to clarifying statements from 1996 version and the change of the “or” for “and” (within the scope of the EMS); “… products and services…” Control and influence are now mutually exclusive, whilst introducing planned and new developments… new and modified activities… Considering identifying significant aspects must occur from development, implementation, and maintaining the EMS (see 4.1). Information on environmental aspects needs be in documentation format.
To a more assertive statement, “… over which it can be expected to have…” changes to the following “…those which it can influence.”
Clause 4.3.2, Legal and Other Requirements – The wording changes to “legal” in better addressing context to different world regions. Consideration must be given with changes to clause 4.1, for development, implementation, and maintaining the EMS.
Clause 4.3.3 – No significant change.
Clause 4.3.4 – No significant change.
Clause 4.4.1 , Resources, Roles, Responsibility and Authority, please note that this is a new title. This title reflects the importance and relevancy of each term to the EMS. Some minor wording changes include from “…provide…” to “…ensure the availability…” Do not forget that this will require reviewing auditing, planning, and responding to emergencies.
Clause 4.4.2, Competence, Training and Awareness – Whilst using the same
terms in the title notice the change in sequence. This change reflects the expected order of importance of the terms-subjects. Also consider that introduces a new phrase that broadens the individuals within an EMS; “…persons working for, or on behalf of …” Combining these previous two sentences, provides for the organization to include not only relevancy to significant environmental aspects but as well extending to those working for or in behalf of the organization . (Note: also consider that training provider and supporting services are inclusive to 4.4.6).
Clause 4.4.3, Communication – In specifically addressing the European Requirements (EMAR / EMAS), if the organization decides communicating externally the environmental aspects (environmental performance), ISO 14001:2004 address this issue. This is strictly on a volunteer globally, realizing that within the European Union is require.
Clause 4.4.4, Environmental Management System Documentation – in pursuit
of continuing compatibility with ISO 9001:2000 the term applied is “Documentation.”
Thereof, consider this clause also in the light of ISO 9001:2000 when integrating
EMS and QMS. The EMS documentation and records must be those to ascertain
objective evidence on the effectiveness of implementing the policy, planning, and
execution (including improving), control of operations, verification, and control,
improving, and reviewing the EMS.
Clause 4.4.5, Document Control – Again, changing the title and wording reflects
compatibility with ISO 9001:2000. Other than compatibility between QMS ISO
9001:2000 and EMS ISO 14001:2004 there are no significant changes.
4.4.6, Operational Control – No significant change.
4.4.7, Emergency Preparedness and Response – The structure changes by
placing some of its already content in bullets to emphasize each as pointer for the organization to address.
4.5.1, Monitoring and Measurement – Best to see new clause 4.5.2.
4.5.2, Evaluation of Legal Compliance – This is a new clause
[Note: addressing the concern of many government entities / authorities on
their responsibility on environmental and social issues and EMS ISO 14001 1996].
This is construe as the most impacting change to ISO 14001 2004 – this “new” clause brings the last paragraph of 4.5.1 as a separate clause. This clause brings the importance of periodically reviewing legal requirements / compliance under which the organization ascribes. It implies provision of records to demonstrate that this review occurs. This requires that the EMS be review to address the requirements of this “new” clause.
4.5.3, Non Conformance, Corrective and Preventive Action – Includes clarifications ascertaining that prevention (measures or potential of non conformity)and corrective action are two occurring events (which may be mutually inclusive).
Thereof, “action to eliminate the causes of potential non conformities to prevent their occurrence” can lead to changes in your EMS procedures.
4.5.4, Records – States that organizations need records to demonstrate
implementation of procedures and achieving results. These must demonstrate complying with the EMS (procedures and results). Whilst record retention times are not specifically required, record retention needs being specified (consider legal requirements and contractual agreements such that provide a demonstrable sustainable EMS).
4.5.5, Environmental Management System Audit – Whilst there are no wording changes, auditing must be reviewed in the light and effect of other changes (such as 4.5.1, 4.4.2).
4.6, Management Review – The wording provides (more direct) compatibility with ISO 9001:2000, which includes inputs and outputs for reviewing the EMS. Addition includes reviewing for improving the EMS (from target and not merely objectives).
The advent of ISO 14001:2004 shall not require additional training, unless otherwise the organization decides for a short review presentation or an “IMS” (integrated management systems,” integration of management systems such as ILO-OSH, OSH.MS, OSHAS 18001, ISO 9001 and variants with ISO 14001.) It will require reviewing the EMS by management, (perhaps a gap analysis), acting on any changes, inclusive to auditing against ISO 14001:2004 before transition.

Concept of quality – historical background

Concept Of Quality – Historical Background
The concept of quality as we think of it now first emerged out of the Industrial Revolution. Previously goods had been made from start to finish by the same person or team of people, with handcrafting and tweaking the product to meet ‘quality criteria’. Mass production brought huge teams of people together to work on specific stages of production where one person would not necessarily complete a product from start to finish. In the late 1800s pioneers such as Frederick Winslow Taylor and Henry Ford recognized the limitations of the methods being used in mass production at the time and the subsequent varying quality of output. Taylor established Quality Departments to oversee the quality of production and rectifying of errors, and Ford emphasized standardization of design and component standards to ensure a standard product was produced. Management of quality was the responsibility of the Quality department and was implemented by Inspection of product output to ‘catch’ defects. Application of statistical control came later as a result of World War production methods. Quality management systems are the outgrowth of work done by W. Edwards Deming, a statistician, after whom the Deming Prize for quality is named.
Quality, as a profession and the managerial process associated with the quality control function, was introduced during the second-half of the 20th century, and has evolved since then. Over this period, few other disciplines have seen as many changes as the quality profession.
The quality profession grew from simple control, to engineering, to systems engineering. Quality control activities were predominant in the 1940s, 950s, and 1960s. The 1970s were an era of quality engineering and the 1990s saw quality systems as an emerging field. Like medicine, accounting, and engineering, quality has achieved status as a recognized profession.

Five Steps to Implementing ISO 14001:2004

ISO 14001 provides a logical, common-sense approach for businesses to adopt. To start it is recommended to carry out an environmental review of the business and the Annex to the Standard provides guidance on the approach required. The Standard then requires a management system to be developed that addresses the key environmental issues that were identified by the review as being relevant to the business, through a rational programme of control and continual improvement.
There are five key steps to ISO 14001 EMS implementation, and subsequent operation which are clearly laid out in just three pages of text.
The five key steps are:
1. Environmental Policy
2. Planning
3. Implementation and Operation
4. Checking and Corrective Action
5. Management Review

Step 1. Environmental Policy
The company or organisation must write an environmental policy statement which is relevant to the business activities and approved by top management. Their full commitment is essential if environmental management is to work. The ISO 14001 Standard clearly sets out what to cover in the policy. Often a one page document is sufficient.
Produce a first issue and expect to amend it several times before assessment and registration as knowledge grows in the company.

Step 2. Planning
Plan what the EMS is to address.
Environmental aspects
First make lists of the environmental aspects (issues) that are relevant to the business. The environmental review mentioned earlier should provide most of this information and the Annex to ISO 14001 provides guidance on the format for doing this.
Consider the inputs, outputs and processes/activities of the business in
relation to;
a) emissions to air
b) releases to water
c) waste management
d) contamination of land
e) use of raw materials and natural resources
f) other local environmental and community issues
Consider both site (direct) and offsite (ie. indirect) aspects that you control or have influence over (such as suppliers) and in relation to normal operations, shut-down and start-up conditions and reasonably foreseeable and emergencies situations.
A simple written procedure is then required to determine which of the aspects identified are really or probably significant (important) and training needs, outline the key stages of the project and dates that will lead to the target achievement).
Gradually apply environmental management programme thinking to such things as the introduction of new products, new or improved processes and other key activities of the business. In particular, ensure existing projects become environmental management projects
where there is a significant environmental impact involved, so that the EMS becomes company wide. This is a frequent oversight found during ISO 14001 assessments. The EMS must cover the whole business – like a net thrown over the whole business and for example
including such things as engineering and maintenance

Step 3. Implementation and Operation
Structure and responsibility
Appoint one or more people, depending on the size of the business, to have authority and responsibility for implementing and maintaining the EMS and provide sufficient resources. (It’s worth monitoring costs carefully and benchmarking these against key consumption figures so
that improvements delivered by the EMS become apparent).
Training, awareness and competence
Implement a procedure to provide environmental training appropriate to identified needs for management, the general workforce, project teams and key plant operators. This can have far reaching benefits on employee motivation. The workforce is usually very supportive of
moves to achieve genuine environmental improvement. Every company has its share of cynics but even some of these can be won over with time. Training will vary from a general briefing for the workforce to detailed environmental auditor training.
Communication
Implement procedures to establish a system of internal and external communication to receive environmental information and respond to it and to circulate new information to people that need to know. This will include: new legislation, information from suppliers, customers and
neighbours and communications both with employees and for employees about progress with the EMS. This process can often generate worthwhile ideas from employees themselves for future
environmental improvements.
Environmental management system documentation
The EMS itself needs to be documented with a manual, procedures and work instructions but keep it brief and simple. The Standard clearly states where procedures are required. Eleven system procedures are required to maintain the EMS, plus operating work instructions but if you already have ISO 9000, this will cover most of six of the procedures required and a quality system can certainly be expanded to cover ISO 14001 as well. Cross reference the EMS
manual to other environmental and quality documents to link the EMS and to integrate it with existing business practices.
Operational control
Implement additional operating procedures (work instructions) to control the identified significant (important) aspects of production processes and other activities. Some of these will already exist but may need a ‘bit of polish’. Don’t forget significant aspects that relate to
goods and services from suppliers and contractors.
Emergency preparedness and response
Implement procedures to address reasonably foreseeable
emergencies and to minimise their impact should they occur. (eg. Fire, major spillages of hazardous materials, explosion risks etc.)

Step 4. Checking and Corrective Action
Monitoring and measurement
Implement procedures to monitor and measure the progress of projects against the targets which have been set, the performance of processes against the written criteria using calibrated equipment (verify monitoring records) and regularly check (audit) the company’s
compliance with legislation that has been identified as relevant to your business. The most effective way of doing this is through regular progress meetings.

Nonconformance and corrective and preventive action
Implement procedures to enable appropriate corrective and subsequent preventive action to be taken where breaches of the EMS occur (eg. process control problems, delays in project process, noncompliance with legislation, incidents etc.).
Records
Implement procedures to keep records generated by the environmental management system. The Annex to the Standard suggests those that are likely to be required.
Environmental management system audit
Implement a procedure to carry out audits of each part of the EMS and company activities and operations to verify both compliance with the EMS and with ISO 14001. Audit results must be reported to top management . A typical audit cycle is one year but more critical activities will require auditing more frequently.

Step 5. Management Review
At regular intervals (typically annual), top management must conduct through meetings and record minutes of a review of the EMS, to determine that it is still appropriate and effective or to make changes where necessary. Top management will need to consider audit results, project progress, changing circumstances and the requirement of ISO 14001 for continual improvement, through setting and achieving further environmental targets.

Quality Planning

Friday, September 4, 2009

ISO 14001 Auditing and Registration

ISO 14001 Registration
A registration system has grown up around the implementation of the ISO 9000 quality management documents and has formed the basis for a similar system of registration to ISO 14001. At this writing, ISO 14001 is the only specification_ document of the ISO 14000 series and the only standard that is intended to be auditable; all of the other standards are, or will be, guidance documents.
Registrars – Globally, there are 40 – 50 or more organizations established to register organizations to ISO 14001. These registration organizations are accredited by the standards bodies in, for the most part, major industrial nations that have adopted ISO 14001 as their country’s EMS standard. In the U.S., for example, the body that accredits registrars is the ANSI-ASQ National Accreditation Board (ANAB). ANAB passes on the credentials of registrars to register organizations to ISO 14001.
ISO 14001 Audits
First-, second-, or third-party auditors can assess an organization’s conformity to the requirements of the standard. First-party Audits – In the first-party circumstance, the internal auditors of the implementing organization conduct an audit to determine that the EMS has been properly implemented and is being maintained. If the organization passes the internal audit, it may self declare_ its conformity to ISO 14001.
Second-party Audits – In the second-party circumstance, the audit is conducted by a representative of a party interested in the environmental performance of the implementing organization. The interested party_ may be a customer, an environmental regulator, an insurance company, or any other organization affected by the environmental performance of the implementing organization. The second-party audit can be a condition of doing business with the auditor’s organization.
Third-party Audits – In the third-party circumstance, an external EMS auditor conducts an audit, usually at the request of the implementing organization, to determine if the organization conforms to the requirements of ISO 14001. The third-party audit is most often for the purpose of certifying_ that the organization is in conformity with the requirements of ISO 14001.
Typically, when a registration is awarded, it is for a period of three years with a provision for the periodic conduct of surveillance_ audits to ensure continuing conformity.
A principal benefit of the third-party audit is that it compels organizations to continually maintain the EMS in order to pass the follow-up surveillance audits; without this, there might be slippage in the maintenance of ISO 14001.
It is not a requirement of implementing ISO 14001 that organizations have a registration audit conducted; this is a decision made by each organization based upon its determination of the commercial value or necessity of certifying. When an ISO 14001 EMS is intended to be audited,
the requirements must be implemented and documented sufficiently for an auditor/registrar to be
able to conduct the audit based on the finding of objective evidence that the organization has implemented an EMS conforming to ISO 14001.
Establishing objective evidence requires a higher level of documentation and record keeping than is required for mere implementation of ISO 14001. The implementation of ISO 14001 is a simpler task for the organization when it is only seeking to implement the policy and sixteen procedures than when it is implementing with the intention or expectation of being audited.

ISO 14001:2004 Environment Management System Audit

ISO 14001 Section 4.5.4, Environmental Management System Audits, requires that organizations establish and maintain programs and procedures to conduct periodic EMS audits. The EMS audits must determine if the EMS:
• is properly implemented and maintained
• conforms to the planned arrangements
• meets the requirements of the ISO 14001 standard.

ISO 14001 Section 4.5.4 requires the programs and procedures to define:
• audit scope
• audit frequency
• audit methodologies
• responsibilities and requirements for conducting audit
• communication of the audit results.

Environmental Aspects (ISO 14001:2004, ?4.3.1)

The requirement of ?4.3.1 of ISO 14001 is to establish and maintain procedures 1) for identifying the environmental aspects of the organization’s activities, products, and services that it can control and those that it can influence and 2) for determining which of those aspects have or can have a significant impact on the environment. Understanding the requirement of this element of ISO 14001 is central to understanding the concept of an environmental management system.
1 .A single manufacturing facility has potentially hundreds of environmental aspects. How far must it go in identifying its environmental aspects to satisfy the terms of the requirement? ISO 14001 specifies that the organization is to identify those aspects that it can control and those that it can influence and that it must also take into account planned or new developments and new or modified activities, products, and services. These stipulations in the requirements, without actually drawing boundaries on how far the organization must go in identifying environmental aspects, at least establish some categories of aspect that must be considered. Beyond this principle, each organization must identify its aspects comprehensively enough so as to not fail to identify a significant aspect or a legal requirement. An objection to comprehensive identification of aspects is that the organization may become so immersed in aspects identification that it loses sight of the end objective of the procedure, which is to determine significance.
2. Significant impact is not a stand-alone term in ?4.3.1.
It is accompanied by the phrase impact on the environment_ and environment_ is a defined term (see definition of environment, ?3.5). Significant aspects, then, are those environmental aspects that have or can have significant impacts on air, water, land, natural resources, flora, fauna, and humans. The organization determines, using its own criteria, what magnitude of impact on these seven environmental receptors constitutes a significant impact. Whether an aspect is regulated is not intended to be a factor in determining significance.
3. Proper execution of the environmental aspects procedure is important, in part, because it lifts environmental management out of the regulatory compliance mode and into the mode of systematically identifying environmental aspects and impacts and considering their consequences for the environment, irrespective of regulation. The organization that rigorously applies the environmental aspects procedure discovers many opportunities to improve environmental performance that regulation does not address, including:
• Use of energy
• Consumption of materials
• Environmental impacts of employee activities
•Environmental impacts of products and by-products post-manufacture, including distribution, use, reuse, and disposal
• Environmental impacts of services
• Unregulated waste streams such as carbon dioxide
Aspects vs. Impacts – Environmental aspects and environmental impacts differ by definition from one another in that an aspect is an element of an organization’s activities, products or services that can interact (emphasis added) with the environment_ while an impact is any change (emphasis added) to the environment_ resulting from an organization’s environmental aspects._ An aspect, then, is a precursor to an impact and an impact occurs when the aspect interacts with and changes the environment.
When identifying its aspects and impacts, the organization may find that there are more than one potential impacts associated with any given aspect. For example, an environmental aspect of a coal-fired power generation facility is stack emissions containing sulfur dioxide, nitrogen oxides, mercury, and carbon. These emissions change the environment and become impacts by contaminating plants, soil, and surface waters; contributing to the formation of ground-level ozone; causing or exacerbating heart and lung disease in humans; entering the aquatic food chain and impairing reproductive, immune, and endocrine systems; and contributing to the increase in atmospheric carbon dioxide leading to global warming. One aspect, stack emissions, then can generate at least five impacts.
Other organizations, applying benefit/cost analyses to their corrective actions, may discover that creation of a beneficial impact provides a greater environmental benefit than elimination of an adverse impact.
The introduction of the beneficial environmental impact concept into the ISO 14001 Terms and Definitions suggests that it was considered by some of the ISO 14001:1996 drafters as a placeholder for the future possibility of offsetting adverse impacts with beneficial and, on balance, achieving an environmentally neutral organization.
Control and Influence – The environmental aspects procedure requires the organization to identify those environmental aspects that it can control and those that it can influence._ Circumstances where control and influence are considered separately can occur where the environmental aspects of products or services are concerned. Some examples illustrate the case:
1. No control, no influence – When an organization manufactures a product, such as lumber, and sells it to a customer that can use the product in any way that it wishes, the organization has no control over the environmental aspects of the product’s use. The customer could use the product benignly as in the manufacture of a table or to damage the environment by burning the lumber and releasing its carbon into the atmosphere. In this case, the organization would not be expected to have either control or influence over the environmental aspects of the product.
2. Control, no influence – When an organization’s environmental aspect is the use of electric power generated from coal, it may be able to control its use of electric power by using less, by buying from a different, less environmentally damaging source, or by generating its own power. Rarely, however, does the organization have influence over the power generator to an extent that it could influence it to reduce the environmental impacts of power production.
3. Influence, no control – When an organization manufactures a product, such as an automobile, which is sold to the customer without restrictions on its use, the organization may be said to have no control over the environmental aspects of the product’s use. The organization may, however, be able to assert influence with the inclusion of owner’s manuals containing instructions for low impact use of the product.
4. Control and influence – When an organization buys a product built to its specifications, it has control over the products’ environmental aspects in the sense that it can determine the environmental aspects of the product. In this case, control also includes influence.
Significant Impacts – ISO 14001 does not provide guidance as to what constitutes a significant impact on the environment_, leaving that determination to the organization.
Many organizations ignore the qualifying phrase, impact on the environment_, and add additional criteria to what they determine to be significant impacts. For example, many organizations decide that aspects that are the subject of regulation, irrespective of impact to the environment, or that can cause damage to business reputation, are significant. Legal requirements, however, are identified in ?4.3.2 and legal requirements and business requirements are specifically considered when the organization establishes its objectives and targets (?4.3.3). Adding criteria that are not relevant to impact on the environment in the determination of significance distorts the outcome of procedures for environmental aspects and objectives and targets by giving these criteria undue weight in the determination of significance. For example, an environmental aspect that is significant only because its disclosure might affect the organization’s reputation is best dealt with in the Public Relations Department rather than as an environmental aspect.
Determination of significance is a yes or no question, not a determination of relative value. It is possible, therefore, that the execution of the environmental aspects procedure will result in the determination that the organization has no significant aspects. While the organization may elect to rank its aspects from most significant to least significant, that does not necessarily mean that any rise to the level of significant impact on the environment.
Where the impact occurs can be material to determination of significance. For example, a coal-fired power plant’s air emissions can interact with the environment; these emissions are clearly environmental aspects. Whether they significantly impact the environment may depend upon where the interaction with the environment occurs.
Part of the importance of establishing significance lies in the fact that the potentially significant environmental impacts become a focus of Objectives and Targets (?4.3.3), Competence (?4.4.2), Operational Controls (?4.4.6), and Monitoring and Measurement (?4.5.1) requirements.
An organization that determines that aspects are significant because of regulation or business reputation increases the amount of work it must do in these areas.
ISO 14001 does not require the organization to establish objectives and targets for each significant environmental aspect. On the one hand, the absence of a requirement to set objectives and targets for all significant aspects gives organizations latitude to conform to the requirements of ISO 14001 while not presently dealing, for example, with the significant environmental aspects of products. On the other, a requirement to establish objectives and targets for all identified significant aspects could easily overwhelm an organization having many significant aspects. Without this latitude, organizations might choose to ignore the existence of significant aspects that they believe are insurmountable or even decide not to implement ISO 14001. As it is, many organizations choose to deny the existence of significant aspects about which they feel they can do nothing.

Thursday, September 3, 2009

ISO Audit Control System

ISO Audit Control Software

The ISO 9000 Audit Control Software were designed to handle all aspects of an internal or external audit programme, from planning audits to the follow-up of corrective actions against deficiencies found. The ISO 9000 Audit Control Software increases the accountability and efficiency of your internal/external audits by developing core processes with clearly defined audit plans, step-by-step procedures, and standardized auditor roles and responsibilities. It will help to put you to the right path toward developing a well-organized ISO 9001:2008 internal /external audit system.The ISO 9000 Audit Control Software Provides:-
Audit Schedule - maintains the audit schedule, checklist preparation and all audit info.
Track Non-Conformance – System will help to track all non-conformances found during the audit, including actions & verification.
Corrective Action Report (CAR) - Update of the corrective action.
Security: System provide User Right Control module which enable System Administrator to define the access right to authorized users and activity allowed.

Introduction to ISO Certification

Certification is a way to attest, by the intermediary of a third-party certifier, to a company’s ability to provide a service, product or system in accordance with client requirements and regulation requirements. ISO and IEC give the following definition:
Procedure by which a third party gives written assurancethat a product, process or service complies with the requirementsspecified in a benchmark.The ISO 9000 family of standards corresponds to all the management best practices benchmarks as regards quality, which are defined by ISO (the International Organisation for Standardization).
ISO 9000 standards were originally written in 1987, with revisions taking place in 1994 and 2000. Thus, the 2000 version of the ISO 9001 standard, which is part of the ISO 9000 family, is written “ISO 9001:2000″. The ISO 9001:2000 standard mainly focuses on the processes used to produce a service or product, whereas the ISO 9001:1994 standard was mainly focused on the product itself. Here is an overview of all the different standards in the ISO 9000 family:
ISO 9000: “Quality Management Systems – Basic Principles and Vocabulary”. The ISO 9000 standard describes the principles of a quality management system and defines the terminologyISO 9001: “Quality Management Systems – Requirements”. The ISO 9001 standard describes the requirements relative to a quality management system either for internal use or for contractual or certification purposes. Therefore, this standard is a group of requirements that companies must followISO 9004: “Quality Management Systems – Guidelines for Improving Performance”. This standard, which is intended for internal use and not for contractual purposes, focuses particularly on continually improving performanceISO 10011: “Guidelines for auditing quality management and/or environmental management systems”.