Processes and Procedures

• What does ISO 9001:2015 have to say about processes and procedures?
• How can companies create processes and procedures for their organizations?
• What are some common auditing questions about processes and procedures?

An In-depth Look at ISO 9001:2015 Processes and Procedures

Processes and procedures, while apparently simplistic terms, how they are incorporated in your organization must be thoroughly considered and understood in order to avoid errors in the definition and implementation of your management system. 

As defined by the ISO standard, a procedure is a “specified way to carry out an activity or a process,” and a process is a “set of interrelated or interacting activities which transforms inputs into outputs.” ISO also defines a system as a “set of interrelated or interacting elements.” Every process is developed in order to meet an objective. During a process, activities happen that turn inputs into outputs in order to meet that objective. A procedure is the proper way to carry out that process. It’s not enough to understand the formal definition of these terms–in order to understand the full meaning of this requirement, your organization must consider their context and how they work together within your organization.

The process approach is a foundational quality management principle of ISO 9001, and understanding your organization’s processes, procedures, and how they interact is essential to implementing and improving your QMS. An intimate understanding of your processes will help you identify which ones demand specific ways of creating outputs, thus knowing when to create a procedure to go along with them and determine whether or not that procedure needs documentation in order to ensure consistent quality results. This well-rounded understanding of your QMS will ultimately improve efficiency and customer satisfaction, a common goal for all QMS managers!

How Do I Create Processes and Procedures for My Organization?

Your organization will have many processes for doing all types of things. Think about your process of purchasing supplies, hiring contractors, accounting, confirming orders, filling orders, customer service support, making repairs, filling warranties, etc. Once you define your processes, and then decide they need to be carried out a specific way, then you arrive at a procedure. Integral to being called a process is that it has to take an input, perform an activity, and then produce an output. For example, an accounting process might include collecting expense reports, income statements and purchase records, documenting or updating existing records as needed, and creating new reports for management review and future business decisions. 

Other examples might include:

• Operations management 
• Design 
• Planning 
• Resource management 
• Training
• Evaluations
• Outsourcing
• Equipment management
• Shipping/Delivery
• Sales
• Manufacturing

Common procedures are developed around legal requirements or considerations, regulatory compliance, or company policies, for example. If that procedure is preserved in some kind of durable media, it then becomes a documented procedure. Not all processes will demand written procedures. When deciding whether or not a process requires a procedure, consider if step-by-step instructions are necessary to carry out the process correctly.

Procedures are often used for activities that have several different departments or operations that are working together. For example, a contract review process might require a procedure stating that once customers produce a purchase order, there is a specified series of steps to review and approve that order, and then record the order and distribute it a certain way to employees.

Other examples might include:

• Purchasing procedures, 
• Supplier evaluations, 
• Control of documents,
• Control of records,
• Performance evaluation,
• Internal auditing, 
• Corrective action, 
• Control of nonconforming products, and 
• Preventative action.

Common Auditing Questions About Processes and Procedures

Does every process need a procedure?

Not every process requires a procedure to accompany it. There may be some instances where a process is defined, but the approach taken to fulfill that process does not have specific instructions to follow. For example, you might have a process that requires you to purchase from a list of approved suppliers. But it may not be specified that you add or subtract suppliers from that list. In this case, you can buy from an approved supplier, but there is no need for a procedure to accompany that process. Similarly, software developers understand there are many different ways to write code, so there may not be outlined procedures for some areas of software development. Other industries embracing and encouraging creativity and innovation also may not have procedures associated with their design process. Instead, employees rely on their skills and experience to make these decisions. 

Is customer property a procedure?

Customer Property procedures have appeared in some organizations’ QMS in response to ISO requirements laid out in Clause 7.5.4; however, it doesn’t technically fall into the category of procedure, but rather, is an input into an organization’s operations. Assigning a QMS procedure to customer property stretches the definition of a procedure. A procedure describes something that happens in a process (how a process is carried out)–it is not an input itself. If one would assign a procedure to Customer Property, it would follow that Customer Property would be identified as a process needed for their management system. Sometimes methods or activities that make up core processes are mistakenly identified as processes, and this confuses the core priorities and definition of the management system. When organizations identify processes, they must name core processes that are needed for the management system (for example: purchasing, sales, production, receiving, and shipping). 

Does every procedure need to be documented?

ISO 9001:2008 identifies six documented procedures that are required for a QMS, but in ISO 9001:2015 there is no mandated documented procedure. Not every procedure will require documentation, especially if it relies heavily on operator skill, knowledge, and experience. Think of surgeons who must react to multiple different scenarios during a procedure. There isn’t textbook, documented guidance for every single situation they might encounter. Organizations will have to determine for themselves whether or not they need to document a procedure in order to ensure consistent, successful results. 

How do work instructions fit into this? What is the difference between a process, procedure, and work instruction?

Work instructions are like the most specific documentation that is required for a procedure. The hierarchy is process—procedure—work instruction. Procedures are required to carry out processes and work instructions describe specifically how to carry out certain tasks within those procedures (and work instructions are mandatory). A process is outcome-based, a procedure is task-based, and work instructions detail exactly how each person is responsible for completing tasks. As technology changes, work instructions may change, but procedures may remain the same. As organizations adopt new techniques (for example, for measurement, or calibration), procedures may change and work instructions will need to be updated. Additionally, if customer needs change, then entire processes might change, necessitating the need for new procedures and work instructions. Below is a chart to help you sort out the difference between processes, procedures, and work instructions and plan accordingly within your organization.

DIFFERENCES REGARDING QUALITY MANAGEMENT

Source: AlbaTian Innovation Consulting