Planning of a QMS implementation based on ISO 9001
Domain 3 is where an implementation becomes a design. The exam tests whether you can convert the current state into a defined scope, a process model, a policy, measurable objectives and planned responses to risk - all consistent with one another.
Scope and process model (4.3, 4.4)
The scope statement names products and services, sites and boundaries. ISO 9001:2015 no longer uses "exclusions": a requirement may be determined not applicable only if it does not affect the ability to ensure conforming products and services and enhance customer satisfaction, and the justification is retained as documented information. Clause 4.4 requires the processes needed, their inputs, outputs, sequence and interaction, criteria and methods, resources, responsibilities, risks, and evaluation and improvement.
Policy and objectives (5.2, 6.2)
The quality policy must suit purpose and context, provide a framework for objectives, be communicated, and be available to interested parties as appropriate. Objectives must be consistent with the policy, measurable, monitored, communicated and updated, and planned: what will be done, what resources, who, when, and how results are evaluated.
Risk and change (6.1, 6.3)
6.1 requires determining risks and opportunities from 4.1 and 4.2, planning actions, integrating them into processes and evaluating effectiveness. A risk register is a common tool but not a requirement. 6.3 requires planning changes considering purpose, consequences, QMS integrity, resources and responsibility.
Worked example
A packaging converter sets the objective "reduce customer returns to 0.8% or less by 31 December". The plan defines the KPI and data source (8.7 records), the owner (operations manager), the resource (sealing-machine upgrade), milestones, and evaluation at management review. The linked 6.1 risk is inconsistent seal strength; the action is the upgrade plus a new changeover check.
Traps
- Objectives that state an aspiration with no measurement method or data source.
- A risk register copied from a template with no link to process controls.
- Treating 6.3 as document change control rather than change to the QMS.