One of the more confusing elements of the ISO9001:2015 standard is the requirement for determining the “Context” of the organisation. Underpinning this requirement is the requirement for the organisation to consider both the internal and external issues that can impact its strategic objectives and the planning of the QMS.
Clause 4 of ISO 9001:2015 Context of the organization requires the organization to evaluate itself and its context. This means that you need to define influences of various elements on the organization and how they reflect on the QMS, the company’s culture, objectives and goals, complexity of products, flow of processes and information, size of the organization, markets, customers, etc. It is also a means to detect risks and opportunities regarding the business context.
Where to start?
Although the standard doesn’t prescribe the method for determining the context of the organization, there are some logical steps and milestones.
If you have already implemented ISO 9001:2008, then you probably have already defined the scope of the QMS in the Quality Manual and the sequence of processes and their interaction, either in the form of text or flowchart. If you are implementing the standard from scratch, then you need to determine the scope of your QMS and identify the processes and their interactions
Once the scope of the QMS is defined, together with exclusions and processes and their relations are identified, the following steps need to be taken:
What are internal and external issues?
An organization’s internal context is the environment in which it aims to achieve its objectives. Internal context can include its approach to governance, its contractual relationships with customers, and its interested parties. Things that need to be considered are related to the culture, beliefs, values, or principles inside the organization, as well as complexity of processes and organizational structure.
To determine external context, you should consider issues arising from its social, technological, environmental, ethical, political, legal, and economic environment. Examples of external context may include:
- government regulations and changes in the law
- economic shifts in the organization’s market
- the organization’s competition
- events that may affect corporate image
- changes in technology
What are interested parties?
In simple terms, the requirement for identifying relevant interested parties means that you need to decide whose opinion about your company you should care about.
Interested parties include direct customers, end users, suppliers and partners, regulators, and others. Others could include people in the organization, owners/shareholders, and even society. These parties add value to the organization or are impacted by the activities within the organization. Identifying and meeting their needs is important to implementing an efficient and effective quality management system. Their feedback can really help you to determine what can be improved in your organization, and how.
How do we document it?
Once all this information is gathered, it should be documented; the standard is pretty explicit about it. But where it should be documented? The first choice is to create a new document, and this document will be something that the certification body will require instead of a Quality Manual prior to the audit. The second choice is to include these new requirements in the existing Quality Manual. This can be very practical, since the Quality Manual contains some of the old requirements, so you’ll only have to add the part with internal and external issues and interested parties. Another advantage of this approach is that everyone is already familiar with the Quality Manual, so it wouldn’t be some great change in documentation structure; also, the certification auditors may ask for it out of habit.
Reviewing the context
Regular management review is necessary to monitor the organization’s internal or external issues. Once the internal context is understood, management can conduct a formal review to identify any changes.
The context of the organization seems like one of the “document and forget about it” requirements, but it shouldn’t be. Information gathered through defining context can be very useful for identifying room for improvement, and it shouldn’t be taken for granted. Knowing the context of your organization and opinions of your interested parties can help you improve your organization and make it even better.