Why Companies Fail Their First ISO 9001 Certification Audit (and How to Avoid It)

At one time getting certified to a standard, for example ISO 9001 was an event. Over the years it has become a prerequisite to being successful in business. That has brought in many consultants, many with quick ready-made solutions built around templates. I at QMII have been leading the QMII Team by them working using our methodology developed over forty plus years, of avoiding a template and starting by respecting the existing management system by capturing the “as-is” of the system and then developing the management system further to meet objectives. With forty plus years in consulting, auditing and training in the process-based management system approach I wonder why some companies fail their certification. I think a company may arrive at its first ISO 9001 certification audit with an impressive manual, signed policies and carefully arranged records, yet struggle to demonstrate that its management system works. The difficulty becomes visible when the auditor follows an actual customer order, asks how a changed requirement reached production, or examines what management did about a recurring complaint. The documents describe control; however, the evidence tells a different story.

The practical purpose of a quality management system is to help the organization consistently meet requirements and improve customer satisfaction. Certification provides independent assurance about that system. When the certificate becomes the primary objective, preparation can drift toward appearances. The more useful question is whether people can show how their processes deliver the intended results, recognize problems and improve. The system must show effectiveness.

This article uses ISO 9001:2026 and follows its Harmonized Structure (HS) through clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and continual improvement. The structure helps connect business needs to controls, results and learning; it does not require a company to organize its departments or procedures in clause order. The 2026 edition strengthens attention to quality culture, ethical behavior, strategy and the distinction between risks and opportunities. These changes sharpen the questions organizations should ask before their first certification audit. [1, 3]

Understand what failing the first audit means:

An initial certification audit normally has two stages. Stage 1 evaluates the organization’s preparedness for Stage 2, including its system documentation, scope and understanding of requirements. Stage 2 evaluates implementation and effectiveness. Treating Stage 1 as a paperwork formality can leave serious readiness concerns unresolved. [2]

A finding does not automatically mean that the company has failed. Major nonconformities require verified correction and corrective action before certification; for minor nonconformities, the certification body must review and accept the organization’s correction and corrective action plan. Certification follows a separate decision process. Here, “failure” means avoidable delay or inability to demonstrate conformity, not simply receiving any finding. Organizations must remember a Non-Conformity (NC) drives correction and corrective action (CA). [2]

Do not schedule the audit solely to satisfy a sales promise. Allow the system to operate sufficiently to produce credible evidence, evaluate performance and address weaknesses. ISO 9001 (as also other standards) does not prescribe a universal three-month operating period. The necessary evidence depends on the processes, their frequency and the certification arrangements.

Clause 4: The system does not reflect the actual business:

A generic context analysis may mention competition, technology and staffing without explaining their effects on quality (environment, security, health, safety and security, asset management, cyber security, food safety and the numerous other disciplines). Under clauses 4.1 and 4.2, context and relevant interested-party requirements should inform the system. A dependence on one specialist, a customer’s demanding approval conditions or an unreliable material source should influence planning and control. Completing a SWOT worksheet alone does not establish that connection.

Scope under clause 4.3 is another source of difficulty. An organization cannot declare a requirement inapplicable merely because it is inconvenient or performed externally. Consider a business that defines product specifications and commissions a contractor to complete the design. Outsourcing does not, by itself, remove design responsibility or justify treating clause 8.3 as inapplicable. The justification must reflect the organization’s actual responsibilities and its ability to provide conforming products and services.

Clause 4.4 requires attention to processes and their interactions. Departmental procedures may each look satisfactory while the handovers between sales, engineering, purchasing and delivery remain unreliable. Follow one real job across those boundaries. Establish what each process receives, what it delivers, who is accountable and how its effectiveness is evaluated. This is more revealing than checking whether every department has a procedure.

ISO 9001:2026 retains the climate considerations introduced in 2024, including a determination of whether climate change is a relevant issue under clause 4.1 and highlights potentially relevant interested-party requirements under 4.2. Determine which relevant interested-party requirements the QMS will address rather than merely listing stakeholders. For example, disruption to temperature-sensitive deliveries may matter to the QMS. A reasoned determination is needed; an environmental management system or carbon-reduction objective is not automatically required. [1, 3]

Clause 5:  Leadership has delegated ownership of the system:

A quality manager can coordinate implementation, but top management retains accountability for the QMS’s effectiveness under clause 5.1.1. An auditor may ask a senior leader why a quality objective was selected, what is preventing its achievement and what resources have been committed. Referring every question to the quality department reveals a potential disconnect between management and the system.

Leadership is demonstrated through decisions. If sales repeatedly accept delivery dates that operations cannot meet, management must address how commitments are made. A signed quality policy does little to offset incentives that reward shipment regardless of conformity. The 2026 emphasis on quality culture and ethical behavior in clause 5.1 makes this especially pertinent. Would an employee feel able to report a defect honestly, or would pressure to meet a target encourage concealment? Under clause 5.2, the quality policy should connect to the organization’s context and strategic direction. [3] Customer focus under clause 5.1.2 should influence the decisions that create promises and the controls that ensure those promises can be fulfilled.

Under clause 5.3, responsibilities and authorities should be assigned, communicated and understood. A person responsible for product acceptance needs the authority to withhold release when requirements are unmet. Prepare leaders to explain actual decisions and results. Coaching them to recite policy language adds little assurance.

Clause 6: Planning produces registers rather than action:

A risk register may be complete while the organization continues to rely on uncontrolled assumptions. Clause 6.1 links risks and opportunities to planned action, integration into processes and evaluation of effectiveness. If reliance on a single supplier threatens delivery, recording a high-risk score is only the beginning. The organization might qualify an alternative, adjust stock arrangements or strengthen contingency planning, then assess whether the action reduced exposure.

ISO 9001 does not prescribe a risk register, a particular scoring matrix or a formal risk management methodology. The method should suit the business. The 2026 edition distinguishes actions addressing risks from actions addressing opportunities within clause 6.1. An opportunity deserves deliberate consideration: improved order-entry validation, for example, may reduce clarification delays and errors. Identify the beneficial result sought and evaluate the action taken; do not treat an opportunity as merely a low-risk score. [1] A longer register is not necessarily better planning.

Quality objectives under clause 6.2 need meaningful measures and plans for achievement. “Improve quality” gives little direction. Reducing order-entry errors from an established baseline, with an owner, resources, completion date and evaluation method, provides something management can act on. Missing an objective does not automatically establish a nonconformity; the auditor must consider the relevant requirement, planning, monitoring and response.

Changes require similar discipline under clause 6.3. Introducing new software, relocating work or replacing an experienced employee can alter the system. Consider the purpose, consequences, resources, responsibilities and integrity of the QMS, then plan implementation and evaluate the result. Communicate changes to the people affected. The 2026 revision strengthens change management; approving a change is not the same as demonstrating that it achieved its purpose. [4] A carefully prepared original system can become unreliable through poorly managed change.

Clause 7: Training and documentation are mistaken for capability:

Attendance records show that someone attended training. Clause 7.2 requires the organization to determine necessary competence; ensure people are competent and evaluate the effectiveness of actions taken to acquire competence. For an inspector, appropriate evidence might include observed performance, successful assessment and authorization for specified work. A course certificate alone may not establish the ability to make reliable acceptance decisions.

Awareness under clause 7.3 is also practical. Employees should understand how their work contributes to effectiveness and what can happen when requirements are not met. Ask a dispatch employee what happens when labeling instructions are unclear. Knowing where to seek clarification and when to stop is more useful than memorizing an ISO clause number. The 2026 awareness provisions also address quality culture and ethical behavior. Discuss real choices, such as recording an inspection honestly when a delivery deadline is at risk. [3]

Documented information under clause 7.5 must support work and be controlled. A shared electronic system is acceptable; printing every record is unnecessary. The important questions concern approval, access, revision, protection, retention and retrieval. A beautifully maintained master procedure offers little protection when an obsolete instruction remains in use at the workstation. The amount of documentation should reflect what is required to operate and demonstrate control, not the size of a purchased template package.

Resources also include organizational knowledge under clause 7.1.6 and suitable monitoring and measuring resources under 7.1.5. Do not stop at checking calibration labels. Where a measuring device is found unfit for its intended purpose, assess whether earlier results may have been affected and take appropriate action. Similarly, identify knowledge that would disappear if a key employee left. These weaknesses can undermine conformity despite complete training files.

Clause 8: Controls break down during real work:

Operational evidence is where an apparently complete system is tested most directly. Under clauses 8.2.2 and 8.2.3, the organization determines and reviews requirements before committing to supply. A purchase order acknowledgment is not necessarily evidence that technical, delivery and applicable statutory or regulatory requirements were adequately reviewed. Changes must also reach the people who need them under clause 8.2.4.

Consider a customer who changes a material specification after order acceptance. Sales records the change, but purchasing uses the original specification and receiving accepts the material against that outdated order. Each department can produce a record, yet the system has failed to carry the requirement through. This illustrates why an auditor follows transactions across functions instead of examining forms in isolation.

External-provider control under clause 8.4 requires more than an approved supplier list. The type and extent of control should reflect the effect of externally provided processes, products and services on conformity. Define what providers must deliver, how their performance is monitored and what triggers action. A provider’s ISO 9001 certificate can support evaluation; it does not eliminate the need for appropriate controls.

For production and service provision under clause 8.5, compare stated controls with practice on different shifts and at relevant locations. Where resulting outputs cannot be verified by subsequent monitoring or measurement, process validation becomes important under 8.5.1. Final inspection cannot compensate for every weakness in the process that creates the output.

Release under clause 8.6 should be supported by evidence that acceptance criteria have been met and by traceability to the authorizing person. Nonconforming outputs under 8.7 require control to prevent unintended use or delivery. An urgent shipment should not bypass these arrangements simply because a manager wants the order dispatched. After a correction, conformity must be verified; making the item look acceptable is insufficient.

Clause 9: Internal assurance is too superficial:

An internal audit that asks only whether documents exist can leave major weaknesses undiscovered. Clause 9.2 calls for information about both conformity and effective implementation and maintenance. Auditors need competence and arrangements that ensure objectivity and impartiality. A consultant’s implementation work does not automatically establish an impartial internal audit of that same work.

A useful audit follows evidence from requirement to result. Select an actual order, examine a changed requirement, test supplier controls and verify release. Include appropriate samples across the scope, considering process importance, changes and previous results. A clean audit report is valuable only if the sampling and evaluation justify its conclusions. The absence of findings is not itself proof of audit quality.

Performance evaluation under clause 9.1 should also go beyond producing dashboards. A company may report excellent on-time delivery while routinely changing promised dates after accepting orders. Clarify what the measure means and whether it reflects the customer’s experience. Customer satisfaction monitoring under 9.1.2 is broader than complaints alone; silence does not establish satisfaction.

Management review under clause 9.3 must use relevant inputs and produce decisions and actions. A brief meeting with the required headings, but no examination of trends or resource needs, may provide little evidence of effective review. Equally, a separate ceremonial “ISO meeting” is unnecessary if established management arrangements address the required inputs and outputs and retain the necessary evidence. Review should help management decide what to change and then follow through.

Clause 10: Problems are corrected without preventing recurrence:

Replacing a rejected component is a correction. Corrective action under clause 10.2 addresses the cause so that recurrence can be prevented. “Operator error” may describe an event without explaining why the system allowed it. Consider unclear criteria, unsuitable tools, conflicting instructions, workload, supervision and changes in the process before concluding that retraining is the answer.

The response should consider whether similar nonconformities exist or could occur elsewhere. If one workstation used an obsolete drawing, examine how drawings are controlled across the relevant operation. Replacing that single copy may resolve the immediate defect while leaving the underlying cause untouched.

Effectiveness needs evidence. Define what would show that the action worked, such as correct revision use across a meaningful sample of subsequent jobs. Closing an action because a procedure was revised verifies completion, not necessarily effectiveness. The depth of action should be proportionate to the effects of the nonconformity, and results should feed improvement under clause 10.1.

Make readiness a management decision:

Before committing to Stage 2, management should ask process owners to demonstrate a complete job, an important change and a resolved problem. Can they retrieve the relevant evidence, explain the controls and show the results? Have internal audits tested implementation? Has management review led to decisions? Have significant weaknesses been addressed and the effectiveness of corrective actions evaluated?

These are practical readiness tests, not additional ISO requirements. They bring the system back to its purpose. A first certification audit should examine an organization’s established way of managing its work. When people understand their responsibilities, controls operate in practice and management learns from evidence, certification becomes a credible recognition of that capability. The real achievement is a system that continues to work after the auditor leaves.

Conclusion:

The leadership in any organization should invest in their system demanding desired outputs. The audits should enable leadership to make better decisions and ensure planned resourcing. The QMS (quality management system) must help the organization consistently meet requirements and improve customer satisfaction, not just become certifiable. Purpose of a MS. Is not only to be auditable but to achieve the objectives.  Certification provides independent assurance about that system. Making the certificate the primary objective is in a way a leadership failure. Leadership must motivate the employees to show their processes deliver the intended results, recognize problems and improve. The system must be effective. Certificates will follow and are important but not the primary aim of the MS.

__

About the Author

Inderjit (IJ) Arora, Ph.D., is the Chairman of QMII. He serves as a team leader for consulting, advising, auditing, and training regarding management systems. He has conducted many courses for the United States Coast Guard and is a popular speaker at several universities and forums on management systems. Arora is a Master Mariner who holds a Ph.D., a master’s degree, an MBA, and has a 35-year record of achievement in the military, mercantile marine, and civilian industry.

Employees Ignore the QMS: How to Build Real Buy-In Beyond the Quality Team

ISO 9001:2026 just dropped and leadership promoting a quality culture is one of the new requirements. Since inception in 1986 QMII has stressed that an effective management system means more than just a folder of documents. True system effectiveness comes from personnel motivated, competent and knowledgeable of the requirements. Often with a poorly implemented system gaining QMS employee engagement can be a challenge. This leaves the quality manager doing all the heavy lifting and the system engagement only coming the week before an audit.

In this article I seek to highlight the steps organizations can take to gain engagement from the workforce. The steps outlined will help organizations reduce the resistance to change and move the mindset from one of just compliance. QMII’s clients’ have benefitted from this over the years and so should you.

Why Employees Treat the QMS as “Quality Team Paperwork”

As I visit clients for the first time, I hear people refer to me as “the ISO guy”. Herein is probably the first mistake that organizations make in their quality management system implementation journey. Treating the system as an ISO system or a quality system rather than how the company operates and gets work done. In doing so organizations tend to document their system to meet audit and customer requirements, prepare to pass audits and treat their QMS as an add-on that can be switched on and off as needed.

As with any change, implementing a QMS will come with this fair share of resistance. Each employee wants to know what’s in it for me. Why should they keep these additional records and document what they do when perhaps their pay will see no increase. Some have concerns about their job security if they document how they do what they do. Others feel they will be restricted in what they do and perhaps there will also be more documented accountability. All valid fears that must be alleviated by the leadership in explaining why the system is important and why personnel should treat their QMS as more than just paperwork.

If you walk onto the shop floor and do not see personnel using the QMS documentation because “I know better”, “I’ve been doing it this way for years” or “It ain’t broke so why fix it” then you know you have a QMS that exists only on paper.

What ISO 9001 Actually Expects from Employees

Before I speak about what ISO 9001 expects from the employees I want to focus on what it requires of Leadership. While a QMS requires engagement from all personnel the onus to promote that engagement, support other leadership roles in implementing the system and encouraging continual improvement lies with the leadership. Leadership is accountable for the success of the system. The leadership must convey their expectations via the policy and objectives and then provide the resources needed to achieve it. They must define clear roles and responsibilities and determine the competency requirements for each position in the organization.

With the framework above set, leaders must now focus on hiring and maintaining competent personnel. In addition, they must drive awareness of the system among the workforce. In ISO 9001:2026 clause 5.2 requires the policy to be communicated, understood and applied. This means that the workforce must understand how they contribute to the policy and then apply it in their daily job. When the entire workforce is working towards a common goal as outline in the policy and objectives then it can be said that the quality culture is good. The workforce must recognize why they should not take shortcuts, who to report to when they notice a risk and the ability to stop work if needed.

A common myth is that a QMS and the ISO 9001 standard requires employees to follow procedures, obey leadership and cross train others. None of these are requirements of the standard. Outlined below are five simple steps to encourage more active participation in the system.

Fix 1: Connect Quality Objectives to Each Role

As stated in the previous paragraph it is important to have measurable goals (also required by the standard). Once the processes have been defined then relevant process owners need to be assigned. Each process owner then defines the process to the extent needed only to have confidence that the process is being carried out as planned. Thus, documentation will vary based on the size of the organization, structure, number of personnel and their experience and the complexity of the process.

ISO 9001 does not limit the number of goals that can be set. Each process can have its own measurable goal, so long as it contributes to the overall objective and does not conflict with any other objective /KPI.

Outlined below is a simple example of an objective cascade through an organization.

Example QMS Objective Cascade
LevelObjectiveMeasure and TargetOwner
OrganizationImprove customer satisfaction.Increase the customer satisfaction score from 88% to 92% by year-end.Top management
Operations processImprove on-time delivery.Increase on-time delivery from 90% to 96% by the end of Q4.Operations manager
Production teamReduce delays caused by rework.Reduce rework from 5% to 2% of units produced by the end of Q3.Production supervisor

Fix 2: Make Leadership Visible

I’ve been working with a number of organization and even through my own career nothing makes a system more effective that visible leadership. This is the reason when I audit, I ask leadership, “How do personnel evidence your commitment”? Top Management must walk the talk. A policy signed and posted on the notice board has no value when the leadership does not provide the resources to support it. When they bypass the requirements, they set for others and when quality goals are adjusted to pass audits.

Leadership must actively participate in contextual risk reviews, their decision making must be evident in the various operational aspects, and they must actively participate in management reviews. When non-conformities occur, they must ensure effective and timely action. Also, when the corrective action is ineffective, they must question why. Other ways that leadership commitment may be evidenced is in them refacing the QMS in meetings, effective communication on the state of the system to all and GEMBA walks.

For leadership a simple way to gain buy in is to not refer to the management system as the QMS. Take quality out of the name and put your company name in there so personnel “own” the system. Gain their inputs when documenting the system.

Fix 3: Replace Generic Training with Role-Based Awareness

The standard ISO 9001 does not ask for training. It requires competence. This minor difference is often lost in implementation where many companies I work with read competence as training. Competence is the ability to apply skills and knowledge effectively and training merely provides that knowledge. A leader that says they care about the system and in driving competence among personnel but then do not want to commit the time or resources to train those personnel does not show commitment.

Apart from competence the standard requires awareness training. Here is where employees need to be trained in how they can contribute to the system. This includes what to do when they evidence risks, how to recommend changes to documentation and whom to report opportunities for improvement to. They need to understand why the QMS supports them in all they do. QMS awareness training when implemented during employee onboarding should be followed by a refresher training at some periodic basis.

If you would like a template for training your employees on your QMS reach out to QMII at [email protected] .

Fix 4: Simplify Procedures and Forms

When consultants are brought in to design your system, they write the procedures based on their experience and with templates they have used in the past. QMII’s approach is to work with companies to capture the documentation the way work is actually done. No assumptions made and no fictional procedures are captured. This ensure that you say what you do and do what you say.

Consider how you can simplify QMS documentation so its easy for the user to locate and use. Think beyond procedures documented in MS word. Consider how to video files, posters, graphical representations, screen shots, flowcharts and more. Make the documentation user-friendly to locate and reference. Think computers at the point of use for ease of reference. Make suggesting changes to documentation easy while ensuring adequate control.

•         Effective document control and compliance guide

Fix 5: Recognize and Involve People

People are more likely to support the QMS when their ideas and contributions are recognized. Recognition does not need to be expensive. Leaders can highlight useful suggestions in team meetings, thank employees who identify risks or improvement opportunities, and share examples where an employee’s input prevented a problem. These simple actions reinforce the message that quality is everyone’s responsibility and help build a culture of continual improvement.

Involvement is equally important. Organizations can introduce suggestion schemes, quality circles, and regular feedback loops that give personnel a simple way to recommend changes. In creating new documents gain reviews of the document from all relevant interested parties prior publishing the document .Employees from different departments can also be trained as internal auditors, allowing them to better understand how processes connect while bringing a fresh perspective to audits. When personnel see that their input leads to action, they are more likely to take ownership of the management system.

Measuring Whether Buy-In Is Improving

Employee buy-in should be visible in how the QMS performs. Look for fewer repeat audit findings, more near-miss and improvement reports, completed role-based awareness activities, and stronger employee feedback in surveys and management reviews. Positive trends in these simple indicators show that personnel are moving beyond compliance and taking ownership of the system.

A QMS becomes effective when objectives connect to each role, leaders remain visible, awareness is relevant, documentation is easy to use, and people are recognized for contributing. When employees see the system as the way the organization works engagement and the quality culture improve. Internal Auditor and Lead Auditor training can further build the skills needed to sustain that involvement and continual improvement.

__

About the Author

Julius DeSilva is CEO of QMII (Quality Management International, Inc.), with more than 25 years of experience in quality management systems, maritime safety and security, and information security. A former seagoing officer and Exemplar Global Certified Lead Auditor (ISO 9001, ISO 27001, ISO 50001, RC14001), he has trained over 1,500 professionals as lead auditors and led consulting and auditing engagements across manufacturing, government, maritime, and aerospace sectors. He holds an MBA from the Darden School of Business, University of Virginia, and is an Associate Fellow of the Nautical Institute.

How to Retain Auditor Training Knowledge When You Can’t Apply It Immediately 

Completing an auditor training course is an exciting milestone. You walk away with frameworks, methodologies to create checklists, audit question techniques, and—if you’re like most professionals-a head buzzing with new knowledge. Ideally, you’d jump right into an audit and apply your skills, reinforcing what you’ve learned while it’s still fresh. But what if that opportunity doesn’t come right away? 

At QMII, we recognize this common challenge among our alumni. Let’s explore effective strategies to bridge the gap between training and practice—so that knowledge doesn’t fade but instead becomes a solid foundation for your future audit work. 

1. Simulate Real-World Scenarios 

Action: Design mock audits for yourself or with peers. 

Even without access to an organization’s system, you can simulate an audit process by reviewing publicly available quality manuals, environmental reports, or sample procedures including your own. Pretend you’re preparing for an audit: write an audit plan, create checklists, additional documentation you would request and practice conducting document reviews. 

Tip: Use scenarios from your training or past experience and ask yourself: 

  • What would I ask as an auditor? 
  • What evidence would I seek? 
  • What risks could be present? 

2. Start a Learning Journal 

Action: Reflect on key concepts, standards clauses, and audit techniques by writing them down in your own words. 

Journaling isn’t just for reflection, it’s a brain-anchoring technique. When you write out what you remember and how you would apply it, you’re reinforcing neural pathways tied to that knowledge. 

Include: 

  • Summaries of ISO clause requirements. 
  • How you would handle nonconformities. 
  • Sample non-conformities within your organization and write down your assessment of them as also the effectiveness of corrective actions. 

3. Teach Others What You Learned 

Action: Participate in knowledge-sharing sessions. 

There’s no better way to solidify your understanding than teaching others. Reach out to other auditors in your organization and discuss applicability and interpretation of a clause. Participate and contribute to discussions on LinkedIn forums. Search the web for interpretation of clauses and see the differences as opined by various different personnel. 

Bonus: You’re also building your credibility and visibility as an auditor. 

4. Stay Active in the QMII Alumni Network 

Action: Engage with blog articles, LinkedIn posts, ask questions, and share insights. 

QMII’s alumni network offers a treasure trove of experience. Staying engaged keeps you in the loop on best practices and might even lead to mentoring or shadowing opportunities. React to blogs written by QMII, contribute articles for QMII blog, comment on QMII posts and connect to QMII alumni. 

Don’t hesitate to: 

  • Ask others how they’re maintaining their skills. 
  • Request mock audit partnerships. 
  • Share resources and templates you’ve created. 

5. Continue the Learning Loop 

Action: Sign up for webinars, read audit case studies, and revisit your course materials regularly. 

Audit skills are built not just on knowledge, but on judgment, observation, and communication. You can sharpen these even while waiting for your first official audit assignment. 

Suggested activities: 

  • Attend QMII webinars or ISO updates. 
  • Subscribe to quality-focused newsletters. 
  • Read ISO audit case studies and identify what went wrong—and why. 

6. Request to Observe Internal Audits 

Action: If you’re part of an organization, ask to shadow an experienced auditor. 

Even if you’re not leading, observing an audit helps you internalize the structure, flow, and behavioral nuances of auditing. Jot down observations on auditor behavior, techniques, and interaction styles. Create your own checklists and then compare it to that prepared by the lead auditor. Discuss the differences after the audit. 

If your organization doesn’t have an active program, this is a great opportunity to propose starting one—a value-added initiative from a proactive auditor-in-training. 

Final Thoughts: Don’t Let the Gap Become a Gully 

Skills fade when left idle, but they flourish with even light engagement. Whether it’s through simulation, teaching, journaling, or community interaction, there are numerous ways to keep your audit knowledge sharp and ready. 

At QMII, we believe that continual improvement isn’t just for organizations, it’s a personal practice. Stay connected, stay curious, and keep that audit mindset active until your next assignment arrives. 

Have your own tips for retaining training knowledge? 
Join the conversation by commenting on this blog or drop us a line-we’d love to feature your story! 

—

About the Author

Dr. Julius is a Senior Consultant at QMII with over 25 years of experience in ISO and aerospace quality systems. He has trained and guided hundreds of U.S. defense contractors on AS9100 and compliance, turning certification into a competitive advantage.

ISO 13485: QMS Requirements of Medical Devices for Regulatory Purposes

by Dr. IJ Arora

ISO 13485:2016 is a standard that addresses quality management system requirements for those within the medical device industry. It is based on the systems-based approach found in ISO 9001:2015, but because it emphasizes requirements for regulatory purposes, it does not align with ISO’s harmonized structure (HS). In many ways, ISO 13485 does align with the HS, particularly in the structure and foundational principles of quality management.

The introduction of ISO 13485 explicitly states that the standard is aligned with ISO 9001, and this connection is important for understanding how the two standards relate to each other. I am a bit surprised as to why ISO 13485 isn’t fully harmonized with the HS as defined in Annex SL, which is the specific document within ISO standards that outlines the HS. I believe that if this standard were aligned to the HS, it would make implementation much less laborious for all involved.

The ISO 9001 foundation

The 2015 version of ISO 9001, which is presently under revision, provides a good basis for all standards. As mentioned, ISO 13485 has its roots in ISO 9001, which is why the key QMS principles (e.g., customer focus, leadership, process approach, continual improvement, and evidence-based decision making) central to ISO 9001 are also embedded in ISO 13485.

ISO 13485 includes several core concepts and clauses from ISO 9001. Clause 4 on quality management systems (e.g., structure, documentation requirements, and the scope of the QMS); cause 5 on management responsibility (e.g., top management involvement, resource allocation, and internal audits); and clause 8 relating to measurement, analysis, and improvement (e.g., monitoring, corrective actions, and continual improvement), are just some of these examples.

As I study, teach, consult, and audit using ISO 13485, I wonder why the standard Is not fully harmonized with similar standards as laid out in Annex SL. In consulting, I feel the pain of organizations that must meet regulatory requirements and so tend to overlook the process-based management system (PBMS) approach as the fundamental to the plan-do-check-act (PDCA) cycle. This regulatory focus is one reason why, although ISO 13485 shares many similarities with ISO 9001, it is not fully aligned with the HS. ISO 13485 places a strong emphasis on compliance with regulatory requirements specific to the medical device industry. The standard’s clauses addressing design and development, post-market surveillance, risk management, and traceability requirements are all far more extensive than those found in ISO 9001. Annex SL focuses more on general management practices and less on industry-specific regulatory controls. The detail and specificity required for medical device safety and compliance often necessitates a structure that goes beyond the framework of the HS.

Overcoming differences

Different scopes and audiences are also a consideration in that, while ISO 9001 is a general quality management standard applicable across industries, ISO 13485 is designed specifically for organizations that manufacture medical devices. These organizations must meet stringent regulatory requirements that go beyond what ISO 9001 addresses. Because of this, ISO 13485 requires more detailed processes related to product lifecycle management, post-market activities, risk management, and regulatory controls, which aren’t adequately covered under the more generalized HS. ISO 13485 includes a much stronger emphasis on managing the product’s entire lifecycle, from design and development to post-market activities (e.g., complaint handling and vigilance). Although ISO 9001 mentions product realization, ISO 13485 goes into much greater depth, including extensive requirements for design control and risk management. These elements reflect the higher level of scrutiny needed in the medical device industry, where safety and compliance are paramount.

With that said, I believe that these differences don’t prevent ISO 13485 from being organized according to the HS format. The standard would not only help medical device manufacturers’ management systems conform with specific regulatory requirements but also meet the obligations for continual improvement. After all, registered organizations in the aerospace and automobile industries already do just that via sector-specific management system standards that are harmonized with ISO 9001.

The structural differences in the clauses found in ISO 13485 and the standards adopting the HS are not too far apart. Although ISO 13485 is aligned with ISO 9001, it diverges when it comes to specifics that are unique to the medical device sector and regulatory requirements.

ISO 13485’s clause 7, “Product Realization” includes additional elements, such as design controls and regulatory compliance requirements, that are critical in the medical device industry. Post-market surveillance and complaint handling are central to ISO 13485, but the HS doesn’t go to the level of detail necessary for medical device manufacturers.

ISO 13485 emphasizes the need for continuous monitoring of device performance, even after they are on the market, ensuring any issues are identified and addressed in a timely manner. I believe ISO 9001’s subclause 9.1.2, “Customer Feedback,” can be updated to incorporate this requirement.

Risk management is a vital consideration. ISO 13485 integrates risk management into the standard in a way that is far more structured and pervasive than what is found in ISO 9001. ISO 13485 has a more detailed approach to identifying, assessing, and mitigating risks throughout the lifecycle of medical devices. However, these added requirements could be added to subclause 6.1.1 (““Actions to Address Risks and Opportunities”) or subclause 8.1.1 (“Operation Planning and Control”) found in the HS.

ISO 13485 includes specific requirements for design and development processes, which are critical in medical devices due to their complexity and potential risk to patient safety. The HS doesn’t provide this level of detail for other types of products or industries.

Identifying similarities

Notwithstanding the differences between ISO 13485 and the standards that align with the HS, there are also some key similarities. As with ISO 9001, ISO 13485 is built around seven quality management principles: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, and relationship management. Continual Improvement of the quality management system is part of both standards, emphasizing the need for a strong focus on monitoring, auditing, corrective actions, and reviews. Document control is another similarity. Both ISO 13485 and ISO 9001 stress the importance of clear and accurate documentation to ensure that quality management processes are defined, monitored, and maintained effectively.

In keeping itself separate from the HS, ISO 13485’s clause structure, despite being based on ISO 9001, serves to meet the unique needs of the medical device industry. The decision not to fully harmonize the standard with the structure seen in Annex SL likely stems from the need to ensure a tailored regulatory focus. ISO 13485 is aligned with a variety of regulatory frameworks across different countries and regions (e.g., FDA, EU MDR, TGA, etc.). These regulations require specific processes that go beyond the generic, high-level harmonized framework provided by Annex SL to facilitate combined/ integrated management systems. The structure of ISO 13485 allows for a more detailed, industry-specific approach to product safety, efficacy, risk management, and compliance. Product lifecycle control is an essential part of the medical device industry, and it has a complex lifecycle that includes design controls, manufacturing processes, and post-market activities that require more attention than the HS would provide.

Looking at a few additional clauses reveals that ISO 13485 follows a specific structure that allows it to emphasize the unique aspects of medical device quality management while maintaining consistency with other ISO standards.

For example, Clause 1, “Scope,” is relatively straightforward and outlines the scope of the standard, which is specific to organizations that design, manufacture, and maintain medical devices. The clause also highlights exclusions (for example, aspects not applicable to the organization), which is quite typical in a quality management standard.

Clause 2, “Normative References,” lists the documents referenced within ISO 13485, which is typical for any ISO management system standard. The important point here is that ISO 13485 requires compliance with relevant regulations and standards, particularly those in the medical device sector.

Clause 3, “Terms and Definitions,” is crucial because the terminology in the medical device industry can be very specifically. Definitions clarify terms that might have different meanings in other industries (e.g., what qualifies as a “medical device,” “design verification,” or “post-market surveillance”). This ensures uniformity and understanding across the industry.

Clause 4, “Quality Management System (QMS),” describes the basic requirements for establishing and maintaining a QMS, which is a fundamental aspect of ISO 13485. This clause outlines the need for a quality policy, the establishment of objectives, and the requirement to continually improve the QMS. These are common in all ISO standards but are tailored here to fit the needs of the medical device industry.

Clause 5, “Management Responsibility,” covers executive involvement as a key theme. In ISO 13485, it emphasizes top management’s responsibility for ensuring that quality objectives are met. This clause also requires that management provide resources for quality activities and review the performance of the QMS regularly, ensuring alignment with regulatory requirements and customer needs.

Clause 6, “Resource Management,” could have been aligned to clause 7, “Support,” found in the HS. This clause in ISO 13485 requires the organization to manage resources effectively, which includes personnel training and competence (a critical area in the medical device industry). This ensures that employees have the skills needed to produce safe and effective devices. It also covers infrastructure and the control of the work environment, ensuring that conditions are suitable for maintaining product quality.

Clause 7, “Product Realization,” diverges further from the HS. Product realization in the medical device sector involves the entire lifecycle of the device—from planning, design, development, and manufacturing to service and post-market activities. This clause is extensive and includes requirements for design controls, risk management, validation, and traceability, all of which are critical in the medical device industry. The detailed focus on design and development, verification and validation, and product monitoring ensures that all aspects of a medical device’s journey, from conception to post-market surveillance, are covered.

Clause 8, “Measurement, Analysis, and Improvement,” requires organizations to evaluate the effectiveness of their QMS through regular monitoring, measurement, and audits. It also focuses on corrective and preventive actions (CAPA) to improve quality. Preventive action in the HS has not been thrown out like the proverbial baby with the bath water. It has instead been replaced by requirement to appreciate risk. For medical devices, complaints and nonconformance reporting are key to ensuring ongoing safety and compliance. ISO 13485 could also have gone from preventive action to risk.

Post-market surveillance and vigilance is a requirement of the medical device standard. Unlike many other ISO standards, ISO 13485 places significant emphasis on post-market surveillance, which is the process of monitoring the performance of medical devices once they are in use. This is a major distinguishing factor from other ISO standards. Manufacturers are required to establish processes for post-market feedback, complaint handling, and field safety corrective actions (FSCA), which are essential for identifying and managing risks after the product is on the market.

In conclusion, I would opine and agree that although ISO 13485 is indeed based on ISO 9001, it diverges from the HS identified in Annex SL because the unique needs of the medical device industry—such as regulatory compliance, product lifecycle management, and patient safety—require a more detailed and specialized approach than the HS can provide. The clause structure of ISO 13485 reflects these specific requirements, making it a robust and industry-specific standard that ensures the safety and quality of medical devices while maintaining alignment with the foundational principles of quality management in ISO 9001.

This balance of maintaining core quality principles while addressing the needs of the medical device industry is why ISO 13485 has not fully adopted the HS but instead continues to incorporate elements of ISO 9001 alongside medical-device-specific regulatory needs. That it could still at the least attempt to align the primary clauses as risk to the HS would help all parties involved.

Note – The above article was recently featured in Exemplar Global’s publication called “The Auditor”. Click here to read it.

The Role of Management Systems in the Tragic Collision Over the Potomac

by Dr. IJ Arora


A significant tragedy occurred in Washington D.C. on January 29, 2025, with the deadly collision between a U.S. military Black Hawk helicopter and a regional jet flying for American Airlines. The resulting crash caused the loss of 67 precious lives and pointed to a multilayered failure of safety mechanisms.

In a short article like this it is not my intent to explore the reasons for this event, and I have neither the expertise nor the authority to investigate, anyway. The U.S. National Transportation Safety Board (NTSB) and other relevant agencies will do that in a most professional manner. However, I do have a degree of experience relating to the systems approach for managing processes at large and complex organizations. I feel called to share my perspective on this disaster with a systems approach in mind.

Proactive appreciation for risk

Hindsight, it has been said, is 20/20. I am aware that I’m writing this after the tragedy has already occurred. However, management systems should be proactive, where data drives the understanding and mitigation of risk. As a practitioner and advocate of process-based management systems, I believe that well-implemented procedures give an organization the best chance to produce conforming products and services.

A systems approach, based on ISO 9001’s subclause 4.4., which relates to quality management system processes, could have played a role in preventing an incident of this type. Subclause 4.4.1 states, in part, “The organization shall establish, implement, maintain and continually improve a quality management system, including the processes needed and their interactions….”

Following this requirement is no guarantee of safe and successful outcomes, but it is surely the best bet. I had similar thoughts on the tragedy of the implosion of the Titan submersible and the Baltimore Bridge collapse. The core principles of ISO 9001, especially risk-based thinking, continual improvement, and process interaction, align well with safety imperatives, particularly safety management for the aviation industry. The systems approach is a fundamental that organizations often neglect at their (and their customers’) peril.

ISO 9001—and for that matter, the aerospace standard AS9100—is built on risk-based thinking. A structured process aligned with the risk management standard ISO 31000 and aviation safety management systems are required by ISO 9001 subclause 6.1, regarding actions for addressing risks and opportunities, and subclause 8.1 concerning operation planning and controls. Conformance with these requirements can help identify and mitigate collision risks between civil and military aircraft.

Process interaction and communication are vital in such situations.  A failure in communication between air traffic control, military operations, and civilian aviation may have contributed to the crash. Of course, we will wait for the full report from the NTSB investigation. However, it is never too late (or for that matter, too early) to be proactive and implement a process approach to ensure that all stakeholders follow well-defined communication and coordination protocols.

PDCA, SWOT, and FMEA

Being proactive requires an appreciation of risk at the Plan stage of the Plan-Do-Check-Act (PDCA) cycle. Note that preventive actions and continual improvement are integral to the system approach.

The media have reported on the details of numerous previous aviation incidents. Analyzing near-miss incidents and integrating lessons learned into improved procedures could enhance safety protocols. Human factors and process redundancy must be considered in a systematic manner. Human errors (e.g., miscommunication, misinterpretation of airspace usage, etc.) can be minimized with automated systems and via decision-making redundancy checks.

In principle, the process approach found in ISO 9001 emphasizes addressing process issues as opposed to blaming individuals. However, in the aviation field, the human factor is important; clause 10.2.1 b2 of AS9100 expresses the importance of this concept. The industry-specific interpretation of requirements as seen in this standard provides a robust framework (via a clause structure) to design an efficient management system. This, together with auditing and compliance requirements, gives leadership confidence that their system can and will produce conforming products and services.

Further to this point, regular audits of flight coordination between civilian and military aviation could highlight gaps before they lead to accidents. As such, integrating ISO 9001 with AS9100 and AS9110 (the aerospace quality standard specifically designed for maintenance, repair, and operations) as well as ISO 45001 covering the management of operational health and safety will provide a solution to proactively address risks in the context of the aviation industry. This would cover all interested parties, as per clauses 4.1 and 4.2 of ISO 9001. Although aviation already has strict regulatory frameworks (e.g., FAA, ICAO, etc.), the structured process management systems required by ISO 9001 and AS9100 can complement these frameworks by embedding the statutory and legal requirements into the management system.

If the organizations involved focus on how specific elements of ISO 9001 can be applied to aviation safety, particularly in preventing collisions, I would first recommend that they look at risk-based thinking as seen in clause 6.1, addressing actions related to risks and opportunities. This can partially be accomplished by undergoing a strengths, weaknesses, opportunities, and threats (SWOT) analysis. ISO 9001 emphasizes risk assessment and mitigation throughout processes.

In aviation, a structured risk-based approach would identify potential hazards (e.g., conflicting flight paths, miscommunication, system failures, etc.). The system would also assess risk severity and likelihood of occurrence and probability of detection, using tools like a failure modes and effects analysis (FMEA). Controls could be implemented (e.g., enhanced air traffic control coordination, better radar tracking, AI-driven airspace monitoring, etc.). For example, aviation safety bodies could require all civilian and military flights to undergo a real-time risk assessment check before takeoff, considering airspace congestion, weather, and military training exercises.

Potential solutions

Process interaction and communication (as seen in ISO 9001’s clause 4.4.1 b regarding understanding process interactions) would systematically improve the system. Aviation operations involve multiple stakeholders, such as airlines, air traffic controllers, military operations, ground crews, etc. A process approach would ensure defined standard operating procedures for communication between civilian and military aviation. These could include real-time data sharing using standardized digital platforms and/or automated conflict-resolution systems that detect and alert pilots and controllers regarding possible mid-air conflicts. An integrated civil-military coordination dashboard could be established, where both parties have real-time visibility on flight plans, airspace restrictions, and emergency deviations.

Risk appreciation and continual improvement (as seen in ISO 9001’s clause 10.2 regarding nonconformity and corrective action, clause 10.3 on continual improvement, and clause 5.1.2 regarding customer focus) require organizations to analyze failures, investigate causes, and take corrective actions. In aviation safety, this could mean automated reporting and analysis of near-miss incidents and regular safety audits to evaluate procedural weaknesses and machine learning-based predictive analytics to foresee and prevent future crashes.

When a near-miss incident occurs, such a system could automatically trigger a root cause analysis and recommend safety adjustments for all stakeholders. Human factors and redundancy (as seen in clause 7.1.6 regarding organizational knowledge) promote knowledge management and human reliability strategies. In aviation, this could mean mandatory cross-training for military and commercial pilots on shared airspace procedures. AI-assisted decision-making tools that provide secondary verification for pilots and controllers could be a positive outcome of data analysis.

Data drives risk and trends. A digital co-pilot system could use AI to continuously monitor air traffic conflicts and intervene if human errors are detected. Auditing and compliance (as seen in clause 9.2 regarding internal auditing) would provide objective and independent inputs by regular safety audits of flight coordination. Air traffic control systems could ensure compliance with standardized airspace usage protocols, identification of gaps in inter-agency communication, and implementation of best practices from previous incident investigations. A shared civil-military aviation audit framework could ensure uniform compliance with risk management policies, reducing the chance of airspace conflicts.

I am not a technical subject matter expert in the aviation industry. My expertise is in looking at systems. My 30 years of experience suggests the importance of strengthening the Plan stage of the PDCA cycle. Things go wrong at the Do stage (i.e., implementation), however, if the plan itself is deficient and not coordinated, the implementation can and perhaps will go wrong.

By integrating ISO 9001 principles into aviation safety proactively and appreciating the risks, management can prevent mid-air conflicts. Process-driven coordination ensures better civil-military collaboration. Automated monitoring and auditing could improve response times to emerging threats.

Sadly, this tragedy once again bears out the wisdom of W. Edwards Deming when he said that a bad system will beat a good person every time.

Note – The above article was recently featured in Exemplar Global’s publication ‘The Auditor”. Click here to read it.

The Baltimore Bridge Collapse—Another Case of a Failed Management System

By – Dr. IJ Arora

Can good management systems make organizations immune to disasters? The Baltimore bridge (or, more precisely, the Francis Scott Key Bridge) collapsed in 2023 because the container vessel MV Dali collided with it. This was a tragedy, perhaps caused by the failure of several management systems, the ship, the port, the state, and whoever else was involved.

The National Transportation Safety Board (NTSB) investigation is ongoing, and will no doubt look at the part played by MV Dali, its crew, and its operator. However, my thought is that MV Dali or other ships plying the waters should have, by simple statistical probability, been considered as risks by the authorities. Between the water channel, the high number of ships sailing in and out regularly, and the bridge itself, there was likely to be an collision someday. Perhaps it was not a matter of if, but when! Therefore, should the bridge have been better designed and made safer based on these known and appreciated risks? After all, not all accidents can be completely avoided, but each tragedy has lessons learned as responsive action. The lessons become the data that drives risk identification and trends, thus making the system proactive. I am sure the NTSB is considering all this. In the meantime, without going into the ongoing investigation, there would seem to be some basics which are common indications of systemic failures. Be it the Titan submersible, or the Boeing management system,  as a subject-matter experts in  process-based management systems, I see a common cause: the failure of the system to  deliver conforming products and services.

In this short article, I want to discuss this bridge collapse in the context of the management system, considering ISO 9001:2015 generically and the requirements of ISO 55001:2024—“Asset management—Vocabulary, overview and principles” specifically. ISO 55001 was first published in 2014. It was developed as a standalone standard for asset management, building upon the principles of ISO 9001 and other relevant standards.

Could simply designing a good system based on the standard have enabled the organization to better assess the associated risks? Perhaps they were assessed, and a bridge allision was considered an extremely low-probability occurrence. If that were the case, the discussion would be on prioritization of risks.

As of the time of this writing (September 2024), the investigation into the Baltimore bridge collapse is still ongoing, and the lawsuits are starting to fly. Although the exact cause of the collapse remains under investigation, we can consider several factors that might have contributed to the incident. MV Dali experienced a series of electrical blackouts before the allision. The implementation of the vessel’s safety management system (SMS, based on the ISM Code) could be a factor. The stability, age, and condition of the bridge are, I am sure, being investigated as a potential contributing factor. Then, there is always human element. There may have been errors on the part of the ship’s crew or the bridge’s operators. Was the SMS designed to support them in such a scenario? What factors may have caused operators at all levels to perhaps not follow requirements and mitigate the risks? The NTSB’s investigation will highlight a detailed analysis of the ship’s navigation systems, the bridge’s structural integrity, and the actions of the individuals involved in this tragedy. Their final report will provide a comprehensive understanding of the incident and may include recommendations to prevent similar occurrences in the future.

However, even at this stage we can agree that bridges in general are national assets. They are valuable infrastructure that provides essential services to communities. Although it is not publicly known whether the state of Maryland specifically implemented ISO 55001 for its bridges, the principles and practices outlined in this standard could have been beneficial in managing the risks associated with the Baltimore bridge. Through the implementation of this standard (and/or ISO 9001), the authorities could have performed:

  • Risk assessments. ISO 55001 requires organizations to conduct regular risk assessments to identify potential threats and vulnerabilities. A thorough assessment of the bridge’s condition, age, and traffic load could have helped identify potential risks and inform maintenance and repair decisions, as could have changes in procedures, protection of navigation channels, and so on.
  • Lifecycle management. The standard emphasizes the importance of managing assets throughout their entire lifecycle, from planning and acquisition to maintenance and disposal. By following ISO 55001, the state could have developed a comprehensive plan for the bridge’s maintenance, upgrades, and eventual replacement.
  • Performance measurements. ISO 55001 requires organizations to establish measurable objectives or key performance indicators (KPIs) to measure the effectiveness of their asset-management activities. This could have helped the state monitor the bridge’s condition and identify any signs of deterioration.
  • Continual improvement. The standard promotes a culture of continual improvement, encouraging organizations to learn from past experiences and make necessary adjustments to their asset-management practices.

It is impossible to say definitively whether ISO 55001 would have prevented the Baltimore bridge collapse. However, the principles and practices outlined in the standard could have helped to reduce the risk inherent in such incidents. By adopting a systematic and proactive approach to asset management, organizations can improve the reliability and safety of their infrastructure. A systematic study must go beyond what the MV Dali contributed to the Baltimore bridge collapse; it is also important to consider the broader context and the potential contributions of other factors:

  • Bridge design and maintenance. The age and condition of the bridge are likely to be factors in the investigation. Older infrastructure may be more susceptible to damage or failure, especially if it has not been adequately maintained or upgraded.
  • Vessel traffic. The frequency and intensity of vessel traffic in the area can also influence the risk of allisions. The bridge is in a busy shipping channel; therefore, the likelihood of incidents was higher.
  • Safety measures. The presence or absence of safety measures such as buoys, warning systems, or restricted areas can also affect the risk of allisions. This needs to be studied and are factors the authorities would know.
  • Human elements and factors. Errors on the part of both the ship’s crew and bridge operators can contribute to accidents. Factors such as fatigue, inexperience, or inadequate training may play a role. What led to these issues? Error proofing, mistake proofing, and failure mode and effects analysis (FMEA) are tools that could be part of the effective management system.

Let us therefore consider ISO 55001 and the relevant clauses of the standard which could apply to the collapse of the Baltimore bridge.

Clause 4—Context of the organization

  • Clause 4.1—Understanding the external context, such as the age of the bridge, traffic volume, and environmental factors, is crucial for risk assessment.
  • Clause 4.2—Identifying the needs and expectations of relevant interested parties, including the public, commuters, and regulatory bodies, is essential for effective asset management.

Clause 6—Planning

  • Clause 6.2.1—The bridge’s asset management plan should have included clear objectives for its maintenance, repair, and replacement.
  • Clause 6.2.2—Specific objectives related to safety, reliability, and cost-effectiveness should have been established.
  • Clause 6.2.3—Detailed planning for maintenance, inspections, and upgrades would have been necessary to ensure the bridge’s structural integrity.

Clause 7—Support

  • Clause 7.1—Adequate resources, including funding, personnel, and expertise, should have been allocated for bridge maintenance and inspection.
  • Clause 7.2—Ensuring that personnel involved in bridge management have the necessary competence and training is essential.
  • Clause 7.3—Raising awareness among all relevant stakeholders about the importance of bridge maintenance and safety is crucial.

Clause 8—Operation and maintenance

  • Clause 8.1—Regular inspections and monitoring of the bridge’s condition would have helped identify potential problems early on.
  • Clause 8.2—A well-defined maintenance schedule, including preventive and corrective maintenance, would have been necessary to address issues before they escalated.

Clause 9—Performance evaluation

  • Clause 9.1—Establishing KPIs to measure the bridge’s performance, such as safety records, traffic flow, and maintenance costs, would have provided valuable insights.
  • Clause 9.2—Regular monitoring and evaluation of these KPIs would have helped identify areas for improvement.

Clause 10—Improvement

  • Clause 10.2—The bridge’s management should have implemented a system for monitoring and measurement, including data collection and analysis.
  • Clause 10.3—Predictive maintenance techniques could have been used to identify potential failures before they occurred.

My objective in writing this article is help demonstrate that by applying the principles of a standard, be it generic ISO 9001 or a more specific standard (as in this case, the asset-management system standard ISO 55001) the organization (in this case the state of Maryland) could have strengthened its asset-management practices and potentially mitigated the risks associated with the Baltimore bridge collapse.

The above article was recently published in the Exemplar Global publication – ‘The Auditor’.

Looking Ahead at ISO 9001

ISO 9001 has proactively kept up with various industry expectations, over the years, to allow

application by a broad spectrum of industry including the defense forces. The 2015 revision was

a thoughtfully planned giant step. It defined risk (ISO 9001 Clause 6.1) in the context of the

organization (ISO 9001 Clause 4.1 & 4.2) and removed exclusions provision from certification by

redefining what an organization does not do or outsources in the scope (ISO 9001 Clause 4.3). It

also removed preventive action, a reactive concept, and introduced proactive risk appreciation

(Clause 6.1 of ISO 9001 & Clause 8.1 in industry specific standards as AS9100).

This took preventive action from the delayed “Act” stage of the PDCA (Plan-Do-Check-Act) stage

to the more logical sensible “Plan” stage. After all, “look before you leap”, as the historical

fundamental, could not be left as a preventive action decision. It had to be at the look – plan

stage! Risk also needed not just mitigation, but also acted as an input, to be used to bring in

innovation in terms of OFI (opportunity for improvement).

These were all positive steps in keeping with technical advancements and computerization and

AI (artificial intelligence) tools. The HLS (high level structure), later updated to HS (harmonized

structure), recognized the need to enable ease of implementation of integrated management

systems. This in turn leading to efficiency, ROI (return on investment) and where applicable

environmental protection, security of the global supply chain, business continuity, cyber

security and health and safety.

The differentiating of knowledge (ISO 9001 Clause 7.6) from competence (ISO 9001 Clause 7.2)

was also a clever needed change. Organizations needed to define their corporate knowledge

aspects and differentiate it from the individual knowledge of personnel. Knowledge and

competence needed merging and a healthy marriage but needed recognition that they were

different. Removal of the reference to Quality Manager (QM) and Quality Manual from the

standard, took away the narrowness of thinking in quality, and brought the clarity to leadership

to remain accountable and to differentiate authority delegation from retaining the

accountability.

I am a member of the TAG-176 group, and yet have not really contributed much to the next

expected changes to ISO 9001. I am sure the TC-176 is working on this. Nevertheless, it is time

to debate and consider updating the standard.

Since the 2015 version was a major fundamental change, I doubt there would be a significant

departure from this 2015 version in the next major update. Unlikely that the next version may

have revolutionary updates. The emphasis, I think would be to clarify and strengthen the

present thoughts in the 2015 version. I would consider the following:

1. Two Standard Concept: I have over the years thought about the two prongs:

manufacturing and service, approach. Both the service and the manufacturing industry

have been using the standard. Some may consider the need for a separate

manufacturing and a service standard as the next step. However, over the years I have

feared too much bureaucracy which the two standards approach brings. I think the two

standard approaches may actually cause more issues than to resolve them. Might I

opine that Clauses under 8.3 for D&D can, if needed, be strengthened, clarified or more

useful notes as applicable to service version incorporated to assist implementers,

consultants and auditors?

2. Risk be better defined and OFI be clarified, to avoid auditors using it as a tool to sneak in

recommendations. OFI is the outcome of considering risk as an input for innovation. It is

not a recommendation.

3. The knowledge clause needs meat to strengthen it, and to better make it inclusive to

systematizing the requirements for organizations to systematize lessons learnt.

4. An annex added to bring clarity and ease to designing and implementing a combined

management system for an organization.

5. Clause 4.3 Scope, in defining scope requires consideration of the context of the

organization, which is based on Clauses 4.1 and 4.2. However, while the scope has to be

available as documented, 4.1 and 4.2 do not require documentation. I would suggest

both clauses 4.1 & 4.2 to have context as a documented requirement.

In conclusion, I think, updating the standard ground up is not a wise idea at this stage. Perhaps

slight tweaking to include some minor changes would give stability in implementation of an

already robust standard.

P-D-C-A with a Christmas Tree

As a QMII employee, I can sit and observe classes whenever I want, more so since they are virtual instructor led these days. It allows me to get a refresher on the clauses, even though it is so hard to get them. It gets me every time. When the time comes to interview auditees, I smile like a Cheshire cat; not a confident grin but one that hopefully does not betray my nervousness.  Often, I am nervous as a long-tailed cat in a room full of rocking chairs. However, my QMII ISO lead auditor training has prepared me well. I am nervous as the auditee too, even though I know audits are not about pass or fail.  While I call myself a writer and researcher my greatest struggle perhaps lies with Audit Report writing. Oh, man! QMII lead auditor training, however, well prepared me to gather all notes during an audit to present a valuable report to the auditee. Smile.

The aspect of Lead Auditor training I like is the P-D-C-A cycle because I can use that analogy anywhere in my life. I have the responsibility of putting up the tree, however, currently, my application of the P-D-C-A is not going so well. Perhaps a re-plan is needed?

So from the Lead Auditor classes that I have attended, P-D-C-A stands for the following and the task next to it is what I have to do:-

P – Planning: We have to put the tree. Also, the objective of my mission. Considerations include where are the decorations kept, do we have enough, do we need a ladder, what should be the first step, then the next (like testing the lights before we put them on the tree), and more. Most important plan the time to do it in my busy schedule!

D – Do: Now to put my plan into action! Locate the boxes, get them out, unpack, and, get my team to help me even if they don’t want to (just to cheer me on perhaps). Yay! Thanks guys, for your help! Thumbs up for that. Basically, everything else that needs to be completed before the tree is finally up and lit up and everyone is happy. The DO stage can be extremely exhausting. How about that drink to cool me down?

Note – From my Lead Auditor training and also when I am auditing my clients, I know that the ‘DO’ section of the process is where a lot of the “action” happens. Just because “you gotta do it, man, get on with it!” I feel the pain of the “Do’s” as it is easy sometimes to plan but more taxing to put the plan into action. Now getting back to my tree.

C – Check: Once the tree is up and you think the job is over, it is not. You have to wait for the others to “check” the tree out and give their opinions. Pass comments, critique your effort while you are bickering away that they didn’t do anything, but they get to analyze it. What was that? Oh yes, I agree it is just an opportunity for improvement and we love our non-conformities.

A – Act: The verdict is out. The tree looks great. Beautiful decorations. However, the lights seem to flicker at some places, we need better lights for next time. Get more decorations. Good job!

VERDICT

Plan it better next time. Stop bickering when you are doing the job. Be patient and stop being

grumpy when they are “checking” and analyzing your work. Continually Improve this process till you get your Act together – words of a wise Yoda who is enjoying the view of the Christmas tree and listening to the Christmas songs.

Can I get that drink now? Long Island, please. Merry Christmas!

Quality Without Question

 

As I was driving home from work, I noticed the following on the back of a vehicle, “Quality without question”. This got me thinking about the message that was being conveyed. Did the organization mean to convey that their quality was great and should not be questioned? That a customer should take their word just because they say so. For many of us that is exactly what we do when we purchase goods off a grocery shelf. We trust the certified organic and non-GMO ratings that we observe on the packaging. But should one question these and how should an organization decide when to?

To check or not to check

ISO 9001 is an internally accepted standard that sets out the requirements for companies looking to implement a quality management system. While ISO 9001 allows an organization to self-declare many organizations choose to go ahead and pursue certification. This is because it demonstrates to the customer an external independent validation by a subject matter expert of the organization’s ability to manage risks and enhance customer satisfaction.

In many cases though, these companies are often audited by customers especially in highly critical industries where the margin for error is very small. ISO 9001 does not require companies to audit their suppliers but asks organizations to determine the type and extent of control they intend to apply. In determining the type and extent of control, consideration should be given to the perceived effectiveness of controls by the supplier. Essentially can the system controls be trusted to effectively manage risks and deliver? This becomes the basis for the need to check or not.

But we don’t have the resources to audit

This is often the case for many small businesses and perhaps even for some governmental organizations that are limited to one or a few suppliers. In these cases, the organization is still obligated to control the externally supplied process, product, or service. Companies can do this by monitoring metrics such as on-time delivery, sampling incoming items for conformity, and in some cases accepting the external organization certification. No matter the approach used, it does not ever absolve the company of ensuring control of the outsourced process/product/service.

In the case of critical items or a single supplier, they may choose to sample 100% of all items coming in and decide over time based on the results if to continue with a large sample size or to reduce to a smaller one. Here also the aspect of resources plays a part. In cases where the resources cannot be made available, the leadership must acknowledge and accept the risk.

In conclusion

Quality must always be questioned, first internally by the organization itself and checked through its processes. It must also be questioned by the customers on a case-by-case basis. Quality and systems that are left unchecked and unmonitored will over time deteriorate and perhaps result in a major incident/accident. To learn more about the requirements of ISO 9001 join QMII’s next lead auditor training.