HSB REGISTRATION SERVICES ISO 9001:2000 AUDIT CHECKLIST

Transcription

1 HSB REGISTRATION SERVICES ISO 9001:2000 AUDIT CHECKLIST COMPANY NAME: AUDIT LOCATION: AUDIT DATE(S): EAC CODE: AUDIT SCOPE: Exclusions / Notes: AUDIT TEAM INFORMATION: Lead Auditor: Auditor(s): ISO FO 22yk QMS = Quality Management System This document may not be reproduced or distributed without the written permission of.

2 Page 2 of 22 SECTION 4 QUALITY MANAGEMENT SYSTEMS KEY POINTS DOCUMENT REFERENCE IN USE EFFECTIV E RECORDS, EVIDENCE, AUDIT TRAILS, NOTES. 4.1 General requirements Has the organization established, documented, implemented and maintained a QMS and continually improved its effectiveness in accordance with ISO 9001:2000? Has the organization? a) identified the processes needed for the QMS and their application throughout the organization, b) determined the sequence and interaction of these processes, c) determined criteria and methods needed to ensure that both the operation and control of these processes are effective, d) ensured the availability of resources and information necessary to support the operation and monitoring of these processes, e) monitored, measured and analyzed these processes, and f) implemented actions necessary to achieve planned results and continual improvement of these processes Are these processes managed by the organization in accordance with ISO 9001:2000? Where an organization has chosen to outsource any processes that could affect product conformity with requirements, they have ensured control over such processes (identified within the QMS)? Note: Processes needed for the QMS referred should include processes for management activities, provision of resources, product realization and measurement.

3 Page 3 of Documentation Requirements General Does the QMS documentation include: a) documented statements of a quality policy and quality objectives, b) a quality manual, c) documented procedures required by ISO 9001: 2000 d) documents needed by the organization to ensure the effective planning, operation and control of its processes, and e) records required by ISO 9001:2000 ( see 4.2.4) Note 1: Where the term "documented procedure" appears within ISO 9001:2000, this means that the procedure is established, documented, implemented and maintained. Note 3: The documentation can be in any form or type of medium. Note 2: The extent of the QMS documentation can differ from one organization to another due to a) the size of the organization, b) the complexity of processes and their interactions, and c) the competence of personnel

4 Page 4 of Quality manual Has the organization established and maintained a quality manual that includes a) the scope of the QMS, including details of and justification for any exclusions (see 1.2). b) the documented procedures established for the QMS, or reference to them, and a description of the interaction between the processes of the QMS

5 Page 5 of Control of Documents Are documents required by the QMS controlled? Are records (special type of document) controlled according to requirements given in 4.2.4? Documented procedure required (to define a-g) Is there a documented procedure established to define the controls needed a) to approve documents for adequacy prior to issue, b) to review and update as necessary and re-approve documents, c) to ensure that changes and the current revision status of documents are identified, d) to ensure that relevant versions of applicable documents are available at points of use, e) to ensure that documents remain legible and readily identifiable, f) to ensure that documents of external origin are identified and their distribution controlled, and g) to prevent the unintended use of obsolete documents, and to apply suitable identification to them if they are retained for any purpose

6 Page 6 of Control of Records Are records established and maintained to provide evidence of conformity to requirements and of the effective operation of the QMS? Procedure required (control of records) Are records legible, readily identifiable and retrievable? Has a documented procedure been established to define controls needed for the identification, storage, protection, retrieval, retention time and disposition of records? SECTION 5 MANAGEMENT RESPONSIBILITY DOCUMENT IN USE EFFECTIVE Records, Evidence, Key points 5.1 Management Commitment Does top management provide evidence of its commitment to the development and implementation of the QMS and the continual improvement of its effectiveness by a) communicating to the organization the importance of meeting customer as well as regulatory and statutory requirements, b) establishing the quality policy; c) ensuring the quality objectives are established, d) conducting management reviews, and e) ensuring the availability of resources? REFERENCE Audit Trails, Notes -Written policy -Written policy -Business plan -Minutes of reviews -Training/Business plan 5.2 Customer Focus Does top management ensure that customer requirements are determined and are met with the aim of achieving customer satisfaction? -Contract review -Customer-related Processes (see and 8.2.1) 5.3 Quality Policy Does top management ensure that the quality policy a) is appropriate to the purpose of the organization, b) includes a commitment to comply with requirements and -Management review -Goals

7 Page 7 of 22 continually improve the effectiveness of the QMS, c) provides a framework for establishing and reviewing quality objectives, d) is communicated and understood within the organization, and e) is reviewed for continuing suitability? 5.4 Planning Quality Objectives Does top management ensure that quality objectives, including those needed to meet requirements for product, are established at relevant functions and levels within the organization? -Continual Improvement -Management review -Management review -Cont. Improvement Are the quality objectives measurable and consistent with the quality policy? Quality Management System Planning Does top management ensure that: a) the planning of the QMS is carried out in order to meet the requirements given in 4.1, as well as the quality objectives? and b) the integrity of the QMS is maintained when changes to the QMS are planned and implemented? 5.5 Responsibility, Authority & Communication Responsibility & Authority Does top management ensure that the responsibilities and authorities are defined and communicated within the organization? Management Representative Has top management appointed a member of management who, irrespective of other responsibilities, has responsibility and authority that includes a) Ensuring that processes needed for the QMS are established, implemented and maintained? b) Reporting to top management on the performance of the QMS and any need for improvement? c) Ensuring the promotion of awareness of customer requirements throughout the organization Internal Communication Does top management ensure that appropriate communication channels are established within the organization and that communication takes place regarding the effectiveness of the QMS? 5.6 Management Review General Has top management reviewed the QMS, at planned intervals, to ensure its continuing suitability, adequacy, and effectiveness? -Records of reviews -Trend charts -Management review records. -Internal Audit reports - Organizational Chart - Top Management written statement of appointment for management rep. - Analysis of data - Quality organizational chart. - Records of QMS effectiveness review Record required (management reviews)

8 Page 8 of 22 Does the review include assessing opportunities for improvement and the need for changes to the QMS, including the quality policy and quality objectives? Are records from management reviews maintained? Review Input Do management reviews contain inputs including the following a) results of audits, b) customer feedback, c) process performance and product conformances d) status of preventive and corrective actions, e) follow-up actions from previous management reviews f) changes that could affect the QMS, and g) recommendations for improvement. - review agenda / minutes. - Summary report of audits or logs. - Surveys, complaints - Metrics, tracking. - CA/PA logs - Action item logs Review Output Does the output from the management review include decisions and actions related to a) improvement of the effectiveness of the QMS and its processes, b) improvement of product related to customer requirements, and c) resource needs - Mngt. review minutes - Metrics - Customer Feedback - Training Plans,budget,etc SECTION 6 RESOURCE MANAGEMENT KEY POINTS DOCUMENT REFERENCE IN USE EFFECTIV E RECORDS, EVIDENCE, AUDIT RAILS, NOTES

9 Page 9 of Provision of Resources Has the organization determined and provided the resources needed a) to implement and maintain the QMS and continually improve its effectiveness, and b) to enhance customer satisfaction by meeting customer requirements? N/A -Review QMS against specified reqt's. -Review job descriptions against responsibilities. 6.2 Human Resources General Are personnel performing work affecting product quality competent on the basis of appropriate education, training, skills, and experience? Competence, awareness & training Has the organization a) determined the necessary competence for personnel performing work affecting product quality, b) provided training or taken other means to satisfy these needs, c) evaluated the effectiveness of the actions taken, d) ensured that its personnel are aware of the relevance and importance of their activities and how they contribute to the achievement of the quality objectives, and e) maintained appropriate records of education, training, skills, and experience. 6.3 Infrastructure Has the organization identified, provided, and maintained the infrastructure needed to achieve the conforming product? This shall include a) buildings, workspace and associated utilities, b) process equipment (both hardware and software), and c) supporting services (such as transport, communication). 6.4 Work Environment Has the organization identified and managed the work environment needed to achieve conformity to product requirements? ***Identified in QSM/procedure and addressed in Management Review meetings See *** above

10 Page 10 of 22 SECTION 7 PRODUCT REALIZATION KEY POINTS 7.1 Planning of Product Realization Has the organization planned and developed the processes needed for product realization? Is planning of the product realization consistent with the requirements of the other processes of the QMS? DOCUMENT REFERENCE IN USE EFECTIVE REQUIRED RECORDS In planning the product realization processes, does the organization determine the following, as appropriate a) quality objectives and requirements for the product, b) the need to establish processes, documents, and provide resources specific to the product, c) required verification, validation, monitoring, inspection and test activities specific to the product, and the criteria for product acceptance, and d) records needed to provide evidence that the realization processes and resulting product meets requirements (see 4.2.4). Is the output of this planning in a form suitable for the organization s methods of operations? Record required 7.1.d:Evidence that realization processes and resulting product fulfill requirements) 7.2 Customer-Related Processes Determination of Requirements Relating to the Product Has the organization determined: a) requirements specified by the customer, including the requirements for delivery and post delivery activities; b) requirements not stated by the customer but necessary for specified or known intended use, where known; c) statutory and regulatory requirements related to the product; d) any additional requirements determined by the organization Review of Requirements Relating to the Product Does the organization review the requirements related to the product? Is the review conducted prior to the organization's commitment to supply a product to the customer (e.g., submission of tenders, acceptance of con tracts or orders, acceptance of changes to contracts or orders) and ensures that: Record required (Results of the review of requirements relating to the product and actions arising from the review)

11 Page 11 of 22 a) product requirements are defined; b) contract or order requirements differing from those previously expressed are resolved; c) the organization has the ability to meet defined requirements? Are records of the results of the review and actions arising from the review maintained (See 4.2.4)? Where the customer provides no documented statement of requirement, are the customer requirements confirmed by the organization before acceptance? Where product requirements are changed, does the organization ensure that relevant documents are amended and that relevant personnel are made aware of the changed requirements? Customer Communication Has the organization determined and implemented effective arrangements for communicating with customers in relation to: a) Product information; b) Inquiries, contracts or order handling, including amendments, and c) Customer feedback, including customer complaints.

12 Page 12 of Design and Development Design and Development Planning Does the organization plan and control design and development of the product? During the design and development planning does the organization determine: a) the stages of design and development b) the review, verification and validation activities appropriate to each design and development stage c) the responsibilities and authorities for design and development - Project schedule - Project records - Org. Chart - Meeting minutes Does the organization manage the interfaces between different groups involved in design and development process to ensure effective communication and clear assignment of responsibility? Is planning output updated, as appropriate, as the design and development progresses? Design and Development Inputs Are records of inputs relating to product requirements determined and maintained (See 4.2.4). Do these inputs include: a) Functional and performance requirements b) Applicable statutory and regulatory requirements c) where applicable, information derived from previous similar designs, and d) other requirements essential for design and development Are the inputs reviewed for adequacy? Are the requirements complete, unambiguous and not in conflict with each other? Design and Development Outputs Are outputs of the design and development provided in a form that enables verification against the design and development inputs and are approved prior to release? Does design and development outputs a) meet the design and development input requirements, b) provide appropriate information for purchasing, production and service provision, c) contain or reference product acceptance criteria, and d) specify the characteristics of the product that are essential for its safe and proper use. Record required: (Design and development inputs) -Project acceptance checklist. -Meeting minutes -Project checklist -Customer input - Project Mgr. notes - Input / Output notes - Purchase orders - Production and service records - Specifications

13 Page 13 of Design and Development Review Are systematic reviews of design and development conducted at suitable stages in accordance with planned arrangements a) to evaluate the ability of the results of design and development to meet requirements, and b) to identify any problems and propose required actions; Do the participants in such reviews include representatives of functions concerned with the design and development stage(s) being reviewed? Are the records of the results of the reviews and any necessary actions maintained? (See 4.2.4) Design and Development Verification Is verification performed in accordance with planned arrangements to ensure that the design and development outputs have met the design and development inputs requirements? Are records of the results of the verification and any necessary actions maintained? (See 4.2.4)? Design and Development Validation Is design and development validation performed in accordance with planned arrangements (see 7.3.1) to ensure that the resulting product is capable of meeting the requirements for the specified application or intended use? Where practical, has validation been completed prior to the delivery or implementation of the product? Record required (Results of design and development reviews and any necessary actions) - Project files - Meeting minutes - N/C Records required (results of design and development verification and necessary actions) - checklist Records required (results of design and development validation and necessary actions) - Are records of the results of validation and any necessary actions maintained? (See 4.2.4) Control of Design and Development Changes Are design and development changes identified and records maintained? Are changes reviewed, verified and validated, as appropriate, and approved before implementation? Do the review of design and development changes include evaluation of the effect of the changes on constituent parts and product already delivered? Are records of the results of the review of changes and any required actions maintained (See 4.2.4)? Records required (records of the review of design and development changes and any necessary actions)

14 Page 14 of Purchasing Purchasing Process Has the organization ensured that the purchase product conforms to specified requirements? Is the type and extent of control applied to the supplier and the type and extent of control of purchased product dependent upon the effect of the purchased product on subsequent product realization or the final product? Records required (Results of supplier evaluations and actions arising from the evaluations) Has the organization evaluated and selected suppliers based on their ability to supply product in accordance with the organizations requirements? Has criteria for selection and evaluation and re-evaluation been established? Are the records of the results of evaluations and any necessary actions arising from the evaluation maintained (See 4.2.4)? Purchasing Information Does purchasing information describe the product to be purchased, including where appropriate a) requirements for approval of product, procedures, processes, equipment, b) requirements for qualifications of personnel, and c) quality management system requirements. - Purchasing documents - Specifications - Supplier Evaluations Does the organization ensure the adequacy of specified purchase requirements prior to their communication to the supplier? Verification of Purchased Product - The organization shall establish and implement the inspection or other activities necessary for ensuring that the purchased product meets specified purchase requirements. Where the organization or its customer intends to perform verification at the supplier s premises, the organization shall state the intended verification arrangements and method of product

15 Page 15 of 22 release in the purchasing information. 7.5 Production and Service Provision 7.5.1Control of Production and Service Provision Does the organization plan and carry out the production and service provision under controlled conditions including, as applicable a) the availability of information that describes the characteristics of the product, b) the availability of work instructions, as necessary, c) the use of suitable equipment, d) the availability and use of monitoring and measuring devices, e) the implementation of monitoring and measurement, and f) the implementation of release, delivery and post-delivery activities Validation of Processes for Production and Service Provision Has the organization validated any processes for production and service operation where the resulting output cannot be verified by subsequent monitoring or measurement? This includes any processes where deficiencies become apparent only after the product is in use or the service has been delivered. Has the validation demonstrated the ability of the processes to achieve planned results? Has the organization established arrangements for these processes that include the following, as applicable: a) defined criteria for review and approval of the process, b) approval of equipment and qualification of personnel, c) use of specific methods and procedures, d) requirements for records (see 4.2.4), and e) re-validation. - Checklist - Routings - Work Orders Records required d (as required by the organization to demonstrate the validation of processes where the resulting output cannot be verified by subsequent monitoring or measurement) - Process and Personnel Qualification records Identification and Traceability Record required (The unique

16 Page 16 of 22 Where appropriate, has the organization identified the product by suitable means throughout product realization? Does the organization identify the status of the product with respect to monitoring and measurement requirements? Where traceability is a requirement, does the organization control and record the unique identification of the product (see 4,2.4)? (The unique identification of the product, where traceability is required) - part numbers - final product marks - product certification Customer Property Does the organization exercise care with customer property (including intellectual property) while it is under the organization s control or being used by the organization? Has the organization identified, verified, protected and safeguarded customer property provided for use or incorporation into the product? If any customer property is lost, damaged or otherwise found to be unsuitable for use, is it reported to the customer, and are records maintained? (See 4.2.4) Preservation of Product Has the organization preserved conformity of product during internal processing and delivery to the intended destination including identification, handling, packaging, storage and protection? Does preservation also apply to constituent parts of a product? Record required (Customer owned property that is lost, damaged or otherwise found to be unsuitable for use) - specific customer ordered items - Rcv./ Storage areas - NC reports - Inventory/segregation records - Inside/outside storage areas - Shelf life - Stock rotation - Handling equipment - Housekeeping - Shipping / labeling

17 Page 17 of Control of Monitoring & Measuring Devices Has the organization determined the monitoring and measurements to be undertaken and the monitoring and measuring devices needed to provide evidence of conformity of product to determined requirements? Has the organization established processes to ensure that monitoring and measurement can be carried out and are carried out in a manner that is consistent with the monitoring and measurement requirements? Where necessary to ensure valid results, is measuring equipment a) calibrated or verified at specified intervals or prior to use, against measurement standards traceable to international or national standards; where no such standards exist, has the basis used for calibration or verification has been recorded, b) adjusted or re-adjusted as necessary c) has been identified to enable calibration status to be determined, d) has been safeguarded from adjustments that would invalidate the measurement result, and e) has been protected from damage and deterioration during handling, maintenance and storage In addition, has the organization assessed and recorded the validity of previous measuring results when the device is found not to conform to requirements? Has the organization taken appropriate action on the equipment and any product affected? Have the records of the results of calibration and verification been maintained? Record required a (Standards used for calibration or verification of measuring equipment where no international or national measurement standards exist) 7.6 (Validity of previous test results when measuring equipment is found not to conform with its requirements) 7.6 (results of calibration and verification of measuring equip note: see ISO and ISO for guidance. - SC approvals - Trained staff - NC / defects - Cal/ frequencies

18 Page 18 of 22 When the organization uses computer software for monitoring and measuring of specified requirements, has the computer software been confirmed to satisfy the intended application prior to initial use and reconfirmed as necessary? - Std. Referenced on reports - EC changes SECTION 8 MEASUREMENT, ANALYSIS AND IMPROVEMENT KEY POINTS DOCUMENT REFERENCE IN USE EFFEC TIVE REQUIRED RECORDS 8.1 General Has the organization planned and implemented monitoring, measurement, analysis, and improvement processes (including determination of applicable methods, including statistical techniques, and the extent of their use) needed a) to demonstrate conformity of the product, b) to assure conformity of the QMS, and - insp./ test records - I. Audit records - CA records - Mngt. review records c) to achieve improvement of the effectiveness of the QMS? 8.2 Monitoring and Measurement Customer Satisfaction Does the organization monitor information on customer perception as to whether the organization has met customer requirements as one of the measures of performance of the QMS (including the determination of methods for obtaining and using this information)? - Customer complaints - Cust. Satisfaction reports - Service / warranty records Internal Audit Does the organization conduct internal audits at planned intervals to determine whether the QMS a) conforms to the planned arrangements (see 7.1) to the requirements of the ISO 9001: 2000 and to the QMS requirements established by the organization Record required (Internal Audit results) Procedure required (Internal Audit

19 Page 19 of 22 b) is effectively implemented and maintained? Has the organization planned the audit program taking into consideration the status and importance of the processes and areas to be audited, as well as the results of previous audits? Have the criteria, scope, frequency and methods been defined? Does the selection of auditors and conduct of audits ensure objectivity and impartiality of the audit process (auditors shall not audit their own work)? Is there a documented procedure that includes the responsibilities and requirements for planning, conducting, and reporting and maintaining results of audits? Does management responsible for the area being audited ensure timely actions are taken to eliminate detected nonconformities and their causes? Do follow-up activities include the verification of the actions taken and the reporting of verification results (see 8.5.2) Monitoring and Measurement of Processes Does the organization apply suitable methods for monitoring and, where applicable, measurement of the QMS processes? Do these methods demonstrate the ability of the processes to achieve planned results? (Internal Audit responsibilities and requirements) - schedule - audit reports - verif. Of C/A Note: see ISO ISO and ISO for guidance - See (e) - Process Routers and Checklists - Process Statistics Where planned results are not achieved are correction and corrective action taken, as appropriate, to ensure conformity of the product? Monitoring and Measurement of Product Does the organization monitor and measure the characteristics of the product to verify that product requirements have been met? Is this carried out at appropriate stages of the product realization process in accordance with planned arrangements? Is evidence of conformity with the acceptance criteria maintained and do the records indicate the person(s) authorizing release of the product (see 4.2.4)? Is product release and service delivery held until all planned arrangement are satisfactorily completed, unless otherwise approved by a relevant authority, and where applicable by the customer? 8.3 Control of Nonconforming Product Does the organization ensure that product which does not conform to product requirements is identified and controlled to Record required (Evidence of product conformity with the acceptance criteria and indication of the authority responsible for the release of the product). - Receiving records - In Process records - Process Statistics Record required (Nature of the product

20 Page 20 of 22 prevent unintended use or delivery? Are the controls and related responsibilities and authorities for dealing with nonconforming product defined in a documented procedure? Does the organization deal with the nonconforming product by one or more of the following ways? a) by taking action to eliminate the detected nonconformity b) by authorizing its use, release or acceptance under concession by relevant authority, and where applicable, by the customer c) by taking action to preclude its original intended use or application? Is the nature of the nonconformity and any subsequent actions taken including concessions obtained recorded and maintained? (see 4.2.4)? product nonconformities and any subsequent actions taken, including concessions obtained) Procedure required (Control of nonconformity). - N/C reports After correction, is the product subject to re-verification to demonstrate conformity to the requirements? When nonconforming product is detected after delivery or use has started, has the organization take action appropriate to the effects, or potential effects of the nonconformity? 8.4 Analysis of Data Does the organization determine, collect and analyze appropriate data to demonstrate the suitability and effectiveness of the QMS and to evaluate where continual improvement of the effectiveness of the QMS can be made? Does this include data generated as a result of monitoring and measurement and from other relevant sources? Does the organization analyze data to provide information relating to a) customer satisfaction (see 8.2.1), b) conformity to product requirements (see 7.2.1), c) characteristics and trends of processes and products including opportunities for preventive action, and suppliers? - Warranty reports - Reject/ Scrap rates - Repair activities - Customer input and feedback - Process/Product N/C - Supplier N/C - CA / PA actions

21 Page 21 of Improvement 8.5.1Continual improvement Does the organization continually improvement the effectiveness of the QMS through the use of the quality policy, quality objectives, audit results, analysis of data, corrective and preventive actions and management review? Corrective Action Does the organization take action to eliminate the cause of nonconformities in order to prevent recurrence? Are the corrective actions appropriate to the effects of the nonconformities encountered? Is there a the documented procedure established to define requirements for a) Reviewing nonconformities (including customers complaints), b) determining causes of nonconformities, c) evaluating the need for action to ensure that nonconformities do not recur, d) determining and implementing the corrective action needed, e) records of the results of actions taken (see 4.2.4), and reviewing of corrective action taken. - Mngt. review - I. Audits - CA/ PA reports - Process/Program improvements Record required (Results of corrective action) Procedure required ( Corrective action) - Customer complaints - Cust. Dissatisfaction - NCR evaluation - Mngt. review - Review of past CA/PA records Preventive Action Does the organization determine action (appropriate to the effect of the potential problems) to eliminate the causes of potential nonconformities in order to prevent their occurrence? Does the documented procedure for preventive action define/establish requirements for a) determining potential nonconformities and their causes, b) evaluating the need for action to prevent occurrence of nonconformities, c) determining and implementing action needed, d) records of results of action taken (see 4.2.4), and e) reviewing of preventive action taken? Record required (results of preventive action) Procedure required (Preventive action) - Process/Program evaluations for improvement, actions taken, Mngt. review (past/present).

22 Page 22 of 22 SECTION 9 USE OF THE REGISTRATION MARK KEY POINTS QUALITY MANUAL / PROCEDURES REFERENCE IN USE EFFECTIVE 9.1 The supplier has physical control of the Certificate of Registration and has designated responsibility for the control of the application and its reproduction. 9.2 The Certificate of Registration and Mark are only referenced in a professional, technical, trade or other business publications and announcements that accurately represent the supplier s Scope of Registration in such a way that does not imply product endorsement based upon registration by HSB. 9.3 The Registration Mark is not displayed on any product, product certifications, product labels, containers, or packaging. 9.4 If the accreditation body s mark is used, the supplier makes it clear that the accreditation mark signifies HSB-RS s accreditation, not the supplier s.