Implementing quality

You will need to adhere to all of the clauses in the standard and be able to demonstrate compliance with all of the requirements up to and including internal management systems which can be audited by us as your EI.

You will need the policies, procedures and working instructions in place which are required in ISO9001 and 22301 but you do not necessarily need a fully functional management system. Mandatory requirements of the standard are met.

• Policy: This is a document which states management expectations and intentions. They should be used to direct decisions, ensure consistent and appropriate implementation of procedures, roles and activities.
• Procedure: This is a document which provides a high level summary of how to carry out an activity or process. It includes a specified series of actions or operations which have to be executed in the same manner in order to always obtain the same result under the same circumstances (for example, emergency procedures). Less precisely speaking, this word can indicate a sequence of activities, tasks, steps, decisions, calculations and processes, that when undertaken in the sequence laid down produces the described result, product or outcome.
• Working instruction: This is a document providing detailed instructions that specify exactly what steps you need to follow to carry out an activity. This should contain much more detail than a Procedure and is only created if very detailed instructions are needed.

ISO9001 is a standard related to business management systems which is designed to help organisations meet the needs of customers and other stakeholders as well as meeting statutory and regulatory requirements and encouraging business improvement. The standard is due to be updated by the end of 2015 but there is a draft currently available. The decision whether to align to the 2008 or 2015 version is a matter of personal choice. 

The standard specifies that the organisation shall, as a minimum, create and maintain eight documented procedures:

• Control of Documents
• Control of Records
• Internal Audits
• Control of Non-Conforming Products
• Corrective Action
• Preventive Actions
• Quality Manual
• Quality Policy

ISO27001 is a standard for information security management and details the requirements for a robust information security management system (ISMS). An ISMS is a framework of policies and procedures that includes all legal, physical and technical controls involved in an organisation's information risk management processes. ISO 27001 uses a top-down, risk-based approach and is technology-neutral. The specification defines a six-part planning process:

1. Define a security policy
2. Define the scope of the ISMS
3. Conduct a risk assessment
4. Manage identified risks
5. Select control objectives and controls to be implemented
6. Prepare a statement of applicability

The specification includes details for documentation, management responsibility, internal audits, continual improvement, and corrective and preventive action. The 27001 standard does not mandate specific information security controls, but it does provide a checklist of controls that should be considered in the accompanying code of practice, ISO 27002:2013. This second standard describes a comprehensive set of information security control objectives and a set of generally accepted good practice security controls.

ISO22301 is a standard for managing business continuity in an organisation. The standard specifies requirements to plan, establish, implement, operate, monitor, review, maintain and continually improve a documented management system to protect against, reduce the likelihood of occurrence, prepare for, respond to, and recover from disruptive incidents when they arise. The requirements are generic and intended to be applicable to all organisations regardless of type, size and nature of the organisation. The extent of application of these requirements depends on an organisation's operating environment and complexity.