ISO 9001:2008 Clause 4.1 “Explained”

 In Blog, Old newsletter

ISO 9001:2000 Requirements

4.1 General requirements

The organization shall establish, document, implement and maintain a quality management system and continually improve its effectiveness in accordance with the requirements of this International Standard.
The organization shall

  • a) determine the processes needed for the quality management system and their application throughout the organization (see 1.2),
  • b) determine the sequence and interaction of these processes,
  • c) determine criteria and methods needed to ensure that both the operation and control of these processes are effective,
  • d) ensure the availability of resources and information necessary to support the operation and monitoring of these processes,
  • e) monitor, measure where applicable, and analyse these processes, and
  • f) implement actions necessary to achieve planned results and continual improvement of these processes.
  • These processes shall be managed by the organization in accordance with the requirements of this International Standard.
  • Where an organization chooses to outsource any process that affects product conformity to requirements, the organization shall ensure control over such processes. The type and extent of control to be applied to these outsourced processes shall be defined within the quality management system.

ISO 9001:2008 Intent


Most management system trainers spend little time on this clause during seminar delivery. In my personal experience they spend only an average of 3-5 minutes covering this clause. Clause 4.1 is an umbrella clause that depicts the overall purpose of the QMS in terms of content, structure, interaction amongst various clauses, and the process approach.


ISO 9001:2008 Clause 4.1 “Explained”-Cont’d

The indirect purpose of this clause is to instil in the mind of the user the importance and value of the QMS in running businesses effectively (as well as efficiently, although this is not directly addressed in the Standard). Moreover, the intent of the clause is to create a belief in the mind of the user that an integrated approach of using all clauses of the ISO 9001:2008 to run a business is vital for its survival , prior to putting so much time and effort on individual clauses in a piece meal approach. The majority of trainers either do not emphasize or do not understand the importance of applying a process-management approach combined with risk management to run a practical, commonsense-based, non beaurocratic and value-based management system. Essentially, this clause captures the overall purpose of clauses 4.2 through 8.5 of the Standard.

ISO 9001:2008-Requirements Explained

“Establish” means that the QMS have either formally or informally in place, depending upon the requirements of the Standard or the effectiveness of the system, or the value-added by the QMS, or the risks exposed to the organization by the QMS.
“Document” means the requirements of the Standard to be written. Some of the requirements to be written include: procedures for control of documents, control of records, internal audit, control of non-conforming products, corrective and preventive action. Other documents include the quality policy, quality objectives and quality manual. The documents described in the preceding sentences only cover up to 10% of the documentation requirements. The remaining trick or value is in the soul-searching of the documents that contribute (add’ teeth’ to the existence of the QMS) to the effectiveness of the QMS as required in clause 4.2.1 d of the Standard. This documentation is required in clause 4.2.3 d and could cover up to 60-70 % of the required documentation. Some of the consultants who do not understand clause 4.2.3 d mislead their clients into preparing bare bone documentation to entice them into a contract obligation by watering down the initial costs of the QMS development to absolute minimum. This ” cutting corners” approach, combined with an absence of value in this type of QMS, comes back to haunt the client during the first 2-3 years when the senor management begins to question the payback of the QMS. Some of the key management -related processes must be documented based upon their impact on the business otherwise all the work done at the working level may not be supported or validated in a rational and real objective manner, thus depriving the organization of the real purpose behind the QMS

ISO 9001:2008 Clause 4.1 “Explained”-Cont’d

On the contrary, quality professionals from the old school would like to document every formal/informal practice without questioning its need, value, risk and associated cost of documentation. These professionals drive the size of documentation to the extent that they turn off the senior managers to the point that the managers never ever build any faith or trust in the ability of the QMS to enable them to run the business that is preferred by a modern, progressive organization.
So the trick is to draw a common sense balance between “cutting corners” and “massive documentation empire building” approaches so that your organization gets the biggest bang for its buck while ensuring that its rear end is covered with a due-diligent strategy.

“Implement” means that everyone in the organization, depending upon their role and impact on the QMS, must walk the talk in accordance with the previously established QMS. This entails awareness of
which processes exist within their role, which processes are critical for value-added, and how do you demonstrate that you are doing what is required from your role by the QMS. Typically all the efforts for implementation are focussed at the working level while not enough effort are directed at the management level. The management must understand the impact of their decision-making on the overall success or failure of the QMS and its value to the business.

“Maintain” means that the QMS remains current in light of a “management of change” process. The list of changes could include product statutory/regulatory requirements, customer perception changes, business environment changes, internal process modifications resulting from infrastructure and work environment changes, organizational streamlining/reengineering, mergers/takeovers, manpower downsizing, and management realignment, etc.

“Continually improve the effectiveness”
 means that the organization will make progressive and incremental improvements in the overall effectiveness of the QMS that may include customer processes, product realization processes, management processes, resource management processes, supply-chain processes, measurement and monitoring processes, and outsourced processes. The improvement does not have to be around-the-clock but must take the organization in a positive direction. The positive direction could be along the lines of product/service cost reduction, cycle time optimization, elimination of non-value added processes, product yield increase and suppler-related cost production.

ISO 9001:2008 Clause 4.1 “Explained”-Cont’d

“Identify the processes …… and their application throughout…….” means that the processes within the organization be identified not in a haphazard or ‘gut-feeling’ manner but along the workflow lines. The processes identified must cover the whole organization and not just critical areas. The processes for a quality management system should not only include typical manufacturing/service, maintenance, design, purchasing and testing/inspection processes but must also include marketing, research/development, legal, accounting and strategic processes depending upon their impact on the QMS and the business. The bottom line being that at the end of the day all facets of the business must be looked at to identify the processes that could one way or other affect the QMS. This requirement echoes the fundamental principle of the process approach behind the Standard.

“Determine the sequence and interaction of …………” means that the flow of the processes must be established from the moment the phone rings requesting a product or service until the time customer satisfaction has been achieved and sustained. More importantly, the interfaces between individual processes must be identified, well-defined and managed to ensure continuity and integrity of the overall process. The process interfaces or interaction occurs when tasks are handed over from one responsibility to another or from one functional unit to another. Overall process optimization is not achievable until each and every process, as well as the interface optimization, is under control. The preferred way of establishing the sequence and interaction of the process is through the use of basic flow charts, functional flow charts and process maps. This requirement echoes the fundamental principle of the process approach behind the Standard. Most organizations end up putting a basic picture of a PDCA model in their QMS rather than applying the concept of a PDCA model to their own specific and customized organization processes.

“Determine the criteria and methods to ensure the operation and control of processes …..”
means that for previously identified processes, it must be determined how to make these process function and to establish the checks/balances within the processes to ensure their effective functioning. The satisfactory functioning of the processes would require formal/informal procedures/work instructions to be determined and established. Moreover, the criteria for checks/balances within processes must be specifically defined. This criterion could include customer requirements, statutory/regulatory requirements, and company specifications. The specific criteria definitely leads to sound implementation of required checks/balances, thereby resulting in process integrity, effectiveness and stable control. This requirement provides a high level version of clause 7 and partially clause 8 of the Standard.

ISO 9001:2008 Clause 4.1 “Explained”-Cont’d

“Ensure the availability of resources and information necessary to support ….” means that resources such as competent human and adequate infrastructure are available to support the overall needs of the processes. In addition, the information such as data and documentation are also available to support the processes and its associated tracking. These requirements capture the overall intent of clause 6 and partially clause 8. The information management consists of organizing and presenting the document/data in a manner that is user-friendly, practical, value-adding, and covers both the QMS technical and administrative information necessary to support a successful, progressive, competitive and sustainable organization. Very few companies get it “right” in terms of appropriately managing the technical (documentation, I/T technology and data) and administrative (interfaces and follow-ups)
information simultaneously, with the end result being a management system with numerous loose ends and lacking a timely response to organizational needs.

“Monitor, measure and analyse these processes ……..” 
requires monitoring of the processes so that a “warm and fuzzy” feeling that the processes are under control develops. Monitoring is subjective and does not provide assurance of satisfactory process control whereas the measurement of the processes could be extremely beneficial and include qualitative and quantitative data. The nature of data could be continuous (variable) and discrete (attribute) data. Measurement scales could include nominal, ordinal, interval and ratio depending upon the nature of the operations. Some of the measurement indicators could include process capability indices and process capability performance indices. A large majority of organizations rely only on qualitative data and not quantitative data. Out of the ones which track quantitative data, the concepts of the nature of data and its application are not well understood. The end result is that numerous companies collect a great deal of data which mostly dies on the collection table without being utilized for further analysis and hence not enabling the organizations to move forward in a positive direction. The tools for analysis of data are least understood and utilized. Some of these analysis tools include: Variables Measuring & Modeling Relationship, Hypothesis Testing, Failure Mode Effects Analysis, Root Cause Analysis, Cause and Effect Diagram, Pareto Charts, and Fault Tree Analysis. Few organizations retain specialized competence to determine appropriate data analysis tools based upon the nature of data collected or to be collected. Unfortunately a lack of this type of expertise deprives organizations of dissecting their business delivery in a challenging and authentic manner. The lack of authenticity of business delivery results drive the management ‘crazy’, thereby losing management’s confidence in the ability of the management system and tempting them to pursue a piece meal approach.

ISO 9001:2008 Clause 4.1 “Explained”-Cont’d

“Implement actions necessary to achieve planned results …..” means put actions in place that are necessary to accomplish the planned results such as business drivers, quality objectives, and key performance indicators. The actions could include execution of processes, monitoring/measuring of processes, employee training/awareness, equipment upgrade, etc.

“Where an organization chooses ……..”
 means when the processes that could influence the conformity with customer and statutory/regulatory requirements are outsourced to another party, the organization shall implement some type of control over the outsourced processes. These controls could vary depending upon the nature of outsourced processes and their impact on customer/statutory requirements. The type of controls could extend from pre-qualifying the sub-contractors to establishing a contract, source surveillance, as well as through statistical management.

Recent Posts
Contact Us

We're not around right now. But you can send us an email and we'll get back to you, asap.

Not readable? Change text.