Section 2.2: Planning and Support (Clauses 6 and 7)

Section 2.2: Planning and Support (Clauses 6 and 7)

Clause 6: Planning

Clause 6 focuses on proactive risk management, objective setting, and change control. It bridges the organizational context identified in Clause 4 with the operational processes detailed in Clause 8.

Clause 6.1: Actions to Address Risks and Opportunities

ISO 9001:2015 replaced the concept of 'preventive action' (found in older versions) with 'risk-based thinking.' The organization must determine the risks and opportunities that need to be addressed to give assurance that the QMS can achieve its intended results, enhance desirable effects, prevent or reduce undesired effects, and achieve improvement.

Auditor Focus: Auditors must understand that ISO 9001 does not mandate a formal risk management standard (such as ISO 31000) or require a documented risk register. However, the organization must show evidence of identifying risks and planning actions to address them. These actions must be proportionate to the potential impact on the conformity of products and services. The auditor will search for evidence that the organization does not just identify risks, but actually integrates the planned actions into its daily processes and evaluates their effectiveness (linked to Clauses 9.1.3 and 9.3).

Auditor Verification: Look for evidence of risk evaluation methods (e.g., Failure Mode and Effects Analysis - FMEA, risk registers, SWOT actions, or business continuity plans). The auditor must verify that these actions are integrated into QMS processes and that their effectiveness is evaluated.

Clause 6.2: Quality Objectives and Planning to Achieve Them

Quality objectives must be established at relevant functions, levels, and processes. They must:

• Be consistent with the Quality Policy (Clause 5.2).
• Be measurable and take into account applicable requirements.
• Be monitored, communicated, and updated as appropriate.
• Be maintained as documented information.

Planning to Achieve Objectives: The standard is highly specific here. The organization must plan what will be done, what resources will be required, who will be responsible, when it will be completed, and how the results will be evaluated.

Auditor Verification: An objective such as 'improve quality' is a nonconformity because it is not measurable. The auditor should verify that objectives are quantitative (e.g., 'reduce customer complaints by 15% by Q4') and check the action plans, resource allocation, and progress tracking records. There must be a clear alignment between the Quality Policy commitments (e.g., customer satisfaction, compliance) and the specific, measurable objectives.

Clause 6.3: Planning of Changes

When changes to the QMS are necessary, they must be carried out in a planned and systematic manner. The auditor must verify that the organization considers the purpose of the change, potential consequences, QMS integrity, resource availability, and role allocation.

---

Clause 7: Support

Clause 7 addresses the resources, competence, awareness, communication, and documented information required to execute the QMS successfully.

Clause 7.1: Resources

The organization must determine and provide the resources needed for the QMS.

• 7.1.3 Infrastructure: Buildings, utilities, equipment (hardware/software), transportation, and communication systems.
• 7.1.4 Environment for the Operation of Processes: Social, psychological, and physical factors (e.g., temperature, humidity, lighting, noise, cleanrooms).
• 7.1.5 Monitoring and Measuring Resources: When measurement traceability is a requirement, measuring equipment must be calibrated or verified at specified intervals (or prior to use) against national/international measurement standards.
  • Critical Lead Auditor Note: If calibration certificates are expired, or if equipment lacks identification status (e.g., a 'calibration due' label), a nonconformity must be issued. If an instrument is found out-of-calibration, the organization must assess the validity of previous measurement results.
• 7.1.6 Organizational Knowledge: The organization must determine the knowledge necessary for its processes and to achieve product conformity. This includes knowledge gained from experience, lessons learned, and benchmarking.

Clause 7.2: Competence

The organization must determine the necessary competence of persons doing work under its control that affects quality performance. They must ensure these persons are competent based on appropriate education, training, or experience. Additionally, the organization must take actions (such as training or mentoring) to acquire the necessary competence, and evaluate the effectiveness of these actions. Documented evidence of competence must be retained.

Auditor Verification: The auditor selects a sample of personnel (e.g., new hires, machinery operators, internal auditors) and requests their job descriptions, training needs assessments, training records, and evidence that the training was evaluated for effectiveness. A training attendance sheet alone does not prove competence or effectiveness.

Clause 7.3: Awareness

Personnel must be aware of the Quality Policy, relevant quality objectives, their contribution to QMS effectiveness, and the implications of nonconformity.

Auditor Verification: The auditor verifies awareness during shop-floor interviews by asking staff how their work affects customer satisfaction. The focus is on whether staff understand the direct connection between their day-to-day duties and quality outcomes.

Clause 7.4: Communication

The organization must plan internal and external communications: what, when, with whom, how, and who communicates.

Clause 7.5: Documented Information

This covers the control of QMS documentation and records.

• Maintain vs. Retain: ISO 9001:2015 uses specific terminology. 'Maintain documented information' refers to documents (e.g., procedures, quality manuals, work instructions), while 'retain documented information' refers to records (e.g., completed checklists, calibration reports, training logs).
• Control of Documented Information: Documents must be controlled to ensure they are available where and when needed, and adequately protected. This includes controlling distribution, access, retrieval, storage, legibility, change control (version history), retention, and disposition.

Auditor Verification: The auditor will check if documents in use are of the correct revision status and that obsolete documents are marked or removed to prevent unintended use.