Section 2.3: Operation: Operational Planning, Design, and Development (Clauses 8.1 - 8.3)
Key Takeaways
- Clause 8.1 requires defined process criteria, resources, and documented controls appropriate to the operations.
- Unintended changes must trigger an impact review and mitigation actions to prevent adverse effects.
- Clause 8.2 requires proactive customer communication and a formal review of requirements before committing to supply.
- Clause 8.3 can only be excluded under 4.3 if the organization does not perform any design activity impacting conformity.
- Design controls must separate Review, Verification (output-to-input check), and Validation (fitness-for-use check).
Section 2.3: Operation: Operational Planning, Design, and Development (Clauses 8.1 - 8.3)
Operational Planning and Control (Clause 8.1)
Clause 8.1 marks the transition from QMS planning (Clause 6) and support (Clause 7) to active execution. This is the "Do" phase of the Plan-Do-Check-Act (PDCA) cycle. Under Clause 8.1, the organization must plan, implement, and control the processes needed to meet the requirements for product and service provision. This planning is not a one-time event; it is an ongoing requirement to establish:
- Requirements for products and services.
- Criteria for processes (e.g., operating parameters, temperature ranges) and acceptance of products/services (e.g., dimensional tolerances, surface finish standards).
- Resources needed to achieve conformity.
- Process controls in accordance with the established criteria.
- Documented information necessary to have confidence that processes were executed as planned and to demonstrate product conformity.
The output of this planning must be appropriate to the organization's operations. A lead auditor must assess whether the planning detail matches the complexity of the processes. For instance, a complex manufacturing process might require detailed routing cards, control plans, and work instructions, while a standard office service might only require a simple process map.
Controlling Planned and Unintended Changes
A critical area of audit focus is change management. Clause 8.1 requires organizations to control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects.
- Worked Scenario: A manufacturer faces a sudden shortage of a specified grade of plastic resin. They substitute a lower-grade material to meet a delivery deadline without performing a documented review of the change's impact on product strength. In the field, the substituted components fracture under normal loads. The lead auditor should cite a nonconformity against Clause 8.1 for failing to review the consequences of unintended changes and take mitigating action. Furthermore, Clause 8.1 requires the organization to control outsourced processes. This creates a link to Clause 8.4, which establishes the detailed controls for external providers.
Requirements for Products and Services (Clause 8.2)
8.2.1 Customer Communication
Communication with customers must be structured and proactive. The organization's processes must cover:
- Providing information relating to products and services.
- Handling enquiries, contracts, or orders, including changes.
- Obtaining customer feedback, including customer complaints.
- Handling or controlling customer property.
- Establishing specific requirements for contingency actions, when relevant (e.g., business continuity plans for critical service providers).
8.2.2 Determining Requirements
Before offering products or services, the organization must ensure that:
- Product and service requirements are defined, including any applicable statutory and regulatory requirements, and those considered necessary by the organization.
- The organization can meet the claims it makes for the products and services it offers (e.g., performance claims in marketing materials).
8.2.3 Review of Requirements
Before committing to supply a product or service (e.g., accepting an order or contract), the organization must perform a formal review. This review ensures the organization has the capacity and capability to deliver. It must cover:
- Customer-specified requirements, including delivery and post-delivery activities.
- Implied requirements necessary for intended use.
- Requirements specified by the organization.
- Statutory and regulatory requirements applicable to the products/services.
- Contract or order requirements differing from those previously expressed.
If the customer provides no documented statement of requirements (e.g., a phone order), the requirements must be confirmed by the organization before acceptance. The results of the review, and any new requirements, must be retained as documented information.
- Auditor's Tip: Check the dates. A signed contract-review checklist dated after production started indicates that the review was a retrospective paper exercise rather than a functioning control. This represents a nonconformity against Clause 8.2.3. Clause 8.2.4 requires that when product/service requirements change, documented information is amended and relevant personnel are made aware.
Design and Development of Products and Services (Clause 8.3)
8.3.1 General and Justification of Exclusions
Clause 8.3 governs how designs are planned, inputted, controlled, outputted, and changed. Under Clause 4.3 (Scope), an organization can exclude Clause 8.3 if they do not perform design activities and if the exclusion does not affect product conformity.
- Worked Scenario: A machine shop receives fully defined technical drawings from customers. They program their CNC machines to match the specified dimensions. They make no design decisions. This represents a justified exclusion of Clause 8.3.
- Counter-Scenario: A company receives functional requirements from a customer (e.g., "design a bracket that can hold 500 lbs"). The company's engineering team determines the material, thickness, and geometry. The company claims they can exclude 8.3 because "the customer approved the final drawing." The lead auditor must reject this exclusion. The company is performing design work, and Clause 8.3 applies.
8.3.2 Design Planning, Inputs, and Outputs
- Planning (8.3.2): The organization must determine design stages, reviews, verification, validation, and interfaces between different engineering groups.
- Inputs (8.3.3): Requirements must be complete, unambiguous, and not in conflict. Conflicting inputs must be resolved.
- Outputs (8.3.5): Outputs must meet input requirements, provide acceptance criteria, and specify safety characteristics. Documented information (drawings, manuals, code) must be retained.
8.3.4 Design Controls: Review, Verification, and Validation
Auditors must distinguish between these three distinct controls:
- Design Review: Evaluates the ability of the design results to meet requirements, identifies problems, and proposes actions.
- Design Verification: Confirms that design outputs meet the input requirements ("Did we build the design correctly?"). Evidence: calculations, checklist reviews, comparison testing.
- Design Validation: Confirms that the product meets requirements for its specified or intended use ("Did we build the right design?"). Evidence: prototype field trials, clinical trials, flight tests.
| Control | Objective | Audit Evidence |
|---|---|---|
| Review | Evaluate project progress & identify issues. | Minutes of multi-disciplinary review meetings, action items. |
| Verification | Check outputs against inputs (math, specs). | Test reports, calculation checks, drawing sign-offs. |
| Validation | Check product against intended use (real-world). | Field trial logs, customer acceptance testing, prototype tests. |
Validation must be completed prior to delivery or implementation. Finally, under Clause 8.3.6, all design changes must be reviewed, authorized, and recorded, showing that adverse impacts on conformity were prevented.
An auditor is checking whether a contract manufacturer can exclude Clause 8.3. The manufacturer receives complete CAD models and drawings from the customer, but the manufacturer selects the manufacturing tolerances and chooses alternative raw materials based on availability. What should the auditor conclude?
During a design audit, the auditor is shown records of an engineering calculation checking that a structural beam can bear the maximum load specified in the project's input document. Which control under Clause 8.3.4 does this represent?
A company accepts a verbal order over the phone from a long-time customer without documenting the requirements. According to Clause 8.2.3, what must the organization do?