Technical update on ISO 9001:2015 Colin MacNee Duncan MacNee Limited

The views expressed are my own and do not represent Caveat The views expressed are my own and do not represent BSI CQI IAF IBM IRCA ISO Colin MacNee is currently a member of the following BSI committees: AUS/001 Revision of ISO 19011, CAS/001 Conformity assessment, IST/33 Security techniques MSEG Management Standards Expert Group, QS/00-/0-/01 Quality management and quality assurance (International) QS/001 Quality management and quality assurance procedures, IST/15 Software and Systems Engineering Colin MacNee has been a member of the following BSI committees: BDD/2 IT Security JTISC Joint TickIT Industry Steering Committee (Information Technology Assessment Guide Committee) Colin MacNee is currently a member of the following ISO committees: ISO/CASCO/IAG "IAG 9000 Members" ISO/CASCO/WG 35 "Requirements for third party certification auditing of quality management systems -- Competence requirements" ISO/TC 176 "Quality management and quality assurance“, ISO/TC 176/SC 2 Quality systems ISO/TC 176/SC 02/WG 22 "Interpretations“, ISO/TC 176/SC 02/WG 24 “Revision of ISO 9001” ISO/TC 176/SC 03 "Supporting technologies" ISO/TC 176/SC 03/WG 16 "Joint WG with TC 207/SC2 for the revision of ISO 19011“ Colin MacNee has been a member of the following ISO committees: ISO/TC 176/SC 2/WG 18/TG 1.9.1 'Product Introduction‘, & ISO/TC 176/SC 2/WG 18/TG 1.9.2 'Transition Planning' ISO/TC 176/SC 2/WG 18/TG 1.7.7 'Drafting ISO 9001:2000' (Clauses 7 & 8) ISO/TC 176/SPTG 'Strategic Planning Task Group‘ & ISO/TC 176/SC 02/AHG 02 "User survey" ISO/IEC JTC1/SC 7/WG 18 'Revision of ISO 9000-3:1997' ISO/TC 176/SC 2/WG 18/TG 1.11 'Communication and User Feedback‘, ISO/TC 176/SC 2/WG 18/TG 1.19'Drafting ISO 9001:2008 (Clauses 6 & 8) Colin MacNee is currently the ISO/TC 176/SC 2 UK Delegation Leader and has been previously the ISO/TC 176/SC 3 UK Delegation Leader Colin MacNee has been a member of the following IAF Technical Committee groups: ISO 9000 Advisory Group, IAF WG on ISMS (ISO 27001) MLA Scope IAF TF on Audits of Combined & Integrated MS, IAF TF on Multi-site Certification without Sampling IAF TF on Audit Duration Issues under MD5, IAF TF on Accreditation Market Surveillance IAF TF on Indicators of CB Performance, IAF CMC Colin MacNee has been previously the IAF Technical Committee secretary Colin MacNee is the CQI Standards Panel chair Colin MacNee was employed by IBM for 33 years

Content What is the process for updating ISO standards? What are the stages Who is involved What is the current situation? Background:1994, 2000 and 2008 revisions, User Surveys and QMPs The ISO 9001:2015 Project plan, what we have achieved and what we have still to do Current major revisions of ISO 9001, ISO 14001 and ISO 27001 (Reference to Annex SL) How IRCA auditors influence the development? When to contribute How to contribute What ISO 9001:2015 could look like? Annex SL plus possible changes

ISO Development Process 1 of 3 The ISO/IEC Directives Part 1 and Consolidated ISO Supplement1 describes in detail the following stages: Preliminary - Preliminary work item (PWI) Proposal - New work item proposal (NP or NWIP) Preparatory – working draft(s) (WD) Committee – committee draft(s) (CD) Enquiry – draft international standard (DIS) Approval – final draft international standard (FDIS) Publication – international standard (IS) 1 Third edition, 2012 (based on the ninth edition of the ISO/IEC Directives, Part 1)

ISO Development Process 2 of 3 Who will receive the documents? Member bodies. E.g. JISC (Japanese Industrial Standards Committee) Participating Countries: 73 Observing Countries: 16 Internal liaison to SC 2 (ISO: 8, IEC: 3) External liaison to SC 2 (21) ALL of the above are allowed to comment. ONLY member bodies are allowed to vote. Internal liaison: JTC 1/SC 7, TC 34, TC 69, TC 207/SC 1, TC 210 and TC 251. External liaison: IIOC (Independent International Organization for Certification), IPC (International Personnel Certification Association), IQNet (The International Certification Network) and the CQI (Chartered Quality Institute) . Note: Although ISO/CASCO is an internal liaison to ISO/TC 176 it is NOT in liaison with ISO/TC 176/SC 2 and therefore no members of CASCO directly participate in SC 2 activity. See Backup for complete list.

ISO Development Process 3 of 3 Voting CD: 2/3 positive of total of member bodies voting DIS: 2/3 positive AND not more than ¼ negative of total of member bodies voting FDIS: 2/3 positive AND not more than ¼ negative of total of member bodies voting Not counted in the total vote: Abstentions Negative votes without technical justification Current total Member bodies: 89 (73 'P' and 16 'O'). Scenario: all member vote with no abstentions. Fot the vote to pass - CD: 60 vote positive DIS: 60 vote positive AND 22 vote negative FDIS: 60 vote positive AND 22 vote negative

Current Situation Background The ISO 9001:2015 Project plan 1994, 2000 and 2008 revisions User Surveys Quality Management Principles (QMPs) The ISO 9001:2015 Project plan What we have achieved What we have still to do 3 major ISO MSSs in development – all using Annex SL ISO/IEC 27001 (expected later this year) ISO 14001 (expected early 2015) ISO 9001 (expected late 2015) ISO 22301:2012 developed using an early draft ISO/IEC 27001 Information technology - Security techniques - Information security management systems - Requirements ISO 14001 Environmental management systems - Requirements with guidance for use ISO 9001 Quality management systems – Requirements ISO 22301:2012 Societal security - Business continuity management systems – Requirements Note: ISO 22301 was developed using an early draft of Annex SL; then titled ISO Guide 83

ISO/CD 9001 2013 CD ballot opens: June 2013 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec 2013 CD ballot opens: June 2013 CD ballot closes: August 2013 It is standard practice for the CD to be distributed only to member body mirror committees. However, some member bodies may distribute the CD to the public (free or for sale)

ISO/DIS 9001 2014 DIS ballot opens: April 2014 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec 2014 DIS ballot opens: April 2014 DIS ballot closes: August 2014 It is standard practice for the DIS to be distributed to members of the public (free or for sale). Some member bodies provide electronic tools for viewing and commenting on the DIS.

ISO 9001 published: September 2015 ISO/FDIS 9001 2015 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec FDIS ballot opens: July 2015 FDIS ballot closes: August 2015 ISO 9001 published: September 2015

MSS – High Level Structure 1 of 3 Introduction 1. Scope 2. Normative references 3. Terms and definition Appendix Bibliography 4. Context of the organization 5. Leadership 6. Planning 7. Support 8. Operation 9. Performance evaluation 10. Improvement

MSS – High Level Structure 2 of 3 4. Context of the organization 4.1 Understanding the organization and its context 4.2 Understanding the needs and expectations of interested parties 4.3 Determining the scope of the XXX management system 4.4 XXX management system 5. Leadership 5.1 Leadership and commitment 5.2 Policy 5.3 Organization roles, responsibilities and authorities 6. Planning 6.1 Actions to address risks and opportunities 6.2 XXX objectives and planning to achieve them

MSS – High Level Structure 3 of 3 7. Support 7.1 Resources 7.2 Competence 7.3 Awareness 7.4 Communication 7.5 Documented information 7.5.1 General 7.5.2 Creating and updating 7.5.3 Control of documented information 8. Operation 8.1 Operational planning and control 9. Performance evaluation 9.1 Monitoring, measurement, analysis and evaluation 9.2 Internal audit 9.3 Management review 10. Improvement 10.1 Nonconformity and corrective action 10.2 Continual improvement

MSS – Common Terms and Definitions Organization Interested party (preferred term) Stakeholder (admitted term) Requirement Management system Top management Effectiveness Policy Objective Risk Competence Documented information Process Performance Outsource (verb) Monitoring Measurement Audit Conformity Nonconformity Correction Corrective action Continual improvement

Possible* ISO 9001:2015 1 of 3 4. Context of the organization 4.1 Understanding the organization and its context 4.2 Understanding the needs and expectations of interested parties 4.3 Determining the scope of the quality management system 4.4 Quality management system 5. Leadership 5.1 Leadership and commitment 5.2 Policy 5.3 Organization roles, responsibilities and authorities 6. Planning 6.1 Actions to address risks and opportunities 6.2 Quality objectives and planning to achieve them 6.3 Planning of changes *Note: This structure is based on a early draft of ISO CD 9001:2015

Possible * ISO 9001:2015 2 of 3 7. Support 7.1 Resources 7.1.1 General 7.1.2 Infrastructure 7.1.3 Process environment 7.1.4 Monitoring and measuring devices 7.1.5 Knowledge 7.2 Competence 7.3 Awareness 7.4 Communication 7.5 Documented information 7.5.1 General 7.5.2 Creating and updating 7.5.3 Control of documented information 8. Operation 8.1 Operational planning and control 9. Performance evaluation 9.1 Monitoring, measurement, analysis and evaluation 9.1.1 General 9.1.2 Customer satisfaction 9.1.3 Analysis and evaluation of data 9.2 Internal audit 9.3 Management review 10. Improvement 10.1 Nonconformity and corrective action 10.2 Continual improvement *Note: This structure is based on a early draft of ISO CD 9001:2015

Possible * ISO 9001:2015 3 of 3 8. Operation 8.1 Operational planning and control 8.2 Determination of market needs and interactions with customers 8.2.1 General 8.2.2 Determination of requirements related to the goods and services 8.2.3 Review of requirements related to the goods and services 8.2.4 Customer communication 8.3 Operational planning 8.4 Control of external provision of goods and services 8.4.1 General 8.4.2 Type and extent of control of external provision 8.4.3 Documented information for external providers 8.5 Development of goods and services 8.5.1 Development processes 8.5.2 Development controls 8.5.3 Development transfer 8.6 Realization of goods and services 8.6.1 Control of production of goods and provision of services 8.6.2 Identification and traceability 8.6.3 Property belonging to customers or external providers 8.6.4 Preservation of goods or services 8.6.5 Post delivery activities 8.6.6 Control of changes 8.7 Release of goods or services 8.8 Nonconforming goods and services *Note: This structure is based on a early draft of ISO CD 9001:2015

Thank You Any Questions?