This is what I think of the changes in ISO 9001:2015.

The key differences in ISO 9001:2015 is the requirement to use risk-based tools (e.g., Reference standard ISO 31000-2009 [Risk Management-Principles & Guidelines] to pre-determine any hazards & their associated mitigation, reduction and/or mitigation for each of the 2015 ten clause requirements.

Since “preventive action” is proposed to be dropped from the 2015 version, the proposed revised standard now requires the organization to implement a risk-based process throughout your enterprise’s operations.

Together these clauses require the organization to identify the issues and requirements that can impact the planning of the quality management system, and can be used for input and development of the quality management systems.

There is now a reference to determining the requirements of the relevant interests, but no new changes.  External and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcome(s) and to determine the risks and opportunities that need to be addressed to assure the quality management system can achieve its intended outcome(s) specifically prevent or reduce undesired effects and achieve improvement.

These two sets of requirements cover the concept of ‘preventive action’, and also to take a wider view that looks at risks and opportunities. This approach is continued in the discipline specific text to require risk based thinking and a risk driven approach to preventive action throughout the development and implementation of the quality management system.

WHAT DO YOU DO?
You need to understand your business’ environment, your customers requirements & expectations from a process perspective and all the hazards (risks) expected or unexpected associated with the service or product your company markets.  Risk is the effect of uncertainty. 

The proposed draft standard requires that you systematically pre-determine the risks associated with all your company processes.  (1) An effect is a deviation from the expected, positive or negative. (2) Uncertainty is the state, even partial, of efficiency of information related to, understanding or knowledge of, an event, its consequence, or likelihood. (3)  Risk is often characterized by reference to potential events, and consequences or in terms of a combination of the consequences of an event and the associated likelihood of occurrence.

DOCUMENTATION REQUIREMENTS
The organization’s quality management system shall include documented information required by this International Standard.  “Documented information determined by the organization as being necessary for the effectiveness of the quality management system.”

Remember documented information for a quality management system can differ from one organization to another due to: (1) Size of Organization and its type of actives, processes, goods and services. (2) Complexity of processes and there interactions and competence of people.

For auditing purposes, auditors would conceivably verify how you have implemented risk-based thinking throughout the product life cycle plus all business operations delineated in the 10 clauses.  The organization shall conduct internal audits at planned intervals to provide information on whether the quality management system:

SELECT AUDITORS TO CONDUCT AUDITS
If I were auditing your company, I would expect to see how you determined the risks encountered throughout all processes & operations and how identified hazards are mitigated, reduced and/or eliminated.  This includes the results of the audit and reported to management right away, for evaluation,take appropriate action without undue delay, and post, file records either hard or electronically.

The use of risk based tools is one of the most prominent changes between the existing standard and the changes of ISO 2015. Understanding Risks, can be found in ISO 31000 Risk Management Standard mentioned earlier.

I think ISO 9001:2015 will be a challenge for organizations.

 Bio:

With more than two decades of Quality Systems, and development experience, Stanley Taylor has developed a keen sense for how operational costs can get inflated by inefficiencies, ineffectiveness and non-value added costs – and how they can execute systems for a leaner, more strategic operation.  As an engineer who quickly built his success on lean and six sigma methodology, ( ISO 9000-2000/TS 16949) he also fervently strives to help other organizations set priorities, achieve targets and work together in a partnership atmosphere.   His experience has encompassed the global supply chains and operations of education, military, automotive and commercial transportation markets (China India, Europe) etc..  Stanley maintains numerous professional memberships and certifications to ensure understanding of current standards and expectations.  He can be contacted at: (423)-884-2774  Mobile (423) 836-3080 or stanley.taylor@tds.net.