Clause 7.1 Resource Requirements (revealed)

Resource Requirements for ISO 9001:2015? (explained)

The general statement at clause 7.1 is a high-level requirement that sets the stage for the more detailed requirements of clauses 7.1.1 to 7.1.6 that follow. This requirement establishes the context and the need for resources that enable the management system to function effectively. It states that resources are required for:

Establishment; the setting up of the management system including contact with a 3^rd party auditor, internal training, possible employment of a quality manager and possible purchase of a document management system.

Implementation; the shortest period allowed by 3^rd party auditors (in the UK) for the implementation and subsequent first audit is a period of 6 months. This calls for a commitment in time resource and for the cooperation and communication of all parties both internal and external as required

.

Maintenance; a management system is a living, breathing entity that is dynamic in nature and requires constant maintenance in terms of document management, communication, training, monitoring, and reporting.

Continual Improvement; this is the scaffolding that supports the whole of the management system and its reason for existence. It’s really easy during all of those endless meetings and reports writing to forget that ISO 9001:2015 is all about the continual improvement of your products and service to the customer.

If roles, responsibilities and authorities are established early in the life of the management system then the establishment, implementation, maintenance and continuous improvement of the system will be easier. Of course, no management system is all plain sailing and without problems but the distribution of tasks between people, and therefore making them accountable will make it easier.

There is nothing really specific for you to do to meet this requirement as I’m guessing that you are already doing everything that I’ve mentioned above. One could retain evidence of budget planning for the management system that will be an agenda item of your annual management system review meeting. Budget planning would plan for items such as human resources, time, document management, auditing, monitoring equipment and training etc.

You are also asked to consider:

• Existing resources and constraints
• Resources provided externally

Existing resources; you might already have a document management system, monitoring and measuring equipment that can be adapted. Can you provide your own in-house training for internal auditors? Is there the need to employ a dedicated quality manager or can you divide the duties between an existing team?

External Resources; you will definitely need to budget for a 3^rd party auditor, and that doesn’t come cheap depending upon the size of your organisation. If you are newly implementing your management system, then there will be an initial 3^rd party auditor consultation fee, your first auditing fee (post a 6-month minimum implementation time) and a continued audit fee every 3 years for recertification (UK). If you don’t have the capability to provide internal management system training for such things as internal auditing, then will have to be sourced externally and budgeted accordingly.

ISO 45001:2018

The requirements read as for ISO 9001:2015 (part of the high-level structure)

ISO 14001:2015

The requirements read as for ISO 9001:2015 (part of the high-level structure)

Clause 7.1.2 People

This requirement is short and is summed up by requiring that your organisation shall determine and provide persons for effective implementation of its QMS, and for the operation and control of its processes. There are two points of focus here: Your QMS and your process.

As mentioned earlier, you might employ a dedicated quality (safety, environmental) manager to take overall control of your management system or you can spread responsibility for the task across a group of people. Please remember, whichever option you choose, overall ‘accountability’ for the management system lies with top management. There is very little for you to worry about with this requirement because almost all people within your organisation will have a minor role to play in relation to the management system. Because of this, you are providing ‘persons’ to help implement the management system by default.

In much the same way, everyone in your organisation will be working within a process or multiple processes. This means that all persons within your organisation will be contributing to, and controlling your processes.

ISO 45001:2018

There is no equivalent clause 7.1.2 requirement in this standard.

ISO 14001:2015

There is no equivalent clause 7.1.2 requirement in this standard.

Clause 7.1.3 Infrastructure

With this clause, the standard is requiring you to provide and maintain the infrastructure needed for the provision of your products and services. What infrastructure do I hear you ask? Well, it’s referring to all of the physical things such as buildings and machines etc. The standard then provides examples of infrastructure within the note section:

Buildings and associated utilities; I would imagine that ‘most’ buildings that organisations operate within are leased. The buildings are either maintained by the leasing agents or your organisation is maintaining them through an annual maintenance contractor. If you have a maintenance contract, then the effectiveness of maintenance provision will have to be monitored and reported on. An annual review of the maintenance contract is normally something that would happen during your annual management review. If the leasing agent is responsible for maintaining the infrastructure, then any default on the contractual agreements might become a legal matter for resolution.

Equipment, including hardware and software; plant machinery such as CNC equipment and the associated software that is linked to their operation will require maintenance. Machines will often have manufacturers guidance on maintenance procedures. This might be maintenance that can be performed in-house, or outsourced to specialist contractors. Software maintenance is largely a question of virus/malware protection and regular updates to ensure you are operating the latest version. Most organisations have a dedicated IT department that will fix and maintain general faults to both hardware and software.

Transportation resources; includes delivery vehicles, forklift trucks, MEWP’s, warehouse and loading equipment. Delivery vehicles, forklifts and MEWP’s are most commonly maintained through outsourced service contracts. As mentioned earlier, these contracts will require monitoring and reviewing for effectiveness. Warehouses will come under the banner of buildings and so what I stated earlier will apply.

IT systems; if your IT systems including hardware and telephony are leased, then there would normally be a maintenance and fault repair service as part of the leasing contract. For example, most ‘high-end’ photocopy machines are leased, and when a fault occurs a service person will arrive very quickly to fix the problem. If your leased IT systems are running bespoke software, then usually the software vendor will provide a fault repair as part of the lease contract.

Let’s not forget, that this requirement is to ensure the conformity of your products and services. If, through lack of an effective maintenance process, you have problems with the conformity of products and services, then ask yourself; “Who will be affected?”. The answer will enviably be ‘the customer’. ISO 9001:2015 is all about protecting the customer from negative impact, don’t let your customers be affected negatively by having defective maintenance procedures and a lack of resources.

ISO 45001:2018

There is no equivalent clause 7.1.3 requirement in this standard

.

ISO 14001:2015

There is no equivalent clause 7.1.3 requirement in this standard.

Clause 7.1.4 Environment For The Operation Of Processes

This requirement is asking you to determine, provide and maintain your operating environment in order to achieve conformity of products and services. The note section then provides examples of both physical and human factors.

ISO 9001:2015 is to be commended here, it’s making a real effort to ensure that workers are performing their duties in a pleasant working environment as possible. One should note that the standard uses the phrase “A suitable environment can be”, what’s missing here is the word ‘shall’. This tells us that the items listed in the ‘social’ and ‘psychological’ are examples that your organisation ‘might’ consider. you might also backup a commitment to this through your quality policy statement and objectives.

This raises some interesting questions for both 3^rd party and internal auditors. How would you as an auditor check for the items listed under social and psychological? And, do you really need to? First you could determine if there is a policy and associated process for controlling these issues. If your policy is considered part of your continual improvements process, then you must consider them. You can begin to interview staff to identify if they have raised any complaints in regards to stress etc. Next, you can then investigate how these were dealt with in the HR department. There you will find any records of complaints for stress, discrimination and confrontations etc. You would then check to see if this fed through to the continual improvement process.

Your working environmental conditions might be dictated by your organisational context. For example, I was once working as an environmental engineer at an organisation that specialised in the production of precision glass products for use in military equipment. Some of the production processes had very stringent environmental conditions such as being 100% dust-free, and strict humidity and vibration control. You might be an organisation that produces a food product, and your environmental conditions would include control of: hygiene, dust, airflow, temperature, humidity, human infection contamination etc.

Your concern for this requirement could be in terms of machine and environmental maintenance. Is there a lack of dust control due to your LEV systems not being maintained according to regulation and/or internal requirements? Are there problems with noise or humidity due to faulty, out-of-date equipment? Have there been complaints about this? Are there complaints about stress that have simply been ignored? Maintenance audits are easy to perform as there should be records captured against the requirements of the process.

Environmental controls for processes are normally built into specifications and procedures for example:

ISO 45001:2018

There is no equivalent clause 7.1.4 requirement in this standard.

ISO 14001:2015

There is no equivalent clause 7.1.4 requirement in this standard.

The fact that there are no equivalent clause 7.1.4 requirements in these standards I find both odd, and disappointing. This is a good example of where there is still too much disparity between the standards, and where there is still a great deal of work to be done to align them with one another. You could argue that issues related to social and psychological wellbeing are even more suitable for inclusion within ISO 45001:2018 than they are for ISO 9001:2015.

There is no requirement for you to maintain or retain documented information for this clause however, as I’ve said many times already, if you are doing it then document it. You will naturally be keeping documented procedures for maintenance, and records to identify when it occurred. These documents should be more than sufficient to demonstrate how you are managing your environmental operating conditions effectively.

7.1.5.1 Monitoring and Measuring Resources

When working as an auditor, I’ve found that a great many organisations misinterpret this requirement of the standard. If any of your monitoring resources such as a sound meter, for example, requires traceability, then calibration and verification records are required. In this example, and depending upon the particular sound meter, calibration instructions might be provided by the manufacturer and can be performed in-house. Verification of the instrument can be performed by testing it against a known frequency that should produce an expected result.

Some instruments used for specific processes may allow for a +/- tolerance of a certain percentage such as 5% for example. It all depends on how critical the characteristics of the product or process specifications are. Calibration and verification might also be a legal requirement such as for those products that fall into the category of medical devices.

For the general part of this statement, the requirement is that your organisation shall ensure the resources provided are:

How you calibrate and how often you do this is entirely up to you unless, you are guided by legislation. Deciding on whether an instrument is still performing accurately is most commonly done through activities such as:

It’s a good idea for you to make a list of where all monitoring and measuring occurs for your products and services. For products, most people think in terms of conformity according to size, shape, weight and colour etc. When considering monitoring and measuring in its entirety, one should be thinking in terms of the ‘product life cycle’. This might include measuring the amounts of raw material as they are being extracted from the ground through to product or material disposal. You can then make a list of any monitoring and measuring instruments that are being used such as a weigh bride at raw material extraction, and a weighbridge for material disposal. Of course, materials will likely go through a large number of transformations as part of their life cycle and there will inevitably be a great many monitoring and measuring devices used along the journey.

Don’t get confused between the requirements of this clause and the requirements of clause 9.1. This clause is specifically focused upon instruments that are used for monitoring and measuring. Clause 9.1 is pertaining to the monitoring and measuring of processes and procedures in general.

As one might expect, you are required to retain documentation of your steps that ensure the monitoring equipment is considered fit for purpose. If you perform any or all of the points listed above and store the results as records, then you are good to go.

ISO 45001:2018

There is no equivalent clause 7.1.5.1 requirement in this standard.

ISO 14001:2015

There is no equivalent clause 7.1.5.1 requirement in this standard.

Clause 7.1.5.2 Measurement Traceability

As mentioned earlier, certain products and devices such as medical devices for example, require that measuring instruments are calibrated against a specified national standard. In the United Kingdom, the organisation that holds the most standards is called the United Kingdom Accreditation Service (UKAS). This is the national accreditation body for the United Kingdom, appointed by the government, to assess organisations that provide certification, testing, inspection and calibration services.

When you have an instrument that is calibrated against a traceable standard, this is the best way to demonstrate that it is reliable and fit for purpose. When verifying the instrument, you are testing it against an expected result, such as that provided by the UKAS standard. If the instrument matches the expected result, then it is considered to be accurately calibrated and fit for purpose.

The standard described by UKAS will often contain requirements for the frequency of calibration testing. These are to be considered the minimum as instructed by the standard. However, should your organisation wish to test more often than the minimum, then feel free to do so. I suppose that frequent checking of an instrument in-between calibration tests might be called verification checks. Verification is performed to identify whether the instrument is still within its required calibration tolerances.

Spreadsheets in the form of calibration plans are used to track when calibration is due to be performed. The spreadsheet should track and capture:

The person performing the calibration must be trained and competent to do so, especially for critical instrument such as those used to measure tolerances for components used in aircraft production for example. In certain instances, the calibration of an instrument is so critical that it can only be performed by an outsourced, specialist contractor.

Calibration Identification

Calibration (and servicing) of instruments and equipment is usually identified by stickers or tags that are attached to the device. This will normally identify the last calibration or service date and may also indicate letters that identify if it was calibrated against a particular standard. For example, all scuba diving cylinders manufactured within the EU must conform to the Pressure Equipment Directive (PED) standard and will bear a CE mark. These cylinders are manufactured to the BS EN ISO 18119 (for steel cylinders). SCUBA cylinders require a hydrostatic test every 5 years. On successful completion, the date (Year/Month) of the test is stamped on the cylinder shoulder. The hydrostatic test equipment is also calibration tested and will have a sticker that identifies when it was last performed and when it is next due for re-test.

Protection Against Unauthorized Adjustments

This can be in the form of a physical barrier such a lock and key, an access code, or a specialist tool. Restrictions could also be communicated through education and training. Most approaches would include both physical barriers and educational training. This brings back memories of working for BSI as a management systems tutor, and the lead auditor exam questions. There was a question asking how one might prevent unauthorised adjustment of a calibrated instrument and also what clause requirement it was described within. I’m very glad to say that no person ever failed a lead auditor exam in all of the time that I taught classes for BSI. Although, I suspect that is down to the quality of the students rather than the instructor!

Protection From Damage

I remember my father once telling me “Look after your tools, treat them with respect and they will look after you”. Sensitive measuring and monitoring equipment can be very expensive indeed, and so it pays to look after it and use it in the manner for which it was designed. The best guide for looking after the equipment is to use common sense and always follow the manufacturer’s guidance instructions which typically include:

If, when performing a calibration check you find that your instrument is outside of your permitted parameters, one might be wise to ask the question “for how long has the device been outside of its tolerance?”. It’s for this reason that the frequency of calibration testing is important. The topic of risk is important here; if the instrument is being used in critical environments, then your calibration frequency will increase accordingly.

When finding a measuring device that’s outside of its calibration parameter, a sample testing of historical products will have to be performed. This may result in a product recall if the use of those products could malfunction or cause a danger to the end-user. Machine calibration, and measuring equipment calibration is very important, and you are best giving it the attention it deserves. A robust calibration testing schedule, that is based upon risk requires careful planning. Roles, responsibilities and authorities need to be strictly assigned.

Retaining documentation that records that a measuring device is fit for purpose also includes recording its calibration and verification records. Enter a calibration record for each individual piece of equipment onto a spreadsheet and ensure that its calibration status is identified with a sticker or tag attached to it.

ISO 45001:2018

There is no equivalent clause 7.1.5.2 requirement in this standard.

ISO 14001:2015

There is no equivalent clause 7.1.5.2 requirement in this standard.

Clause 7.1.6 Organisational Knowledge

This is a completely new addition to the standard that bears no relation to anything contained in the previous 2008 edition. This new requirement is best explained through illustration by using a few real-life examples.

I was once auditing a very large (and famous) daily tabloid newspaper production facility in Manchester UK. One of the problems that I identified was that a great many employees had recently took an early retirement deal and were being replaced by very young, and fresh out of university graduates. This was causing the organisation some very real problems that had not been foreseen. For example, there were some very old production machines at the facility that were still performing well and being used daily. However, there were no servicing and maintenance procedure documents for these machines as were historically serviced by workers over the past 40 years by using experience.

Servicing and maintenance procedures had not been captured and documented as part of the management system and so there was nothing available for the new cohort of younger workers as guidance. This resulted in hiring back some previously retired staff on a consultancy (expensive) basis to retrain the new staff. I’ve described only one of the issues caused by the lack of knowledge acquisition and sharing but there were many more at the factory.

To give you another example, I was once hired as an environmental consultant for an emergency 3-month contract. The organisation that hired me was in a total panic because the person in charge of environmental management was off work due to stress and had been for 6 months. The problem was, that their tri-annual 3^rd party audit was due in 3 months’ time. Unfortunately, the environmental manager had created lots of processes and procedures that were not documented as part of the management system and nobody could locate them.

The manager concerned had left specific instructions not to be contacted by email or phone due to being very ill from work-related stress. I was hired to try and rescue the situation. I was able to do this with the assistance of approximately 20 of their staff assisting me when I needed it. I basically recreated many of the missing documents, reorganised their management system, and performed a great deal of ISO 14001 training. This again illustrates the need to capture and document knowledge into your management system so that it can be accessed and shared when required.

The requirement of clause 7.1.6 is that you shall determine the knowledge necessary for

:

• The operation of your processes
• To achieve conformity of your products and services
  
  

You are required to retain this knowledge in a way that is sustainable, and so that it can be accessed, shared and updated when necessary. You have many options for how to do this including:

• Using a simple form that might contain fields such as: what knowledge is necessary, how the knowledge was originated, a description of the knowledge, how to apply the knowledge and who last reviewed the knowledge.
• An interactive, intranet training package designed to train potential users of the knowledge designed using a program such as Adobe Captivate, Articulate Storyline or similar.
• A relational database that captures fields such as those described for a form but will provide the ability to link forms of knowledge to each other if they have related similarities.
• Face-to-face training activities.
• Educational posters.
• Leadership commitment that ensures knowledge is valued as a commodity.
  
  

Let’s not lose sight of the fact that organisational knowledge is a collection of facts, principles, learning experiences and data analysis etc, that is used by the management system to aid the processes of continual improvement. Any knowledge that supports continual improvement should be captured, formally entered into your management system, and shared with those who can use it for the better of the organisation.

After reading this, it might be a good idea to ask yourself the following questions;

• Am I the creator and bearer of some knowledge that should be documented as part of the management system?
• What might happen if I was off on long-term sickness?
• Do I possess knowledge that could be used for the continual improvement process?
  
  

ISO 45001:2018

There is no equivalent clause 7.1.6 requirement in this standard.

ISO 14001:2015

There is no equivalent clause 7.1.6 requirement in this standard.

For Auditors:

Clause 7.1

Clause 7.1.2

• Check that role, responsibilities and authorities have been assigned for management system duties

Clause 7.1.3

• Check for maintenance records and schedules for buildings, transport, equipment and IT systems.

Clause 7.1.4

• Where applicable, check for monitoring of environmental conditions such as: heat, humidity, noise and hygiene etc.

Although not essential, you could investigate if policies for stress and discrimination exist as part of the management system. If they do, investigate any complaints and how they were dealt with in terms of continual improvement.

Clause 7.1.5

Clause 7.1.5.2

Clause 7.1.6

Check for the acquisition, maintenance and application of organisational knowledge and how it contributes to the continual improvement process.

ISO 14001:2015

• Clause 7.1, as above.

ISO 45001:2018

• Clause 7.1, as above.

Some further questions that I will be answering in future articles include:

References: www.iso.org

Be kind, please create a link back to this article from your website, thank you.

(c) All content is copyrighted to ING Training, all rights reserved 2022.