CAF Centre Recommendations for the Implementation of the Quality Management System

The CAF Centre has prepared certain recommendations for selected steps of the implementation of the quality management system in accordance with STN EN ISO 9001:2016. The recommendations are based on the experience of employees of ÚNMS SR gained during the implementation of the system. As the title indicates, these are recommendations and are not binding. Any public administration organization may draw inspiration from them; however, it is not obliged to apply these recommendations. If you are an organization that already has experience with a quality management system and would like to contribute additional advice for other organizations, please contact the CAF Centre, which will be pleased to add your recommendation to the relevant step.

Step 1 – Recommendations:

• When considering the scope of QMS implementation, it is necessary to take into account that a QMS in accordance with STN EN ISO 9001:2016 is strongly focused on improving provided products and services; therefore, it is recommended to apply QMS to the entire organization rather than only to a part of it.
• When selecting the Guarantor, it is necessary to carefully consider the composition of the organization’s leadership/management and to appoint the member who is most suitable for this role. This also depends on the size of the organization: in smaller organizations, it may be the statutory representative, while in larger organizations it may be a member of top management who is not the statutory representative. This must be a person with leadership qualities and a respected employee within the organization.
• When selecting the Quality Manager, it is for the implementing organization to decide whether this will be a person from within the organization with knowledge of the organization, or an external Quality Manager.
• If the Quality Manager is appointed from within the organization and does not have sufficient knowledge in the area of quality management system implementation, they should begin intensive training in QMS, where possible also by exchanging experience with Quality Managers from other organizations with an established system. Another solution is to engage an external expert who can provide the organization with training activities and consultations and guide the organization throughout the implementation process.

Step 2 – Recommendations:

• It is an advantage if members of the implementation team are selected across all organizational units of the organization. In the subsequent phases, this ensures a smoother implementation process, as all activities of the organization will be covered.
• A member of the implementation team should be a person with knowledge of procedures and processes within their organizational unit and with good communication skills.

Step 3 – Recommendations:

• Some processes in organizations may be described in detail in internal directives, others in the form of brief tables or flowcharts, some processes may be carried out according to various procedures and guidelines issued by a third party, or some processes may be performed intuitively based on verbal instructions.
• In order to create an overall picture of the organization, it is useful during process identification to also collect information on who owns the given process (who decides how the process is to be carried out) and how individual processes are linked to each other.
• When identifying processes, it is also recommended to immediately assign them to the relevant clause of the standard.

Step 4 – Recommendations:

• The current state analysis may be carried out through a review of selected internal directives of the organization, interviews with employees, or a structured questionnaire survey. The current state analysis is carried out by the Quality Manager, either independently or in cooperation with an external expert.
• For the purpose of conducting the current state analysis, it is useful to prepare a table, for example in MS Excel, where the requirements are listed on the left-hand side according to the individual clauses of the standard (what the organization must have/do and what documentation it must maintain). On the right-hand side, for each requirement, it should be recorded how the organization currently fulfils the requirement, or what still needs to be introduced or further developed in order for the requirement to be met.
• The report describing the current state of the organization should serve as a starting point for the implementation process. It should describe which requirements of the standard the organization does not fulfil or fulfils insufficiently, and it should provide guidance on which processes should be introduced in the organization and which documents need to be created.
• The implementation plan should be based on the current state analysis and should contain a detailed breakdown of individual steps and timeframes resulting from the analysis.

Step 5 – Recommendations:

• If the organization has no previous experience with a quality management system, it is appropriate to arrange training for the members of the implementation team.

Step 6 – Recommendations:

• The structure of QMS documentation usually includes all internal management documents (policies, regulations, directives, work procedures, etc.), plans, and all forms in use. Any exceptions should be specified in the relevant internal directive describing document control.
• If this is not the case, the organization should define the method for creating and reviewing documents, as well as the method for labelling individual documents, so that it is always clear which version of a document is currently valid.
• The internal directive on document control should define responsibilities for the preparation, review, approval, and issuance of internal documents, the method of updating documentation and issuing changes, procedures for withdrawing obsolete documentation, and criteria for issuing new documentation. Responsibility for maintaining and updating the register of internal and external QMS documentation should also be defined.
• The organization should ensure that QMS documentation is available and used at accessible locations for all employees of the organization.

Step 7 – Recommendations:

• If they have not been defined, the organization should identify stakeholders, determine their requirements, and monitor and evaluate them. Stakeholders mainly include individuals and organizations from among suppliers, employees, customers, the public, the founding organization, other public administration authorities, as well as European and international organizations.
• A process map describes the links between individual organizational processes. When creating a process map, processes are graphically grouped into three categories (main, support, and management processes) and the interactions between these groups are indicated. The description of processes may take various forms. The organization may decide that the entire description will be provided only in the form of directives and work procedures, only in the form of a process card (supplemented by a graphical representation of individual process steps – a flowchart), through a specialized software tool, or through a combination of these approaches. Regardless of the chosen method, it is important that at least the following parameters are identified for each process:
  1. Process objective – a verbal description of what the organization aims to achieve through the execution of the process and why the process is carried out at all.
  2. Process owner – usually a managerial employee of the relevant organizational unit or a person who has the authority to decide how the process is carried out.
  3. Process performers – the employee(s) who carry out individual activities of the process. The objective is not to identify performers by name, but to describe them by specific job positions, so that changes in personnel do not require changes to the process documentation.
  4. Inputs to the process and their providers – inputs may include information, documents, finances, tangible items, and all essential elements without which the required outputs cannot be achieved.
  5. Process outputs and their recipients – defining what the result of the process should be. The output may be a specific product or service for a customer, or an input to another process.
  6. Each process should also have identified risks that may arise within the process and could affect the creation of the required output or the achievement of the process objective.
  7. Performance indicators – one or more numerical, measurable indicators (measurable objectives) through which the organization can monitor the performance and quality of individual processes. Performance indicators should have defined units of measurement, an evaluation period, and a defined methodology for how results are obtained and evaluated (e.g. defining whether an increasing trend of a given indicator represents a positive or negative development of process performance for the organization). Performance indicators are a tool for continual improvement, and the organization should review them at regular intervals (usually annually) in order to continuously support the improvement of process performance and quality.
• The organization must develop and implement a quality strategy and quality concept with a customer-focused approach across all organizational units by declaring a quality policy. The organization’s management must ensure that the quality policy is implemented, understood, and supported at all levels of the organization. The quality policy should be accessible to all stakeholders. Good practice is to publish it on the organization’s website, intranet, or within the organization’s premises (e.g. at the reception, in representative areas, corridors, etc.).
• The organization must also define quality objectives for all levels of the organization so that they are measurable and consistent with the quality strategy and quality policy. Quality objectives are usually set for a one-year period. The overall “annual” objective should then be further broken down into smaller components—shorter-term partial objectives should be defined, which the organization regularly evaluates in order to gain an overview of whether progress toward achieving the objectives is proceeding according to plan or whether additional measures need to be taken. At the end of the period for which the quality objectives were set (usually one year), the organization evaluates the achievement of the quality objectives and defines new quality objectives for the following period. Quality objectives should be defined in such a way that they consistently move the organization forward in terms of quality.
• Top management must also demonstrate leadership and commitment to the QMS, which means that it must recognize the QMS as a tool for improving the quality of provided products and services, ensure resources for its continual improvement, and actively participate in it.
• Another procedure that the organization must establish, if not already in place, is a procedure and measures for risk management. The success of every process carried out within the organization is threatened by both foreseeable and less foreseeable risks. The organization should define a procedure for identifying these risks, classifying them (in terms of probability and/or impact), adopting measures to eliminate them, and evaluating the effectiveness of the adopted measures.
• As part of ensuring resources, the organization should define in its internal documents the infrastructure necessary for providing products and services, as well as procedures for ensuring and maintaining it. This includes, for example, buildings, workspaces, various specific technical equipment depending on the nature of the organization, hardware, software, and similar resources.
• The organization should also identify, document, plan, and ensure sufficient financial resources necessary for product realization and service provision, as well as for maintaining and improving the QMS. Planning and securing financial resources for operational activities is carried out in every organization through budgeting processes; however, it is important not to forget to include the costs related to improving the QMS itself.
• With regard to human resources, it is necessary to define requirements for employees, identify their training needs, and accordingly prepare training plans, implement them, and appropriately evaluate them.
• If the organization uses measuring equipment in the performance of some of its activities, it is necessary for the organization to have a procedure established for its use, registration, and verification.
• The organization should describe the processes leading to the provision of products and services in order to ensure adequate understanding of the needs of customers and other stakeholders. An important part is also resource planning (human resources, technical equipment where necessary, material provision, and financial resources). In addition to the description of individual activities, the inputs and outputs of individual processes should also be clear (i.e. what needs to be provided at the beginning in order to obtain the required, precisely defined output), as well as the requirements for the given product or service and the method of verifying whether the provided product or service meets those requirements. The organization should also review product/service requirements and have a method for determining customer satisfaction. This may be carried out in various ways, for example through questionnaire surveys or direct interviews. Requirements may also be identified, for example, through the analysis of received complaints.
• The organization should apply an appropriate procedure for identifying provided products or services to ensure their traceability. The rules for the release of products or services should also be clear, meaning that it must be defined in some way when a product or service is acceptable and can be provided to the customer, or conversely, when corrective action must be taken prior to final delivery to the customer due to an identified nonconformity. At the same time, a clearly defined and applied procedure must exist for how corrective actions are to be carried out (how to repair a defective product or eliminate nonconformities in a provided service), as well as how to prevent the accidental mixing and delivery of nonconforming products/services to the customer.
• If some organizational processes or parts thereof are provided by suppliers (externally provided services), the organization must define procedures for supplier selection, quality control of their provided products or services, and supplier evaluation. Each supplier that assumes part of the organization’s activities must comply with the same quality standards.
• The objective of the QMS is continual improvement. In order to determine whether the organization is improving and to what extent, it is necessary for the organization to define what needs to be measured and monitored, which methods of monitoring, measurement, analysis, and evaluation will be used, and when such measurement and monitoring must be carried out. The organization must also measure customer satisfaction and should determine appropriate methods for doing so (as mentioned above, for example satisfaction surveys, interviews, etc.).
• The organization must analyze and evaluate data obtained from monitoring and measurement. The results of the analysis must be used to evaluate:
  1. the conformity of products and services with the requirements of the standard,
  2. the level of customer satisfaction,
  3. the performance and effectiveness of the quality management system,
  4. the effectiveness of planning,
  5. the effectiveness of measures taken to address risks and opportunities,
  6. the performance of external providers,
  7. the need for improvements to the quality management system.

• Verification of the effectiveness of the QMS is also carried out through the performance of internal QMS audits. For this reason, it is essential that the organization adopts procedures for planning internal audits, for performing internal audits themselves, including verification of the effectiveness of corrective actions taken. It is also necessary to define requirements for internal auditors and to ensure their training.
• A frequent question concerns how many trained internal auditors an organization should have. If organizationally possible, the minimum number in a smaller organization is two (if possible, from different organizational units), since an internal auditor should not audit their own area of activities. For reasons of substitutability, more than two internal auditors are recommended. An auditor learns and gains experience through auditing, so with a lower number of auditors there is an assumption of gaining experience, but at the same time it represents a significant burden in terms of time and workload. It is therefore up to each organization to find a balance between these two aspects.
• The standard also requires the performance of management review. The recommended frequency of management review is once a year. Management review serves to verify the effectiveness of the QMS and is a means for its continual improvement. The standard defines minimum inputs to management review. The quality manager usually prepares a report on the status of the QMS at the end of the calendar year and submits it for discussion by management. The output of the management review should be decisions on improvement actions, the need for additional resources, or changes to the QMS.
• Since, in a properly implemented QMS, nonconformities are identified across all organizational activities, the organization must have procedures implemented for reviewing the causes of identified nonconformities, adopting corrective actions, and evaluating the effectiveness of the actions taken.
• Although the standard does not require it, good practice in many organizations is the preparation of a quality manual. The quality manual presents the organization and its implemented QMS. The chapters of the quality manual usually mirror the clauses of the standard and describe how the requirements of individual clauses of the standard are fulfilled within the organization. The quality manual may include references to other organizational documents (directives, management documents, other documentation in use), or it may describe a procedure that is required by the standard and is not contained in any other organizational documentation. The quality manual thus serves as a guide to the implemented QMS.

Step 8 – Recommendations:

• With regard to the selection of a certification body, it is not a requirement, but it is considered good practice to choose an accredited body.

Step 9 – Recommendations:

• Certification of the QMS does not mark the end; on the contrary, it marks the beginning of maintaining and continually improving the implemented QMS.
• In the period following the certification audit, the organization works on eliminating nonconformities identified during the certification audit (if any were identified) and, where applicable, on implementing recommendations for improvement.
• At the same time, the organization continues to carry out internal audits.
• On an ongoing basis, based on identified deficiencies, changes implemented within the organization, or decisions of the organization’s management, the implemented QMS is modified and improved.
• Good practice includes regular refresher training for employees on the implemented QMS, as well as training of new employees as part of induction training upon commencement of employment.