Quality management systems – Requirements

1 Scope

1.1 General

This International Standard specifies requirements for a quality management system where an organization:

a) needs to demonstrate its ability to consistently provide product that meets customer and applicable regulatory requirements, and

b) aims to achieve customer satisfaction through the effective application of the system, including processes for continual improvement of the system and the assurance of conformity to customer and applicable regulatory requirements.

NOTE: In this International Standard, the term “product” applies to the product intended for, or required by, a customer

1.2 Application

All requirements of this International Standard are generic and are intended to be applicable to all organizations, regardless of type, size and product provided.

Where any requirement(s) of this International Standard cannot be applied due to the nature of an organization and its product, this can be considered for exclusion.

Where exclusions are made, claims of conformity to this international Standard are not acceptable unless these exclusions are limited to requirements within clause 7,and such exclusions do not affect the organization’s ability, or responsibility, to provide product that meets customer and applicable regulatory requirements.

2 Normative reference

The following normative document contains provisions  which, through reference in this text, constitute provisions of this International Standard. For dated references, subsequent amendments to, or revisions of, any of these publications do not apply. However, parties to agreements based on this International Standard are encouraged to investigate the possibility of applying the most recent edition of the normative document indicated below. For undated references, the latest edition of the normative document indicated below. For undated references, the latest edition of the normative document referred to applies. Members of ISO and IEC maintain registers of currently valid International Standards.

ISO 9000:2000, Quality management systems – Fundamentals and vocabulary.

3 Terms and definitions

For the purposes of this International Standard, the terms and definitions given in ISO 9000 apply.

The following terms used in this edition of ISO 9001 to describe the supply chain, have been changed to reflect the vocabulary currently used:

Supplier ----------> organization ----------> customer

The term “organization” replaces the term “supplier” used in ISO 9001”1994,and refers to the unit, to which this International Standard applies. Also, the term “supplier” now replaces the term “subcontractor”.

Throughout the text of this International Standard, wherever the term ”product” occurs, it can also mean “service”.

4 Quality management system

4.1 General requirements

The organization shall establish, document, implement and maintain a quality management system and continually improve its effectiveness in accordance with the requirements of this International Standard.

The organization shall:

a)   identify the processes needed for the quality management system, and their application throughout the organization (see 1.2);

b)  determine the sequence and interaction of these processes;

c)   determine criteria and methods needed to ensure that both the operation and control of these processes are effective;

d)  ensure the availability of resources and information necessary to support the operation and monitoring of these processes;

e)   monitor, measure and analysis these processes, and

f)   implement action necessary to achieve planned results and continual improvement of these processes.

These processes shall be managed by the organization in accordance with the requirements of this International Standard.

Where an organization chooses to outsource any process that affects product conformity with requirements, the organization shall ensure control over such processes. Control of such outsourced processes shall be identified within the quality management system.

NOTE: processes needed for the quality management system referred to above should include processes for management activities, provision of resources, product realization and measurement.

4.2 Documentation requirements

4.2.1 General

The quality management system documentation shall include:

a)   documented statements of a quality policy and quality objectives;

b)  a quality manual;

c)   documented procedures required by this International Standard;

d)  documents needed by the organization to ensure the effective planning operation and control of its processes, and

e)   records required by this International Standard(see 4.2.4)

NOTE 1 Where the term “documented procedure” appears within this International Standard, this means that the procedure is established, documented, implemented and maintained.

NOTE2 The extent of the quality management system documentation can differ from one organization to another due to:

a)   the size of organization and type of activities;

b)  the complexity of processes and their interactions and;

c)   the competence of personnel.

NOTE 3 The documentation can be in any form or type of medium.

4.2.2 Quality manual

The organization shall establish and maintain a quality manual that includes

a)        the scope of the quality management system, including details of and justification for any exclusions (see 1.2);

b)       the documented procedures established for the quality management system, or reference to them, and

c)        a description of the interaction between the processes of the quality management system.

4.2.3 Control of documents

Documents required by the quality management system shall be controlled. Records are a special type of document and shall be controlled according to requirements given in 4.2.4.

A documented procedure shall be established to define the controls needed:

a)        to approve documents for adequacy prior to issue;

b)       to review and update as necessary and re-approve documents;

c)        to ensure that changes and the current verision status of documents are identified;

d)       to ensure that relevant versions of applicable documents are available at points of use;

e)        to ensure that documents remain legible and readily identifiable;

f)        to ensure that documents of external origin are identified and their distribution controlled, and

g)       to prevent the unintended use of obsolete document, and to apply suitable identification to them if they are retained for any purpose.

4.2.4 Control of records

Records shall be established and maintained to provide evidence of conformity to requirements and of the effective operation of the quality management system. Records shall remain legible, readily identifiable and retrievable. A documented procedure shall be established to define the controls needed for the identification, storage, protection, retrieval, retention time and disposition of quality records.

5 Management responsibility

5.1 Management commitment

Top management shall provide evidence of its commitment to the development and implementation of the quality management system and continually improving its effectiveness by:

a)    communicating to the organization the importance of meeting customer as well as statutory and regulatory requirements;

b)   establishing the quality policy ;

c)    ensuring that quality objectives are established;

d)   conducting management reviews,and

e)    ensuring the availability of resources.

5.2 Customer focus

Top management shall ensure that customer requirements are determined and met with the aim of enhancing customer satisfaction (see 7.2.1 and 8.2.1).

5.3 Quality policy

Top management shall ensure that the quality policy:

a)        is appropriate to the purpose of the organization;

b)       includes a commitment to comply with requirements and continually improve the effectiveness of the quality management system;

c)        provides a framework for establishing and reviewing quality objectives;

d)       is communicated and understood within the organization;

e)        is reviewed for continuing suitability.

5.4 Planning

5.4.1 Quality objectives

Top management shall ensure that quality objectives, including those needed to meet requirements for product (see 7.1 a) are established at relevant functions and levels within the organization. The quality objectives shall be measured and consistent with the quality policy.

5.4.2 Quality management system planning

Top management shall ensure that

a)   the planning of the quality management system is carried out in order to meet the requirements given in 4.1,as well as the  quality objectives, and

b)  the integrity of the quality management system is maintained when changes to the quality management system are planned and implemented.

5.5 Responsibility, authority and communication

5.5.1 Responsibility and authority

Top management shall ensure that the responsibilities, authorities are defined and communicated within the organization.

5.5.2 Management representative

Top management shall appoint a member of the management who, irrespective of other responsibilities, shall have responsibility and authority that includes:

a)   ensuring that processes needed for the quality management system are established, implemented and maintained;

b)  reporting to top management on the performance of the quality management system and any need for improvement,and

c)   ensuring the promotion of awareness of customer requirements through the organization.

NOTE: The responsibility of a management representative can  include liaison with external parties on matters relating to the quality management system.

5.5.3 Internal communication

Top management shall ensure that appropriate communication processes are established within the organization and that communication takes place regarding the effectiveness of the quality management system.

5.6 Management review

5.6.1 General

Top management shall review the organization’s quality management system, at planned intervals, to ensure its continuing suitability, adequacy and effectiveness. This review shall include assessing opportunities for improvement and the need for changes to the quality management system, including the quality policy and quality objectives.

Records from management reviews shall be maintained (see 4.2.4).

5.6.2 Review input

The inputs to management review shall include information on

a)   results of audits;

b)  customer feedback;

c)   process performance and product conformity;

d)  status of preventive and corrective actions;

e)   follow-up actions from previous management reviews;

f)   changes that could affect the quality management system, and

g)  recommendations for improvement.

5.6.3 Review output

The outputs from the management review shall include any decisions and actions relate to:

a)   improvement of the effectiveness of the quality management system and its processes;

b)  improvement of product related to customer requirements,and

c)   resource needs.

6 Resource management

6.1 Provision of resources

The organization shall determine and provide the resources needed

a)   to implement and maintain the quality management system and continually improve its effectiveness, and

b)  to enhance customer satisfaction by meeting customer requirements.

6.2 Human resources

6.2.1 General

Personnel performing work affecting product quality shall be competent on the basic of appropriate education, training, skills and experience.

6.2.2Competence, awareness and Training

The organization shall:

a)   determine the necessary competency for personnel performing work affecting product quality;

b)  provide training of take other actions to satisfy these needs;

c)   evaluate the effectiveness of the actions taken;

d)  ensure that its personnel are aware of the relevance and importance of their activities and how they contribute to the achievement of the quality objectives, and

e)   maintain appropriate records of education, training, skills and experience(see 4.2.4).

6.3 Infrastructure

The organization shall determine, provide and maintain the infrastructure needed to achieve conforming to product. Requirements. Infrastructure includes, as applicable

a)   buildings, workspace and associated utilities;

b)  process equipment, (both hardware and software),and

c)   supporting services. (such as transport or communication).

6.4 Work environment

The organization shall determine and manage the work  environment needed to achieve conformity of product requirements.

7 Product realization

7.1 Planning of realization processes

The organization shall plan and develop the processes needed  for product realization. Planning of the product realization processes shall be consistent with the other requirements of the quality management system(see 4.1).

In planning for product realization, the organization shall determine the following, as appropriate:

a)   quality objectives and requirements for the product;

b)  the need to establish processes, documentation, and provide resources  specific to the product;

c)   required verification, validation, monitoring, inspection and test  activities specific to the product, and the criteria for  product acceptance;

d)  records needed to provide evidence that the realization processes and resulting product meet requirements (see 4.2.4).

The output of this planning shall be in a form suitable for the organization’s method of operations.

NOTE 1 A document specifying the processes of the quality management system (including the product realization processes) and the resources to be applied to specific product, project or contract, can be referred to as a quality plan.

NOTE 2 The organization may also apply the requirements given in 7.3 to the development of product realization processes.

7.2 Customer-related processes

7.2.1 Determination of requirements related to the product

The organization shall determine:

a)        requirements specified by the customer, including the requirements for delivery and post-delivery activities;

b)       requirements not stated by the customer but necessary for specified or intended use,where known,

c)        statutory and regulatory requirements related to product,and

d)       any additional requirements determined by the organization.

7.2.2 Review of requirements related to the product

The organization shall review the requirements related to the product. This review shall be conducted prior to the organization’s commitment to supply a product to the customer (e.g. submission of tenders, acceptance of a contract or orders, acceptance of changes to contracts or orders) and shall ensure that:

a)   product requirements are defined;

b)  contract or order requirements differing from those previously expressed are resolved,and

c)   the organization has the ability to meet defined requirements.

Records of the results of the review and actions arising from  the review shall be maintained  (see 4.2.4).

Where the customer provides no documented statement of requirement, the customer requirements shall be confirmed by the organization before acceptance.

Where product requirements are changed, the organization shall be ensure that relevant documents are amended and that relevant personnel are made aware of the changed requirements.

NOTE: In some situations such as in internet sales, a formal review is impractical for each order. Instead the review can cover relevant product information such as catalogues or advertising  material .

7.2.3 Customer communication

The organization shall determine and implement effective arrangements for communication with customers in relation to:

a)   product information;

b)  enquiries, contracts or order handling, including amendments;

c)   customer feedback, including customer complaints.

7.3 Design and development

7.3.1 Design and development planning

The organization shall plan and control design and development of  product.

During the design and development planning, the organization shall determine:

a)   the design and development stages.

b)  The review, verification and validation that are appropriate to each design and development stage,and

c)   The responsibilities and authorities for design and development .

The organization shall manage the interfaces between different groups involved in the design and development to ensure effective communication and clear assignment of responsibilities.

Planning output shall be updated, as appropriate, as the design and development progresses.

7.3.2 Design and development inputs

Inputs relating to product requirements shall be determined and recorded  maintained (see 4.2.4). These shall include:

a)   functional and performance requirements;

b)  applicable statutory and regulatory requirements;

c)   where applicable, information derived from previous similar designs, and;

d)  other requirements essential for design and development.

These inputs shall be reviewed for adequacy. Requirements shall be complete, unambiguous and not in conflict with each other .

7.3.3 Design and development outputs

The outputs of the design and development shall be provided in a form that enables verification against the design and development inputs shall be approved prior to release.

Design and development output shall:

a)   meet the input  requirements for design and development .

b)  provide appropriate information for purchasing, production and service provision;

c)   contain or reference product acceptance criteria,and

d)  specify the characteristics of the product that are essential for its safe and proper use.

7.3.4 Design and development review

At suitable stages, systematic review of design and development shall be performed in accordance with planned arrangements (see 7.3.1)

a)   to evaluate the ability of results of design and development to meet requirements, and

b)  to identify any problems and propose necessary actions.

Participants in such reviews shall include representatives of functions concerned with the design and development stage(s) being reviewed. Records of the result of the reviews and any necessary actions shall be maintained (see 4.2.4).

7.3.5 Design and development verification

Verification shall be performed in accordance with planned arrangements (see 7.3.1) to ensure that the design and development outputs have met the design and development input requirements. Records of the results of the verification and any necessary actions shall be recorded (see 4.2.4).

7.3.6 Design and development validation

Design and development validation shall be performed in accordance with planned arrangements (see 7.3.1) to ensure that the resulting product is capable of meeting the requirements for the specified application or intended use, where known. Wherever practicable, validation shall be completed prior to the delivery or implementation of the product. Records of  the results of validation and any necessary actions shall be maintained  (see 4.2.4).

7.3.7 Control of design and development changes

Design and development changes shall be identified and recorded maintained. The changes shall be reviewed, verified and validated, as appropriate, and approved before implementation. The review of design and development changes shall include evaluation of the effect of the changes on constituent part and product already delivered.

Records of the results of the review of changes and any necessary actions shall be maintained (see 4.2.4).

7.4 Purchasing

7.4.1 Purchasing control

The organization shall ensure that purchased product conforms to specified purchase requirements. The type and extent of control applied to the supplier and the purchased product shall be dependent upon the effect  of the purchased product on subsequent product realization or the final product.

The organization shall evaluate and select suppliers based on their ability to supply product in accordance with the organization’s requirements. Criteria for selection, evaluation and re-evaluation shall be established. Records of the results of evaluations and any necessary actions arising from the evaluation shall be maintained (see 4.2.4)

7.4.2 Purchasing information

Purchasing information shall describing the product to be purchased, including where appropriate:

a)   requirements for approval of product, procedures, processes,  and equipment;

b)  requirements for qualification of personnel, and

c)   quality management system requirements.

The organization shall ensure the adequacy of specified requirements prior to their communication to the supplier.

7.4.3 Verification of purchased product

The organization shall establish and implement the inspection or other activities necessary for ensuring that purchased product meets specified requirements.

Where the organization or its customer intends to perform verification at the supplier’s premises, the organization shall state  the intended verification arrangements and method of product release in the purchasing information.

7.5 Production and service provision

7.5.1 Control of production and service provision

The organization shall plan and carry out the production and service provision under controlled conditions. Controlled   conditions shall include, as applicable:

a)   the availability of information that describes the characteristics of the product;

b)  the availability of work instructions, as necessary

c)   the use of suitable equipment ,

d)  the availability and use of monitoring and measuring devices;

e)   the implementation of monitoring and measurement ,and

f)   the implementation of release, delivery and post-delivery activities.

7.5.2 Validation of processes  for production and service provision

The organization shall validate any processes for production and service provision where the resulting output cannot be verified by subsequent monitoring or measurement. This includes any processes where deficiencies become apparent only after the product is in use or the service has been delivered.

Validation shall demonstrate the ability of the processes to achieve planned results.

The organization shall establish arrangements for these processes including, as applicable:

a)        defined criteria for review and approval of the process;

b)       approval of equipment and qualification of personnel;

c)        use of specified methods and procedures;

d)       requirements for records (see 4.2.4),and

e)        revalidation.

7.5.3 Identification and traceability

Where appropriate, the organization shall identify the product by suitable means throughout product realization.

The organization shall identify the status with respect to monitoring and measurement requirements.

Where traceability is a requirement, the organization shall control and record the unique identification of the product (see 4.2.4).

NOTE: In some industry sectors, configuration management is a  means by which identification and traceability are maintained.

7.5.4 Customer property

The organization shall exercise care with customer property while it is under the organization’s control or being used by the organization. The organization shall identify, verify, protect and safeguard customer property provided for use or incorporation into the product. If any customer property is lost, damaged or otherwise found to be unsuitable for use, this shall be reported to the customer and records maintained (see 4.2.4).

NOTE: Customer property can include intellectual property.

7.5.5 Preservation of product

The organization shall preserve the conformity of product during internal processing and delivery to the intended destination. This preservation shall include identification, handing, packaging, storage and protection. Preservation shall also apply to the constituent parts of a product.

7.6 Control of monitoring and measuring  devices

The organization shall determine the monitoring and measurement to be undertaken and the monitoring and measuring devices needed to provide evidence of conformity of product to determined requirements.

The organization shall establish processes to ensure that monitoring and measurement can be carried out and are carried out in a manner that is consistent with the monitoring and measurement requirements.

Where necessary to ensure in valid results, measuring equipment shall

a)   be calibrated and verified at specified intervals, or prior to use, against measurement standards traceable to international or national measurement standards; where no such standards exist, the basis used for calibration or verification shall be recorded;

b)   be adjustments or re-adjusted as necessary;

c)   be identified to enable calibration status to be determined;

d)   be safeguarded from adjustments that would invalidate the measurement results;

e)   be protected from damage and deterioration during handling, maintenance and storage;

In addition, the organization shall assess and record the validity of the previous measuring results when the equipment is found not to conform to requirements. The organization shall take appropriate action on the equipment and any product affected.

Records of the results of calibration and verification shall be maintained (see 4.2.4).

When used in the monitoring and measurement of specified requirements, the ability of computer software to satisfy the intended application shall be confirmed. This shall be undertaken prior to initial use and reconfirmed as necessary

NOTE: See ISO 10012-1 and ISO10012-2 for guidance.

8 Measurement, analysis and improvement

8.1 General

The organization shall plan and implement the monitoring, measurement, analysis and improvement processes needed

a) to demonstrate conformity of the product;

b)to ensure conformity of the quality management system, and

c)       to continually improvement the effectiveness of the quality management system.

This shall include the determination of applicable methods including statistical  techniques, and the extent of their use.

8.2 Monitoring and measurement

8.2.1 Customer satisfaction

As one of the measurement of the performance of the quality management system,the organization shall monitor information relating to customer perceptions as to whether the organization has met customer requirements. The methods for obtaining and using this information shall be determined.

8.2.2 Internal audit

The organization shall conduct internal audits at planned intervals to determine whether the quality management system:

a)   conforms to the planned arrangements(see 7.1) to the  requirements of this international Standard and to the quality management system requirements established by the organization, and

b)  is effectively implemented and maintained.

An audit programme shall be planned taking into consideration the status and importance of the processes and areas to be audited as well as the results of previous audits. The audit criteria, scope, frequency and methods shall be defined. Selection of auditors and conduct of audits shall ensure objectivity and impartiality of the audit process. Auditors shall not audit their own work.

The responsibilities and requirements for planning and conducting audits, recording and reporting of results and maintaining records (see 4.2.4) shall be defined in a documented procedure.

The management responsible for the area being audited shall ensure that actions are taken without undue delay to eliminate detected nonconformities and their causes. Follow-up activities shall include the verification of the actions taken and the reporting of verification results (see 8.5.2).

NOTE See ISO 10011-1,ISO 10011-2 and ISO 10011-3  for guidance.

8.2.3 Monitoring and measurement of processes

The organization shall apply suitable methods for monitoring and, where applicable, measurement of the quality management system processes. These methods shall demonstrate the ability of the processes to achieve planned results. When planned results are not achieved, correction and corrective action shall be taken, as required, to ensure conformity of the product.

8.2.4 Monitoring and measurement of product

The organization shall monitor and measure, the characteristics of the product to verify that product requirements have been  met. This shall be carried out at appropriate stages of the product realization process in accordance with the planned arrangements (see 7.1).

Evidence of conformity with the acceptance criteria shall be maintained. Records shall indicate the person(s) authorizing release of product (see 4.2.4).

Product release and service delivery shall not proceed until the planned arrangements (see 7.1)have been satisfactorily completed, unless otherwise approved by a relevant authority, and where applicable by the customer.

8.3 Control of nonconforming product

The organization shall ensure that product which does not conform to product requirements is identified and controlled to prevent its unintended use or delivery. The controls and related responsibilities and authority for dealing with nonconforming product shall be defined in a documented procedure.

The organization shall deal with nonconforming product by one or more of the following ways:

a)        by taking action to eliminate the detected nonconformity;

b)       by authorizing its use, release or acceptance under concession by a relevant authority, and where applicable, by the customer;

c)        by taking action to preclude its original intended use or application.

Records of the nature of the nonconformity and any subsequent actions taken including concessions obtained shall be maintained (see 4.2.4).

When nonconforming product is corrected it shall be subject to re-verification to demonstrate conformity to the requirements.

When nonconforming product is detected after delivery or use has started, the organization shall take action appropriate to the effects, of the nonconformity.

8.4 Analysis of data

The organization shall determine, collect and analyze appropriate data to demonstrate the suitability and effectiveness of the quality management system and to evaluate where continual improvement of the effectiveness of the quality management system can be made. This shall include data generated as a result of monitoring and measuring and other relevant sources.

The analysis of data shall provide information relating to:

a)   customer satisfaction (see 8.2.1);

b)  conformance to product requirements (see 7.2.1);

c)   characteristics and trends of processes and products including opportunities for preventive action, and

d)  suppliers.

8.5 Improvement

8.5.1 Continual improvement

The organization shall continually improve the the effectiveness of the quality management system through the use of the quality policy, quality objectives, audit results, analysis of data, corrective and preventive actions and management review.

8.5.2 Corrective action

The organization shall take corrective action to eliminate the cause of nonconformities in order to prevent recurrence. Corrective action shall be appropriate to the effects of the nonconformities encountered.

A documented procedure shall be established to define establish requirements for:

a)   reviewing nonconformities (including customer complaints);

b)  determining the causes of nonconformities;

c)   evaluating the need for actions to ensure that nonconformities do not recur;

d)  determining and implementing the action needed;

e)   recording results of action taken (see 4.2.4), and

f)   reviewing corrective action taken.

8.5.3 Preventive action

The organization shall determine preventive action to eliminate the causes of potential nonconformities in order to prevent their occurrence. Preventive actions shall be appropriate to the effects of the potential problems.

A documented procedure shall be establish to define  requirements for:

a)   determining potential nonconformities and their causes;

b)  evaluating the need for action to prevent occurrence of nonconformities;

c)   determining and implementing action needed;

d)  records results of action taken (see 4.2.4), and

e)  reviewing preventive action taken.

品質管理体系  --  要求

1範圍

1.1     通則

本國際標準規定了品質管理体系的各項要求，以滿足當組織有下列需求時:

a)  須要展現其能力足以穩定地提供符合客戶或適當法規要求之產品,和

b)  透過体系的有效運用，包括持續改善與保證達成客戶和法規要求的流程，達到客戶滿意

備註：本國際標準中，〝產品〞一詞適用於預期提供予顧客或其所需要之產品。

1.2應用

此國際標準的所有要求乃通用性要求且期望能適用於所有組織,無論其行業、規模及所提供的產品，

本國際標準的任何要求若因組織或產品之特性而無法適用時可考慮予以排除

當本國際標準的任何要求被排除時，則組織不得宣稱其符合本國際標準，除非所排除的要求局限於本國際標準的第七章，且不影響組織提供符合客戶及適當法規要求產品的能力或責任

2 引用標準

本國際標準引用下列標準的內容以構成本國際標準的條款，所引用的標準如具日期版次，則其后之修訂或改版均不適用於本國際標準．然而依據本國際標準達成共識之各團體仍應探求使用下列標準文件最新版次的可能。引用的標準如未指定日期版次，則應使用最新的引用標準．ISO及IEC會員皆維持有最新有效國際標準的登錄清單。

ISO 9000:2000  品質管理体系 – 原理與詞彙

3 名詞與定義

ISO 9000:2000中之與定義均適用於本國際標準。

本國際標準用來描述供應鏈之名詞更動如下，以反映目前的習慣用語：

供應商 à 組織 à 顧客

本版次以“組織”取代先前1994版次使用的”供應商”，以表示採用本國際標準的單位。而”供應商”則用來取代之前版次的”分包商”。

本國際標準全文之中,”產品”一詞亦等同於”服務”。

4 品質管理体系

4.1一般要求

組織應遵照本際際標準的要求建立、文件化、執行、維持品質管理体系並持續改善其有效性。

組織應：

a)   鑑別品質管理体系所需的過程及其在組織中之運用(見1.2)

b)  決定這些過程的順序及相互關係

c)   決定確保這些過程有效運作及管制的必要的準則及方方法，

d)  確保提供支援這些過程的運作及監督必要的資源與資訊；

e)   量測、監控及分析這些流程，和

f)   采取必要行動以達成這些過程預期的結果及持續改善

組織應遵照本國際標準的要求管理這些過程．

當組織選用任何滿足產品與要求所需的外來資源流程時，組織應確認能掌控這些流程。品質管理体系之外來資源流程的控制應被定義。

備註：上述品質管理体系所須之過程包括管理活動、資源提供、產品實現與量測等過程。

4.2 文件化要求

4.2.1 通則

品質管理体系文件應包括：

a)      品質政策及品質目標

b)     品質手冊

c)      本國際標準要求的文件化程序；

d)     組織為確保其過有效規劃、運作及管制所需要的文件，及

e)      本國際標準要求之記錄（見4.2.4）

備註1 本國際標準中出現名詞”文件化程序”之處，係要求該程序須被建立、文件化、實施及維持。

備注2 各組織其品質管理体系文件化程度或有差別，端賴下列而定：

a)   組織的規模及活動型態；

b)  過程的複雜性及相互關係

c)   員工的能力。

備註3  文件可能為任何形式或種類的媒體。

4.2.2 品質手冊

組織應建立與維護品質手冊，其內容包含

a) 品質管理体系的範圍，包括對排除部份的細節與理由(見1.2)

b) 品質管理体系所建立的文件化程序，或參考該等程序，及

c) 描述品質管理体系各過程的順序及其彼此間之相互關係

4.2.3文件管制

品質管理体系所要求之文件應加以管制，記錄為一特殊型態之文件應依據4.2.4之要求加以管制。

應建立文件化之程序用以管制

a) 文件發行前，核准其正確性

b) 審查必要的更新與再次核准文件

c) 確定文件的最新版次狀態已被界定

d) 確保文件的改變及目前版次次狀態被標明

e) 確保使用各場所，持有相應版次的適當文件，

f) 確保外來原始文件被識別及管制分發，和

g) 防止作廢文件被誤用。如因任何目的而留存時，應被適當的鑑別

4.2.4記錄的管制

品質管理体系所須之記錄應被建立與維護，以証明符合品質管理体系要求的符合性及有效運作。品質紀錄應易於閱讀，識別及取用．應建立文件化程序以定義紀錄的識別、儲存、取用、保護、保存期限儲與處置方式。

5 管理責任
5.1 管理承諾

最高管理者應透過下列方式，以證明對其品質管理体系發展、實施與持續改善体系有效性之承諾:

a) 對組織內部溝通 - 符合客戶及法令要求的重要性

b) 建立品質政策

c) 確保品質目標被建立

d)  執行管理審查，和

e)   確保必要資源的提供

5.2 以客戶為中心

最高管理者應確保客戶之要求已被決定且滿足，以達到客戶滿意為目的(見7.2.1及8.2.1)

5.3 品質政策

最高管理者應確保其品質政策:

a)      適合組織的目地

b) 包括符合品質管理体系要求及持續改善体系有效性之承諾

c) 提供一個建立及審查品質目標之體制

d) 於組織中被溝通及了解

e) 審查其持續的適切性

5.4 規劃

5.4.1 品質目標

高階管理者應確保組織內各相關機能及各層級之品質目標被建立，品質目標包含符合產品要求之各項要求(見7.1.a).品質目標應可被量測，且必須與品質政策相一致。

5.4.2 品質管理体系規劃

高階管理者應確保：

a)        規劃品質管理体系以符合條文4.1節及品質止標之要求，和

b)       當品質管理体系計劃將有或已有變化時，維持品質管理体系之完整性。

5.5 責任,授權與溝通

5.5.1 責任與授權

高階管理者應確定組織內之責任、授權已被定義及溝通。

5.5.2管理代表

高階管理者應指派管理階層中之一員，不受其他責任影響，明定其責任與授權包含下列：

a) 確保品質管理体系所需之過程被建立、實施與維持

b) 向高階管理者報告品質管理体系執行之成效及必要之改善

c) 確保組織全員對客戶要求認知的提昇

備註  管理代表的責任可以包括與外部機構對品質管理体系有關事務的聯繫

5.5.3 內部溝通

最高管理者應確保組織內之溝通過程已被建立,並且對於品質管理体系有效性進行溝通

5.6 管理審查

5.6.1 通則

高階管理者應於事先計劃的間隔期間審查組織的品質管理体系,以確保其持續的適切性、正確性與有效性。管理審查應包括評估改善的機會與品質管理体系修正的必要性，包括政策與目標

管理審查的記錄需加以維護(參見4.2.4)

5.6.2 管理審查輸入

管理審查的輸入應涵蓋下列資訊：

a) 稽核的結果

b) 客戶回饋

c) 過程績效及產品符合性

d) 各項矯正預防措施的狀態

e) 前次管理審查決議事項的跟催

f)   可能影響品質管理体系的變化,和

g)  改善的建議

5.6.3 管理審查的輸出

管理審查的輸出應包括下列各項的決議與行動

a) 品質管理体系及各過程有效性的改善

b) 與客戶要求有關的產品改善

c) 資源的要求

6.資源管理

6.1 資源的提供

組織應決定與提供必須的資源，以

a) 執行和維護品質管理体系及持續改善其有效性，和

b)籍由符合客戶要求以增進客戶滿意

6.2 人力資源

6.2.1 通則

人員從事足以影響產品品質之工作,必須依其適當的教育、訓練、技能和經歷以勝任其工作

6.2.2 資格、認知與訓練

組織應：

a) 界定從事足以影響產品品質者之資格要求

b) 提供訓練或其他措施以滿足這些要求

c) 評估所采取措施的有效性

d) 確保員工認知本身作業的相關性與重要性及其對達成品質目標的貢獻,和

e) 維護適當的教育、訓練、技能及經驗的紀錄(見4.2.4)

6.3 基礎設施

組織應決定、提供及維護為達成符合產品要求必要的基楚設施，基楚設施包括可行的下列:

a) 建築物、工作空間及附屬的設施

b) 過程設備(包括軟、硬體設備), 和

c) 支援服務(例如：運輸、通訊)

6.4 工作環境

組織應決定和管理為達到符合產品要求的工作環境，

7 產品實現

7.1 產品實現的規劃

組織應規劃與展開產品實現所需要的各項過程,產品實現過程的規劃必須與品質管理体系其他過程的要求相一致

在規劃產品實現過程時，組織必須適當決定下列要項:

a)品質目標和產品要求;

b)針對產品所需過程、文件及資源的提供;

c)針對產品必要的驗證、確認、監控、檢驗與測試的活動及產品的允收標準

d)必要的記錄以証明產品實現過程與最終產品符合要求(見4.2.4)

此項規劃產出的結果,其格應適合其組織作業方法。

備註1  針對特定產品、專案或合約用以描述其品質管理体系所有過程(包括產品實現過程)及所需資源的書面文件,可被稱為品質計劃

備注2 組織亦可運用條文7.3的要求於產品實現過程的展開。

7.2 顧客相關的過程

7.2.1 決定產品相關的要求

組織應決定

a) 顧客已指明的要求，包括對交貨與售后的要求

b) 非顧客所明確指定，但對於已知特定或使用目的是必要的要求

c)        與產品相關法令及法規的要求,和

d)       組織自訂的任何額外要求

7.2.2 產品相關要求的審查

組織應審查產品相關的要求.此項審查應該在向客戶承諾提供產品之前完成(即:提出標單,接受合約或訂單,接受合約或訂單的變更)並且確保：

a)      產品的要求已被定義

b）合約或其他要求與先前表達有所不同處已被解決

c) 組織有能力滿足各項已定義的要求

審查結果及後續措施的紀錄必須加以維持（見4.2.4）

當客戶提出非文件化的要求時，組織在接受客戶要求前應加以確認。

當產品要求被改變時，組織應確保相關文件被修正，及相關人員都知道改變後的要求

備註：在某些情況下,例如網際行銷，對每一張訂單進行正式審查並不實際.取代的方式可以是對相關產品的資訊：例如型錄、廣告等加以審查。

7.2.3 客戶溝通

組織應決定及實施有效的安排,以進行下列與客戶有關的溝通：

a) 產品資訊;

b) 詢價，合約或訂單的處理及修改,和

e) 客戶回饋，包括客戶抱怨

7.3 設計與/或開發

7.3.1 設計與/或開發規劃

組織須規劃和管制產品的設計開發活動

在設計與開發規劃時,組織必須決定:

a) 設計開發過程的各階段;

b) 適合於各設計開發階段的審查,驗證和確認活動,和

c) 設計與開發活動的責任與授權.

組織需管理參與設計開發不同群組間的界面，確保有效的溝通和責任的分配，

規劃的結果必須依據設計與開發的進展加以適當地更新

7.3.2 設計與開發的輸入

有關產品要求的設計輸入必須加以決定和記錄(見4.2.4)，這些必須包括

a) 功能與性能要求,

b) 適用法規和法令要求,

c) 可行時,得自先前類似設計的資訊,及

d) 其它有關設計開發必要的要求

這些設計輸入應被審查其正確性，要求必須完整、明確且不與其他要求相衝突

7.3.3 設計與開發輸出

設計與開發輸出的格式必須能和設計與開發輸入相驗証,且在發出前被核準

設計與開發的輸出必須:

a) 符合設計與開發的輸入

b) 提供採購、生產及服務提供的適當資訊

c) 包含或引述產品之允收標準,和

d) 明定對安全及正當使用必備的產品特性

7.3.4設計與開發的審查

於適當階段，應依規劃的安排(見7.3.1)執行体系化的設計與開發的審查

a) 評估設計與開發結果符合要求的的能力,和

b) 指出問題並提出必要的措施

參與此類審查者,應包含與該階段審查有關功能的代表人員.必須維持設計審查其結果及任何必要措施的紀錄(見4.2.4)

7.3.5 設計與開發的驗證

設計與開發的驗證應依規劃的安排執行(見7.3.1)以確保設計與開發的輸出符合設計與開發的輸入．必須維持設計驗證其結果及任何必要措施的記錄(見4.2.4)

7.3.6 設計與開發的確認

設計與開發的確認應依規劃的安排執行(見7.3.1)，以確保最終產品能符合已知的特定應用或預期使用的要求。可行時，確認必須在產品交貨或執行前被完成。必須維持確認的結果及任何必要措施的紀錄（見4.2.4）

7.3.7 設計與開發變更的管制

必須鑑別設計與開發的變更並維持紀錄.此等變更必須被適當地審核、驗證及確認且於執行前獲得核准.設計與開發變更的審查必須包括對其組成零件和已交貨產品的影響評估.

必須維持變更審查的結果及任何必要措施的記錄(見4.2.4)

7.4 採購

7.4.1 採購過程

組織須確保採購品符合規定的要求，對於供應商及采購品的管制方式及范圍,應依采購品對后續產品的實現或最終產品影響的程度而定

組織須根據供應商提供符合組織要求產品的能力來評估及選擇供應商．用以選擇、評估及定期評供應商的標準估應建立．必須維持評估結果及任何后續必要措施的記錄(見4.2.4)

7.4.2 採購資訊

採購資訊必須清楚描述採購品，適當時，包括:

a)對產品、程序、過程及和設備的要求

b)人員資格的要求，和

c)品質管理体系要求

組織與供應商溝通前，應確保所規定要求內容的適當性

7.4.3 採購品的驗証

組織應建立及實施為確保采購品符合規定要求所需之檢驗及其他活動。

當組織或其客戶準備於供應商處進行驗証時，組織應於採購資訊中說明計劃驗証的安排及產品放行的方法。

7.5 生產及服務提供

7.5.1 生產及服務提供之管制

組織應在管制狀態下計劃及進行生產及服務的提供．管制狀態包括下列可行的項目

a) 提供描述產品特性的資訊

b) 必要時，提供作業說明

c) 使用適當的設備

d) 具備及使用量測與監控設備

e) 實施監控與量測，和

f) 實施放行、交付與售後活動

7.5.2 生產與服務提供過程的確認

當過程其結果輸出無法被隨後之監控或量測所驗證時。組織應確認生產及服務過程．這包括過程的缺陷唯有在產品使用或是服務已提供后才會顯現的任何過程。

過程的確認必須展現該等過程具有達成計劃結果的能力。

組織應建立此等過程確認的安排，可行時，應包括以下各項

a)定義過程審核與核准的準則；

b)設備與人員的資格的核準；

c)使用規定的方法與程序；

d)記錄要求(參見4.2.4)，和

e)再確認。

7.5.3 鑑別與追溯

適當時，組織於產品實現所有過程中應以適當的方式來鑑別產品

組織必須鑑別產品的量測與監控狀態

當追溯為一項要求時，組織應管制及記錄產品鑑別的特定方式(見4.2.4)

備註：在某些產業中，型態管理為達到識別與追溯的一種方式。

7.5.4 客戶財產

組織應注意被組織控管或使用的客戶財產，組織須鑑別、驗證、保護和維護客戶所提供使用於或組裝於產品之財產，任何客戶財產如發生遺失、損壞或發現不適用時,須向客戶報告並維持記錄(見4.2.4)

備註  客戶財產可包含智慧財產.

7.5.5 產品保存

在內部實現過程及交運至指定地點中，組織應確保產品符合要求，此處的保存應包括鑑別、搬運、包裝、儲存及防護．此項要求亦適用於產品的零組件

7.6 量測與監控設備的管制

組織應決定必需監控與量測，以及用以證明產品符合規定要求所需的量測與監控設備（見7.2.1）

組織應建立過程以確保監控與量測被執行，且其執行的方式相對監控與量測的要求是一致的．

當監控與量測的結果需確保正確時，量測的設備必須

a) 依規定周期或在使用前加以校正及驗証，比對的基準應可追溯至國際或國家的量測基準；如無此類標準存在時，應記錄校正或驗証所使用之基準

b)必要的調整或重復調整

c)足以識別其校正狀態的標識

d)妥善防護免於不當調整而致量測結果失效

e)於搬運、維護與儲存過程中加以保護以免造成損壞及劣化

除此之外，當發現設備不符其要求時，組織應評估及紀錄先前量測結果的有效性．組應對該設備及受影響之任何產品採取適當的措施。應維持校正及驗証結果的記錄(見4.2.4)

用於量測與監控規定要求的電腦軟體,應於首次使用前確認其具備足夠之能力滿足預期之運用,且於必要時進行再確認.

備註  見ISO10012-1及ISO10012-2指導綱要

8 量測、分析與改善

8.1 通則

組織應規劃與執行用以滿足下列要求之監控、量測、分析及改善所需過程:

a) 證明產品的符合

b) 確保品質管理体系的符合

c) 持續改善品質管理体系的有效性

這包括決定可行的方法,含統計技術及其使用的范圍。

8.2  監控與量測

8.2.1 客戶滿意

作為品質管理体系成效量測之一。組織應監控客戶所認知組織是否滿足其要求的資訊.取得及運用此等資訊的方法應被決定.

8.2.2 內部稽核

組織應於規劃的期間執行內部稽核以決定品質管理体系是否

a) 符合計劃的安排(見7.1),符合本國際標準的要求及組織所建立的品質管理体系要求,和

b) 有效的被執行與維持

稽核計劃的規劃應考量被稽核過程與區域的狀態及其重性和前次稽核結果.稽核的準則、范圍、頻率與方法必須加以定義.稽核人員的指派及稽核工作的執行必須確保稽核過程的客觀與公平．稽核員不得稽核自身的工作．

規劃稽核與執行及報告結果與維持紀錄（見4.2.4）的責任與要求應被定義於文件化的程序

被稽核區域的管理者應確保采取立即的矯正措施以消除所發現的不符合事項及其原因．后續追蹤應包括矯正措施執行結果的驗証及驗証結果的提報(見8.5.2)

備註  參見ISO10011-1, ISO10011-2及ISO10011-3指導綱要

8.2.3 過程的量測與監控

組織應對品質管理体系的各項過程運用適當方法加以監控及可行的量測.此等方法必須展現每項過程滿足其預期結果的能力.當預期結果未達成時,必須采取糾正及矯正措施以確保產品的符合性.

8.2.4 產品的監控與量測

組織應監控與量測產品特性，以驗證產品的要求已被達成，此量測與監控應根據計劃的安排(見7.1).於產品實現的適當過程中執行

符合允收標準的證據必須被維持，記錄應包括負責產品放行的權責人員(見4.2.4).

除非獲得相關權責及可行時客戶的准許,否則產品放行及服務的提供必須等到所有計進的安排(見7.1)均已完成且符合要求.

8.3. 不合格品管制

組織應確保不合格產品被識別與管制，以防止非預期的使用或交貨，不合格品的管制及處理的責任與授權,應被定義於文件化程序中.

針對不合格品,組織應該采取下列一項或多項措施:

a)採取行動消除所發現的不符合。

b)獲相關權責及可行時客戶的特準其使用、放行或接收。

c)採取行動以排除其預期之使用與運用

應維持不符合的特性及其后續的任何措施,包括特採取得的記錄(見4.2.4).

不合格品糾正后應該再次驗証以展現其符合各項要求

當不合格品在交運后或開始使用才被發現,組織應相對不符合的影響或其潛在影響采取適當的行動.

8.4 資料分析 

組織應決定、收集與分析適當的資料，以展現品質管理体系的適切性與有效性，並評估持續改善品質管理体系有效性的機會.這包括量測與監控結果及其他相關來源所產生之資料

組織應分析資料，在提供下列資訊:

a) 客戶滿意(見8.2.1)

b) 產品符合要求的程度(見7.2.1)

c) 過程及產品的特性及趨勢,包括預防措施的機會,和

d) 供應商

8.5 改善

8.5.1 持續改善

組織應透過品質政策、品質目標、稽核結果、資料分析、矯正與預防措施及管理審查的運用,以持續改善品質管理体系的有效性.

8.5.2 矯正措施

組織應採取矯正措施消除不符合原因，以防止再次發生，矯正措施應適切於所遇不符合的的影響程度。

應建立矯正措施的文件化程序以定義下列：

a) 審查不符合事項(包含客戶抱怨)

b) 決定不符合事項的原因,

c) 評估為確保不符合事項不會再度發生必要的措施

d) 決定及執行必要的矯正行動

e) 記錄矯正措施執行結果(見4.2.4)

f) 審查已執行的矯正措施

8.5.3 預防措施

組織應決定預防措施以消除潛在不符合的原因，以防止其發生，預防措施應適切於潛在問題的影響度

應建立預防措施的文件化程序應以定義下列：

a)決定潛在不符合事項及其原因

b)評估預防不符合事項發生的必要措施

c)決定及執行必要的預防措施

d)記錄預防措施執行結果(見4.2.4),和

e)審查已執行的預防措施