Internal Quality Auditors

Learning Session 01

February 14, 2009

NTC Boardroom, 1:00-3:30 pm

Auditing the Design and Development Process ISO

9001:2008 clause 7.3

Meaning:
refers only to design and development of products
and services.
not design and development of processes,
although it can be beneficial to apply the
methodology of clause 7.3 to the latter.

Auditing the Design and Development Process

Auditing Objective:
Determine whether the process is managed and
controlled to enable products to meet their
intended use and specified requirements.

Note: Auditing Design and Development Process for Service organization may be
different from traditional manufacturing organization.

What is
Product Design and Development?

Product Requirement

i.e. specifications, statutory

requirements and specific or
implied customer requirements

Transform
into

Specified Product
Characteristics

distinguishing features of the

product

Examples of product characteristics

ISO 9000:2005 clause 3.4.1
1.
2.
3.
4.
5.
6.

Physical (e.g. mechanical, electrical, chemical or

biological characteristics)
Sensory (e.g. related to smell, touch, taste, sight,
hearing)
Behavioral (e.g. courtesy, honesty, veracity)
Temporal (e.g. punctuality, reliability, availability)
Ergonomic (e.g. physiological characteristic, or related
to human safety)
Functional (e.g. maximum speed of an aircraft)

How to evaluate if exclusion of 7.3 is correct?

Establish who is responsible for defining the
characteristics of product or service together with
how and when it is carried out.
ISO 9001:2008 Clause 1.2 Application
are not acceptable unless these exclusions are limited w/in
Clause 7, and such exclusions do not affect the
organizations ability, or responsibility, to provide product
that meets customer and applicable statutory and
regulatory requirements.

Each stage has specific deliverables that cover both the commercial and technical aspects of design
and development of a product. In some cases, organizations might be able to justify the exclusion of
certain sub-clauses or individual requirements from their QMS without necessarily excluding the entire
clause.

How to start?
Establish what design and development projects
have been, and are currently being undertaken.
= select a sufficient number of projects to be able to audit all stages of the
design process

How to evaluate if there is on-going

D&D activity?
Validate by:

Ensuring that no changes have been effected to the

previous design

Reviewing relevant documents and records such as:

1. Relevant document to find out whether any amendment has been

issued during the review period.
2. Customer feedback to find out whether any design-related comment
has been received and auditee has taken appropriate action.
3. Nonconformity reports to find out whether any design-related NCs
have been recorded.

Records that we can take a look at

7.3.2

Design and development inputs relating to product requirements

7.3.4

Results of design and development reviews and any necessary

actions

7.3.5

Results of design and development verification and any necessary

actions

7.3.6

Results of design and development validation and any necessary

actions

7.3.7

Results of the review of design and development changes and any

necessary actions

Auditing the need for design & development

Triggering factors:
the organizations strategic planning;
market intelligence and research;
service reports;
customer feedback and demand;
new or changed statutory and regulatory
requirements;
process changes;
new technology;
suppliers.

(7.3.1) Auditing design and development planning

ISO 9001:2008 Clause 7.3.1
The organization shall plan and control the design and development of product.
During the design and development planning, the organization shall determine
a.
b.
c.

The design and development stages,

The review, verification and validation that are appropriate to each design and
development stage, and
The responsibilities and authorities for design and development.

The organization shall manage the interfaces between different groups involved in design
and development to ensure effective communication and clear assignment of
responsibility.
Planning output shall be updated, as appropriate, as the design and development
progresses.

ISSUES to CONSIDER:

what is the overall flow of the design planning process?

how is it described?
what resources and competencies are required?
what part of the design will be outsourced?
who is responsible and are the authorities defined?
how are (internal and external) interfaces between various groups
identified and managed?
are the required verification, validation and review points defined?
are the main milestones and timelines identified?
is the implementation and effectiveness of the plan monitored?
is the plan updated and communicated to all relevant functions as
necessary?

(7.3.2) Auditing design and development inputs

ISO 9001:2008 Clause 7.3.2
Inputs relating to product requirements shall be determined and
records maintained. These inputs shall include
a)
b)
c)
d)

Functional and performance requirements

Applicable statutory and regulatory requirements
Where applicable, information derived from previous similar designs,
and
Other requirements essential for design and development.

The inputs shall be reviewed for adequacy. Requirements shall be

complete, unambiguous and not in conflict with each other.

(7.3.2) Auditing design and development inputs

When auditing the design and development inputs,
auditors should develop an understanding of how
the organization identifies its own inputs based on:

the organizations products and processes;

financial, environmental, health and safety issues;
organizational risks and impacts;
customers requirements and expectations;
statutory and regulatory requirements applicable to the
product .

(7.3.2) Auditing design and development inputs

Auditors should
evaluate the risks,
the possible implications for customer
satisfaction, and
issues that the organization may encounter if
some relevant inputs are not considered.

(7.3.3) Auditing design and development outputs

ISO 9001:2008 Clause 7.3.3
The outputs of design and development shall be in a form suitable for
verification against the design and development input and shall be
approved prior to release.
Design and development outputs shall
a)
b)
c)
d)

Meet the input requirements for design and development

Provide appropriate information for purchasing, production and service
provision,
Contain or reference product acceptance criteria, and
Specify the characteristics of the product that are essential for its safe
and proper use.

Note: Information for production and service provision can include details for
the preservation of products.

(7.3.3) Auditing design and development outputs

D&D outputs should comply with the identified needs in
order to ensure that the resulting product can fulfil its
intended use. Outputs can include information relevant to
the following:
marketing, sales and purchasing;
production;
quality assurance;
information for service provision and maintenance of the
product after delivery
and, should be provided in a form that enables verification and
validation activities to be performed.

(7.3.3) Auditing design and development outputs

Auditors should obtain evidence from the projects

selected to confirm that:
information regarding the completion of design and
development stages is available;
the design and development process has been
completed for the stage under review;
design and development outputs have been confirmed

(7.3.4) Auditing the design and development process

and design reviews

ISO 9001:2008 Clause 7.3.4

At suitable stages, systematic reviews of desig and development shall be
performed in accordance with planned arrangement (see 7.3.1)
a)
b)

To evaluate the ability of the results of the design and development to

meet requirements, and
To identify any problems and propose necessary actions.

Participants in such reviews shall include representatives of functions

concerned with the design and development stage(s) being reviewed.
Records of the results of the reviews and any necessary actions shall be
maintained.

(7.3.4) Auditing the design and development process and

design reviews

Auditors should
verify that the overall design and development process is
controlled in accordance with the organizations original plan being
reviewed
the design and development reviews take place at appropriate
planned stages
Participated by representatives from concerned/related functions

(7.3.4) Auditing the design and development process

and design reviews

The following issues should be considered by auditors when examining

the review process:
do reviews occur at planned stages throughout the design process?
are the reviews carried out in a systematic way involving representatives
of the functions concerned with the stage(s) being reviewed?
have all original and any new inputs been considered ?
are the original outputs still relevant or have revised outputs been
identified?
have revised inputs and outputs been reviewed and approved by those
with the relevant responsibility and authority (including the customer
where appropriate)?
does the output demonstrate the suitability, adequacy and effectiveness
of the designed product?
are the relevant design objectives being achieved?
are there adequate records of reviews?

(7.3.5) Auditing design and development

verification
ISO 9001:2008 clause 7.3.5
Verification shall be performed in accordance with
planned arrangements (see 7.3.1)to ensure that the
design and development outputs have met the design
and development input requirements. Records of
the results of the verification and any necessary
actions shall be maintained (see 4.2.4)

(7.3.5) Auditing design and development

verification
Design and development verification is aimed at providing assurance
that the outputs of a design and development activity have met the
input requirements for this activity as shown in Figure 2 below.

(7.3.5) Auditing design and development

verification
Verification can comprise activities such as:
performing alternative calculations;
comparing a new design specification with a
similar proven design specification;
undertaking demonstrations including prototypes,
simulations or tests; and,
reviewing documents prior to issue.

(7.3.5) Auditing design and development

verification
Auditors should determine that the design and development verification activities
should provide confidence that:

required verifications are planned and that verification is performed as

appropriate during the design and development process;
the completed design or development is acceptable and the results are
consistent with and traceable to the initial requirements;
the completed design or development is the result of implementation of a
proper sequence of events, inputs, outputs, interfaces, logic flow, allocation of
timing, etc;
the design or development provides safety, security, and compliance with
other requirements and design inputs;
evidence is available to demonstrate that the verification results and any
further actions have been recorded and confirmed when actions are
completed.

Auditors should determine that only verified design and development outputs
have been submitted to the next stage, as appropriate.

(7.3.6) Auditing design and development

validation
ISO 9001:2008 Clause 7.3.6
Design and development validation shall be performed in
accordance with planned arrangements (see 7.3.1) to ensure
that the resulting product is capable of meeting the
requirements for the specified application or intended use,
where known. Wherever applicable, validation shall be
completed prior to the delivery or implementation of the
product. Records of the results of validation and any
necessary actions shall be maintained (see 4.2.4).

(7.3.6) Auditing design and development

validation
confirmation by examination,
provision of evidence, that the particular requirements for
specific intended use are fulfilled.
Is the validation process capable of checking that the final
product and/or service will meet, or does meet, the
customers needs when it is in use ?

Validation methods should be specified as part of the

design and development planning process, although these
could be modified during the realization of design and
development.

(7.3.7) Auditing design and development changes

ISO 9001:2008 Clause 7.3.7
Design and development changes shall be identified ad
records maintained. The changes shall be reviewed, verified
and validated, as appropriate, and approved before
implementation. The review of design and development
changes shall include the evaluation of the effect of the
changes on constituent parts and product already delivered.
Records of the results of the review of changes and any
necessary actions shall be maintained (see 4.2.4)

(7.3.7) Auditing design and development changes

Changes to design and development shall be:

Identified
Reviewed
Verified and validated, as appropriate
Approved before implementation
Records maintained

(7.3.7) Auditing design and development changes

Review of changes shall include:

Evaluation of the effect of the changes on
constituent parts and product and products
already delivered
Maintain records of the results of review and any
necessary actions

(7.3.7) Auditing design and development changes

Design and development changes made during the design process
need to be controlled.
Auditors should consider the following:
are the sources and requests for changes properly identified and
communicated?
is the impact of any change evaluated?
is any additional design proving or testing undertaken where appropriate?
are the effects of the changes on constituent parts and product already
delivered evaluated?
has appropriate approval been given before a change is implemented (this
could include statutory or regulatory approval or approval by the client)?
are the changes fully documented and do records include information
regarding any necessary additional actions?

KEY POINTS IN SUMMARY

1) Plan design activities,
2) Determine the requirements,
3) Execute the initial design,
4) Test the design to see if it met requirements,
5) Change the design if you have to until you can confirm you
met the requirements,
6) Document the process, specs and changes, and
7) Get the customer to confirm it's what they wanted.

Examples

Scenario 1 :
Customer property (intellectual property) controlled by a bank

Situation:
A bank provides a variety of services to its customers (i.e. personal and
company bank accounts), but chooses to implement a QMS only for its
Internet banking services. For this service the bank has claimed
conformity to ISO 9001:2008. The bank clearly states in its Quality
Manual which services are covered by the QMS. The bank applies all the
requirements of ISO 9001:2008 for the realization of its Internet
banking services, with the exception of sub-clause 7.5.4 Customer
property. The bank does not feel that it has possession of any customer
property as part of its Internet banking services and has stated this in
the justification for the exclusion of sub-clause 7.5.4 Customer property
from its QMS.

Issue(s):
Can the bank exclude sub-clause 7.5.4 Customer property from its QMS
and claim conformity to ISO 9001:2008?

Scenario 2 :
Exclusion of design and development by a contract manufacturer
Situation:
XYZ Electronics is building a new factory to perform manufacturing of mobile
phones, as a subcontractor. It has only one customer and this customer
maintains responsibility and authority for product design. XYZ Electronics is
responsible for purchasing of all components and for performing the
manufacturing activities. The customer provides XYZ with the manufacturing
and parts specifications, and is also responsible for notifying XYZ of any
design changes and providing the appropriate change information.
XYZ Electronics, in the development of its QMS, has excluded the
requirements of ISO 9001:2008 sub-clause 7.3 Design and development. XYZ
Electronics considers the customer specifications as a customer supplied
product and therefore controls this according to ISO 9001:2008 sub-clause
7.5.4 Customer property.

Issue(s):
Can the XYZ Electronics exclude sub-clause 7.3 Design and development from
its QMS and claim conformity to ISO 9001:2008?

Scenario 3 :
Regulators permit the exclusion of design development
Situation:
KML designs and fabricates pressure vessels for electricity generating
stations, in accordance with various mandatory pressure vessel
regulations.
The regulatory authority has not yet revised its requirements to take
ISO 9001:2008 into account, but has confirmed that it will continue not
to require manufacturers QMSs to include design. On this basis KML
decides to exclude sub-clause 7.3 Design and development from its QMS
and to claim conformity to ISO 9001:2008.

Issue(s):
Can KML exclude sub-clause 7.3 Design and development from its QMS
and claim conformity to ISO 9001:2008?