Beyond the knowledge requirements
Q: What are you seeing from organizations in terms of how they are responding to ISO 9001:2015’s subclause 7.1.6 about organizational knowledge? I often support knowledge management efforts in organizations, so I’m curious to see how they are approaching this requirement.
A: Until research has been published on what organizations are doing to comply with subclause 7.1.6 of ISO 9001:2015, I can only offer suggestions on how to approach the organizational knowledge requirement. This response is intended to spark ideas, not to provide an all-inclusive list of topics to address. Each organization must determine how this subclause’s requirements apply to its business and processes.
The requirements of subclause 7.1.6 can be summarized as follows:
- Determine the knowledge necessary to carry out processes, and achieve conformity of products and services.
- Maintain knowledge and make it available to the appropriate extent.
- Consider an organization’s current knowledge, and determine how to acquire or access any additional knowledge and updates required to address changing needs and trends.1
To carry out processes and achieve conformity in products and services, an organization should address all processes in the scope of its quality management system. For example, you should consider knowledge in areas (as they’re applicable to the organization) that relate to the standard, such as:
- Context of the organization: current strategy, competitive landscape, culture, political environment, quality relative to competitors, substitute products and services, and available technology.
- Leadership: customer requirements and preferences, laws and regulations, standards, and roles and responsibilities.
- Planning: strengths, weaknesses, opportunities and threats analysis; results of risk analysis; quality objectives; planned changes; research; design of experiments results; best practices; benchmarking results; make-or-buy decisions; quality function deployment results; and alternatives analysis.
- Support: resources, infrastructure, environmental requirements, measurement capabilities, employee education and skills, communication channels and processes.
- Documented information: policies, procedures, specifications and records.
- Operation: design specifications, material specifications, plans, work instructions, machine settings, process parameters, order of operations, approved tools, authorized repair actions, packaging methods, capacities, cycle times, tolerances, process variation, qualified procurement sources and supplier capabilities.
- Performance evaluation: corrective actions, lessons learned, audit results, process improvement, customer feedback, failure rates, process analysis, product wear-out and reliability.
With regard to maintaining knowledge and ensuring its availability, note that there is no requirement to document knowledge or to implement a knowledge management system. You should consider:
- How knowledge is maintained (mentally, digitally or manually, such as hand-written notes).
- Where knowledge is maintained (databases, documents, physical file systems, servers or cloud services).
- How knowledge is made available (word of mouth, training or procedures).
- How knowledge availability is maintained and protected (encryption, passwords or limited distribution).
To determine how to acquire new knowledge and updates that may be required in the future to address changing needs and trends, consider these areas:
- Triggers that indicate a need to obtain additional knowledge. This is a suggestion, not a requirement.
- How to identify what additional knowledge is required.
- How and where to obtain the additional knowledge.
- How knowledge is updated and what sources are used.
- What knowledge is updated and how often.
The organizational knowledge requirements could be addressed in isolation, but they should be integrated with other ISO 9001:2015 requirements such as roles, responsibilities and resources for knowledge-management activities; management reviews; customer focus; audits; document control; record retention; and control.
When it comes to defining organizational knowledge, and what is in and out of scope: That must be determined by each organization. For example, data can be found throughout the organization. Should it be included as a part of organizational knowledge? Merriam-Webster.com defines "knowledge" as "information, understanding, or skill that you get from experience or education" and an "awareness of something: the state of being aware of something."2
Data generally do not convey "information." Data can be analyzed or transformed to create information. Information is knowledge, but it could be argued that data would generally be excluded from subclause 7.1.6.
To address the organizational knowledge requirements of subclause 7.1.6, consider taking these four steps:
- Agree on an operational definition for "organizational knowledge," and decide what is in and out of scope.
- For each process, product and service, determine the knowledge necessary to carry out those processes and achieve conformity of products and services. This should be based on knowledge that is currently available in the business, not what should be available.
- For the knowledge identified in step two, determine how it will be maintained and made available.
- Because an organization’s knowledge needs may change over time, determine how to acquire or access additional knowledge. The requirement is to determine how to do it. This may include hiring a consultant or employee with the needed knowledge, conducting research, attending a seminar or other methods.
If you’re interested in going beyond the basic requirement of clause 7.1.6, consider the concept of knowledge transfer: Employees leave an organization with lessons learned and knowledge from experience that’s not shared with others. And documents from past projects are not reviewed during current projects, and mistakes recur in processes if employees are not aware of new practices. These are just a few of the opportunities that can be addressed by effective knowledge-transfer practices. Organizations that go beyond the basic organizational knowledge requirements in ISO 9001:2015 and leverage knowledge strategically will benefit greatly from this new clause.
Senior project manager
- International Organization for Standardization, ISO 9001:2015—Quality management systems—Requirements, subclause 7.1.6—Organizational knowledge.
- "Knowledge," Merriam-Webster.com, http://tinyurl.com/knowledge-defined.
Voluntary or mandatory audits?
Q: Shouldn’t an organization audit its own processes and procedures to ensure compliance before a third-party audit is scheduled?
A: One of the purposes of the internal audit process is that an organization should be able to detect opportunities and problems to be addressed before they escape or are passed along in the process. It would be wise to do an internal audit and management review to prepare for a certification audit. As W. Edwards Deming indicated, you don’t have to do this stuff, survival is not mandatory.1
Director of standards and consulting
Omnex Engineering and Management
Ann Arbor, MI
- "W. Edwards Deming Quotes," Brainyquote.com, http://tinyurl.com/deming-survival.