Toughest ISO 9001:2000 Requirements (7.5.2)

In an earlier newsletter, I identified twelve ISO 9001:2000 clauses as the toughest requirements to understand and meet with conforming practices. Clauses 4.1, 5.1, 5.4.1, 6.3, and 7.3.1 have been addressed in past newsletters.

This article picks up with clause 7.5.2, Validation of Processes for Production and Service Provision. It states (in part):

The organization shall validate any processes for production and service provision where the resulting output cannot be verified by subsequent monitoring or measurement. This includes any processes where deficiencies become apparent only after the product is in use or the service has been delivered.

The intent of validating a process is to ensure it is capable of achieving the planned results and the organization can demonstrate this capability. So, if you cannot fully verify the resulting product or service will meet the specified requirements, the process must be validated in advance (pre-qualified).

There are cases where the result of a process cannot be measured upon completion. For example, when pouring a concrete slab, the properties of the concrete are not known at the time of the pouring. For the slab to have the required strength, the amounts of cement, aggregate, and water are controlled, as well as, the mixing and delivery phases. Plus, the pouring and working of the concrete must be carried out by trained people.

Concrete doesn’t reach its full strength for several weeks, so samples taken at the time of pouring are not tested for a month. This is an example of a “special”  process where strict controls are needed to ensure the delayed test results will be acceptable.

Another situation for process validation is when the measurements cannot be made without harming the product. For example, to test a weld strength, the weld would be destroyed to obtain the necessary test pieces. Therefore, welders must be trained and qualified to perform welds according to the weld procedure to assure the weld strengths.

In addition to welding, other manufacturing processes that are candidates for qualification are soldering, painting, plating, casting, forging, and heat treating.

But how does process validation apply to service organizations? In some cases, the service is provided immediately to the customer, which doesn’t readily allow for inspection before the service is delivered. Consider a travel agency. Failure to give the right advice will likely not be discovered by the customer until after having attempted to use the incorrect travel information. So, service organizations are not exempt from the need to validate their special processes.

What about the need to validate software processes? Since many software deficiencies become apparent only after installation or use, an argument could be made that the production of any software is a special process. However, software “production” as addressed by clause 7.5.1 only covers product replication and packaging. The bulk of the work is back in software development and those activities are controlled by clause 7.3. The provisions of 7.3.4 (Review), 7.3.5 (Verification), and 7.3.6 (Validation) are the principal means for assuring software development quality.

Remember, these special types of processes will be identified as part of the planning addressed by clause 7.1. The organization has to determine if any processes require validation, if the personnel must be qualified based on established criteria, and its equipment must be qualified prior to use.

Validation shall demonstrate the ability of these processes to achieve planned results. The organization shall establish arrangements for these processes including, as applicable

a) defined criteria,
b) approval of equipment and qualification of personnel,
c) use of specific methods and procedures,
d) requirements for records (see 4.2.4), and
e) revalidation.

The requirement is to validate any special processes to show in advance that they can provide the planned results. But what does “validation” really mean?

Validation is defined by ISO 9000:2000, 3.8.5, as the “confirmation, through the provision of objective evidence, that the requirements for a specific intended use or application have been fulfilled.”

The subclauses of 7.5.2 (a-e) identify the necessary steps to validate a process. First, decide on the criteria for validating the process. Next, define the requirements for qualifying the people and approving any process equipment. Then, identify the specific methods and procedures to be used. Also, determine the records that must be kept to demonstrate all the required validation steps have been successfully completed. And, at planned intervals, or when process parameters change, the process must be re-validated.

A procedure for process qualification may include:

  • process definition, inputs, and outputs
  • process resources and controls
  • process parameters and operating conditions
  • process equipment and personnel qualification
  • product or service acceptance criteria
  • measurement, testing, and analysis
  • records of process validation
  • process changes requiring revalidation

As stated above, the requirement includes the “qualification” of personnel. Training alone is not sufficient. Qualification, according to ISO 9000:2000, 3.8.6, is the “process to demonstrate the ability to  fulfillspecified requirements.” Be prepared to show evidence that the personnel were able to demonstrate their competence.

ISO 9004:2000 Guidance
Some of you may have tried to find guidance for 7.5.2 in ISO 9004:2000, but found none. With no guidance included at that section of the document, the number 7.5.2 was assigned for guidance on 7.5.3, Identification and Traceabilty (which throws off the clause numbering for the rest of clause 7.5).

However, there is ISO 9004 guidance for 7.5.2, just not where you expected it. See, Product and Process Validation and Changes. It states that particular attention should be paid to validation of processes:

  • for high value and safety critical products,
  • where deficiency in product will only be apparent in use,
  • which cannot be repeated, and
  • where verification of product is impossible.

For those of you moving to ISO 9001:2000 from the 1994 edition, these “special” process requirements were included as part of clause 4.9, Process Control. Although worded differently, the requirements are basically the same.

If your organization had no “special” processes, your quality manual would have explained that a policy wasn’t included since the requirements weren’t applicable. Some of you may plan on using that precedent to exclude clause 7.5.2 in your new quality manual. However, don’t make that assumption too quickly. With the separate clause number and expanded coverage, coupled with re-trained 3rd party auditors, it might be determined that you actually have some processes that match the description of clause 7.5.2.

If a process is determined to be a special process at another company, it doesn’t automatically mean it will be a special process for your organization. The specified requirements for the two process outputs may be different. In addition, the organizations have different resources and equipment, which may allow one to determine conformity to requirements, while the other would have to handle the same process as a “special” process.

Any process, special or not, must be well defined and performed by competent people. If an organization properly plans and develops its production and service processes, there may not be a big difference between a process that can be verified and a special process that must be validated prior to its use.