When products enter production or services are about to be delivered, they should have already gone through a transition phase in which any variations due to special causes have been examined and tracked, and the only variations present are those due to common causes that fall within acceptable limits.
It is at this point that the paragraph 8.5.6 of ISO 9001:2015 comes into play because it deals with the control of any subsequent changes to this situation. A change is a situation in which the performance of any of the process parameters varies.
For example, they can increase or decrease to a level that is outside the tolerances that have been previously accepted. A natural variation within the accepted tolerances, therefore, does not fall into this case and is not classified in this context.
The changes that could arise are of different types:
- planned and authorized
- planned and unauthorized
- unplanned
Let's look at them one by one.
Planned and authorized changes
It is possible to make a planned and authorized change to the design of a product or service that requires varying the processes used for its production or delivery. Furthermore, planned and authorized changes can be made to processes to make them more efficient or effective.
Planned and unauthorized changes
A planned and unauthorized change is one that has gone through all the steps provided for the management of a change except for authorization. It may be decided to proceed with execution anyway when, for example, it is decided that the benefits of proceeding without authorization outweigh the risks due to a possible delay in the production of the product or the delivery of the service.
Unplanned changes
An unplanned change may be due to unknown causes that are detected during a regular review of process performance. At this point, it will be necessary to commit to understanding what caused the change and what to do to manage the process.
Review of changes
Reviewing a change in this context means determining the suitability, adequacy, or effectiveness of a change in order to achieve the established objectives. This is why the review takes place both before and after the change has been made. The action taken to determine what might be affected by the change before its execution is an assessment that will then be verified after the change has occurred.
Control of changes
Exercising active control over changes means ensuring that only desirable changes are made and preventing undesirable changes from being implemented. An unauthorized change may be both desirable and undesirable, depending on the risks involved, which must be assessed.
Why is such a requirement necessary?
If a change in production and service delivery processes were allowed without exercising a certain degree of control, it is highly likely that process performance would be negatively affected. The consequences may vary from case to case, but unless the effects are studied before making any changes, it would not be known how damaging the changes could be to final performance.
If changes in performance are detected for which there is no obvious explanation, an investigation is necessary to understand what happened and to contain any impact of the change on the product or service. Since a quality management system has a systemic perspective of the organization, it follows that a change in any of its elements could affect other elements of the system since everything is connected within a functioning whole.
Once processes are stable and produce outputs of acceptable quality, standard operating conditions must be established, i.e. a series of reference values to adhere to, and personnel must be discouraged from making any changes to the processes.
The key process parameters must be monitored regularly and process owners must be notified immediately of any changes in process performance that have not been planned. Any problems must be recorded, reported, and subject to investigation to determine the cause and to be able to take action after an adequate assessment of the potential impact.
Planned changes to products and services must be routed through the design change process, the output of which should be a plan that includes at least the following steps:
- an announcement to all interested parties communicating the date on which the change is expected to become effective;
- the name of the person or organization authorizing the change and all related references;
- a history of all activities to be carried out to undertake and validate the change;
- instructions on what action to take on products currently in production, in stock and already in service;
- the instructions necessary to change, if necessary, the infrastructure, equipment, processes and other resources, including - possibly - the training of process personnel
Everything affected by the change should be scheduled to go through this change. After careful consideration, the things to keep in mind should be at least the following:
- how, when and in what ways the current production or service delivery will cease, if necessary;
- if applicable, the extent to which current production or service provision can continue during the implementation of the change;
- the sequence in which the identified changes will be made;
- an accurate description of how the people affected will be informed of the changes to be made;
- a list of who will be involved in managing the change and the path leading to its full implementation;
- if applicable, a description of how infrastructure elements will be removed to install new ones;
- an accurate description of how the processes affected by the change will be redesigned and restarted;
- a description of how process capability will be verified or revalidated, if applicable;
- a forecast of when the effects of the change on the process will be examined;
- a description of what form the resumption of production or service delivery will take;
- a list of who will be notified of all this
Depending on the nature and extent of the change, information about the change may be in the form of a simple verbal instruction from the process owner to the set of information in a real dossier of considerable size with all the documented steps.
In this second case, it would be a good idea to foresee the intervention of a task force specifically dedicated to the implementation of the change.
Review of changes
After the plan for the change has been implemented, a review should be scheduled by those responsible for implementing the change to find answers to the following questions:
- Have all the actions taken been implemented as planned?
- Did the actions actually take place as planned?
- Did they achieve the desired goal?
The managers of the affected processes and key personnel involved in the execution of the change should participate in the review of the changes made so that no aspect related to the change is overlooked. The cause of deviations from what was planned should always be established, as should a plan to initiate corrective action be authorized and implemented.
If the plan is already in place, the appropriate changes should be made to it. How is the implementation of what is foreseen in this requirement demonstrated? Demonstrating that changes, whether they have been designed or are unexpected, to production or service provision are reviewed and controlled can be done simply in this way:
- presenting evidence of the performance of the process affected by the change and accurately demonstrating that any unplanned change has been subject to thorough evaluation;
- presenting evidence of the existence of a process designed for the evaluation of any changes to be made to production and service delivery;
- presenting evidence of the planning undertaken to execute the changes in a controlled manner;
- selecting a representative sample of the planned changes made to production and service delivery and demonstrating through evidence that they were carried out in accordance with the prepared plan