What Does ISO 9001 Require?

Such a broad question might best be answered, “It depends upon the circumstances.” It’s a bit like asking, “What does the law require?” The answer depends upon the situation in which it is being applied.

Let’s take part of ISO 9001:2008, 7.2.2 as an example:

“The organization shall review the requirements related to the product. This review shall be conducted prior to the organization”s commitment to supply a product to the customer (e.g. submission of tenders, acceptance of contracts or orders, acceptance of changes to contracts or orders) and shall ensure that:

a) product requirements are defined,

b) contract or order requirements differing from those previously expressed are resolved, and

c) the organization has the ability to meet the defined requirements.

Records of the results of the review and actions arising from the review shall be maintained (see 4.2.4).”

One organization might generate sales orders as evidence of successful review and acceptance of customer purchase orders. In this case, the above ISO 9001 requirements apply directly to that organization’s sales orders and to their respective customer purchase orders. Review activities resulting in accepted sales orders are also subject to these requirements. Since order review and acceptance is evidenced by the generation of sales orders, sales orders are regarded as quality records and must be maintained accordingly. In this case, the above ISO 9001 requirements may be construed as follows:

Before sales orders are generated, customer purchase orders must be reviewed to ensure that product requirements are defined, that any requirements differing from those previously expressed are resolved, and that the organization has the ability to meet those requirements. Records of sales orders must be maintained according to the requirements of ISO 9001:2008, 4.2.4.

Meanwhile in another organization, the evidence of successful review and acceptance of a customer’s purchase order might be order entry in “the PO Log.” In this case, ISO 9001 applies to the log and to the activities resulting in each log entry. So, in this case, the standard’s requirements might be construed as:

Before orders are recorded in the PO Log, customer purchase orders must be reviewed to ensure that product requirements are defined, that any requirements differing from those previously expressed are resolved, and that the organization has the ability to meet those requirements. The PO Log must be maintained according to the requirements of ISO 9001:2008, 4.2.4.