对质量方针、质量目标和管理评审的审核

对质量方针、质量目标和管理评审的审核

1.审核质量方针

只有在审核的整体结论的基础上，才能真正对质量方针及其有效展开情况进行评审。

审核方法应包括：

●与最高管理层面谈，了解其对质量的承诺和途径;

●通过管理评审的记录，评价最高管理者的承诺和在建立、实施、

监视和更新质量方针方面的参与程度;

●评价管理层是否有效地将质量方针“翻译”成易于理解的话，并

通过在各适当的职能／层次上确立相应的目标，将其变成在组织

所有层次上的指导方针;

●与员工面谈，验证他们是否有正确的意识和知识，理解组织的质

量方针与其本职活动的关系，不必在意他们使用什么样的词汇来

表达;

●搜寻质量方针通过适当沟通进行有效传播的证据。

2.审核质量目标

审核员需验证组织已规定了总的质量目标，质量目标反映了质量方针，并与总的经营目标（包括顾客期望）充分保持一致。如果不是，审核员应进一步评价最高管理者对质量的承诺。

质量目标的实现需要被测量和文件化。

质量目标的确定或文件化没有特定的方式，质量目标可以通过经营计划、管理评审输出、年度预算等来体现。审核员应证明质量目标被充分文件化。

审核员应获得证据表明，质量目标以什么方式在组织的整个机构和过程中适当展开，并连接总的战略目标直到管理目标，向下连接到具体的操作活动。

在审核过程中，建议在文件评审阶段就应检查文件化的质量目标。

在审核结束前，审核员应查证质量目标是现实的、恰当的，组织为实现目标向负责人员分配了所需的资源。此证据应在组织的各层次上获得。

质量目标不是一成不变的，需要随着当前的经营环境和持续改进的要求不断更新，审核组应验证组织的整体业绩是否反映了质量方针的目的，是否很好地实现了质量目标。

审核员应记住，目标的实现是能够以定量或定性的方式进行测量的，还应记住，在质量方针和质量目标的修订机制，以及组织持续改进的承诺之间应建立明确的联系。

3.审核管理评审

ISO 9001:2000要求最高管理层按照计划的时间间隔对组织的质量管理体系进行评审，以确保其持续的适宜性、充分性和有效性。管理层可以单独开会来进行评审，但这不是标准的要求。最高管理层可以通过很多方法来评审质量管理体系，比如听取并评审管理者代表或其他人员的报告，通过电子方式进行沟通或定期召开管理会议（在会上还可以讨论预算和目标这样的事项）。

管理评审是一个过程，管理评审的实施和对管理评审的审核都应当采用过程方法。

ISO 9001:2000条款5.6.2规定了管理评审过程的输入，这些输入应作为管理评审的议题。但是，管理评审并不是只能包括这些方面。管理评审中可能不会逐一或同时讨论这些议题，而是作为对业务的总体评审的一部分来讨论。审核员应当意识到输入可以有很多形式，如报告、趋势图等等。

作为管理评审过程的输出，应当有以下决定的证据：

●质量方针和目标的变化；

●改进计划和可能的改进措施；

●资源变化；

●修订的业务计划；

●预算。

输出不仅仅与改进或变化相关，也包括对其他重要事项作出的决定，如引进新产品的计划。

标准要求保留管理评审的记录，但并未规定记录的形式。会议纪要是最常见的记录，但电子记录、统计图表、演示稿等也是可被接受的记录形式。

管理评审过程还可以包括对过程和体系的做出考虑的质量管理体系策划的内容。在这种情况下，审核员应当审查下列方面是否已得到了考虑：

●管理体系或业务的变化在整体上会对体系或业务的其他部分产

生影响吗？

●在实施所建议的更改前，对其进行评估了吗？

●在编制战略计划时，是否考虑了诸如标准条款4.1中的问题？

●在开始将一个过程外包前，是否识别了所需的控制？管理评审过程不仅仅是为了满足标准和审核员的要求，还应该成为组织经营管理过程中不可分割的一部分。全面的管理评审是一个在组织各层面实施的复杂过程，是由最高管理层根据来自组织各个层次的输入而实施的一个双向过程。管理评审的活动可以是每天、每周或每月的会议，或是部门会议，也可以是简单的讨论或报告。

审核员应当寻找证据来证明管理评审过程的输入和输出与组织的规模以及复杂程度相关，并被用于业务的改进。审核员还应当考虑组织的管理层结构是什么样的，这个机构是怎样来运用管理评审过程的。

Date: 12 December 2005 ISO 9001 Auditing Practices Group

Guidance on:

Auditing Quality Policy, Quality Objectives and

Management Review

1. Auditing quality policy

The quality policy and its effective deployment can only be truly assessed based on the overall results of the audit.

Audit methods should include:

•Interviewing Top Management to understand their approach and commitment to quality; (click here to link to the guidance paper on the auditing of Top Management processes)

•Evaluating, through the records of management review, the commitment and involvement of Top Management in the establishment, implementation, monitoring and updating of the quality policy;

•Assessing whether Management has effectively “translated” the quality policy into understandable words and guidelines at all levels of the organization, with corresponding objectives at each applicable function / level;

•Conducting interviews with personnel to verify if they have the required awareness, understanding and knowledge of the way the organization’s quality policy relates to their own activity, regardless of the terms used by such people to express their understanding;

•Seeking evidence of effective dissemination of the quality policy by appropriate communication.

2. Auditing quality objectives

Auditors need to verify that the organization’s overall quality objectives have been defined, that they reflect the quality policy, are substantially coherent, aligned and compatible with the overall business objectives, including customer expectations. If this is not the case, the auditors should further evaluate Top Management commitment to quality.

The fulfilment of quality objectives needs to be measurable and documented.

There is no specified way of identifying or documenting quality objectives, as these may appear through business plans, management review outputs, annual budgets, etc. It is up to the auditors to satisfy themselves that the objectives are adequately documented.The auditors should obtain evidence of the way the quality objectives are suitably cascaded throughout the organization’s structure and processes, linking the general strategic objectives to management objectives and down to specific operational activities.

It is recommended that the documented quality objectives should be examined at the documentation review stage of the audit.

Before the end of the audit, the auditors have to satisfy themselves that the quality objectives are realistic and relevant, and that the organization has assigned to responsible personnel the resources needed to meet their objectives. Evidence of this should be obtained at all levels of the organization.

Quality objectives are not static and need to be updated in the light of the current business climate and the quest for continual improvement. Auditors should verify that the overall performance of the organization reflects the aims of the quality policy and reasonably meets the quality objectives.

Auditors should keep in mind that the fulfilment of objectives can be measured in a quantitative or qualitative manner. They should also remember that there is a clear link between the dynamic aspects of revising the quality policy and the quality objectives and the commitment of the organization to continual improvement.

3. Auditing Management Review

ISO 9001:2000 requires top management to review the organization's quality management system, at planned intervals, to ensure its continuing suitability, adequacy and effectiveness. The review could be carried out at a separate meeting but this is not a requirement of the standard. There are many ways in which top management can review the quality management system such as receiving and reviewing a report generated by the management representative or other personnel, electronic communication or as part of regular management meetings where issues such as budgets and targets are also discussed.

The management review is a process that should be conducted and audited utilizing the process approach.

ISO 9001 clause 5.6.2 specifies the inputs to the management review process and these topics shall be included. However, these are not the only subjects that can be included in a review. They might not be addressed individually or simultaneously but as part of an overall review of the business. Auditors should be aware that inputs could be in many forms such as reports, trend charts and so on.

As output from the management review process, there should be evidence of decisions regarding:-

•change of quality policy and objectives,

•plans and possible actions for improvements,

•change of resources,

•revised business plans,

• budgets.

Output is not only related to improvements or changes but could include decisions on other important issues such as plans to introduce new products.

Records of management reviews are required but the format of these is not specified. Minutes of meetings are the most common type of record, but electronic records, statistical charts, presentations etc. could be acceptable types of records.

The management review process might also include elements of quality management system planning where changes to processes and systems are being considered. Where this is the case, the auditors should review whether or not the following points have been considered:-

•Will changes to the management system or business as a whole have an impact on other parts of the system or business?

•Are proposed changes evaluated before implementation?

•In preparing strategic plans, are issues such as those in 4.1 of the standard considered?

•Are the controls needed identified before the outsourcing of a process is begun? The management review process should not be an exercise carried out solely to satisfy the requirements of the standard and the auditors; it should be an integral part of the organization’s business management process. The overall management review is complex process carried out at various levels in the organization. It is always a two-way process, generated by top management with inputs from all levels in the organization. These activities could vary from daily, weekly, monthly, organizational unit meetings to simple discussions or reports.

Auditors should look for evidence that the inputs and outputs of the management review process are relevant to the organization’s size and complexity and that they are used to improve the business. Auditors should also consider how the organization’s management is structured and how the management review process is used within this structure.

- 7 -