Systematic process improvement using ISO 9001:2000 and CMMI

8.2 ISO 9001:2000 registration process 257
• Were design and development activities planned
• Were design objectives specified
• Was a life cycle with predetermined stages identified
• Was the design reviewed, verified, and validated
• Who was responsible for reviewing design and development
In addition, the auditor will verify that the organization has implemented
the QMS direction for review of design inputs, their relationships to the
requirements, outputs, and their adequacy for performing subsequent processes
such as production, coding, or purchasing. The auditor will verify
that design changes were documented and were implemented only when
approved.
Throughout the audit, the auditor verifies that measurement and monitoring
activities were performed and that data were collected and analyzed.
In each instance of the process audit, the auditor will determine the
effectiveness of those processes in practice. Because the audit trails are interactive,
the auditor will be able to make sure that the processes implemented
in an organization indeed form an interconnected system.
At the conclusion of the assessment, the assessor presents the identified
noncompliances (classified as major or minor) to the client and makes the
recommendation for certification or rejection. Shortly after the assessment,
a written report is created and delivered to the organization’s management
and to the Committee on ISO Registration, which reviews the report and
decides if certification will be granted. Any major noncompliance will require
corrective action and may require a corrective action assessment to be conducted
before certification is granted. The corrective action usually must be
implemented within 90 days.
After registration, surveillance audits are conducted on a yearly basis to
review compliance with selected elements of the standard. After 3 years, a
reassessment must be conducted to maintain registration. The reassessment
reviews all applicable ISO 9001 elements.
If the organization’s QMS changes significantly, and those changes affect
ISO compliance, the organization should inform the registrar. The registrar
may then decide to perform a special assessment to address those changes,
perform a new assessment, or take no action. Similarly, if the organization
increases or decreases the scope of the registration, reassessment may be
required or the changes in scope may be addressed in the next surveillance
assessment.