ISO 9001 clause 8.1: plan the controls before delivery begins

What clause 8.1 requires in practice

Clause 8.1 asks the organisation to plan, run and keep under control the processes it needs in order to meet the requirements for its products and services, and to carry out the actions determined during the planning in clause 6. The planning has five parts: determining the requirements for the offering, establishing criteria for accepting products and services, establishing criteria for the processes themselves, implementing control of the processes in line with those criteria, and determining the resources needed to achieve conformity.

The clause then adds three expectations. Documented information must be available to the extent needed to give confidence that processes ran as planned, and as evidence that products and services conform. The organisation must keep planned changes under control, and review what follows from unintended ones, acting to reduce any harm. And anything provided by outside parties that is relevant to the system, whether process, product or service, must be controlled, with detail in clause 8.4. The clause does not call for a separate operational plan for each job. Existing project, production or service arrangements can serve, provided they show the criteria, controls and resources in place before work begins.

Distinguish process criteria from acceptance criteria

Acceptance criteria concern whether the product or service meets the relevant requirements. Process criteria concern how the work is controlled so it can produce that result. Both matter. A team may follow a procedure faithfully while working toward an acceptance condition that does not reflect the customer's actual requirement.

Determine the resources needed and implement controls in accordance with the criteria. Consider who makes important decisions, what information is necessary and how exceptions are handled. Planning should be sufficiently clear for people to operate the process, not simply document that management intends good quality.

Why operational planning matters to the business

Planning decides whether quality is built in or inspected in afterwards. When criteria and controls are set before work starts, teams know what good looks like, resources are available when needed, and problems are caught near their source where they are cheaper to fix. Without planning, delivery depends on the heroics of individuals, and results vary between shifts, sites and customers. The clause also makes management think about changes before they happen, which reduces the surprise failures that follow a rushed alteration. For the customer, planned control means more consistent service and fewer unpleasant discoveries after delivery. In an audit, a clear link between requirement, criteria, control and result is one of the strongest signs that the system works.

How to implement clause 8.1

Use a representative order or service as the test case. One way Sterling's teams do it is to follow it and ask at each step what must be true for the result to be acceptable.

1. Record the requirements the order or service must meet, including those from customers and legislation.
2. Set acceptance criteria describing when the product or service is considered conforming.
3. Set process criteria describing how the work must be carried out to deliver that result, such as inputs, settings and checks.
4. Decide the controls that apply the criteria, for example inspections, approvals, system validations or supervision.
5. Determine the people, equipment, information and time the work needs, and confirm they are available before it starts.
6. Define what information will show the work was done as planned, using existing records where possible, and name who keeps it.
7. Agree how planned changes are approved and how unplanned ones are reviewed for harm, and who decides what happens next when they are found.

Evidence an auditor expects for clause 8.1

The auditor follows a live job against its plan. Typical evidence includes:

• acceptance and process criteria that can be seen to apply to the sampled work;
• records or system data showing that planned checks and approvals took place;
• observation that the resources defined for the work were in place when it began;
• interviews with operators about the criteria and what they do when a result falls outside them;
• records of a recent change, showing how it was approved or, if unplanned, how consequences were reviewed.

Common nonconformities with clause 8.1

Auditors most often meet planning that stops short of the shop floor or the service desk.

• Acceptance criteria are missing or vague, so staff cannot tell whether a result conforms.
• Planned controls are not applied in the work, or are skipped when schedules are tight.
• Resources such as competent staff or equipment were not available when the work began.
• A change in process or tooling was introduced without evaluating its effect on conformity.
• There is no information showing the work was carried out as planned.

Illustrative software example: planning a customer release

Illustrative BPO example: a new processing service

A hypothetical BPO provider begins processing a new type of customer submission. The team defines what information must be present, how incomplete submissions are handled and what constitutes an acceptable completed output. It determines the staffing, instructions and review resources needed for the expected work.

During initial operation, an unforeseen submission format appears. The team controls affected work, reviews the consequences and adjusts the process through appropriate authority. It retains sufficient evidence to explain the decision and the resulting output. The example shows how operational control handles variation rather than assuming the original plan anticipated every case.

Use documented information for two purposes

The clause requires documented information to the extent necessary for confidence that processes have been carried out as planned and as evidence of product and service conformity. Those purposes may use related records, but they are not identical. A completed process step may not establish that the acceptance criteria were met.

Choose information suited to the work and its complexity. A transaction system, project record or controlled inspection result may already provide appropriate evidence. Avoid adding a duplicate quality form where the existing information is sufficient, but do not omit necessary evidence merely because the process is familiar to experienced staff.

Control planned and unintended changes

Planned changes need control. Unintended changes require review of their consequences and action to mitigate adverse effects as necessary. Examples could include an unexpected resource loss, a changed input or a deviation from the intended sequence. The organisation should recognise when the basis of the plan has changed.

A useful response identifies the affected work, evaluates what remains valid and determines the necessary action. The clause does not prescribe a single change form or universal escalation threshold. Choose arrangements that allow significant changes to reach people with the authority and competence to respond.

Keep external provision within the control arrangement

Externally provided processes, products and services relevant to the QMS must be controlled under the related 8.4 requirements. Operational planning should account for those interfaces. A provider's activity can affect the organisation's acceptance decision even when the work takes place elsewhere.

Common failures include vague acceptance criteria, plans disconnected from actual resources and records that show activity without a result. Another is allowing an unexpected change to become the normal method without review. Follow one delivery from requirements to output and test whether the planned controls explain what happened.