Context of the Organization, or “Know Thyself”

What is “the context”?

The ISO 9001 requirement to define the context of the organization is as important as it is poorly understood.

Intuitively, it makes sense that organizations should understand themselves before they can ensure their management systems (quality or otherwise) are capable of delivering the intended results.

The organization should understand the market it serves, its business and regulatory environment, the products it makes (or services it delivers), knowledge unique to itself, and more.

To implement this, the Standard has explicit requirements in clauses 4.1 (relevant external and internal issues), 4.2 (relevant interested parties and their requirements) and 4.3 (scope of the quality management system).

Where to start

ISO 9000:2015 (not to be confused with ISO 9001!), provides some useful guidance about relevant internal and external issues. Under the heading “Fundamental concepts,” it lists some potential internal factors: values, culture, knowledge, and performance. It then goes on to mention external factors such as legal, technological, competitive, market, cultural, social, and economic environments.

This is a helpful way to visualize relevant external and internal issues:

Each organization must determine its own relevant issues, but these examples are a good starting point.

Relevant “interested parties”? Stakeholders!

Before defining the needs and expectations of relevant interested parties (4.2), we have to define the interested parties themselves, but only those that are ‘relevant to the quality management system.’ ISO 9000:2015 lyrically defines an interested party (or stakeholder) as a ‘person or organization … that can affect, be affected by, or perceive itself to be affected by a decision or activity’ of the organization.

Relevant interested parties should vary from one organization to the next, but generally include customers, employees, external providers, stockholders, regulatory agencies, and the community.

Many organizations find table to be very useful. It lists the relevant interested parties and assigns specific external or internal issues to each one, along with applicable risks and opportunities (as defined in clause 6.1):

What is not applicable?

Next, in clause 4.3, the organization must explain why particular requirements are not applicable. An organization can be certified, while not fulfilling some requirements of the Standard, only if the requirements that are not applicable ‘do not affect the organization’s ability or responsibility to ensure the conformity of its products and services and the enhancement of customer satisfaction.’ Although the prose is beautiful, it is not Charlotte Brontë, but ISO 9001:2015.

By far the most common nonapplicable element is 8.3 (Design and Development).

Next, the scope of the quality management system ‘…shall state the types of products and services covered…’

What do we do and how does it affect our certificate?

An organization’s ISO 9001 certificate states what activity is actually certified, the ‘scope of certification.’ This should mirror the management system scope.

If anything about the scope changes, it is vital to alert the certification body. A special audit may be required to ensure the continued validity of the certificate.

Relevant changes include physical relocation, expanding to additional locations or acquiring other businesses, changing the products and services the organization delivers, etc.

Who we are, what we believe in, and how we behave

An organization that complies with the requirements of clauses 4.1, 4.2 and 4.3 knows exactly what it does for a living, the internal issues that make it what it is, the external issues that can affect it, who its relevant interested parties are and what matters to them.

In short, such organization truly knows itself and is ready to tell the world what it believes in (the quality policy) and what it intends to do about it (its quality objectives).

Now go forth and prevent.