How to Write an ISO or API Compliant Quality Manual

The bad news is that this won’t be a one-page Quality Manual. A one-page Quality Manual is just not an “accepted” practice, so unless you are ready to put up a fight with Mr. Auditor, do not bother. The good news is that the Quality Manual I will present here will get you closer to being perfect in an audit, rather than just being efficient. At our firm, we coach our clients to aim for zero nonconformities during their Stage 2 audit, therefore this manual is as good as it gets in the Quality Manual world.

The steps I follow to build a good, thorough Quality Manual that meets the requirements of ISO 9001, API Spec Q1 9th Edition and API Spec Q2 are as follows:

1. Talk about your organization
2. Define your scope
3. Create your process map
4. Develop your procedures
5. The content of the Quality Manual
6. Review and Approve

I will present a summary of each step below.

1. Talk about your organization

The first section of your Quality Manual should tell me a bit about your organization. Whether I’m a new employee, a customer, or Mr. Auditor, I want to know about your company: when it was founded or established, what the products and services are, and details about the locations. Nothing is better than starting a Quality Manual by introducing your very own organization, so reserve the first section for highlighting your company.

2. Define your scope

Section two of the Quality Manual should consist of your Scope and Exclusions for your quality management system. One of the requirements of the ISO 9001, as well as API Spec Q1 9th Edition and API Spec Q2, is to include the scope and exclusions in the Quality Manual, as shown below:

Of course, I recommend that before you even start embarking on getting your organization certified, you need to define your scope, so you know exactly what areas of your organization will be part of your quality management system. A good scope tells what the company does or provides and may include limitations such as the locations where the organization operates or the industries it serves.

Examples of good scopes, both with no exclusions, are below:

• The design and execution of drilling and workover applications, using air, mist, foam, aerated fluid, and other underbalanced drilling techniques, for the petroleum, gas, and geothermal industries.
• The provision of engineering solutions and adaptive fluid power systems for the Industrial, Marine, and Offshore Industries.

Here is a real excerpt from our very own Quality Manual, to show you a nice way to display it:

Although the Scope is one of the first things you do, it will more than likely be revised, refined, and polished a few times before certification. By the time you get ready to create a Quality Manual, you should have a well-thought-out and well-written scope.

One last thing on Scope: The Scopes I presented here have been accepted by either ISO or API. Here is an example of a bad scope that unfortunately, I see sometimes:

The scope of this manual is to specify the requirements for this quality management system where our organization will demonstrate its ability to provide product that meets customers and applicable statutory and regulatory requirements; and to enhance customer satisfaction through the effective application of the system.

In essence, when it comes to Scope, you do not want to regurgitate the ISO or API standard.

3. Create your process map

Section three of your Quality Manual should include a description of your processes and their interaction. If you have read my article, “Do You Feel Like Your Company is acting like a Chicken without a Head?” you may know my strong belief that adopting the process approach is key to a good management system. In fact, I often compare a company’s main process map to the blueprint for a building’s foundation: Without a good plan, no matter how fancy the house is, it will eventually crumble.

A good process map should exhibit the following traits:

1. It’s readable – You read that right. If your process map has arrows going in every direction, or looks like a hieroglyph, then you certainly still have some work to do.
2. Easily recognize inputs and desired outputs – This will help to show what the right direction of the activities are.
3. Distinguish Core versus Support processes: This is critical because we understand that the core is what makes the company money.

Other pointers I recommend are:

1. Separate product realization (what I call core processes) versus support processes. For example, Document Control is a process that is embedded everywhere in your organization; you should put it on the support processes area rather than trying to add it in multiple places in your product realization or core processes. If you try to embed your support processes within your core processes, that’s when you start making it muddy.
2. Add the procedure numbers to your processes if there is a one-to-one correlation. This makes for a crystal clear representation of your quality management system documentation, which all of your employees will surely appreciate and want to use.

Here is an excerpt from our very own Quality Manual to show you a good way to display your process map:

One last thing on Process Maps: The Process Map I presented here has gone through various audits and has been deemed acceptable. Here is an example of a bad process map that unfortunately I still see sometimes:

This is just ISO’s representation of the Plan Do Check Act (PDCA) cycle and should not be taken as your own process map. In essence, when it comes to Process Map, you still do not want to regurgitate the ISO or API standard.

4. Develop all your procedures

That’s correct. You have to develop all your procedures before you even think of starting drafting the Quality Manual. I often grin (to put it nicely) when I go to Clients who want to get certified and they tell me they already have a Quality Manual, yet they don’t even have procedures or know what their processes are. You cannot build your manual unless you have created all your procedures. That is a fact, and anyone who tells you different is probably making a bogus Quality Manual for you.

Now, it is important for you to understand that some auditors will interpret the requirements of API or ISO as being “All-your-procedures-must-be-referenced-in-the-Quality-Manual,” while others are content to know that you referenced the “applicable” procedures. Again, because we aim at zero nonconformities at Stage 2, we highly recommend that you reference ALL of them. Therefore, if you have a gazillion of them, this is a good time to bring out the good old “document pyramid scheme” and separate your procedures from your work instructions, and perhaps even manuals or policies. You want to have a manageable size that truly answers the requirements of the ISO or API standards and that fits into your Quality Manual.

5. The Content of the Quality Manual

Now comes the best part: filling in the “meat” of your Quality Manual. Think of the standard as if it was a list of questions, where you have to answer them by stating what procedure you use to accomplish each of the requirements.

Here are a few excerpts from various areas of ISO 9001, API Spec Q1 9th Edition, and API Spec Q2 that show how they are worded within the Quality Manual:

• (ISO 9001:2008) 4.2.3 Control of Documents

Documents associated with the QMS are controlled and approved prior to issue according to the Control of Documents procedure MXP-ADM-001.

• (API Spec Q2) 4.4.2 Control of Documents

ACME Offshore Services has established a Control of Documents procedure SOP-001, for the identification, distribution, and control of documents required by the quality management system and by API Specification Q2, including required documents of an origin external to ACME.

• (ISO 9001) 7.4.1 Purchasing Process

In order to ensure that its purchased products and services meet specified requirements, Mireaux Management Solutions selects and monitors its suppliers based on criteria described in the Supply Chain procedure MXP-ADM-007.

• (API Spec Q2) 5.6.1 Purchasing Control

ACME Offshore Services ensures that purchased or outsourced services and service-related products conform to specified requirements. This is done through the Supply Chain procedure SOP-006.

• (API Spec Q1 9th Edition) 5.6.1.1 Purchasing Control Procedure

ACME Manufacturing maintains a documented procedure to ensure that purchased products or outsourced activities conform to specified requirements. This is done through the New Critical and Non-Critical VendorEvaluation procedure SOP-007 and the Critical and Non-Critical Vendor Reevaluation procedure SOP-008.

• (API Spec Q1 9th Edition) 5.3 Risk Assessment and Management

ACME Manufacturing maintains a Risk Assessment procedure SOP-015 to control risks associated with the impact on delivery and quality of the product. The Risk Assessment procedure provides a technique for conducting a risk assessment regarding product delivery and product quality.

While these are just a few excerpts and examples, you want to apply the same approach to every one of the clauses throughout the standard or specifications. And, by the way, follow the sections of the standard or specifications in your own Quality Manual. That is, create as many sections as the standard or spec has. So if you started with section 4, you should continue with section 5, 6, and so on, until you have covered all the sections of the standard or spec.

A word of advice between ISO 9001 and API Spec Q1 or Spec Q2: You have more leeway in ISO 9001 to deviate from the actual words of the standards. For API Spec Q1 9th Edition and API Spec Q2, however, I recommend you stick to the requirements, for the very reason that you will later have to complete the Conformity Matrix. If you deviate too much from the requirements, you will find yourself a rebel with a lost cause when filling out the Conformity Matrix, realizing that you should have stuck to the script in the first place.

Think of “Jeopardy,” where you see the question as a statement and you have to state the answer as a question. The only difference is that you put the two together as a final statement.

One final word on the Quality Manual: If you regurgitate the standard or spec without inserting a reference to your own procedures, you have pretty much missed the point. You need to make reference to your procedures, or you will end up with a useless Quality Manual.

6. Review and Approve

Once you have completed the Quality Manual, including all the sections shown in this article, the next step is to gather your top management and review it. Yes, you heard me right. If you are the QMS Coordinator, Management Representative, Consultant, or Quality Manager, make sure that the other members of management, such as Quality Director, VP of Operations/Quality or whomever is part of the top management, is available for review.

During the review, go over the entire Quality Manual, line by line, point by point, ensuring that your audience understands what is required and how the requirement is being met. This will help everyone link the Quality Manual with the actual procedures and acknowledge their importance. If you do this, and if you have involved your team during the development of procedures and managed them through a system approach, you will not only succeed, but I guarantee that you will empower your team to make a difference in your quality management system.

Are we there yet?

If you follow these steps, I know your Quality Manual will comply with the requirements of ISO 9001, API Specification Q1 9th Edition and API Specification Q2, and will look pretty enough that everyone, including Mr. Auditor, will want to read it.