· Web viewThis document is intended to help identify gaps between current arrangements and the new ISO management system standards, and commence the planning of an IMS (integrated

IMS Gap Analysis

Based on the requirements of:

ISO 9001:2015 Quality management standard ISO 14001:2015 Environmental management standard ISO 45001:2016 Draft OHS management standard

CONTENTSClauses of the standards that specify requirements commence at 4.

4 CONTEXT OF THE ORGANIZATION

This document is intended to help identify gaps between current arrangements and the new ISO management system standards, and commence the planning of an IMS (integrated management system). It is not a substitute for the standards or an exhaustive definition of their requirements. It is a ‘plain English’ summary of those requirements with notes. The standards are open to other interpretations. The standards may be obtained from ISO, your local standards authority, or other sources.

The analysis may be updated as the system is developed / updated. In completing the Gap Analysis, identify how the requirement will be addressed in your system.

References to ISO 45001:2016 are to the FDIS or final draft version of that standard available at time of preparation. Whilst there may be changes when the final version is released, they are expected to be minor.

5 LEADERSHIP6 PLANNING FOR THE MANAGEMENT SYSTEM7 SUPPORT8 OPERATION9 PERFORMANCE EVALUATION10 IMPROVEMENT

IMS Gap analysis Copyright © 2016 Qudos Management Pty. Ltd. All rights reserved. Page 1 of 18

Analysis for

Analysis by Date Notes / SummaryInitial analysis

Compliance against each clause of the standard is indicated in the Status field. A simple traffic light system for cell background shading may be used to provide that indication. As follows:

Considered to be fully compliant

Considered to be partially compliant – some fine-tuning, further controls, or full implementation requiredConsidered to be non-compliant – controls either not developed or not widely implemented

N/A Clause not applicable to the organization

? Not verified

Note: The analysis is the opinion of the person performing it – based on the evidence sampled at the time. Due to the sampling nature of the analysis, other compliance issues may be present that were not detected at the time.


Summary of requirements How currently addressed Improvements planned Status Notes

4 CONTEXT OF THE ORGANIZATIONISO 9001 Quality - 4.1 Understanding the organization and its context ISO 14001 Environment - 4.1 Understanding the organization and its contextISO 45001 OHS - 4.1 Understanding the organization and its contextConsider what factors can affect the organization’s strategy and ability to achieve its intended results.

New requirement in all standards.

Consider external issues: Political, Economic, Social, Technological, Environmental, Legal (PEST or PESTEL)

Consider internal issues such as culture and resources.

Business plan SWOT (Strengths, Weaknesses,

Opportunities, Threats) analysis

Monitor and review information about those issues.


Could be achieved by periodic review.

ISO 9001 Quality - 4.2 Understanding the needs and expectations of interested partiesISO 14001 Environment - 4.2 Understanding the needs and expectations of interested partiesISO 45001 OHS - 4.2 Understanding the needs and expectations of workers and other interested partiesEstablish which interested parties are relevant to the organization’s IMS.


Relevant interested parties are people and organizations that can affect the IMS or be affected by it. These steps may be carried out in tandem with 4.1.

Determine what their relevant requirements are.


Legal / obligations review Customer survey Employee survey Expressed in contracts / SLAs / Permits

Determine if any requirements become a legal or compliance obligation (45001 and 14001).

Expansion / relocation of existing requirement.

Legislation Permits Charters Contracts / SLAs Voluntary arrangements – such as

industry association guidelines



Monitor and review information about them.

New requirement Periodic review. Permit management. Agenda item in management review.

ISO 9001 Quality - 4.3 Determining the scope of the quality management systemISO 14001 Environment – 4.3 Determining the scope of the environmental management systemISO 45001 OHS – 4.3 Determining the scope of the OH&S management systemDefine and document the scope of the IMS.

Scope statement Documented information on any claimed

non-applicability Information on the products & services

offered by the organization Availability on server / intranet / web site

The above may be included in a compiled document such as a ‘IMS Overview’

ISO 9001 Quality - 4.4 Quality management system and its processesISO 14001 Environment – 4.4 Environmental management systemISO 45001 OHS - 4.4 OH&S management systemDevelop and operate an IMS - including any necessary processes.

Integrate environmental and OHS requirements into operational and support processes.Overall Process map.

Determine the characteristics and relationships of processes.

More specific requirements in the new standard.

Overall Process map and individual Process plans.

From a project point of view, the requirements may already be addressed in Project plans.

Maintain documents to support operations, and keep records.

Document management system.Records management.



5 LEADERSHIP (Leadership and worker participation in ISO 45001)ISO 9001 Quality - 5.1 Leadership and commitmentISO 14001 Environment – 5.1 Leadership and commitmentISO 45001 OHS – 5.1 Leadership and commitmentTop management demonstrate their leadership of - and commitment to - the IMS.

More specific requirements in the new standard.

Attendance at management review and certification audits.

Communications to workers and others about the IMS.

Establishing policies. Allocation of resources. Other personal involvement.

Top management demonstrate their leadership and commitment with respect to having a customer focus (9001).

Market research Customer satisfaction survey, analysis

and action plans Agenda item in management review

ISO 9001 Quality - 5.2 Quality policyISO 14001 Environment - 5.2 Environmental policyISO 45001 OHS - 5.2 OH&S policyTop management establish, review and maintain a suitable policy.

Quality policy. Environmental policy. OHS policy. Any existing ‘top level’ policies will need

at least a minor update to reflect the new standards.

Subsidiary or related policies.

The policy is documented and implemented within the organization.

On display in premises, Intranet, Web site, part of induction. Verify understanding and implementation at internal audits.

The policy is available to relevant interested parties.

New requirement in ISO 9001:2015.

Web site. Part of contractor induction.



ISO 9001 Quality – 5.3 Organizational roles, responsibilities and authoritiesISO 14001 Environment – 5.3 Organizational roles, responsibilities and authoritiesISO 45001 OHS - 5.3 Organizational roles, responsibilities and authoritiesTop management ensure that people know their IMS responsibilities and authorities.

Org. chart, PDs, Delegation of Authorities, KPIs, Roles / Objectives in process plansRACI Matrix.

Responsibility and authority is specifically assigned to manage and report on the IMS.

PD for Compliance Manager.

ISO 45001 OHS - 5.4 Participation and consultationArrangements for workers or their representatives to participate in, and be consulted about the IMS.

OHS committee.Reporting mechanisms for hazards, incidents, and concerns.

6 PLANNING FOR THE MANAGEMENT SYSTEMISO 9001 Quality - 6.1 Actions to address risks and opportunitiesISO 14001 Environment - 6.1 Actions to address risks and opportunitiesISO 45001 OHS - 6.1 Actions to address risks and opportunitiesDetermine the risks and opportunities that need to be addressed.


Overall Business LevelUse formal (e.g. FMEA, Risk matrix, or Tie Line) or informal risk assessment process. The standard does not specify that this process must be documented.

Process LevelRisk section in Process Plans

Plan actions to address these risks and opportunities. Those actions being proportionate to the risks and opportunities presented.


Overall Business LevelAction plans following on from SWOT analysis

Process LevelControl section in Process Plans



Plan how to integrate and implement the actions into the IMS, and evaluate how effective they are.


Overall Business LevelAction plans following on from SWOT analysis

Process LevelControl / measurement sections in Process Plans

ISO 14001 Environment - 6.1.2 Environmental aspectsISO 45001 OHS - 6.1.2 Hazard identification and assessment of OH&S risksDetermine environmental aspects of activities, products and services that can be controlled or influenced. Determine their impacts over the anticipated life-cycle.

Consider normal operations, maintenance, and abnormal events such as emergencies.

Aspects and Impact Register (or integrated risk tools).

Life-cycle analysis IMS software.

There is a process for the identification of hazards.

Hazard identification procedure - how you will identify hazards from activities and facilities.

IMS software.

ISO 14001 Environment - 6.1.3 Compliance obligationsISO 45001 OHS - 6.1.3 Determination of applicable legal requirements and other requirementsConsider what compliance obligations might apply in relation to OHS / environmental aspects.

Compliance / legal review

Maintain documented information about them.

Compliance obligations register. Access to legislation. Standards watch / subscription services.

ISO 14001 Environment - 6.1.4 Planning actionISO 45001 OHS - 6.1.4 Planning to take actionTake action to address significant aspects, compliance obligations, risk and opportunities.Integrate those actions into the business.



Evaluate their effectiveness.

ISO 9001 Quality - 6.2 Quality objectives and planning to achieve themISO 14001 Environment - 6.2 Environmental objectives and planning to achieve themISO 45001 OHS - 6.2 OH&S objectives and planning to achieve themEstablish measurable objectives. New requirement regarding

processes.At management review, planning meetings

Document them – including the ‘who, what, when and how’.

Objective Register / IMS software KPIs Records kept as hard copy, Word/PDF

files or in software application

ISO 9001 Quality - 6.3 Planning of changes(Also see ISO 45001 OHS – 8.2 Management of change)When it is decided to make a change to the IMS, carry it out in a planned and systematic manner.


Change management procedure.



7 SUPPORTISO 9001 Quality - 7.1 ResourcesISO 14001 Environment - 7.1 ResourcesISO 45001 OHS - 7.1 ResourcesDetermine and provide the resources needed for the IMS.

Agenda item at management review. PEST or PESTEL / SWOT analysis

(Internal capacity and capability) Gap analysis Infrastructure / facilities Work environment Monitoring and measuring equipment /

resources (also see 9.1 regarding calibration)

Job planners / Timetables / calendars ERP software data Resources section in Process Plans Project Management Plans QESH Management Plans Knowledge retention / management

processes e.g. in the event of loss of key workers – might include apprenticeships, mentoring younger / less experienced workers, technical library, retreats, forums, conferences, wikis, collaboration software, IMS software (issues / audits / risk database)

Benchmarking across sites / business units

ISO 9001 Quality - 7.2 CompetenceISO 14001 Environment - 7.2 CompetenceISO 45001 OHS - 7.2 CompetenceDetermine the necessary levels of competence (for work that affects performance).

Training needs analysis. PDs

Ensure that the people doing that work are competent.

Training, education, experience, induction (company and site-specific).Training budget and programme.



Where applicable, take actions to acquire the necessary competence, and evaluate their effectiveness.

Training budget and programme. Assessment of competence.

Retain appropriate records. Training records. IDP / Performance review records.

ISO 9001 Quality - 7.3 AwarenessISO 14001 Environment - 7.3 AwarenessISO 45001 OHS - 7.3 AwarenessPeople working under the organization’s control shall be aware of:

IMS policies. Objectives that are relevant to

their role. How they contribute to the

effectiveness of the IMS. The implications of them NOT

conforming with requirements.

KPIs. Intranet Document management software Awareness session – perhaps as part of

management / staff meetings / Toolbox talks.

Correspondence with suppliers / subcontractors.

Also relates to ISO 45001 OHS - 5.4 Participation and consultation.

ISO 9001 Quality - 7.4 CommunicationISO 14001 Environment - 7.4 CommunicationISO 45001 OHS - 7.4 Information and communicationWith regard to the IMS, determine what to communicate, with whom, when, and how.

What: News of certification and milestones, major successes.How: Intranet, Web site, Blogs, Newsletters, Emails.

Also relates to ISO 45001 OHS - 5.4 Participation and consultation.



ISO 9001 Quality - 7.5 Documented informationISO 14001 Environment - 7.5 Documented informationISO 45001 OHS - 7.5 Documented informationThe IMS includes documented information required by standard and otherwise considered necessary.

Scope, Policy, Objectives. IMS Overview. Records of various events.

Ensure appropriate identification, description, format, media, review and approval.

Document control procedure. Corporate style guide.

Information Security: Ensure the CIA triad (confidentiality, integrity, availability), and proper use of documented information.

Information security policy. Data privacy policy. Information security training, awareness

sessions, internal audits. Arrangements to ensure relevant docs.

are accessible to workers or their representatives (For 45001).

Exercise control over documents / records.

Backup procedures. Document control procedure. IMS software.

8 OPERATIONISO 9001 Quality - 8.1 Operational planning and controlISO 14001 Environment - 8.1 Operational planning and controlISO 45001 OHS - 8.1 Operational planning and controlManage the processes needed for product / service provision, and to address risks and opportunities.

Procedures / process plans Project Plans QESH Management Plans Hierarchy of controls

ISO 45001 OHS – 8.2 Management of changeIdentify hazards and risks associated with change prior to them being made. Manage changes.

Consider the impacts of unplanned changes, and act to mitigate risk / take the opportunities they pose.

Project planning / management Document control Change management procedure. Also relates to emergency preparation

and response clauses below.



ISO 14001 Environment - 8.2 Emergency preparedness and responseISO 45001 OHS - 8.6 Emergency preparedness and responsePrepare for and respond to emergencies.

Potential emergencies should have been identified in addressing clause 6.1.

Review of emergency response plans should particularly take place after an emergency has occurred – performance can then be evaluated and plans improved as necessary.

Interested parties might include neighbours, workers, contractors, visitors, government bodies, emergency services, health care organizations, media etc.

ISO 9001 Quality - 8.2 Requirements for products and servicesProcesses to communicate with customers about products and services.

Web site, social media, brochures, presentations, advertising, seminars, open days.

Processes to handle enquiries, contracts or orders (including changes).Processes to obtain customer views and perceptions about the organization (including complaints).

Surveys, Collecting feedback

Processes to determine requirements for products / services to be offered to potential customers.Review requirements before committing to supply products / services.

Review of Contracts, Tender documents, SLAs

Where the customer does not document their requirements, confirm them before acceptance.

Verbal confirmation. Email or other documented confirmation.

ISO 9001 Quality - 8.3 Design and development of products and servicesPut in place and maintain a design and development process.

Design procedure or process plan.

Plan the stages and controls for design and development.



Determine requirements or design inputs.

Include legal requirements – possibly also Safety in Design and Ecodesign requirements

Determine the controls to be applied to manage the design and development process.Determine the design and development outputs

Review, control and identify changes made to design inputs or outputs

ISO 9001 Quality - 8.4 Control of externally provided processes, products and servicesISO 45001 OHS – 8.3 OutsourcingISO 45001 OHS – 8.4 ProcurementISO 45001 OHS – 8.5 Contractors(45001) Identify appropriate controls prior to procuring goods and services.

Purchasing procedures.Delegation of authority.

Ensure that processes, products, and services from external providers meet requirements and are controlled.

Project plans.

Put in place checking or other verification activities.

Inspection & Test, Certification.

Ensure that specified requirements are adequate, and communicate them to external providers

Review of P.O’s, Contracts, Tender documents, SLAs

(45001) Identify and communicate the hazards relating to contractors.

Evaluate and control the OHS risks relating to contractors.

Could relate to contractor’s own activities, or other activities that might affect contractors.

ISO 9001 Quality - 8.5 Production and service provisionControl the conditions for production / service provision.

Procedures and process plans. Competent workers (qualified or experienced). Supervision. Use of specified product / materials / methods. Controlled work environment etc.



Where necessary, identify outputs from processes.

ERP software output, Labelling, Bar coding, Numbering systems.

Identify the status of those outputs Labelling, location, documentation.

Where traceability is required, control the unique identification of process outputs, and retain any records necessary for traceability.

Unique numbering / labelling.

Exercise care with property belonging to the customer or external providers while it is under your control.

Operational procedures Information security policies and controls

Report problems with such property to the owner.

Reporting process, standard letters.

Ensure that process outputs are preserved during production and service provision – in order to maintain their conformity to requirements.

Can include identification, handling, packaging, storage, transmission or transportation, and protection.

Review and control unplanned changes to production or service delivery to ensure continuing conformity.

Emergency arrangements, Go-pack (might also integrate with some arrangements to address ISO 14001 clause 8.2).

ISO 9001 Quality - 8.6 Release of products and servicesVerify that product and service requirements have been met, and retain evidence of conformity.

Inspection and test plan.Checklists.

Hold the release of products and services until any planned conformity checks are complete.

Quarantine area, Labels, Documentation, Software.

ISO 9001 Quality - 8.7 Control of nonconforming process outputsEnsure that nonconforming process outputs are identified and controlled to prevent unintended use or delivery.

Quarantine area, Labels, Documentation, Software.

Take appropriate corrective action based on the nature of the nonconformity and its impact.

Action forms / NC reports, IMS software.

Deal with nonconforming process outputs, products and services by one or more of the approved options.

Options may be specified in a procedure.



Where nonconforming process outputs, products and services are corrected, re-check their conformity.Retain records of actions taken on nonconforming process outputs, products and services.

Records of Action forms / NC reports.

9 PERFORMANCE EVALUATIONISO 9001 Quality - 9.1 Monitoring, measurement, analysis and evaluationISO 14001 Environment - 9.1 Monitoring, measurement, analysis and evaluationISO 45001 OHS - 9.1 Monitoring, measurement, analysis and evaluationDefine requirements for monitoring and measurement, analysis and evaluation).

Procedure Inspection and test plan Checklists

Ensure that required monitoring and measurement activities are implemented, and retain appropriate records.

Internal audit Compliance evaluation Permit management

Ensure that calibrated equipment is used as appropriate. (14001 and 45001 – see note).

Calibration procedure and records.In ISO 9001, the topic of measurement traceability in 7.1.5.2 includes reference to calibration.

Evaluate the performance and the effectiveness of the IMS.

Internal audit Compliance evaluation Permit management Benchmarking Data analysis

Monitor customer perceptions of the degree to which requirements have been met (9001).

Surveys Collecting feedback

Ascertain customer views and opinions of the organization and its products and services (9001).

Online surveys Telephone interviews Feedback forms

Analyse and evaluate appropriate data and information arising from monitoring, measurement and other sources.

Plant / vehicle utilisation analysis

Use that data to demonstrate conformity, assess performance, and determine improvements.

Software dashboard Compliance report



Communicate relevant monitoring / measurement / environmental performance information. (14001 and 45001).

Team meetings. Committee meetings. Notice boards. Intranet. Web site / Blogs / Newsletters /

Sustainability report. Formal reporting mechanisms

government bodies / licencing authorities.

Use that data as an input to management review.

Agenda item at management review.

ISO 9001 Quality - 9.2 Internal auditISO 14001 Environment - 9.2 Internal auditISO 45001 OHS - 9.2 Internal auditConduct internal audits at planned intervals.

Audit schedule / IMS software.

The audit programme takes into account objectives and risks.

Adjust frequency / scope of individual audits as required.

Establish criteria and scope for each audit.

Audit checklist.

Ensure the impartiality and objectiveness of auditors.

People should not audit their own work.

Ensure that the results of the audits are reported to relevant management.

Provide initial report ASAP. Agenda item at management review.

Take necessary correction and corrective actions without undue delay.

Retain documented information as evidence.

Maintain audit records as hard copy, Word/PDF files or in IMS software application



ISO 9001 Quality - 9.3 Management reviewISO 14001 Environment - 9.3 Management reviewISO 45001 OHS - 9.3 Management reviewTop management review the IMS at planned intervals with an agenda that meets requirements of the standard.

Agenda.

There are decisions and actions related to improvement opportunities, and any need for changes to the IMS.

Minutes and action points.

Retain records as evidence. Maintain Management review records as hard copy, Word/PDF files or in IMS software application.

10 IMPROVEMENTISO 9001 Quality - 10.1 GeneralISO 14001 Environment - 10.1 GeneralDetermine and select opportunities for improvement, and then implement the necessary actions.

IMS software.

ISO 9001 Quality - 10.2 Nonconformity and corrective actionISO 14001 Environment - 10.2 Nonconformity and corrective actionISO 45001 OHS - 10.1 Incident, nonconformity and corrective actionWhen an incident or nonconformity occurs, take action to deal with the immediate issue.

Emergency response First aid Chemical spill kits Engineering controls Action Forms / NC report / IMS software.

Consider any similar nonconformities that might exist.

Note in Action Forms / NC report / IMS software.

Take action to identify and address the root cause(s), and any make any necessary changes to the IMS.

Root Cause Analysis FMEA Cause and effect diagrams Brainstorming.

Retain records as evidence. Records kept as hard copy, Word/PDF files or in IMS software application.



ISO 9001 Quality - 10.3 Continual improvementISO 14001 Environment - 10.3 Continual improvementISO 45001 OHS - 10.2 Continual improvementContinually improve the suitability, adequacy, and effectiveness of the IMS

Agenda item at management review.

Analyse data to confirm if there are opportunities for improvement.

Data could come from various forms of evaluation or management review.IMS software action history / dashboard.


Documents

· Web viewThis document is intended to help identify gaps between current arrangements and the new ISO management system standards, and commence the planning of an IMS (integrated