ISO 9001 and project management: controlling projects within the quality system
ISO 9001 does not prescribe a project management method. The standard does ask you to plan and control the delivery of your services and products (clause 8.1). For organisations that work with projects, that means: every project has a plan, clear requirements, control points and a handover you can demonstrate. You do not need to introduce a separate method such as PRINCE2 (a project management method) or Scrum (an agile way of working) for this. You do need to show that you handle your projects in the same way every time. You can read more about the chapters of the standard at the ISO 9001 requirements. You can find the text of the standard at NEN , and your project planning should align with your process descriptions.
What does the standard require for projects?
The requirements for projects are spread across the standard. The most important are:
- Planning of the work (8.1). You determine in advance which steps there are, what the requirements are and which resources are needed.
- Requirements for products and services (8.2). You record the customer requirements before you start, and check that you can deliver them.
- Design and development (8.3), if applicable. If your project also includes design, extra requirements apply for review, verification and validation.
- Changes to requirements (8.2.4) and control of changes (8.5.6). Projects change along the way. You assess, control and record changes.
- Release of products and services (8.6). Before handover, you check that the requirements have been met, and you keep the evidence.
A project manager who handles every change verbally may find it hard to show that changes were assessed, even if the project delivers well. The standard requires that evidence.
A project plan that fits ISO 9001
The table below is an example project plan for a renovation project at a housing association. It is fictional, but you can use the structure straight away.
| Element | Example content | Requirement from the standard |
|---|---|---|
| Project brief | Renovation of 24 homes, handover before 1 June | 8.2 |
| Customer requirements | Insulation to the agreed level, noise standard, schedule | 8.2 |
| Steps and responsibilities | Inspection, execution, handover, with a named person for each step | 8.1 |
| Resources and competences | Fixed team with certified fitters | 7.1, 7.2 |
| Control points | An inspection form after each phase | 8.6 |
| Changes | Additional work only with written approval | 8.5.6 |
| Nonconformities | Record and resolve according to the nonconformity register | 10.2 |
| Handover and evidence | Handover form, photos, customer approval | 8.6 |
A plan that contains only the schedule is not enough. The auditor wants to see that the “requirement” column is backed by evidence somewhere. That is why this table has the last column.
Step by step: setting up projects in your quality system
- Create one standard start form for every project. Brief, customer requirements, schedule, responsibilities and risks. The same form for every project makes them comparable.
- Link the control points to your processes. Which inspections belong to each type of project? These are set out in your process descriptions.
- Record changes. Use one change form that shows the impact on time, cost and quality. Without this form, additional work stays invisible.
- Record nonconformities per project. A nonconformity in project A belongs in the same register as one in another project. That way you can see trends.
- Evaluate after handover. What went well and what did not? Take the outcomes into the management review.
How do you combine project management with agile?
Many IT companies and product developers work with Scrum or Kanban. This can be combined with ISO 9001. A sprint is a short work period, usually two weeks. The sprint plan can serve as your planning (8.1), the backlog (the list of work) with acceptance criteria can serve as your requirements record (8.2), and the review at the end of the sprint can serve as your control point (8.6). This only works if it is recorded. You do not have to replace the word “project”. You do have to show that the steps are documented. For the IT version, read ISO 9001 for IT companies.
What does the auditor want to see?
The auditor often chooses a project from the past year and follows it from start to finish. They check whether:
- the customer requirements were recorded before the work began,
- the schedule and responsibilities can be demonstrated,
- changes were approved,
- checks were carried out and recorded,
- the handover was done on the basis of the agreed requirements.
That is one project file that holds together. So it is sensible to run one or two projects as a trial before the audit. That way you know whether your forms and processes work.
Common mistake: keeping projects in a tool that nobody updates. A project board with the right columns does not help if the changes, nonconformities and approvals are not recorded in it.
Common mistakes
- No recorded customer requirements. The project starts on the basis of a phone call. Later it turns out the customer meant something different.
- Additional work without a form. The change was discussed, but not recorded. The audit will pick that up.
- Every project manager has their own method. That makes the system unreliable. One common form and one process are stronger.
- Handover without evidence. The project is finished, but the handover form is missing or not signed.
- No link to the quality objective. The project objective is to deliver on time, but the quality objective is not measured. See quality objectives (6.2).
What belongs in a project file?
A project file is the collection of documents that shows how the project was carried out. These are the standard parts:
| Document | Content | When completed |
|---|---|---|
| Start form | Brief, customer requirements, schedule, responsibilities, risks | At the start |
| Schedule with milestones | Phases, deadlines, responsibilities per phase | At the start, updated when changes occur |
| Change form | What changes, why, impact on time, cost and quality, approval | At every change |
| Inspection forms | Check per phase, outcome, name of the inspector | After each phase |
| Nonconformity register | Nonconformity, cause, action, owner, status | As soon as a nonconformity arises |
| Handover form | Requirements ticked off, photos or evidence, customer approval | At handover |
Keep the file in one place, with the project name and year in the folder name. Then the auditor can find it without help.
Common question: must every project be documented to the same level?
No. A small one-day project can be handled with a one-page start form and a handover slip. A renovation of twenty homes needs the full file. Set the level of documentation per project type, and record it in your process description. Then everyone knows what is expected of them, and the auditor can see that you apply your own choice consistently.
Next step
Pick one ongoing or completed project and walk it through the five steps above. Note where the file is empty. Those are your first improvement points. For the wider context of your organisation, start with the context analysis (chapter 4) and mapping processes.