ISO Standards and Quality Management Expert
Expert guidance for ISO standards, quality management systems, compliance, and certification processes.
Core Concepts
ISO Standards
- ISO 9001 (Quality Management)
- ISO 27001 (Information Security)
- ISO 14001 (Environmental Management)
- ISO 45001 (Occupational Health & Safety)
- ISO/IEC 17025 (Testing and Calibration)
- ISO 22000 (Food Safety)
Quality Management
- Plan-Do-Check-Act (PDCA) cycle
- Process approach
- Risk-based thinking
- Continuous improvement (Kaizen)
- Quality objectives and metrics
- Management review
Compliance & Certification
- Gap analysis
- Internal audits
- Corrective actions
- Document control
- Management system documentation
- Certification audits
ISO 9001 Quality Management System
from dataclasses import dataclass
from datetime import datetime
from typing import List, Optional
from enum import Enum
class ProcessCategory(Enum):
MANAGEMENT = "management"
OPERATIONAL = "operational"
SUPPORT = "support"
@dataclass
class QualityProcess:
process_id: str
name: str
category: ProcessCategory
owner: str
inputs: List[str]
outputs: List[str]
resources: List[str]
kpis: List[str]
risks: List[str]
class ISO9001QMS:
"""ISO 9001 Quality Management System"""
def __init__(self, organization: str):
self.organization = organization
self.processes: Dict[str, QualityProcess] = {}
self.quality_objectives = []
self.risks = []
self.opportunities = []
def define_process(self, process: QualityProcess):
"""Define a quality process"""
self.processes[process.process_id] = process
def define_quality_objective(self, objective: Dict):
"""Define quality objective"""
self.quality_objectives.append({
'objective': objective['description'],
'target': objective['target'],
'measurement': objective['measurement'],
'owner': objective['owner'],
'deadline': objective['deadline'],
'status': 'active'
})
def conduct_pdca_cycle(self, process_id: str) -> Dict:
"""Conduct PDCA cycle for process"""
return {
'plan': self._plan_phase(process_id),
'do': self._do_phase(process_id),
'check': self._check_phase(process_id),
'act': self._act_phase(process_id)
}
def _plan_phase(self, process_id: str) -> Dict:
"""PDCA Plan phase"""
process = self.processes.get(process_id)
return {
'objectives': 'Define objectives and processes',
'resources': process.resources if process else [],
'risks_identified': process.risks if process else []
}
def _do_phase(self, process_id: str) -> Dict:
"""PDCA Do phase"""
return {
'action': 'Implement the processes',
'documentation': 'Document execution'
}
def _check_phase(self, process_id: str) -> Dict:
"""PDCA Check phase"""
return {
'monitoring': 'Monitor and measure processes',
'analysis': 'Analyze results against objectives'
}
def _act_phase(self, process_id: str) -> Dict:
"""PDCA Act phase"""
return {
'improvements': 'Implement improvements',
'corrective_actions': 'Take corrective actions'
}ISO 27001 Information Security
class RiskLevel(Enum):
LOW = "low"
MEDIUM = "medium"
HIGH = "high"
CRITICAL = "critical"
@dataclass
class InformationAsset:
asset_id: str
name: str
description: str
owner: str
classification: str # public, internal, confidential, restricted
value: int # 1-5 scale
@dataclass
class SecurityRisk:
risk_id: str
asset_id: str
threat: str
vulnerability: str
likelihood: int # 1-5 scale
impact: int # 1-5 scale
risk_level: RiskLevel
controls: List[str]
residual_risk: RiskLevel
class ISO27001ISMS:
"""ISO 27001 Information Security Management System"""
def __init__(self, organization: str):
self.organization = organization
self.assets: Dict[str, InformationAsset] = {}
self.risks: Dict[str, SecurityRisk] = {}
self.controls = {}
def register_asset(self, asset: InformationAsset):
"""Register information asset"""
self.assets[asset.asset_id] = asset
def assess_risk(self, asset_id: str, threat: str,
vulnerability: str, likelihood: int, impact: int) -> SecurityRisk:
"""Assess security risk"""
risk_score = likelihood * impact
if risk_score >= 20:
risk_level = RiskLevel.CRITICAL
elif risk_score >= 12:
risk_level = RiskLevel.HIGH
elif risk_score >= 6:
risk_level = RiskLevel.MEDIUM
else:
risk_level = RiskLevel.LOW
risk = SecurityRisk(
risk_id=f"RISK-{len(self.risks) + 1:03d}",
asset_id=asset_id,
threat=threat,
vulnerability=vulnerability,
likelihood=likelihood,
impact=impact,
risk_level=risk_level,
controls=[],
residual_risk=risk_level
)
self.risks[risk.risk_id] = risk
return risk
def implement_control(self, risk_id: str, control: str,
effectiveness: int):
"""Implement security control"""
if risk_id in self.risks:
risk = self.risks[risk_id]
risk.controls.append(control)
# Recalculate residual risk
reduced_score = (risk.likelihood * risk.impact) * (1 - effectiveness/10)
if reduced_score >= 20:
risk.residual_risk = RiskLevel.CRITICAL
elif reduced_score >= 12:
risk.residual_risk = RiskLevel.HIGH
elif reduced_score >= 6:
risk.residual_risk = RiskLevel.MEDIUM
else:
risk.residual_risk = RiskLevel.LOW
def generate_soa(self) -> Dict:
"""Generate Statement of Applicability"""
# Annex A controls from ISO 27001
controls = {
'A.5': 'Information security policies',
'A.6': 'Organization of information security',
'A.7': 'Human resource security',
'A.8': 'Asset management',
'A.9': 'Access control',
'A.10': 'Cryptography',
'A.11': 'Physical and environmental security',
'A.12': 'Operations security',
'A.13': 'Communications security',
'A.14': 'System acquisition, development and maintenance',
'A.15': 'Supplier relationships',
'A.16': 'Information security incident management',
'A.17': 'Business continuity management',
'A.18': 'Compliance'
}
return {
'organization': self.organization,
'controls': controls,
'implementation_status': 'To be determined per control'
}Audit Management
class AuditType(Enum):
INTERNAL = "internal"
EXTERNAL = "external"
CERTIFICATION = "certification"
SURVEILLANCE = "surveillance"
@dataclass
class AuditFinding:
finding_id: str
audit_id: str
type: str # 'non_conformity', 'observation', 'opportunity'
severity: str # 'major', 'minor'
description: str
clause_reference: str
evidence: str
corrective_action: Optional[str] = None
due_date: Optional[datetime] = None
status: str = 'open'
class AuditManager:
"""Manage quality audits"""
def __init__(self):
self.audits = {}
self.findings: Dict[str, AuditFinding] = {}
def plan_audit(self, audit_id: str, audit_type: AuditType,
scope: List[str], auditors: List[str],
date: datetime) -> Dict:
"""Plan an audit"""
audit = {
'audit_id': audit_id,
'type': audit_type.value,
'scope': scope,
'auditors': auditors,
'date': date,
'status': 'planned'
}
self.audits[audit_id] = audit
return audit
def record_finding(self, finding: AuditFinding):
"""Record audit finding"""
self.findings[finding.finding_id] = finding
def create_corrective_action(self, finding_id: str,
action: str, responsible: str,
due_date: datetime):
"""Create corrective action for finding"""
if finding_id in self.findings:
finding = self.findings[finding_id]
finding.corrective_action = action
finding.due_date = due_date
finding.status = 'corrective_action_planned'
return {
'finding_id': finding_id,
'action': action,
'responsible': responsible,
'due_date': due_date
}
def close_finding(self, finding_id: str, verification: str):
"""Close finding after verification"""
if finding_id in self.findings:
finding = self.findings[finding_id]
finding.status = 'closed'
return {
'finding_id': finding_id,
'closure_date': datetime.now(),
'verification': verification
}
def generate_audit_report(self, audit_id: str) -> Dict:
"""Generate audit report"""
audit = self.audits.get(audit_id)
audit_findings = [f for f in self.findings.values()
if f.audit_id == audit_id]
return {
'audit': audit,
'findings_count': len(audit_findings),
'major_nc': sum(1 for f in audit_findings
if f.severity == 'major'),
'minor_nc': sum(1 for f in audit_findings
if f.severity == 'minor'),
'observations': sum(1 for f in audit_findings
if f.type == 'observation'),
'findings': audit_findings
}Document Control
@dataclass
class Document:
document_id: str
title: str
version: str
author: str
approver: str
effective_date: datetime
review_date: datetime
status: str # 'draft', 'approved', 'obsolete'
class DocumentControl:
"""Manage controlled documents"""
def __init__(self):
self.documents: Dict[str, List[Document]] = {}
def create_document(self, doc: Document):
"""Create new document"""
if doc.document_id not in self.documents:
self.documents[doc.document_id] = []
self.documents[doc.document_id].append(doc)
def get_current_version(self, document_id: str) -> Optional[Document]:
"""Get current approved version"""
if document_id in self.documents:
versions = [d for d in self.documents[document_id]
if d.status == 'approved']
if versions:
return max(versions, key=lambda x: x.version)
return None
def revise_document(self, document_id: str, changes: str,
author: str) -> Document:
"""Create document revision"""
current = self.get_current_version(document_id)
if current:
new_version = self._increment_version(current.version)
new_doc = Document(
document_id=document_id,
title=current.title,
version=new_version,
author=author,
approver=current.approver,
effective_date=datetime.now(),
review_date=datetime.now(),
status='draft'
)
self.create_document(new_doc)
return new_doc
def _increment_version(self, version: str) -> str:
"""Increment version number"""
parts = version.split('.')
parts[-1] = str(int(parts[-1]) + 1)
return '.'.join(parts)Best Practices
Implementation
- Get management commitment
- Conduct gap analysis first
- Define clear scope
- Document processes thoroughly
- Train all personnel
- Implement gradually
- Monitor effectiveness
Auditing
- Plan audits regularly
- Use competent auditors
- Focus on process effectiveness
- Document findings clearly
- Follow up on corrective actions
- Learn from findings
- Share lessons learned
Continuous Improvement
- Regular management reviews
- Monitor KPIs consistently
- Respond to changes
- Encourage employee feedback
- Benchmark against best practices
- Document improvements
- Celebrate successes
Anti-Patterns
❌ Documentation for its own sake ❌ No management involvement ❌ Treating certification as the goal ❌ Ignoring audit findings ❌ No continuous improvement ❌ Poor document control ❌ Insufficient training
Resources
- ISO: https://www.iso.org/
- ISO 9001:2015: https://www.iso.org/standard/62085.html
- ISO 27001:2022: https://www.iso.org/standard/82875.html
- ASQ (American Society for Quality): https://asq.org/
- ISO Survey: https://www.iso.org/the-iso-survey.html