API Q1 4 Quality Management System Requirements

4 Quality Management System Requirements

4.1 Quality Management System

4.1.1 General

The organization must always plan, set up, record, put into action, and keep up a quality management system in line with this specification’s demands for the product within the organization’s defined scope. Additionally, the organization needs to assess and enhance the effectiveness of this quality management system.

The Process-Based Management System Model supports all of the other API and ISO management system standards and specifications. The model starts with an understanding of the Organization’s Customer Requirement, this is an INPUT to the organization’s Product Realization is where the product/service takes place producing an OUTPUT (Product/Service) to Customer satisfaction. Product Realization must be constantly measured, analyzed and when needed, improved to ensure customer requirements and satisfaction are maintained. The results of the analysis go to Top management, which is responsible for acting upon the results and properly allocating resources to the organization to ensure that Products and services will continue to keep up with Customer requirements.

4.1.2 Quality Policy

The organization’s commitment to quality must be clearly outlined, documented, reviewed, and endorsed by top management. The quality policy should align with the organization’s goals and guide its strategic path. It must serve as a foundation for setting quality objectives. It must be effectively communicated, understood, put into practice, and upheld within the organization. It must be accessible to relevant stakeholders as determined by the organization, and include a pledge to meet requirements and consistently enhance the efficiency of the quality management system.

The quality policy must be appropriate to its purpose and there is a commitment to continually improving the quality management system, and the quality objectives are consistent with the quality policy. The policy does not have to include objectives but should create a framework for establishing them. The policy should be stated in such a way that it aims toward continual improvement. It should be reviewed and possibly revised to meet higher aspirations. Develop and implement a policy that is consistent with the company’s codes of conduct and business practices. The policy should be signed by senior management and committed to:

• Preventing process loss or quality impacts;
• Complying with obligations and legal requirements;
• Promoting continual improvement;
• Adopting best practices;
• Creation of measurable and achievable targets for performance improvement;
• Providing resources to achieve targets;
• Communicating and consulting with all stakeholders regarding the QMS;
• Meeting customer requirements.

Tell everyone about it.

• Make sure it is written.
• Making sure people know it and understand it.
• Give it to people who have an interest in your business (e.g. clients/suppliers/manufacturers/staff).
• Publishing it on your website.

The Examples include written Quality policy, company induction, basic training, and toolbox talks.

4.1.3 Quality Objectives

Quality objectives, including those necessary to fulfil product and customer needs, must be set at appropriate functions and levels within the organization by management, with approval from top management. These objectives should be measurable, communicated, and aligned with the quality policy.

No quality plan can be completed without having measurable quality objectives. An objective should include a description of who is responsible, what is the target, and when is it planned to be achieved. Progress must be monitored. Also, requires objectives to be set for relevant processes. Ensure that whatever objectives you implement are SMART

• Specific
• Measurable
• Achievable
• Realistic
• Time-bound

Some  key rules are as follows:

• Make sure they comply with the law and industry standards.
• Make sure they conform with the products and services to make them better.
• Monitor your objectives periodically to check what you are doing.
• Tell the staff what they are and what you expect of them.
• Updated when the management changes something.

Keep records of this. This should be included in the customer SLA and planning should be in place to ensure you can resource this response rate. An example could be Understanding the total number of planned maintenance, and the number of reactive maintenance to ensure you calculate the appropriate levels of resources. Organizations need to clearly understand how these will be realized. For example, if you aim to provide national coverage, how will this be achieved? What resources will you allocate, recruiting staff to cover the nation, training your staff etc.

4.1.4 Planning the Quality Management System

4.1.4.1 General

The planning of the quality management system must be conducted. While planning, the organization must specify the scope of the quality management system, including the products covered and any limitations or exclusions. The organization must recognize external and internal factors relevant to the organization’s long-term objectives and goals. Identify relevant stakeholders and their requirements for the quality management system. The organization must establish the sequence and interaction between the processes of the quality management system. The organization must determine and oversee the criteria and methods necessary for the efficient operation and control of quality management system processes. The organization must set quality objectives, detailing actions, resources, responsibilities, timeframes, and methods for monitoring and evaluation. It must address identified risks. It addresses opportunities for improvement. It must identify key personnel involved in the quality management system.

To meet the requirements for the delivery of products and services, the organization needs to plan, implement, and control its processes. The first step is to determine the requirements for products and services, meaning what features the product or service will have. Then, the organization needs to define how processes will be performed and what criteria the product or service needs to meet to be accepted for release. Finally, the organization needs to determine the resources needed for the processes and the records needed to demonstrate that the processes were carried out as planned. Once they have done their planning for what they are going to sell, they then must plan the details of how this can be done operationally. The organization may need to :

• Set up supplier accounts/trade accounts.
• Purchase stock.
• Ensure staff have the correct skills and understand the process.
• Purchase tools and vehicles.
• Make sure you have enough staff.
• Issue clear instructions, drawings, procedures risk assessments to enable them to do the job.

The organization needs to show clear control of the process. They will be expected to check that delivery is as expected and when there are deviations that this is managed and negative impacts controlled. The same control should be applied to subcontractors.

4.1.4.2 Exclusions

If an organization carries out activities covered by API Q1, whether internally or through outsourcing, it cannot claim the exclusion of those activities. Excluding certain activities should not impact the organization’s capability or obligation to deliver products that meet customer and legal standards. If any exclusions are made, the reasoning behind them must be documented. When an organization performs activities addressed by this specification, no claims to exclusion of those activities are permitted. When exclusions are permitted, they are limited to the following sections:

API Q1 Clauses	Sections
5.4	Design
5.6.4	Validation of Processes
5.6.7	Externally Owned Property
5.8	Testing, Measuring, Monitoring, and Detection Equipment (TMMDE)

4.1.5   Communication

4.1.5.1 Internal

The organization must set up internal communication processes. These processes should involve communicating, at appropriate levels and functions within the organization the significance of meeting customer, legal, and other relevant requirements; and the outcomes of data analysis.

4.1.5.2 External Communications

The organization must create and put into action a procedure for communicating with external entities, including customers. This process should cover:

1. Handling inquiries, contracts, or order processing, and any modifications;
2. Understanding and meeting requirements during contract execution and product creation;
3. Providing product details, including any non-conformities;
4. Addressing feedback and customer complaints;
5. Sharing quality plans and any subsequent adjustments; and
6. Communicating changes and associated risks.

This clause includes both internal and external communication about the QMS. Processes for internal and external communication need to be established within the QMS. The key elements of Communication that an organization must establish are

• what needs to be communicated.
• when it needs to be communicated?
• how it should be done?
• who needs to receive the communication? and
• who will communicate?

It should be noted here that any communication outputs should be consistent with related information and content generated by the QMS for the sake of consistency. This is a straightforward clause and is simply about effectively communicating to all those within the organization and those affected by it. Internal communications  can include briefings to staff on:

• new policies;
•  new or amended objectives;
•  new or  amended strategies;
• new clients;
• new or amended technology;
• new products;
• issues with suppliers;
•  anything that will have an impact on them.

Designate a person responsible for updates may be the department head.

To understand the requirements and other external organizations throughout contract execution and product realization, the organization must determine and implement a process for communicating with the customers and other external organizations. The communication process must address the execution of inquiries, contracts, or order handling and amendments, feedback and customer complaints. The organization must also provide product information, including product nonconformities identified after delivery to the customer. When it’s required by contract, the organization must provide information required by product quality plans and subsequent changes to those plans. An organization may choose to communicate with other interested parties, but the requirements under 4.1.5.2 were targeted and mandated to occur between the manufacturer and the operator (customer). It was also intended to go from manufacture to affected suppliers. External communication is to manage risk that occurs throughout the execution of the contract. Many will do this upfront, but this occurs during tendering, contract review, and execution.

4.2 Management Responsibility

4.2.1 General

Top management must show leadership and dedication to setting up, implementing, maintaining, and enhancing the quality management system by endorsing the creation of quality objectives at relevant functions and levels within the organization. Top management must allocate the necessary resources for the quality management system. These resources can encompass human resources, specialized skills, organizational infrastructure, financial assets, and technology. Top management must involve and back personnel in implementing and sustaining the quality management system and designating responsibilities and authorities to ensure that processes achieve intended outcomes.

This section focuses more on the roles and responsibilities of management and top management. This section focuses more on the roles and responsibilities of management and top management Top management must ensure essential resources are available necessary for establishing, implementing, maintaining, and improving the quality management system. Resources can include human resources and specialized skills, organizational infrastructure, financial resources, and technology. The responsibility of management within the organization is to provide evidence of its commitment to the development and implementation of the quality management system. Management continually improves its effectiveness by ensuring that quality objectives are established including key performance indicators for use in data analysis. The management must conduct management reviews.

Responsibilities of Top Management in API Q1 standard

1. Approval of Quality policy
2. Review of Quality policy
3. Approval of Quality objectives
4. Availability of Resources
5. Appointment of Management Representative
6. taking reports from the Management representative on the performance of the quality management system
7. Review and approve the output of Management Review

Responsibilities of Management in API Q1 standard

1. Establishment of quality objectives at relevant functions and levels
2. criteria and methods needed for the operation and control of all quality management system processes are determined, managed, and effective
3. planning of the quality management system is carried out to meet the requirements of this specification.
4. ensure that appropriate communication processes are established
5. the effectiveness of the quality management system is communicated
6. provide evidence of its commitment to the development and implementation of the quality management system
7. Review of the Organization’s Quality Management System

4.2.2 Responsibility and Authority

The duties, powers, and responsibilities of personnel within the organization’s quality management system must be clearly outlined, documented, and communicated across the organization.

Responsibilities, authorities, and accountabilities of personnel within the scope of this document shall be defined, documented, and communicated throughout the organization. The organization must ensure that responsibilities are allocated across the organization to maintain the management system to make sure what is supposed to happen is happening. While allocating Roles, Responsibilities, and authorities, the organization must remember the customer at all times the outcome of the business processes, and how they can be improved. Remembering to update the system as and when you change how you work or the intended process is amended. The organization must define job roles before recruitment, allocate job descriptions to personnel, and link this to the processes within the business. For eg, A sales administrator might be expected to have 12 months of experience in writing quotations. When they join there would be a period of training and reinforcing this through a written job description. The output would be a more senior colleague reviewing quotes, confirming they are correct, and ensuring that the customer is being quoted for what they asked for. If a form or process is amended along the way advise the sales administrator and ensure the new versions are applied.

4.2.3 Management Representative

Top management must appoint and retain a member of the organization’s management who, regardless of other duties, holds responsibility and authority that involves guaranteeing compliance of the quality management system with the requirements of this specification. Establishing, implementing, and maintaining processes necessary for the quality management system. Providing reports to top management regarding the performance of the quality management system and any areas requiring improvement. Initiating actions to rectify nonconformities. Ensuring the promotion of awareness of customer requirements throughout the organization.

Management Representatives must be appointed by the Top management. Management Representative must be a member of the organization’s management. The Top management must always maintain the Management Representative. Irrespective of the other responsibilities the Management Representative may have, He/She shall also have the responsibility and authority to ensure that processes needed for the quality management system are established, implemented, and maintained. Report to top management on the performance of the quality management system.Report for any need for improvements. Ensuring of initiation of action(s) to minimize the likelihood of the occurrence of nonconformities and ensuring the promotion of awareness of customer requirements throughout the organization. The management representative ensures that the QMS processes are established, implemented, and maintained. This may involve review and planning of internal audits, discussion with process owners, or even review of the processes in person to ensure they are properly maintained. If this were not the responsibility of the management representative, then it would be a responsibility distributed among the process owners, and when this happens no one has the responsibility at all. By having a focal point for the overall processes, the management representative can not only ensure that each process is functioning, but that the interaction of the processes is maintained. By doing this, the interactions can then start to be optimized, because it is not always the case that optimization in one process is the best thing for the overall system.

The management representative has a second responsibility to report to top management on how well, or poorly, the QMS is performing. Identifying any needs for improvement to top management is also part of this responsibility. As has already been said, top management needs to be fully supportive of the Quality Management System implementation if it is going to provide true benefit to the company. For this to function, there needs to be a point of focus for top management to use when reviewing the resource needs of the QMS, and how best to support the improvement needed. Being the voice of the QMS for top management can be the critical factor in a QMS providing a return on investment for the company, or not.

The management rep will gather this sort of information from the monitoring and measurement activities in the organization, as well as the results of the internal audits, and when the company uses a management review meeting, this is the sort of information that is presented.

The last responsibility is to ensure that people are aware of customer requirements throughout the organization. Since one of the main thrusts of an ISO 9001 Quality Management System is customer satisfaction, all employees must understand what the customer needs, and how they can affect how well the company satisfies these needs. Customer focus is one of the main Seven Quality Management Principles behind ISO 9001 requirements, and as such needs to have an advocate in the company. By being the “voice of the customer” in the organization, the quality management representative can make great strides in how satisfied customers are. If the company implemented a quality management system to improve customer satisfaction, it only makes sense that someone is responsible for promoting the customer needs in the company, and the management rep is the leader of this initiative.

The quality management representative becomes the one name that the Auditing organization (like API) can call, or the customer can contact with complaints. It is often these optional responsibilities that are seen as the main role of the management rep, but in fact, these could be done by one of many other people without affecting the effectiveness and success of the QMS.

4.3 Organization Capability

4.3.1 Resources and Knowledge

4.3.1.1 Resources

The organization must identify and allocate the necessary resources to implement, maintain, and enhance the effectiveness of the quality management system.

The organization shall determine and provide the resources needed to implement, maintain, and improve the effectiveness of the requirements of the quality management system. The organization must have the resources it needs to ensure the effective operation of the QMS. Resources may include raw materials, infrastructure, finance, personnel, and IT, all of which can be either internally or externally provided. The organization must have a clear understanding of:

• what an organization has in-house and whether this is sufficient/fit for purpose to achieve its goals and objectives.
• what additional support might be needed externally?

For example, Specialist skills are better outsourced due to the size of the organization (e.g. security screening, health, and safety advice).

4.3.1.2 Knowledge

The organization must identify the expertise required to sustain the operation of its processes and ensure the consistent conformity of its products. This knowledge should be preserved and accessible at the organization’s discretion. Knowledge may be gained through experience, study, training, lessons learned, best practices, or other means.

To identify the expertise required to sustain operations and ensure consistent product conformity while preserving and making knowledge accessible, the organization must identify critical areas of expertise required for sustaining operations and ensuring product conformity. Document this knowledge systematically, including key processes, procedures, best practices, and lessons learned. Map out the expertise needed across various roles and functions within the organization. This involves identifying specific skills, qualifications, experience levels, and certifications required for each role involved in sustaining operations and ensuring product conformity. Establish a knowledge management system to store, organize, and make knowledge accessible within the organization. This system could include a combination of databases, intranet portals, wikis, document repositories, and collaboration tools. Implement access controls and permissions within the knowledge management system to ensure that sensitive information is protected and accessible only to authorized personnel as per the organization’s discretion. This may involve role-based access control mechanisms. Encourage continuous learning and development among employees to acquire and enhance the required expertise. Provide training programs, workshops, seminars, and access to educational resources to support ongoing skill development. Facilitate knowledge transfer mechanisms such as mentorship programs, cross-functional training sessions, job rotations, and communities of practice. These initiatives help disseminate expertise among employees and ensure continuity in operations. Regularly update and review the documented knowledge to ensure its relevance and accuracy. Encourage employees to contribute their insights, experiences, and lessons learned to enrich the knowledge base. Identify potential risks associated with knowledge loss or expertise gaps and develop contingency plans to mitigate these risks. This may involve succession planning, knowledge retention strategies, and cross-training initiatives. Establish feedback mechanisms to gather input from employees regarding the effectiveness of knowledge management processes and identify areas for improvement. Ensure that knowledge management practices comply with relevant regulations, standards, and quality assurance requirements. Regular audits and assessments can help verify adherence to these standards. By implementing these strategies, the organization can effectively identify, preserve, and make accessible the expertise required to sustain operations and ensure consistent product conformity while safeguarding sensitive information as per its discretion.

4.3.2           Human Resources

4.3.2.1        Personnel Competence

Personnel involved in the organization’s quality management system responsibilities must be competent. The organization should uphold a documented procedure concerning personnel competence. This procedure should cover:

1. Identifying and documenting required competencies.
2. Identifying necessary education, training, experience, or other actions to attain competence.
3. Evaluating the effectiveness of measures taken to acquire competencies.
4. Establishing criteria and methods for assessing, maintaining, and re-assessing competencies.
5. Designating personnel responsible for assessing competency.

Records of personnel competence must be retained.

In the Four Levels of Learning In adult learning, there are four stages of learning to reach mastery. Three of the four have been incorporated into the term competent in API Spec Q1, 10th edition. The organization shall establish a documented procedure for determining the competency of its employees and other personnel. The procedure must also identify training requirements or other actions to achieve the necessary competency of these employees and other personnel. The procedure must also determine and document the effectiveness of the training or other actions taken toward the achievement of required competency. Personnel shall be competent based on the appropriate education, training, skills, and experience needed to meet product and customer requirements. Evidence of the determination of competence of personnel shall be recorded and maintained.

The organization needs to determine the necessary competence of its employees and ensure those employees are competent based on appropriate education, training, and experience. The organization must have a process for determining the necessary competence and achieving it through training or other means. Determining competence is a necessity in any organization. Working out on the skills your team has the skills they don’t yet have and the skills they will need to achieve the company’s objectives. For example to achieve the objective of “Increase in sales”, you need to improve the competency of your sales team by training them.

4.3.2.2 Training

The organization must establish and uphold a training procedure. The organization must identify the content and frequency of necessary training. The organization must provide training on the quality management system. It must provide job-specific training, including raising awareness among personnel about the significance of their tasks and their contribution to achieving the organization’s quality objectives. It must offer customer-specified or customer-provided training when necessary. It must assess the effectiveness of the training. It must document the required training records. Records of personnel training must be retained.

The organization must provide quality management system training and job training. They must also ensure that customer-specified training and/or customer-provided training, when required, is included in the training program. They must ensure that the frequency and content of training are identified. They must ensure that their personnel are aware of the relevance and importance of their activities and how they contribute to the achievement of quality objectives and maintain appropriate records of education, training, skills, and experience. The content of awareness training may include items covered in induction training, specific training, toolbox talks or any other quality, environmental, or health and safety issues that affect several employees in the workplace. You should seek evidence to confirm that this requirement has been applied by your organization to ensure that the people who need to be made aware now include all the people who work on your organization’s behalf that affect the conformity of your organization’s management system or products. You ensure that these people are aware of:

1. The quality policies;
2. Relevant quality objectives;
3. Their contribution to the effectiveness of the management system;
4. Benefits of improved performance;
5. The implications of not conforming to management system requirements.

This also is to take into account all legal and other requirements that it subscribes to or is required to comply with. Not having an understanding of these “legal and other applicable requirements” not only puts employees at risk, but it has a potential negative impact on organizational processes and the environment,

Awareness training

The awareness training does not need to follow the format of long classroom sessions. Training techniques can include short training segments supplemented with videos and hands-on demonstrations that address key elements of the management system. Other methods to promote and reinforce awareness training sessions include communication via electronic bulletin boards, posters, newsletters and informational meetings. The requirements for general awareness training apply to all employees including those whose work may cause impacts on customer/product or service requirements. Awareness training is intended to provide an overview of the organization’s policy, objectives and targets, and overall management system. Your organization must ‘establish and maintain procedures to make its employees and members at each relevant function and level aware of’:

1. The importance of conformance with the policy and the management system procedures and requirements;
2. The actual and the potentially significant impacts and risks of the activities, products, and/or services;
3. The benefits of improved personal performance;
4. The employees’ roles and responsibilities in achieving conformance with policies and procedures;
5. The employees’ roles and responsibilities towards emergency preparedness and response;
6. The potential consequences of departure from specified operating procedures.

The awareness training materials may also include additional elements that address:

1. The organization’s objectives and targets;
2. The employees’ actions to minimize/eliminate impacts and risks and how they can contribute;
3. The importance of compliance with operational and regulatory requirements;
4. The overall improvement of the management system performance and the potential financial return;
5. The importance to interested parties.

Induction training

General awareness training should be undertaken by task demands. All recruits (workers, contractors and temporary staff) must receive induction briefings and periodic Quality management system awareness training appropriate to the duration of their responsibilities to ensure they are aware of the importance of ethical behaviour e.g. codes of conduct, internal management, working relationships, fair treatment, confidential reporting mechanisms, protecting anonymity, no-blame-culture, awareness campaigns, notice boards, posters, training programs including:

• Core values and policies;
• Company overview;
• History of the company;
• The people and structure;
• Contract of employment;
• Induction pack;
• Health, safety and environmental briefing.

The induction record should be completed, signed by each participant and sent to the Human Resources Manager.

4.3.3  Work Environment

The organization must identify, furnish, oversee, and sustain the work environment necessary to ensure product conformity. This work environment encompasses Facilities, workspaces, and related utilities; Process equipment, including both hardware and software; Ancillary services (e.g., transportation, communication, information systems); and Work conditions, covering physical, environmental, or other influencing factors.

The organization must determine, provide, manage, and maintain the work environment needed to achieve conformity applicable to the manufacture of the product. Work environment includes buildings, workspace, and associated utilities,  process equipment and its maintenance (both hardware and software), supporting services (e.g. transport, communication, information systems); and conditions under which work is performed such as physical, environmental, or other factors. The environment for the operation of processes clause ensures that the organization determines, provides, and maintains an environment necessary for the operation of its processes and to achieve conformity. The term environment refers to the work environment and is used to describe the set of conditions in which employees perform their work and under which products and services are produced. Conditions can include physical, social, psychological, and environmental factors (such as temperature, lighting, recognition schemes, social and occupational stress, ergonomics, etc). It can also relate to conditions on how work is done (complex, repetitive, creative, interactive, team, etc.) in work processes and procedures. The environment that you work in may include the following:

• Equality Opportunities, whistle-blowing, the anti-bullying policy.
• Violence at work, counselling support, lone working.
• Office-based risk assessment, space, noise levels.

The manufacturer (organization) is responsible for identifying and knowing the different types of servicing and SRP that they will produce or support. They are also responsible for ensuring that the work environment needed to meet those requirements has been provided, is managed, and maintained to ensure conformity requirements are met. This includes the organization’s facilities, workspace, utilities, process equipment, and physical and environmental conditions where servicing and SRP are produced. The work environment includes the organization’s facilities,  mobile work environments, and the well sites where services and SRP are utilized. Besides understanding what is considered the work environment, the organization also needs to understand the servicing and product conformity requirements.

4.4 Documentation Requirements

4.4.1 General

The documentation of the quality management system should consist of:

1. An outline of the quality management system’s scope, defining the products covered and providing reasons for any exclusions;
2. Declarations of the quality policy and quality objectives;
3. Listing legal and other relevant requirements that the organization must adhere to to ensure product conformity;
4. Explanation of how the quality management system fulfils each requirement outlined in this specification;
5. Identification of processes requiring validation; and
6. Procedures, documents, and records necessary for planning, executing, and controlling processes, as well as for meeting specified requirements.

Traditionally, some of this documentation has been incorporated into a quality manual, but it can take various formats and may be presented as either a single document or multiple documents.

The quality management system documentation must include statements of Quality policy, statements of Quality objectives and. documented procedures. It must also include documents and records required for effective planning, operation, and control of its processes and compliance with specified requirements. Legal and other applicable requirements needed for product conformity must also be identified. The quality manual describes the quality management system by the stated quality policy and objectives, while the procedures describe the processes and activities required to implement the quality management system. Organizations can address the requirements of the standards by preparing a management system manual and by implementing procedures to control processes. The quality manual, the policies, processes and procedures are all about what the organization has decided is important to ensure they can provide the services and products that continually meet customer requirements, deliver satisfaction and for the business to meet its targets and objectives. The quality manual provides the scope of the management system. Also, the manual contains an overview of management’s and employee responsibilities as well as conformity statements applicable to the Q1 causes that are contained and supported by your management system. The management system processes and procedures provide detailed requirements for each of your key processes with the intent to specify who does what, when, where, how the process, action, or task is performed, and what documentation is used to verify that all required the quality-related activities have been executed as required.

4.4.2 Procedures

Every procedure mandated by this specification must outline the organization’s approach to conducting an activity. These procedures must be documented, put into action, and upheld to ensure ongoing appropriateness. One procedure can encompass the requirements for one or more documented procedures. Likewise, multiple procedures can fulfil any requirement for a documented procedure.

All procedures mentioned in the API Q1 standard must be established, documented, implemented, and maintained for continued suitability. One or more procedures can be contained in a single document or the requirement of a documented procedure can be contained in one or more documents.

Documented Procedure Required by API Q1 standard

1. defining personnel competency and identifying training requirements
2. identification, distribution, and control of documents
3. integration of external specification requirements into the product realization process and any other affected processes
4. the identification, collection, storage, protection, retrieval, retention time, and disposition of records
5. review of requirements related to the provision of products and required servicing (Contract Review)
6. identify and control risks associated with impact on delivery and quality of product.
7. plan and control the design and development of the product.
8. contingency planning
9. procedure to ensure that purchased products or outsourced activities conform to specified requirements.
10. the verification or other activities necessary for ensuring that purchased products or activities meet specified purchase requirements
11. controls associated with the production of products.
12. controls associated with the servicing
13. Validation of Processes for Production and Servicing
14. identification and traceability
15. product inspection and/or test status
16. Customer-supplied Property
17. Preservation of Product
18. Inspection and Testing
19. preventive maintenance of equipment
20. Calibration and Maintenance of testing, measurement, and monitoring equipment.
21. release of product
22. Control of non-conforming product
23. customer satisfaction
24. Internal audit
25. Analysis of data
26. correct nonconformities and to take corrective actions,

4.4.3 Control of Internal Documents

The organization must maintain a documented procedure for managing internal documents required by the quality management system and this specification, including revisions, translations, and updates. This procedure must cover:

1. Responsibilities for approval and re-approval;
2. Review and approval for adequacy before issuance and use;
3. Periodic reviews for ongoing suitability and necessary revisions;
4. Identification of changes and current revision status;
5. Ensuring legibility and proper identification of documents;
6. Availability of documents at locations where activities are carried out.

Obsolete documents must be removed from all points of distribution or use, or appropriately marked to prevent unintended usage if retained for any purpose. Procedures, work instructions, and forms mandated by the quality management system must be controlled.

The organization must establish a documented procedure for the identification, distribution, and control of its documents or those of external origin. The procedure shall specify responsibilities for approval and re-approval of the documents. It must identify the controls needed to ensure that the documents are reviewed and approved for adequacy before issue and use. It must identify changes and revision status. Document must remain legible and readily identifiable, and are available where the activity is being performed. Documents of external origin must be controlled to ensure that the relevant versions are used and maintained. The organization must ensure against unintended use of obsolete documents and remove them from all points of issue or use, or otherwise identified if they are retained for any purpose. All Procedures, work instructions, and forms must be controlled. The organization must control the documents required by its QMS. A suitable process must be implemented to define the controls needed to; approve, review, update, identify changes, identify revision status and provide access. The procedure should define the scope, purpose, method and responsibilities required to implement these parameters. To comply with the document requirements, all personnel must understand what types of information should be controlled and more importantly, how this control should be exercised. To get the most out of your procedure it must communicated to ensure that staff and other users of the documentation information understand what they must do to manage that information effectively and efficiently. Demonstrate the organization’s arrangements for controlling documents required by API Q1 and your organization’s own requirements, including

• Availability e.g. document accessibility (hard copy, electronic media), readily available at the point of use;
• Suitability e.g. format, media suitable to the environment, ease of understanding, language, interpretation;
• Protection e.g. document authentication, document markings (official, secret, restricted, confidential, private, sensitive, classified, unclassified), access controls (individual, role-specific),
• Physical security (master documents, server rooms, libraries) IT security (User ID, password, servers, download, back up, encryption, ‘read-only’, ‘read/write’), protection from corruption and unintended alterations.
• Demonstrate the organization’s arrangements for document retention e.g. organization/legal/contractual retention periods, storage, preservation, back up, retention of knowledge, disposal, obsolescence e.g. withdrawal, replacement, legacy archive and suitable identification (‘for information only’, ‘not to be used after….’, ‘uncontrolled copy’, ‘for reference purposes only’, etc.

Ensure your organization protects electronic data, e.g. security policy, system access profiles, password rules, storage and backup policy including protection from loss, unauthorized changes, unintended alteration, corruption, and physical damage. Access can imply a decision regarding the permission to view the documented information only, or the permission and authority to view and change the document.

4.4.4 Control and Use of External Documents

The organization must uphold a documented procedure for managing documents from external sources necessary for product realization and use, including API or other external specifications. This procedure should cover:

1. Identifying and documenting the necessary external documents;
2. Managing access to and distribution of required documents, including relevant versions;
3. Incorporating requirements from external documents into product realization and any affected processes;
4. Establishing a process for identifying changes to required documents, such as addenda, errata, and updates;
5. Assessing the impact of changes;
6. Incorporating relevant changes.

Normative references specified within API products or other external specifications, essential during product realization, may also be regarded as external documents.

The organization must establish a documented procedure for the integration of the requirements coming from external specifications such as API products including addenda, errata, and updates into the product realization process and any other affected processes when such requirements are used in the design or manufacture of the product. External documents are the documents relevant to the quality management system (QMS) and issued by an external entity. Examples of those issuers can be customers, suppliers, legislators, regulators, standardization bodies, or business partners. Documents of external origin relevant to the QMS can be, for example, Product Specifications, Logistics Specifications, Material Safety Data Sheets, Legislation, Permits, Standards, Platform Rules, or Work Instructions. Organizations must determine what relevant documents of external origin are used in the design and manufacture of the products. The organization must ensure that external document is still updated. If the document was changed, what are the implications on the specification of the product? Do the changes in the document imply changes in the manufacturing process? The procedure must include:

• what are the relevant documents of external origin
• who is responsible for checking, with what frequency,
• who is going to do what when there are changes or new documents;
• get new versions or new document
• update register
• distribute new versions or new document
• check if it is applicable
• plan changes
• implement changes
• confirm that changes were implemented

4.5 Control of Records

Records, including those originating from outsourced activities, must be established and managed to demonstrate conformity to requirements and the organization’s quality management system. The organization must maintain a documented procedure outlining the controls and responsibilities for managing records. This procedure should cover:

1. Identifying records;
2. Collecting records;
3. Ensuring legibility of records;
4. Correcting records when necessary;
5. Storing records securely;
6. Safeguarding records from unintended alteration, damage, or loss;
7. Retrieving records as needed;
8. Determining retention periods;
9. Disposing of records when appropriate.

Records must be retained for a minimum of ten years or as required by customer, legal, and other relevant requirements, whichever is longer.

The organization must establish a documented procedure for control of Records. The procedure must identify the controls and responsibilities needed for the identification, collection, storage, protection, retrieval, retention time, and disposition of records. Records should remain legible, identifiable, and retrievable. The retention of records should be based on customer, legal, and other applicable requirements or 5 years whichever is more. The records including those of outsourced processes must be e established and controlled to provide evidence of conformity to requirements and the organization’s quality management system.

Records Required by API Q1 standard

1. records of education, training, skills, and experience
2. records to ensure the effective planning, operation, and control of its processes and compliance with specified requirements
3. record of customer requirements, when the customer provides no documented statement of requirements
4. Records of contract review including resulting actions
5. records needed to provide evidence that the product realization processes meet requirements (for eg inspection record)
6. Records of risk assessment and management including actions taken
7. Contingency plan
8. Records of design inputs
9. Records of design outputs
10. Records of design review
11. Records of design and development verification and the final review
12. Records of the design and development validation, approval, and any necessary actions
13. Records of design and development changes,
14. Records of supplier evaluation
15. Records of outsourced activities
16. Records of verification of Purchased Products or Activities
17. Records of product realization plan
18. records of review/verification, validation, monitoring, measurement, inspection, and test activities, including criteria for product acceptance
19. Records of validation of Processes for Production and Servicing
20. Records of identification and traceability
21. Records for the control and disposition of customer-supplied property
22. Records of the results of assessments of products kept in storage
23. Records of required inspection and testing
24. Records of preventive maintenance
25. Records of assessment of the validity of previous measurements and actions to be taken on the equipment and product, when the equipment is found to be out of calibration.
26. Records of the results of calibration and verification
27. Records shall be maintained to enable identification of the individual releasing the product
28. Records of notification to customers of products not conforming to DAC or contract requirements
29. Records of the nature of nonconformities of non-conforming products and any subsequent actions taken
30. Records of MOC activities
31. Records of customer satisfaction
32. Records of internal audit
33. Records of the Corrective Action
34. Records of Management Review