Clause 8 Operation
8.1 Operational planning and control
Clause Criteria
The organization shall plan, implement and control the processes needed to meet requirements, and to implement the actions determined in 6.1, by:
establishing criteria for the processes;
implementing control of the processes in accordance with the criteria;
keeping documented information to the extent necessary to have confidence that the processes have been carried out as planned.
The organization shall control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary.
The organization shall ensure that outsourced externally provided processes, products or services are controlled.
Explanation
The intent of the clause on Operational planning and control is to specify the requirements that need to be implemented within the organization’s operations to make sure the Management Systems Standard requirements are fulfilled, and the priority risks and opportunities are being addressed.
Operational control includes the methods implemented to make sure business operations, activities or equipment do not exceed specified conditions or performance standards or violate regulatory compliance limits, and thereby effectively achieve the intended outcome results of the management system.
These controls establish technical requirements necessary to achieve the desired optimal functionality for business processes, such as technical specifications or operating parameters or a prescribed methodology.
Operational control is required for situations related to business processes where absence of controls could lead to deviations from the policy and objectives or poses unacceptable risk.
These situations can be related to business operations, activities or processes; production, installation or servicing; maintenance; or contractors, suppliers or vendors.
The degree of control exercised will vary depending on many factors, including the functions performed; their importance or complexity; the potential consequences of deviation or variability; or, the technical competency involved versus what is available.
Documentation needed to have confidence that the operational control processes have been carried out as planned is created and controlled in accordance with the requirements of Clause 7.5 Documented information.
Requirements for management of change, both planned and unintended changes, are required to prevent or otherwise minimize the chance technical requirements are not fulfilled, or new risks are introduced.
When operational controls fail, action is necessary to address any resultant undesired effect(s).
Control of outsourced processes externally delivered processes, products or services is not unlike the control of operations; however the type and degree of control can be limited to partial control.
Chief Explainer:
Phil Byrne