"But it's such a small change!"

Now that ISO TC 176 has formally announced the decision to start work on a revision of ISO 9001 (see this announcement from 3 August 2023), this may be a good time to revisit the question what constitutes a big change rather than a small one. What's interesting is that often you can't tell from the outside how big an impact a change is going to have.

The question matters because every change introduces churn and disruption. When a global standard like ISO 9001 introduces new requirements or changes old ones, organizations across the world have to stop what they are doing, evaluate the change to see what it means for them, and then make the appropriate changes in their own operations; that last step includes planning the changes (clause 6.3), updating the relevant documented information (clause 7.5.3.2c), introducing the changes in a controlled way (clause 8.5.6), auditing them for effectiveness (clause 9.2.2a) and reviewing the results (clause 9.3.2b). 

Is the serving large or small? Depending on your context (in this case,
the size of the plate) the same serving can look very different!

It's never easy. So it's always a relief when the changes turn out to be small and not big. But what makes for a big change?

It turns out that the answer depends very narrowly on the specific organization's current Quality Management System. Changes that are trivial for one organization might be huge for another.

This point was driven home to me back when the 2008 edition of the standard was being rolled out. At that time I worked for a regional office of a mid-sized global company. My office had started as an independent company of its own, and we still handled many of our operations the way we always had in the past (rather than integrating fully into all of our parent's systems). It made our QMS a little complicated 😀, but in practice it worked fine.

When ISO 9001 rolled from the 2000 edition to the 2008 edition, I looked through the changes. Mostly they looked superficial—minor changes to wording or sentence structure that made the text less ambiguous or more readable. 

• Passive verbs were replaced by active verbs. 
• The phrase "regulatory requirements" was replaced by "statutory or regulatory requirements." 
• Instead of being told to "identify" the processes in its QMS, the organization was told to "determine" them. 

This was the kind of change that I found throughout the document. And when I discussed the changes with our certification auditor (who was always very collegial when he was off-duty), he agreed completely. Neither of us found anything in the document to worry about.

Meanwhile the Home Office reacted to these same changes with panic. During Quality department staff meetings, I kept hearing that the updates in the 2008 edition were momentous, that they could require us to change everything. I didn't like to tell my colleagues they were wrong, but for some time I had no idea what worried them so.

Turns out they were worried over one provision. At one point, seemingly as an afterthought, the authors of the 2008 edition shed light on a requirement that had been more or less implicit before but never spelled out in words: in a clarification of clause 4.1 ("General requirements") the new edition now stated:

NOTE 3: Ensuring control over outsourced processes does not absolve the organization of the responsibility of conformity to all customer, statutory and regulatory requirements.

Why did this alarm the Home Office? I learned that they regularly outsourced certain processes that they did not have the capability to perform themselves, and the contracts with their suppliers made the suppliers responsible for all conformity issues involved. In other words, the Home Office had no systems in place to allow them to accept or exercise this level of responsibility; and the new edition of the standard meant they had to build those systems from scratch in a hurry. 

Our office, by contrast, had always taken that responsibility for granted, even when it wasn't explicitly stated. (You remember I said that many of our operations were left over from when we had been independent.) So for us, locally, this Note required literally no change at all to anything we were doing. And I'm pretty sure (from talking to other people later) that the authors of the standard thought the Note was no more than a restatement of something that had been implied all along.

You never can tell what changes are going to look big until you check the individual cases one at a time. It's remarkable, really.