Although it was implied in the 1994 version that top management was responsible for setting the quality policy, it really wasn't driven from that level in many organizations. The language in the new standard, however, gets down to business with five requirements, which ensure that the quality policy:

• is appropriate to the purpose of the organization;
• includes a commitment to comply with requirements and continually improve the effectiveness of the quality management system;
• provides a framework for establishing and reviewing quality objectives;
• is communicated and understood within the organization; and
• is reviewed for continuing suitability.

In basic terms, the quality policy is a single statement of commitment from the highest-level members of the organization that articulates their visions of how they will meet their business objectives and satisfy their customers. As you can see from above, the language of the five requirements is clear: The first three address the requirements of the policy, and the remaining two address how the policy will be communicated throughout the organization and how it will be reviewed for its "suitability" to the business.

But remember that ISO 9001:2000's language in this clause is designed for flexibility, stating up front that the policy must be "appropriate to the purpose of the organization." That means two things: First, it means that every quality policy out there will be different because every organization in the marketplace is different. Indeed, organizations shouldn't use a "cookie cutter approach" when designing the quality policy-it should be relevant to what the organization does. Second, make sure the policy is appropriate for the organization and its No. 1 priority-the customer! If you write an eloquent policy but the organization can't meet its expectations, then the system is doomed to fail right out of the starting blocks.

The policy also should create "a framework" for the organization's quality objectives, meaning that every goal you establish for the business is measurable and considers the continual improvement concept. You don't have to include the quality objectives in the quality policy, but it must provide a framework for establishing and reviewing them. Some examples of quality objective areas include customer satisfaction, warranties, shipping/delivery time and meeting regulatory commitments.

Once your team has established the policy, it must be communicated in an understandable way to the entire organization, and if relevant, to other interested parties as well. This means that everyone from the people in the front office to the nighttime cleaning crew understands what the policy means to them and their daily activities. They don't have to memorize it or be able to recite the policy verbatim to an auditor, but they need to understand their role in ensuring all elements of the policy are achieved.

For this to be done effectively, the organization usually needs some kind of awareness training after the policy has been established. Awareness training could be as simple as making sure all personnel read the company's Intranet site on the policy or as complex as sending key people to professional training courses on ISO 9001:2000-that's up to you and top management. But make no mistake-this is one area that auditors will test constantly. Without an effective quality policy and without an effective way to communicate that policy, the system will not conform to the standard's requirements and, ultimately, will not meet the customer's requirements (i.e., potential lost business resulting in stagnant or zero growth for the organization).

When developing your quality policy, be sure to have your organization's vision and mission statements in mind, as well as the organization's long-term business plan. Knowing the organization's purpose will help you set a framework as to how the quality policy and the quality objectives can ensure continual improvement for the business. In fact, be thinking in those terms at all times- improvement, improvement, improvement!

The 1994 version did not require any specific policy content. Now, policies must include commitments to comply with requirements and continually improve the effectiveness of the system to ensure they meet the new requirements.

Also, remember that the quality policy is an evolving document and should be reviewed and updated when necessary. As your customers' needs change, so will your business and, thus, your policy. But "quality policy is listed under 4.2.1 as a required "documented" statement and, therefore, subject to document control.