Change as a QMS Risk
Every significant organizational change is a potential quality risk. Change creates conditions for process variation, documentation obsolescence, and competence gaps. A new software system is implemented without updating work instructions. A production layout is reorganized without reassessing risks. A key supplier is replaced without validation. A department is restructured without clarity on who owns which process. Clause 6.3 (planning of changes) is the formal mechanism for managing this risk. The informal mechanism is the culture of quality awareness during change. Together, they ensure that change does not degrade quality.
Types of Organizational Change That Impact the QMS
| Change Type | QMS Impact | Required Update | Priority |
|---|---|---|---|
| New product/service launch | New processes, new risks, new customer requirements | BIA of new product against QMS; process documentation update | High |
| Process redesign | Documented procedures obsolete; risk profile changes | Process documentation update; training | High |
| Technology change | Work methods change; monitoring and measurement tools change | Work instructions, measurement procedures | High |
| Organizational restructuring | Process ownership changes; competence distribution changes | Role descriptions, process ownership map | Medium-High |
| New regulatory requirement | Compliance gap; process update required | Regulatory requirement register update; process update | High |
| Key personnel departure | Organizational knowledge at risk; competence gap | Knowledge capture; recruitment and training | Medium-High |
Clause 6.3: Planning of Changes
The clause requires that when planning changes to the QMS, the organization must consider: (a) the purpose of the change and its potential consequences; (b) the integrity of the QMS; (c) the availability of resources; and (d) the allocation of or reallocation of responsibilities and authorities. The change record as documented information captures these four considerations. When a new product is launched, document why (market opportunity, customer demand), what processes are affected, what resources are needed, and who owns the new process. This discipline prevents the common scenario where change happens without management understanding the impact.
The QMS Change Management Process
The full cycle is Change identification → Impact assessment → Clause 6.3 considerations documented → Update documentation → Training → Implementation → Verify quality impact. The change management register tracks all changes in process. Who authorizes QMS changes? In most organizations, the QMS Lead authorizes documentation changes; the Process Owner authorizes process changes; top management authorizes strategic changes. Clear authorization levels prevent ad-hoc changes that bypass quality review.
| KEY IDEA | Organizational change does not pause the QMS — it stresses it. The QMS that cannot adapt to change is not a management system — it is a snapshot of how the organization operated at the time of certification. Building change management into the QMS operating model from day one is what makes the difference between a living QMS and a static compliance artifact. |
Unplanned Changes
Changes that happen without formal planning are the most dangerous. Customer changes specification mid-project without updating the requirements. Supplier changes product formulation without notifying quality. A key staff member leaves unexpectedly and knowledge walks out the door. Detecting unplanned changes before they affect quality is the role of internal audit. An internal audit that identifies an undocumented new process or a procedure being ignored is detecting unplanned change that the QMS did not manage. The audit finding becomes the trigger for bringing the change into the formal change management process.
QMS Documentation Maintenance Through Change
| Document Type | Review Trigger | Review Owner | Update Process |
|---|---|---|---|
| Quality policy | Annual review + significant strategic change | Top Management | Redraft + reapproval + re-communication |
| Quality objectives | Annual review + strategy change + persistent miss | QMS Lead + Management | Objectives revision + re-communication |
| Process procedures | Process redesign + technology change + personnel change | Process Owner | Procedure revision + retraining + reapproval |
| Work instructions | Task change + equipment change + method change | Process Owner + QMS Lead | Instruction revision + verification |
| Supplier approved list | Supplier change + new qualification | Procurement | Register update + evaluation record |
Change Communication
Communicating QMS changes to affected staff is as important as making the changes. The change notification process should specify: what is changing, why it is changing, when it is changing, who needs to know, what training is required. Training for significant procedural changes is mandatory. Documenting communication as documented information provides evidence that affected staff were informed. The common failure of implementing changes without adequate communication results in two procedures in concurrent use: the old procedure that people know and trust, and the new procedure that is not yet understood. This creates process variation and quality risk.
| IMPORTANT | The most common audit finding related to organizational change is outdated procedures — documented processes that describe how things used to work rather than how they work now. This almost always results from changes implemented without QMS update. Embed a "does this change affect QMS documentation?" question into all project and change management workflows. |
| BITLION INSIGHT | Indonesian organizations experiencing rapid growth — common in the technology and services sectors — face the greatest change management challenge. New staff, new products, new customers, and new processes are introduced continuously. The QMS team needs a lightweight, agile change management process that can keep documentation current without creating bureaucratic friction that slows business agility. Quarterly documentation review cycles, rather than event-triggered reviews for every minor change, are often the most practical approach. |