ANNEX SL

46 | QUALITY WORLD | SUMMER 2021

ANNEX SLAHARMONISEDAPPROACH TO
MANAGEMENTSYSTEM
STANDARDS
The International Standards Organization (ISO) has recently undertaken
a limited revision of Annex SL, which forms the basis for nearly all its
management system standards. The latest version, published in May 2021
as part of the ISO Supplement to Part 1 of the ISO/IEC Directives, applies
to all new ISO Management System Standards as well as the revisionof existing ones. Nigel Croft, CQP FCQI, Chair of the ISO Joint Technical
Coordination Group (JTCG) for Management System Standards, and DickHortensius, Senior Standardization Consultant Management Systems,
from the Netherlands Standardization Institute and Secretary of the JTCG,
share details of the revisions

QUALITY.ORG | 47

ANNEX SLThe ISO Supplement
to the ISO/IEC
Directives defines
the requirementsthat have tobe followed byISO TechnicalCommittees for
all ISO standards(more than 20,000of them). “Annex
SL” of the Directives is an all-embracing
term used to describe the criteria thathave to be met in order to ensure aconsistent and a harmonised approach
to writing the 40-plus MSS that are
now within the ISO portfolio.
First published in 2012, and now
applied by the vast majority of ISOMSS, Annex SL comprises severalcomponents, which in the latest
edition are:
• The “body” of Annex SL, which
describes among other things the“harmonized approach” to thedevelopment of MSS, including thelevel of autonomy and flexibility
that can be exercised by individual
ISO Technical Committees whendeveloping their discipline-specificstandards.
• Appendix 1, which specifies thejustification studies that are required
when a proposal is made to develop
a new MSS (to avoid overlaps and/or potential conflicts with existing
standards).
• Appendix 2 contains the harmonizedstructure (HS), formerly known as
the high-level structure, with theidentical core text, common terms
and core definitions that MSS writers
are required to follow, together withguidance on how to use it (aimed
primarily at the standards writers
themselves, but which can also be
useful to MSS users).

48 | QUALITY WORLD | SUMMER 2021

• Appendix 3 contains guidance on
the use of terminology.
The ISO’s Joint Technical Coordination
Group (JTCG) was established in 2007
and comprises representatives from allof the ISO technical committees with
one or more MSS.

Review of Annex SL
All ISO standards are periodicallysubjected to a systematic review
for their relevance and topicality.
Although Annex SL is not a “standard”
as such, this review was carried out in2018 by consultation with the various
ISO Committees (and their constituentmembers) with a MSS in their portfolio,and National Standards Bodies(including feedback from users of thestandards). That assessment showedthat the overall acceptance of Annex
SL among standards developers andusers had been good, and that there
was no need for a major overhaul.
However, there were enough points for
improvement that justified an update.
As a result, a new task force of theJTCG (TF14) was set up at the end of
2018 to prepare a limited review of thehigh-level structure, as part of a wider
revision of Annex SL.

The revision process
Almost 100 representatives of ISO’s
Technical Committees and National
Member Bodies participated in therevision process, under the leadershipof Dr Nigel Croft (Brazilian NationalStandards Organization) andDick Hortensius (the Netherlands
Standardization Institute). TF14 triedto avoid making changes for change’s
sake, and applied a benefit/impact
rationale to every individual change.
The changes to the high-level structure(now renamed the HS) are therefore
quite small and will not have an

immediate impact on users. However,the “Guidance for MSS writers”
in Annex SL Appendix 2 has beensignificantly improved, which should
result in enhanced alignment andharmonisation of “discipline-specific”
requirements as the changes filter
down into the various MSS over time.
The revised Annex SL has now been
incorporated into the latest version of
the Directives, published on 1 May 2021,
and will apply to the development of
all new MSS (such as the new ISO 42001
for Artificial Intelligence, which is stillin its early stages) and any revision ofexisting standards, such as ISO 9001(Quality), ISO 14001 (Environment),
ISO 45001 (Occupational Health andSafety) and others. However, it shouldbe emphasised that this will occur
over time, and the standards are notrequired to be revised simply as a resultof the revision to Annex SL.

The main changes
Scope – link with intended results
The scope of all MSS (Clause 1) must
indicate the intended results of themanagement system that is specified
in the standard. For example, ISO
14001:2015 states that it is about
improving environmental performance,
meeting compliance obligations andachieving environmental objectives.
ISO 9001:2015 is clear that theintended results are to consistently“THE REVISED ANNEXSL HAS NOW BEEN
INCORPORATED INTO
THE LATEST VERSION
OF THE DIRECTIVES …
AND WILL APPLY TO THE
DEVELOPMENT OF ALL
NEW MSS”
provide conforming products andservices, thereby improving customer
satisfaction, and so on. This provides
a basis on which organisations
can consider the relevant risks andopportunities they need to control orexploit in order to achieve or exceed
the goals of the management system.
For auditors and those involvedin accredited certification, these
intended results are an importantreference point for determining theANNEX SL

NEW SITUATION: FULLY ALIGNED STANDARDSISO 45001:2018
OCCUPATIONAL HEALTHAND SAFETY

ISO 14001:2015
ENVIRONMENT

ISO 55001:2015
ASSETS

ISO 9001:2015
QUALITY

ISO 22000:2018
FOOD SAFETY

A

NN

EX S

ISO 22301: 2014
BUSINESSCONTINUITY

L$© Nigel H Croft 2021

ISO/IEC 27001:2017
INFORMATIONSECURITY

Annex SL will apply to thedevelopment of all new standards
and revision of existing ones.

ISO 50001:2018
ENERGYISO 19600:2015
COMPLIANCE

Cover courtesy of ISO

overall effectiveness of a management
system. “Effectiveness” is defined inAppendix 2 of Annex SL as being “theextent to which planned activities
are realised and planned results areachieved”. While an organisation might
have other additional expectations
for its management system, theMSS will define the minimum thatshould be achieved as part of theconcept that “Output Matters”. This is
described further in the joint ISO/IAF/
ILAC document “Expected outcomesfor accredited certification to ISO
management system standards”(https://www.iaf.nu/upFiles/CASCO_
Expected_Outcomes2018final.pdf).

Annex SL is the result of an extensive
revision process, with a benefit/rationale
impact applied to every change.

ISO 37001:2016
ANTI-BRIBERY

Terms and definitions always
included in the standard
From now on, the terms and definitions
from Appendix 2 must be incorporated

into each MSS, supplemented, if
desired, with the specific terms anddefinitions applicable to that standard.
This is a change for ISO 9001,
for example, which so far has notincluded definitions, instead making
a normative reference to ISO 9000
(the Fundamentals and Vocabularystandard). This is important for allusers of standards, including auditors,
because it has been shown time andagain that a good understanding ofterminology is essential for a goodunderstanding of a standard asa whole.
Removal of “outsourcing” and“control of outsourced processes”
The concepts of “outsourcing” and“control of outsourced processes” will
no longer be used. In practice, there
has often been discussion about what
exactly outsourced processes areand what is the difference with (thecontrol of) purchasing and working
with outsourced service providers.

QUALITY.ORG | 49

ANNEX SL

The organisation determines whichstakeholder requirements will becomplied withIn Appendix 2 of Annex SL, the term“requirement” is defined as a needor expectation that is stated, generally
implied or obligatory. Clause 4.2
has always required an organisation
to identify the relevant requirementsof relevant interested parties
or stakeholders.
This definition of a requirement
indicates that it encompasses morethan what is mandatory for anorganisation, eg, complying withlegal requirements. However, it has
been unclear how an organisation
should deal with the other needs andexpectations of stakeholders.
This was already clarified in standards
such as ISO 14001 and ISO 45001, andnow a similar wording has been addedin clause 4.2 (Understanding the needs
and expectations of interested parties)of Annex SL, to make it applicable toall MSS. Namely, that the organisation“FROM NOW ON,
THE TERMS AND
DEFINITIONS FROMAPPENDIX 2 MUST BE
INCORPORATED INTO
EACH MSS”
shall determine which of the identifiedrequirements of stakeholders will beaddressed in the management system.
It is logical that these would thenbecome the “applicable requirements”
that the organisation commits tomeet, as expressed in the policy inaccordance with clause 5.2 (XXX Policy),
where “XXX” refers to the specificdiscipline of the MSS, such as quality,environment, etc.
An example in the case of ISO
9001 might be where a potential
customer has a series of needs andexpectations that the organisation

50 | QUALITY WORLD | SUMMER 2021

cannot, or chooses not, to meet.
Such needs and expectations become“applicable requirements” for thequality management system only if
the organisation offers or accepts anorder for products and services that arebased on them.
This is consistent with the concept
of “compliance obligations” asdefined in the newly published ISO37301:2021 standard for ComplianceManagement Systems.

By using different verbs, such as“maintaining” documented information(eg, procedures or work instructions)and “retaining” documented
information (for records), some MSS
hung on to the old concepts in aroundabout way.
This has led to endless discussions
about when a document orrecord is involved and what
specific requirements apply to its
management and control, while inmodern practice there are all kinds ofhybrid forms of making information
available in an effective and agile way.
Therefore, the new version of Annex
SL adopts the idea that documented
information needs to “be available”,
rather than prescribing how exactly
it should happen.

Management of change
Clause 6 now includes the new
subclause 6.3, which states that thechanges to the management system,
for whatever reason, shall be carriedout in a pre-planned manner. Clause
8 elaborates on this by requiring thatthe changes that are being plannedin clause 6.3 are carried out in acontrolled manner. This means thatthe basics of Management of Change
have become an explicit part of Annex
SL. This will not affect users of ISO
9001 (there is already a requirementin ISO 9001 to this effect), but this willneed to be addressed by all MSS in
the future.
Documented information
One important feature in the 2012
version of Annex SL was the departurefrom the well-known concepts of“documents, procedures and records”,
and the introduction of the ideaof “documented information”. The
purpose of this was to emphasise that
it is the information that is important
for the effective functioning of themanagement system, and not so muchthe way in which that information is
captured or documented.
In any case, the JTCG has beenvery reluctant to include specificrequirements for documentation in
Annex SL to provide the maximum
flexibility for individual MSS writers todefine this for their specific discipline,with the minimum of bureaucracy.
The extent of documentation is achoice that an organisation makes
itself (based on the analysis of its
own needs for things like processcontrol, knowledge management,
demonstration of conformity and any
requirements imposed by relevantinterested parties), and not because“ISO requires it to be documented”.

Improvement
There were a number of comments
made about clause 10 of the Appendix
2 text (“Improvement”), for instance“THERE IS NOREQUIREMENT
FOR PUBLISHEDMSS TO
TRANSITION
TO THE NEW
HARMONIZEDSTRUCTURE
WITHIN A
SPECIFIED TIMEPERIOD, SO IT IS
LIKELY THAT THE
2012 AND 2021
VERSIONS WILL
CO-EXIST FOR
SOME TIME”
Getty.com/Creative-Touch

That is why it has now been decided
in clause 8 to set requirements forthe externally provided processes,products and services that are relevantto the management system. This now
also requires these processes to becontrolled (typically via purchasing),
which has not been the case so far.

ANNEX SL

too much emphasis on “learningfrom mistakes” by taking corrective
action on identified nonconformities.
This has resulted in the order of thesubclauses in clause 10 now being
reversed so it now starts with a shortsection on “continual improvement”
in general. This change is unlikely tohave a significant impact on users, but
it is in line with standards such as ISO
9001 and ISO 14001, in which a separate“general” paragraph on improvement isalready included.
Risks and opportunities – no change
The question of “risk” and the ways inwhich the various MSS address “risksand opportunities” varies significantly
between different disciplines andsectors (most notably those that
operate in a regulated environment).
Therefore, it was not surprising thatthese topics were the subject of muchdebate during the revision process.
The ISO’s Technical Committee on

Risk Management (TC262), which
participated in the work, has sinceapproached ISO to recommend
a strategic high-level review on
how all ISO and IEC (InternationalElectrotechnical Commission)
standards (not only MSS) define andaddress risk.
As a result, neither the definition ofrisk nor the text on how to deal withrisks and opportunities in clause 6.1of Appendix 2 has been changed. Thiswas considered to be the best option
available within the project time frame– to have made any “quick-fix” changes
ahead of the significant discussions
that are being initiated at the ISOand IEC level could have caused more
confusion than clarity.
However, TF14 did succeed indeveloping significantly improved
guidance for MSS writers, whichshould provide some flexibility in theapplication of Appendix 2 when needed
within a discipline-specific MSS.

Transition to the new HS
The new core text for MSS prescribedby Appendix 2 of Annex SL applies from
1 May 2021, after which all new MSS andrevisions of existing standards must be
based on this new version of the HS.
A few standards are already ahead of
the game, such as the aforementioned
ISO 37301:2021, published in April 2021.
However, there is no requirement forpublished MSS to transition to the new
HS within a specified time period, so it
is likely that the 2012 and 2021 versions
will co-exist for some time. However,since there are no fundamental
differences between the two, this is notexpected to become a major issue.

Summary – socially responsible
business operations
In light of this updated version ofAnnex SL, the ISO has indicated thatthe path taken in 2012 to improve
the alignment and consistency of
its portfolio of management systemstandards is irreversible, and themillions of users of MSS can expectthat further steps will be taken in
the coming years to support suchan approach that facilitates theiradoption within a single (“integrated”)
management system.
Societal change can be facilitatedby the adoption of the appropriate
MSS. Examples include business
continuity and crisis management(highlighted by Covid-19), resource
scarcity, adaptation to climate change,
digital transformation, Industry 4.0,
the circular economy, sustainability,
the sustainable development goals(SDGs), and others. All of these bringboth business opportunities and risks
that can be addressed within a single,
robust, business management model.
The new Annex SL provides thebasic elements for this, so that any
organisation can easily understandand embed the relevant MSS into its
business operations in a way thatbest fit its strategy and goals, core
processes, products and services, andthe context in which it operates.

The latest version ofAnnex SL is available toview online at:bit.ly/3wAzyRTQUALITY.ORG | 51