standards-expert（标准专家）

ISO Standards and Quality Management Expert

Expert guidance for ISO standards, quality management systems, compliance, and certification processes.

Core Concepts

ISO Standards

• ISO 9001 (Quality Management)
• ISO 27001 (Information Security)
• ISO 14001 (Environmental Management)
• ISO 45001 (Occupational Health & Safety)
• ISO/IEC 17025 (Testing and Calibration)
• ISO 22000 (Food Safety)

Quality Management

• Plan-Do-Check-Act (PDCA) cycle
• Process approach
• Risk-based thinking
• Continuous improvement (Kaizen)
• Quality objectives and metrics
• Management review

Compliance & Certification

• Gap analysis
• Internal audits
• Corrective actions
• Document control
• Management system documentation
• Certification audits

ISO 9001 Quality Management System

from dataclasses import dataclass
from datetime import datetime
from typing import List, Optional
from enum import Enum

class ProcessCategory(Enum):
    MANAGEMENT = "management"
    OPERATIONAL = "operational"
    SUPPORT = "support"

@dataclass
class QualityProcess:
    process_id: str
    name: str
    category: ProcessCategory
    owner: str
    inputs: List[str]
    outputs: List[str]
    resources: List[str]
    kpis: List[str]
    risks: List[str]

class ISO9001QMS:
    """ISO 9001 Quality Management System"""

    def __init__(self, organization: str):
        self.organization = organization
        self.processes: Dict[str, QualityProcess] = {}
        self.quality_objectives = []
        self.risks = []
        self.opportunities = []

    def define_process(self, process: QualityProcess):
        """Define a quality process"""
        self.processes[process.process_id] = process

    def define_quality_objective(self, objective: Dict):
        """Define quality objective"""
        self.quality_objectives.append({
            'objective': objective['description'],
            'target': objective['target'],
            'measurement': objective['measurement'],
            'owner': objective['owner'],
            'deadline': objective['deadline'],
            'status': 'active'
        })

    def conduct_pdca_cycle(self, process_id: str) -> Dict:
        """Conduct PDCA cycle for process"""
        return {
            'plan': self._plan_phase(process_id),
            'do': self._do_phase(process_id),
            'check': self._check_phase(process_id),
            'act': self._act_phase(process_id)
        }

    def _plan_phase(self, process_id: str) -> Dict:
        """PDCA Plan phase"""
        process = self.processes.get(process_id)
        return {
            'objectives': 'Define objectives and processes',
            'resources': process.resources if process else [],
            'risks_identified': process.risks if process else []
        }

    def _do_phase(self, process_id: str) -> Dict:
        """PDCA Do phase"""
        return {
            'action': 'Implement the processes',
            'documentation': 'Document execution'
        }

    def _check_phase(self, process_id: str) -> Dict:
        """PDCA Check phase"""
        return {
            'monitoring': 'Monitor and measure processes',
            'analysis': 'Analyze results against objectives'
        }

    def _act_phase(self, process_id: str) -> Dict:
        """PDCA Act phase"""
        return {
            'improvements': 'Implement improvements',
            'corrective_actions': 'Take corrective actions'
        }

ISO 27001 Information Security

class RiskLevel(Enum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"

@dataclass
class InformationAsset:
    asset_id: str
    name: str
    description: str
    owner: str
    classification: str  # public, internal, confidential, restricted
    value: int  # 1-5 scale

@dataclass
class SecurityRisk:
    risk_id: str
    asset_id: str
    threat: str
    vulnerability: str
    likelihood: int  # 1-5 scale
    impact: int  # 1-5 scale
    risk_level: RiskLevel
    controls: List[str]
    residual_risk: RiskLevel

class ISO27001ISMS:
    """ISO 27001 Information Security Management System"""

    def __init__(self, organization: str):
        self.organization = organization
        self.assets: Dict[str, InformationAsset] = {}
        self.risks: Dict[str, SecurityRisk] = {}
        self.controls = {}

    def register_asset(self, asset: InformationAsset):
        """Register information asset"""
        self.assets[asset.asset_id] = asset

    def assess_risk(self, asset_id: str, threat: str,
                   vulnerability: str, likelihood: int, impact: int) -> SecurityRisk:
        """Assess security risk"""
        risk_score = likelihood * impact

        if risk_score >= 20:
            risk_level = RiskLevel.CRITICAL
        elif risk_score >= 12:
            risk_level = RiskLevel.HIGH
        elif risk_score >= 6:
            risk_level = RiskLevel.MEDIUM
        else:
            risk_level = RiskLevel.LOW

        risk = SecurityRisk(
            risk_id=f"RISK-{len(self.risks) + 1:03d}",
            asset_id=asset_id,
            threat=threat,
            vulnerability=vulnerability,
            likelihood=likelihood,
            impact=impact,
            risk_level=risk_level,
            controls=[],
            residual_risk=risk_level
        )

        self.risks[risk.risk_id] = risk
        return risk

    def implement_control(self, risk_id: str, control: str,
                         effectiveness: int):
        """Implement security control"""
        if risk_id in self.risks:
            risk = self.risks[risk_id]
            risk.controls.append(control)

            # Recalculate residual risk
            reduced_score = (risk.likelihood * risk.impact) * (1 - effectiveness/10)

            if reduced_score >= 20:
                risk.residual_risk = RiskLevel.CRITICAL
            elif reduced_score >= 12:
                risk.residual_risk = RiskLevel.HIGH
            elif reduced_score >= 6:
                risk.residual_risk = RiskLevel.MEDIUM
            else:
                risk.residual_risk = RiskLevel.LOW

    def generate_soa(self) -> Dict:
        """Generate Statement of Applicability"""
        # Annex A controls from ISO 27001
        controls = {
            'A.5': 'Information security policies',
            'A.6': 'Organization of information security',
            'A.7': 'Human resource security',
            'A.8': 'Asset management',
            'A.9': 'Access control',
            'A.10': 'Cryptography',
            'A.11': 'Physical and environmental security',
            'A.12': 'Operations security',
            'A.13': 'Communications security',
            'A.14': 'System acquisition, development and maintenance',
            'A.15': 'Supplier relationships',
            'A.16': 'Information security incident management',
            'A.17': 'Business continuity management',
            'A.18': 'Compliance'
        }

        return {
            'organization': self.organization,
            'controls': controls,
            'implementation_status': 'To be determined per control'
        }

Audit Management

class AuditType(Enum):
    INTERNAL = "internal"
    EXTERNAL = "external"
    CERTIFICATION = "certification"
    SURVEILLANCE = "surveillance"

@dataclass
class AuditFinding:
    finding_id: str
    audit_id: str
    type: str  # 'non_conformity', 'observation', 'opportunity'
    severity: str  # 'major', 'minor'
    description: str
    clause_reference: str
    evidence: str
    corrective_action: Optional[str] = None
    due_date: Optional[datetime] = None
    status: str = 'open'

class AuditManager:
    """Manage quality audits"""

    def __init__(self):
        self.audits = {}
        self.findings: Dict[str, AuditFinding] = {}

    def plan_audit(self, audit_id: str, audit_type: AuditType,
                  scope: List[str], auditors: List[str],
                  date: datetime) -> Dict:
        """Plan an audit"""
        audit = {
            'audit_id': audit_id,
            'type': audit_type.value,
            'scope': scope,
            'auditors': auditors,
            'date': date,
            'status': 'planned'
        }

        self.audits[audit_id] = audit
        return audit

    def record_finding(self, finding: AuditFinding):
        """Record audit finding"""
        self.findings[finding.finding_id] = finding

    def create_corrective_action(self, finding_id: str,
                                 action: str, responsible: str,
                                 due_date: datetime):
        """Create corrective action for finding"""
        if finding_id in self.findings:
            finding = self.findings[finding_id]
            finding.corrective_action = action
            finding.due_date = due_date
            finding.status = 'corrective_action_planned'

            return {
                'finding_id': finding_id,
                'action': action,
                'responsible': responsible,
                'due_date': due_date
            }

    def close_finding(self, finding_id: str, verification: str):
        """Close finding after verification"""
        if finding_id in self.findings:
            finding = self.findings[finding_id]
            finding.status = 'closed'

            return {
                'finding_id': finding_id,
                'closure_date': datetime.now(),
                'verification': verification
            }

    def generate_audit_report(self, audit_id: str) -> Dict:
        """Generate audit report"""
        audit = self.audits.get(audit_id)
        audit_findings = [f for f in self.findings.values()
                         if f.audit_id == audit_id]

        return {
            'audit': audit,
            'findings_count': len(audit_findings),
            'major_nc': sum(1 for f in audit_findings
                          if f.severity == 'major'),
            'minor_nc': sum(1 for f in audit_findings
                          if f.severity == 'minor'),
            'observations': sum(1 for f in audit_findings
                              if f.type == 'observation'),
            'findings': audit_findings
        }

Document Control

@dataclass
class Document:
    document_id: str
    title: str
    version: str
    author: str
    approver: str
    effective_date: datetime
    review_date: datetime
    status: str  # 'draft', 'approved', 'obsolete'

class DocumentControl:
    """Manage controlled documents"""

    def __init__(self):
        self.documents: Dict[str, List[Document]] = {}

    def create_document(self, doc: Document):
        """Create new document"""
        if doc.document_id not in self.documents:
            self.documents[doc.document_id] = []

        self.documents[doc.document_id].append(doc)

    def get_current_version(self, document_id: str) -> Optional[Document]:
        """Get current approved version"""
        if document_id in self.documents:
            versions = [d for d in self.documents[document_id]
                       if d.status == 'approved']
            if versions:
                return max(versions, key=lambda x: x.version)
        return None

    def revise_document(self, document_id: str, changes: str,
                       author: str) -> Document:
        """Create document revision"""
        current = self.get_current_version(document_id)

        if current:
            new_version = self._increment_version(current.version)

            new_doc = Document(
                document_id=document_id,
                title=current.title,
                version=new_version,
                author=author,
                approver=current.approver,
                effective_date=datetime.now(),
                review_date=datetime.now(),
                status='draft'
            )

            self.create_document(new_doc)
            return new_doc

    def _increment_version(self, version: str) -> str:
        """Increment version number"""
        parts = version.split('.')
        parts[-1] = str(int(parts[-1]) + 1)
        return '.'.join(parts)

Best Practices

Implementation

• Get management commitment
• Conduct gap analysis first
• Define clear scope
• Document processes thoroughly
• Train all personnel
• Implement gradually
• Monitor effectiveness

Auditing

• Plan audits regularly
• Use competent auditors
• Focus on process effectiveness
• Document findings clearly
• Follow up on corrective actions
• Learn from findings
• Share lessons learned

Continuous Improvement

• Regular management reviews
• Monitor KPIs consistently
• Respond to changes
• Encourage employee feedback
• Benchmark against best practices
• Document improvements
• Celebrate successes

Anti-Patterns

❌ Documentation for its own sake ❌ No management involvement ❌ Treating certification as the goal ❌ Ignoring audit findings ❌ No continuous improvement ❌ Poor document control ❌ Insufficient training

Resources

• ISO: https://www.iso.org/
• ISO 9001:2015: https://www.iso.org/standard/62085.html
• ISO 27001:2022: https://www.iso.org/standard/82875.html
• ASQ (American Society for Quality): https://asq.org/
• ISO Survey: https://www.iso.org/the-iso-survey.html