standards-expert

name	standards-expert
version	1.0.0
description	Expert-level ISO standards, quality management, compliance, and certification
category	professional
tags	["iso","standards","quality-management","compliance","certification"]
allowed-tools	["Read","Write","Edit"]

ISO Standards and Quality Management Expert

Expert guidance for ISO standards, quality management systems, compliance, and certification processes.

Core Concepts

ISO Standards

• ISO 9001 (Quality Management)
• ISO 27001 (Information Security)
• ISO 14001 (Environmental Management)
• ISO 45001 (Occupational Health & Safety)
• ISO/IEC 17025 (Testing and Calibration)
• ISO 22000 (Food Safety)

Quality Management

• Plan-Do-Check-Act (PDCA) cycle
• Process approach
• Risk-based thinking
• Continuous improvement (Kaizen)
• Quality objectives and metrics
• Management review

Compliance & Certification

• Gap analysis
• Internal audits
• Corrective actions
• Document control
• Management system documentation
• Certification audits

ISO 9001 Quality Management System

from dataclasses import dataclass
from datetime import datetime
from typing import List, Optional
from enum import Enum

class ProcessCategory(Enum):
    MANAGEMENT = "management"
    OPERATIONAL = "operational"
    SUPPORT = "support"

@dataclass
class QualityProcess:
    process_id: str
    name: str
    category: ProcessCategory
    owner: str
    inputs: List[str]
    outputs: List[str]
    resources: List[str]
    kpis: List[str]
    risks: List[str]

class ISO9001QMS:
    """ISO 9001 Quality Management System"""

    def __init__(self, organization: str):
        self.organization = organization
        self.processes: Dict[str, QualityProcess] = {}
        self.quality_objectives = []
        self.risks = []
        self.opportunities = []

    def define_process():
        
        .processes[process.process_id] = process

     ():
        
        .quality_objectives.append({
            : objective[],
            : objective[],
            : objective[],
            : objective[],
            : objective[],
            : 
        })

     () -> :
        
         {
            : ._plan_phase(process_id),
            : ._do_phase(process_id),
            : ._check_phase(process_id),
            : ._act_phase(process_id)
        }

     () -> :
        
        process = .processes.get(process_id)
         {
            : ,
            : process.resources  process  [],
            : process.risks  process  []
        }

     () -> :
        
         {
            : ,
            : 
        }

     () -> :
        
         {
            : ,
            : 
        }

     () -> :
        
         {
            : ,
            : 
        }

ISO 27001 Information Security

class RiskLevel(Enum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"

@dataclass
class InformationAsset:
    asset_id: str
    name: str
    description: str
    owner: str
    classification: str  # public, internal, confidential, restricted
    value: int  # 1-5 scale

@dataclass
class SecurityRisk:
    risk_id: str
    asset_id: str
    threat: str
    vulnerability: str
    likelihood: int  # 1-5 scale
    impact: int  # 1-5 scale
    risk_level: RiskLevel
    controls: List[str]
    residual_risk: RiskLevel

class ISO27001ISMS:
    """ISO 27001 Information Security Management System"""

    def __init__(self, organization: str):
        self.organization = organization
        self.assets: Dict[str, InformationAsset] = {}
        self.risks: Dict[str, SecurityRisk] = {}
        self.controls = {}

    def ():
        
        .assets[asset.asset_id] = asset

     () -> SecurityRisk:
        
        risk_score = likelihood * impact

         risk_score >= :
            risk_level = RiskLevel.CRITICAL
         risk_score >= :
            risk_level = RiskLevel.HIGH
         risk_score >= :
            risk_level = RiskLevel.MEDIUM
        :
            risk_level = RiskLevel.LOW

        risk = SecurityRisk(
            risk_id=,
            asset_id=asset_id,
            threat=threat,
            vulnerability=vulnerability,
            likelihood=likelihood,
            impact=impact,
            risk_level=risk_level,
            controls=[],
            residual_risk=risk_level
        )

        .risks[risk.risk_id] = risk
         risk

     ():
        
         risk_id  .risks:
            risk = .risks[risk_id]
            risk.controls.append(control)

            
            reduced_score = (risk.likelihood * risk.impact) * ( - effectiveness/)

             reduced_score >= :
                risk.residual_risk = RiskLevel.CRITICAL
             reduced_score >= :
                risk.residual_risk = RiskLevel.HIGH
             reduced_score >= :
                risk.residual_risk = RiskLevel.MEDIUM
            :
                risk.residual_risk = RiskLevel.LOW

     () -> :
        
        
        controls = {
            : ,
            : ,
            : ,
            : ,
            : ,
            : ,
            : ,
            : ,
            : ,
            : ,
            : ,
            : ,
            : ,
            : 
        }

         {
            : .organization,
            : controls,
            : 
        }

Audit Management

class AuditType(Enum):
    INTERNAL = "internal"
    EXTERNAL = "external"
    CERTIFICATION = "certification"
    SURVEILLANCE = "surveillance"

@dataclass
class AuditFinding:
    finding_id: str
    audit_id: str
    type: str  # 'non_conformity', 'observation', 'opportunity'
    severity: str  # 'major', 'minor'
    description: str
    clause_reference: str
    evidence: str
    corrective_action: Optional[str] = None
    due_date: Optional[datetime] = None
    status: str = 'open'

class AuditManager:
    """Manage quality audits"""

    def __init__(self):
        self.audits = {}
        self.findings: Dict[str, AuditFinding] = {}

    def plan_audit(self, audit_id: str, audit_type: AuditType,
                  scope: List[str], auditors: List[str],
                  date: datetime) -> Dict:
        """Plan an audit"""
        audit = {
            : audit_id,
            : audit_type.value,
            : scope,
            : auditors,
            : date,
            : 
        }

        .audits[audit_id] = audit
         audit

     ():
        
        .findings[finding.finding_id] = finding

     ():
        
         finding_id  .findings:
            finding = .findings[finding_id]
            finding.corrective_action = action
            finding.due_date = due_date
            finding.status = 

             {
                : finding_id,
                : action,
                : responsible,
                : due_date
            }

     ():
        
         finding_id  .findings:
            finding = .findings[finding_id]
            finding.status = 

             {
                : finding_id,
                : datetime.now(),
                : verification
            }

     () -> :
        
        audit = .audits.get(audit_id)
        audit_findings = [f  f  .findings.values()
                          f.audit_id == audit_id]

         {
            : audit,
            : (audit_findings),
            : (  f  audit_findings
                           f.severity == ),
            : (  f  audit_findings
                           f.severity == ),
            : (  f  audit_findings
                               f. == ),
            : audit_findings
        }

Document Control

@dataclass
class Document:
    document_id: str
    title: str
    version: str
    author: str
    approver: str
    effective_date: datetime
    review_date: datetime
    status: str  # 'draft', 'approved', 'obsolete'

class DocumentControl:
    """Manage controlled documents"""

    def __init__(self):
        self.documents: Dict[str, List[Document]] = {}

    def create_document(self, doc: Document):
        """Create new document"""
        if doc.document_id not in self.documents:
            self.documents[doc.document_id] = []

        self.documents[doc.document_id].append(doc)

    def get_current_version(self, document_id: str) -> Optional[Document]:
        """Get current approved version"""
        if document_id in self.documents:
            versions = [d for d in self.documents[document_id]
                       if d.status == 'approved']
            if versions:
                 (versions, key= x: x.version)
         

     () -> Document:
        
        current = .get_current_version(document_id)

         current:
            new_version = ._increment_version(current.version)

            new_doc = Document(
                document_id=document_id,
                title=current.title,
                version=new_version,
                author=author,
                approver=current.approver,
                effective_date=datetime.now(),
                review_date=datetime.now(),
                status=
            )

            .create_document(new_doc)
             new_doc

     () -> :
        
        parts = version.split()
        parts[-] = ((parts[-]) + )
         .join(parts)

Best Practices

Implementation

• Get management commitment
• Conduct gap analysis first
• Define clear scope
• Document processes thoroughly
• Train all personnel
• Implement gradually
• Monitor effectiveness

Auditing

• Plan audits regularly
• Use competent auditors
• Focus on process effectiveness
• Document findings clearly
• Follow up on corrective actions
• Learn from findings
• Share lessons learned

Continuous Improvement

• Regular management reviews
• Monitor KPIs consistently
• Respond to changes
• Encourage employee feedback
• Benchmark against best practices
• Document improvements
• Celebrate successes

Anti-Patterns

❌ Documentation for its own sake ❌ No management involvement ❌ Treating certification as the goal ❌ Ignoring audit findings ❌ No continuous improvement ❌ Poor document control ❌ Insufficient training

Resources

• ISO: https://www.iso.org/
• ISO 9001:2015: https://www.iso.org/standard/62085.html
• ISO 27001:2022: https://www.iso.org/standard/82875.html
• ASQ (American Society for Quality): https://asq.org/
• ISO Survey: https://www.iso.org/the-iso-survey.html