Why do organizations implement ISO 9000 systems?

More often than not, organizations get ISO 9000 because certain customers force them or encourage them to. In many market sectors—electronics, pulp and paper, telecommunications, automobile manufacturing, defense—major customers have mandated ISO 9000 registration to their key suppliers. Similarly, some overseas regulatory bodies mandate ISO 9000 for the makers of qualitysensitive products (such as medical devices).

Many of these major customers impose ISO 9000 systems in place of, or in addition to, specific quality programs, requirements, specifications, and so on that have been in place for many years. The ISO 9000 Standard becomes a key part of the relationship between the customer and its suppliers.

ISO 9000 is not, however, meant to replace customer-specific requirements in any market segment. Rather, ISO 9000 is meant to be a floor: a basic set of generic requirements. They are generic enough to apply to virtually all supplier/customer relationships anywhere in the world. It matters not the size of the supplier, the location of the customer, or the nationalities involved.

In some industrial segments, formalized standards have been created, adding to the generic ISO 9000 requirements additional clauses that are industry specific. Examples include:

_ Automotive (QS-9000).

_ Aerospace (AS-9000).

_ Telecommunications (TL-9000).

To the extent that ISO 9000 replaces customer-specific quality programs and supporting audit/oversight activities, it can relieve both customers and suppliers of a great deal of redundancy, duplication, and waste of resources. The fundamental requirements are understood, agreed to, and (usually) confirmed by objective third-party audit. This gives customers confidence in the integrity and effectiveness of their supplier’s basic quality practices. The customer and supplier can then invest their energies and resources in agreeing to and working on the specific requirements unique to their relationship.

To some, ISO 9000 sounds like a mandatory, gun-to-your-head, my-way-or-the-highway program. For many suppliers, it is exactly that (“get ISO 9000 or get lost”). For many others, it is perceived that way:

“They’re trying to tell us how to run our businesses.”

But the goal of ISO 9000 is not to strengthen customers’ control over how their suppliers run their businesses. The goal is to give customers confidence in the ability of suppliers to meet their needs, resulting in satisfied customers, and growing and prosperous suppliers.

Admittedly, implementing ISO 9000 does not guarantee this. Like most things, what you get out of it depends on what you put into it. You can implement a compliant ISO 9000 system that is all cost and no benefit and it’s even possible to pass registration audit this way. This happens, usually, when the supplier’s approach is to try to:

_ Squeak by.

_ Do just enough to get registered.

_ Get this thing done without changing how we work.

But suppliers who implement ISO 9000 fully—to the spirit, as well as the letter—can and do achieve real benefits.

Read more on ISO 9001 Standards at http://www.iso9001store.com

What Is ISO 9000 Registration?

Registration is documented and objective evidence that an organization’s quality system meets the requirements of ISO 9000. Certification is a term often used interchangeably with registration. In the context of ISO 9000, they mean the same thing. Registration is the technically correct term for verification of compliance to standards of quality systems. Certification usually applies to verification of the quality of products (as opposed to quality systems).

Registration is carried out by independent companies called registrars. These companies are:

_ Wholly independent.

_ Accredited by a recognized international accreditation body.

_ Selected, and paid, by you.

Registration can cover:

_ The sole location of a single-location organization.

_ Multiple locations of a multilocation organization.

_ Only certain parts of a multilocation organization (under certain conditions).

_ Separate locations under separate certificates. (This is a more costly approach.)

The registration body audits your quality system against the requirements of ISO 9000. It reports its findings in writing. These findings may (and usually do) include noncompliances. Major noncompliances must be closed out prior to official registration.

When this has been done, the registration body:

Lists the organization’s name in its book of registered companies— in effect, registers the organization in its book.

Issues a certificate to the registered organization. This registration includes:

— Identity of the organization.

— Location(s) covered by the registration.

— A list of products/services supplied by the registered locations.

— Revision date of the Standard.

— Registration effective dates.

— Name and location of registrar.

Most registrars limit registrations to three years. After that, you must renew your registration by undergoing another complete systems audit. Some registrars do not use the renewal approach. They simply keep checking the system via surveillance audits. Whichever the scheme, the organization, to keep registration, must undergo a surveillance assessment every so often. Six months is the typical interval. Some registrars offer annual surveillance schemes (not recommended except for firms with exceptionally well-implemented quality management systems). Surveillance assessments are scheduled events (there is no such thing as a “surprise” surveillance audit). Only part of the quality system is checked at each surveillance. Usually, the registrar does not disclose what part will be assessed until the day of the assessment, although some registrars will tell you everything up front.

The entire quality system is usually checked via surveillance audits over the course of three years. There is no way to “fail” a surveillance assessment, just as there is no way to “fail” a registration audit except by refusing to implement corrective action required by the registrar. Normally, registrars allow adequate time, but corrective actions must be done in a timely and agreed upon manner to keep registration.

One final note: As mentioned, each registrar publishes a list of the firms it has registered to ISO 9000. A comprehensive list of ISO 9000 registered firms is available from Irwin Professional Publishing (703-591-9008).

Read more on ISO 9001 Standards at http://www.iso9001store.com

Process Approach In ISO 9001 Standards

The process approach was introduced into ISO 9001 with the year 2000 version of the standards.

Prior versions used an element approach. The document Guidance on the concept and use of the process approach for management systems describes to process approach and offers an implementation paradigm.

2.4. Verify the process and its activities against its planned objectives
3. Implementation and measurement of the process
4. Analysis of the process
5. Corrective action and improvement of the process Implementation
This document explains the process used to evaluate changes to the 2008 version. In particular, it explains the revision process and illustrates the impact vs. benefit analysis used to evaluate potential changes.
In addition to the guidance documents, ISO maintains a web site with “official interpretations” of

approach was introduced into ISO 9001 with the year 2000 version of the standards.
Prior versions used an element approach. The document Guidance on the concept and use of the process approach for managementsystems describes to process approach and offers an implementation paradigm.
1. Identification of processes of the organization
1.1. Define the purpose of the organization
1.2. Define the policies and objectives of the organization
1.3. Determine the processes in the organization
1.4. Determine the sequence of the processes
1.5. Define process ownership
1.6. Define process documentation
2. Planning of a process
2.1. Define the activities within the process
2.2. Define the monitoring and measurement requirements
2.3. Define the resources needed

ISO 9001. Currently, these interpretations only include ISO 9001:2000, but, because the changes to the 2008 version were limited, they are valuable.
Consider a common question. An organization needs a documented procedure for preventive action (8.5.3), and must keep records of the results of preventive action (8.5.3.d). One of the interpretation requests asks, “Does sub-clause 8.5.3 a) require organizations to demonstrate, with objective evidence in the form of records, that they have undertaken actions to determine the existence of ‘potential nonconformities and their causes’?” The answer is “No”.
Auditing Practices
The ISO 9001 Auditing Practices Group maintains a website9 with guidance and information on auditing ISO 9001 quality management systems. It is an informal group of quality management system (QMS) experts, auditors, and practitioners drawn from the ISO Technical Committee 176 Quality Management and Quality Assurance(ISO/TC 176) and the International Accreditation Forum (IAF).
The website, primarily aimed at QMS auditors, consultants, and quality practitioners, is an online source of papers and presentations on auditing a QMS and reflect the process based approach.
The website contains almost forty guidance documents with practical advice ranging from “How to audit top management processes” to “The role and value of the audit checklist”.

ISO 9001 Standards & ISO 14001 Standards

In order to assist organizations to have a full understanding of the new ISO 9001:2008, it may be useful to have an insight on the revision process, how this revision reflects the inputs received from users of the standard, and the consideration given to benefits and impacts during its development.

Prior to the commencement of a revision (or amendment) to a management system standard, ISO/Guide 72:2001 Guidelines for the justification and development of management system standards recommends that a “Justification Study” is prepared to present a case for the proposed project and that it outlines details of the data and inputs used to support its arguments. In relation to the development of ISO 9001:2008 user needs were identified from the following:

-the results of a formal “Systematic Review” on ISO 9001:2000 that was performed by the members of ISO/TC 176/SC2 during 2003-2004
-feedback from the ISO/TC 176/Working Group on “Interpretations”
-the results of an extensive worldwide “User Feedback Survey on ISO 9001 and
The Justification Study identified the need for an amendment, provided that the impact on users would be limited and that changes would only be introduced when there were clear benefits to users.

The key focuses of the ISO 9001:2008 amendment were to enhance the clarity of ISO 9001:2000 and to enhance its compatibility with ISO 14001:2004.

A tool for assessing the impacts versus benefits for proposed changes was created to assist the drafters of the amendment in deciding which changes should be included, and to assist in the verification of drafts against the identified user needs. The following decision making principles were applied:

1) No changes with high impact would be incorporated into the standard;

2) Changes with medium impact would only be incorporated when they provided a correspondingly medium or high benefit to users of the standard;

3) Even where a change was low impact, it had to be justified by the benefits it delivered to users, before being incorporated.

The changes incorporated in this ISO 9001:2008 edition were classified in terms of impact into the following categories:

-No changes or minimum changes on user documents, including records

-No changes or minimum changes to existing processes of the organization

-No additional training required or minimal training required

-No effects on current certifications

The benefits identified for the ISO 9001:2008 edition fall into the following categories:

-Provides clarity

-Increases compatibility with ISO 14001.

-Maintains consistency with ISO 9000 family of standards.

-Improves translatability.

Audit Of Electronic Documents In ISO 9001 Standards

Audit Of Electronic Documents In ISO 9001 Standards

Electronic documents that establish management system policies and procedures can be in a variety of file formats depending on the software applications that are utilized by the organization to generate the documents. Electronic file formats include, Text, HTML, PDF, etc. Spreadsheets and databases formats are also considered to be electronic “documents” subject to the control elements of the management system to being audited.

Given the relative ease with which users can now create electronic spreadsheets and other electronic documents, auditors (either internal or external) should ensure that policies governing the controls that apply to management system documentation in-general are also employed for electronic documents through appropriate procedures.

Organizations need to employ suitable and effective methods within the electronic environment for ensuring the adequate review, approval, publication and distribution of its management system documentation. These should be consistent with the methods for the development and modification of electronic documents.

In many cases document control measures may also be standard features of software applications used for their creation. Therefore auditors should understand these application-specific controls to the degree that these are utilized as a basis for conformance to the applicable management system standard.

Given the increased capacity to modify, update, reformat and otherwise improve documents within an electronic-based management system, auditors should pay particular attention to control elements such as document identification and document revision level.

As electronic media facilitates an increased rate of document modifications, auditors should verify that the controls being employed for the management of obsolete documents are considered within the organizations’ document control policies and procedures.

Auditors should verify that electronic-based documentation exists to provide orientation to users with regard to the functional and control aspects associated with electronic documents. Additionally, “Point-of-use” requirements associated with the applicable management system standards will typically be addressed in part by the organization’s document access policies. Auditors should understand the organization’s policies and procedures regarding user privileges as these become important factors for properly realizing the organization’s processes.

External electronic communication with suppliers, customers and other interested parties may involve the exchange of documents. Given that these external documents may contain key parameters that specify the functioning of the organization’s processes, auditors should verify the degree to which these documents are formally introduced and controlled within the electronic-based management system.

How To Prepare ISO 9001 Standards Audit Check List

How To Prepare ISO 9001 Standards Audit Check List

There are a few steps to prepare ISO 9001 Standards Check List, namely:

1. Apply the concept of Plan Do Check Act (PDCA). This PDCA concept is applied at the Quality Management System and the process levels.

2. Convert the question to requirement raised by QMR or the QMS Committee which derived from theISO 9001 standards. In this case, several questions can lead to one single requirement.

3. To edit those questions to suit the process that is to be audited. For example, you are going to audit the Purchasing/Procurement Department and you’re sitting down with the Audit Team trying to come up with relevant questions.

The main objective in auditing any process is to extract adequate information and evidence in order to verify that the process is conformant to the ISO 9001 requirements and that, it is effective in achieving its objectives. As an auditor, you need to be able to investigate, assess and verify the conformity and effectiveness of a given process, in terms of its planning, implementation, monitoring & measurement and improvement. As a Lead Auditor, preparing your Audit Team for the actual audit is crucial in ensuring success of the audit excercise. There is no better way to do that than by developing the audit questions with them.

ISO 9001 Standards – Risks and opportunities

The first things to consider when we want to change a people intensive process are:

• What do the people involved fear? These are the risks – things that we must prevent.

• What do people hope for? These are the opportunities – things that we must strive to obtain.

In order to better understand risks and opportunities, we used a two-step approach. We started by interviewing two developers and one manager. The interviews were semi-structured in that we had a set of questions that we needed answers to but in

addition, we used follow-up questions to gain a better understanding of the answers to the predefined questions. The focus of the interview was on what they expected would happen if the company implemented an ISO 9001 certified process. Two typical examples of what came out of the interviews are shown below – one from a developer and one from a manger.

Manager: Implementing ISO 9001 will cost quite a lot. At the same time, the company will get a better overview of its competence, its experience and its document templates. ISO certification is an investment. We are, however, unsure of how long we have to wait before we can reap the benefits.

Developer: Some of the developers may have a negative attitude towards ISO certification because they are afraid it will hurt creativity. This is not only true for ISO 9001 standards but holds also for coding standards and other rules and regulations. Rules

and standards can take away all the fun from the job. In many ways this is the same attitude as we saw when we started to reuse components – many developers were afraid that they would not be allowed to develop things but just had to use “toy bricks”.

After the interviews we found that:

A. Everybody in the company – both mangers and developers – filled in the questionnaire.

The items in the questionnaire that got an average score of 5.0 or more were considered for risk and opportunity analysis. This gave us the following items:

• When we get ISO certified, we will have to generate more documents for each development project.

• It is important that all employees participate actively in the introduction of new processes, standards and procedures. This is consistent with e.g. Trittmann et al’s observation

• Active management participation is important in order to make the introduction of an ISO certified process a success.

• Active management support is important in order to make the introduction of ISO certification a success.

• An ISO certified process will lead to better working practices in the company in general.

Based on our findings, we identified the following risks that needed to be controlled throughout the implementation of the ISO 9001 certified process:

Risk 1: The introduction of new documents or additions to existing documents.

We decided that we should not make new documents except if absolutely needed.

Risk 2: Developer participation. The developers must be included at all steps in

the process. Their experiences and advices are important input to the new processes and procedures.

Risk 3: Management participation and support. Management must show their commitment by allocating money and time to the ISO implementation activities.

Opportunity 1: Better working practices. The changes in the development process must be considered to be improvements by the developers.

Management and developers are in agreement in the sense that everything the developers found important also was ranked high by management. There were, however, some cases where the two groups disagreed strongly – average score difference greater than 2.0. In all cases, management ranked these items higher than the developers.

The points are:

• Introducing an ISO certified process will cost a lot but will be a good investment – developers 3.3 vs. mangers 6.0

• Introducing an ISO certified process will give the company a better control over the order situation – developers 3.0 vs. mangers 6.0

• Introducing an ISO certified process will give us more satisfied customers already after one year – developers 3.2 vs. mangers 6.0

Management is more optimistic than the developers when it comes to business related issues such as order situation and customer satisfaction.