Tracking ISO 9000
The newly revised standards focus on business processes.
The International Organization for Standardization (ISO) is a multinational agency composed of the standards bodies of over 90 member countries, including the United States, Canada, and the European Union. The purpose of the ISO is to promote harmonization of processing, manufacturing, and quality assurance standards among industrial organizations. The standards actually represent a monitoring program based on a series of measurable parameters designated by the participating company which then, at regular intervals, verifies that its self-imposed standards are met. A feedback loop is used to adjust manufacturing and other processes as necessary. (ISO certification also requires that an outside monitoring group assess the companys performance.) The reason that organizations participate in this effort is because certification carries with it an assurance of quality that customers readily recognize and accept.
On December 15, 2000, a complete revision of the ISO 9000 series of quality management system standards was published. The previous ISO 9000 series was issued in 1994 and used language that focused primarily on manufacturing. However, because not all businesses are involved in manufacturing, and the wording was often confusing, revisions were deemed necessary. In a nutshell, ISO 9000, 9001, and 9004 have been significantly revised. The newly named ISO 9000:2000 standard focuses on fundamentals and vocabulary, while the previous ISO 9001, 9002, and 9003 requirement standards have been combined into ISO 9001:2000. ISO 9004:2000 is now focused exclusively on continuous improvement issues.
The result of the revisions, particularly for the comprehensive 9001:2000 system, is that all companies will now be certified within a single standard. In fact, ISO 9001:2000 and 9004:2000 are intended to form a consistent and synergistic pair of quality management standards that address all types of products. Even though the totality of the ISO 9000 series revision is largely cosmetic, it could potentially have profound implications for industries that use quality manuals oriented around the former structure. As a result, the revised requirements may inadvertently be both costly and challenging to implement.
A New Structure
The revised ISO standards series has a process-oriented structure based on the Plan-Do-Check-Act model. As a result, the former 20-point format has been replaced by 5 major clauses: System Requirements; Management Responsibility; Resource Management; Product Realization; and Measurement, Analysis, and Improvement (see box, The Sections of the ISO 9001:2000 Standard).
Within the five structural clauses are several new requirements designed to ensure a higher focus on the end-user (e.g., organizations are now required to determine customer needs and expectations and to monitor overall customer satisfaction and dissatisfaction). In addition, the revised standards series places greater emphasis on the role of top management to develop and improve their operational systems, integrate legal and regulatory requirements, and establish measurable objectives at appropriate levels throughout the organization.
Measurement and continual improvement processes that were formerly implied are now required, thus forcing organizations to evaluate their needs and uses for all applicable assessment methodologies. For example, the use of statistical techniques in evaluating various systems may be appropriate. Also, data must be collected and used to determine the performance of a quality system and to identify its possible improvements. Results of such analyses and improvements must then be included in management reviews. In addition, it is necessary to train internal auditors to monitor standards conformity and to regularly evaluate the effectiveness of their training.
The most striking changes in the requirements address continual improvement, customer satisfaction, and statistical techniques. In the 1994 version, continual improvement was implied through the requirements for corrective and preventive actions. In the 2000 revision, however, the standards explicitly state that organizations need to establish procedures to facilitate continual improvement. In addition, information and data are now required to measure performance.
The issue of customer satisfaction is brought to the fore in the 2000 revision. Whereas the old standards focused on meeting customer requirements and achieving customer satisfaction, the new standards address this issue in much greater detail. Not only has a requirement of measuring customer dissatisfaction been added, but the 2000 revision also requires that organizations demonstrate their understanding of customer requirements (both needs and wants) and verifiably satisfy those demands.
Finally, a requirement that organizations use appropriate statistical techniques to evaluate not just product conformity but also process measurements is part of the ISO 9001:2000 standard. Data must now be analyzed and provided as input for all management reviews, and this requirement further illustrates the standards focus on continual improvement through actions based on quantitative determinations.
Under the former ISO 9000 standard, organizations that wished to be certified were referred to as suppliers because they supplied products and services to customers. Many people were confused by this usage, and so ISO 9000:2000 uses the word organization instead. In the updated terminology, supplier is now used to refer to an organizations supplier; the subcontractor term previously employed has been dropped.
Also new to ISO 9000:2000 is the phrase product realization. This rather abstract notion is now central to ISOs approach. In fact, Section 7 of ISO 9001:2000 (see box, The Sections of the ISO 9001:2000 Standard) is entirely devoted to this new concept. The term simply refers to the interconnected processes that are used to bring products into being; this concept is also central to the inclusion of the previous ISO 9002 and 9003 requirements in the combined ISO 9001:2000 standard.
Under the new ISO 9001:2000 standard, organizations may exclude or ignore some of the requirements in Section 7 if certain conditions are met. Generally, requirements that may be ignored are known as permissible exclusions and contain the following: requirements that dont apply to the specific organization; requirements that customers needs make reasonable to exclude; and requirements that are superseded by various other regulatory requirements. (Section 7 requirements may not be excluded, however, if doing so will compromise an organizations ability or willingness to meet the demands set by its customers and regulators.)
The permissible exclusion clause is an important improvement as it enables the implementation of the standards to be more flexible and conformance with them to be less rigid. As a result, an organization is more likely to end up with a quality management system uniquely tailored to meet its needs.
Making the Transition
Organizations have three years from the issue date of the new standard to become compliant (i.e., until December 15, 2003). If an organization is currently certified under the previous ISO 9002 or 9003 standards, it will need to become ISO 9001:2000 certified. However, if an organization is certified using the outdated ISO 9001 standard, only their quality monitoring and improvement systems will need to be updated.
Because of the number of revised requirements, the complexity and subsequent costs involved with implementation are an issue. For instance, a production facility that also performs design work and has previously chosen to implement ISO 9002 standards may find that it can no longer exclude the design functions by claiming that they are not part of its principal activity. This is because the 2000 revision makes clear that organizations cannot exclude elements of their systems that impact the quality of the products and services their customers receive.
To maintain the voluntary accreditation, all organizations eventually will have to be certified within the ISO 9001:2000 standard. Because of the multiplicity of products that various companies produce, however, the scope of the individual requirements may be reduced if an activity does not affect the organizations ability to provide a conforming product. However, unlike the previous version of the standard, ISO 9001:2000 requires that an auditor, not the organization itself, determine whether or not a proposed reduction is appropriate.
The strategy used to meet these new requirements should include an appropriate timeline for upgrading the companys registration and certification. The ISO also recommends that organizations plan their implementation schedules with the advice of their registrars. Specifically, an ideal approach flows from the following outline:
- A copy of the new standards should be obtained and disseminated to key personnel.
- A gap analysis should be conducted to determine the improvements necessary to meet the new requirements.
- Processes and procedures should be designed and implemented to fill the gaps identified by the analysis.
- An internal audit should be conducted to verify that compliance with the new standards has been achieved.
- An external audit of the quality management system needs to be ordered (necessary for certification).
- All appropriate documentation for ISO certification should be submitted.
Finally, in improving and redesigning processes to meet the revised standards, it is important to remember that few projects go according to plan. As a result, gradual alterations are more sensible and less disruptive to the current workflow than are immediate changes that may quickly become problematic. But with a year and a half remaining in which to make the transition, a smooth process should be easily achievable for companies that plan ahead.
- A copy of the new ISO 9000:2000 standards can be ordered at www.asq.org.
- For more ISO 9000:2000 information, visit www.iso.ch.
Helen Gillespie is editor/publisher of the LIMS/Letter and webmaster of LIMSource.com. Send your comments or questions regarding this article to email@example.com or the Editorial Office 1155 16th St N.W., Washington, DC 20036.