ISO 9001: The Three Components of the Implementation Process

The three components to implementing an ISO 9001 quality management system are: 1) documentation, 2) information management, and 3) operational changes.

Documentation

On the surface it may seem like developing the ISO 9001 documentation shouldn?t be that difficult. You must have a manual that includes a policy, objectives, scope, and the interaction of the processes; and you must have written instructions for:

1. Managing the quality system documents
2. Managing the quality system records
3. Conducting internal audits
4. Controlling nonconforming product
5. Implementing corrective action
6. Implementing preventive action

The standard also hints at the need for additional instructions, e.g., referring to the work instructions, section 7.1 states ?shall determine the following, as appropriate,? but technically, aside from the manual and these six instructions, anything more is optional.

The reality, however, is that in order to get the most out of a quality management system a significant amount of additional documentation is required. A primary function of the system is to establish consistency and eliminate misunderstandings, which is best facilitated with clear and unambiguous written instructions. Policies, which are a pervasive part of any system, have absolutely no value if they're not in writing, and enforcing accountability is extremely difficult if the responsibilities are not spelled out.

The ISO 9001 system documentation is normally organized into four sections, including:

1. The Manual, which provides background information and explains how the system works;
2. The Administrative Procedures, which include the procedures and policies that define how the company complies with the requirements of the standard and how it manages the processes that are unique to its operation;
3. The Operating Instructions, which are the detailed instructions used to control manufacturing and service activities; and
4. The Reference Documentation, which are documents like industry standards, equipment maintenance manuals, corporate auditing guidelines, employee policies, etc. that define practices, procedures, or performance criteria not covered by the other documents. These can either be externally or internally generated.

No two organizations have the same goals and objectives or do things exactly the same way, which means there are always some differences between the procedures and policies of different organizations. It also means that completely documented ?off-the-shelf? systems don?t exist and some document development is inevitable. The challenge is to minimize the effort without sacrificing value.

The Manual ? The administrative procedures are usually the more difficult and time-consuming of the four sections to develop. The manual, on the other hand, is relatively straightforward and probably the easiest part to develop. The standard suggests what should be included, and an example of a ?well written? manual can provide the format for organizing the material. Most of the work is in converting the ideas of the example into documents that describe your situation. Goals and objectives have to be established, processes defined, responsibilities established, the interaction of the processes explained, and the system parameters established.

Administrative Procedures ? The secret to developing administrative procedures is 1) using a format that creates readable documents, 2) finding examples of procedures that offer solutions that apply to your needs, and 3) organizing the documentation based a process list.

The ?process approach? is the system structure recommended by the authors of the standard and the process list is the starting point of the process approach.

Think of processes as objectives, i.e., maximizing employee output, making sure new products comply with customer requirements, or making sure working conditions adequately support the production objectives. A set of procedures that constitute a means for meeting an objective is what the standard refers to as an ?activity group?. Employee vetting, performance reviews, and training procedures is an examples of an activity group that maximizes employee output. The objectives are the outputs of the ?process approach? and the procedures (the activity groups) the inputs. Example:

Input = Policies and procedures for making sure employees are motivated, informed, and capable of performing the assigned responsibilities

Output = Maximum employee output

The process list is simply a list of those objectives that best represent the needs of your organization. They can be different for every organization and are rarely in sync with the outline of the standard.

The format used for developing the procedures, to a large extent, determines whether employees will embrace the system. It can be the difference between documents that are easy to read and ones that are not. The better formats include a clear propose, policies that are relevant to the purpose, and an explanation why things are done the way they are done. A good format also leaves no doubt as to who is accountable for the actions of the procedures.

Examples of procedures from other systems provide ideas on how to develop new procedures and how to improve existing procedures. The same examples can also provide formatting ideas. Don?t fall into the trap of thinking that there must be a procedure of every requirement of the standard, or that the documentation has to follow the outline of the standard. The authors of the standard have made it clear that this is not the case. You are encouraged to use a process approach, which is inherently unique to your operation, and to include processes that are important to you but may not included in the standard.

While individual examples can be helpful, continuous system templates that lock into the outline of the standard tend to complicate the implementation process. They depersonalize the system, limit the system to the scope of the standard, and make the process of writing procedures more difficult. Also, don?t go overboard on process mapping and flowcharting. Procedures should be clear to everybody, not just the primary users. A fundamental covenant of the system is continual improvement and some of best improvement ideas come from employees with unrelated responsibilities.

Operating Procedures ? The trick to developing operating procedures is in understanding the balance between training and documentation requirements, and in knowing how much information is needed. Too many companies develop too much unnecessary detail.

The standard requires employers to provide employees with the information needed to correctly perform their assigned responsibilities. Proof is either documentation showing that they have been provided the necessary instructions, or training records, which also verifies that they have been provided the necessary instructions. The value of written operating instructions is that they make it easier to hold employees accountable for their actions. From this standpoint, it is only necessary to document those aspects of an operation that are subject to misinterpretation or misunderstanding, which normally doesn?t require a great deal of detail.

Information Management

Managing information is a big part of the standard. The standard states that records shall be maintained in the case of management review meeting minutes (5.6.1); education, training, skills and experience (6.2.2); product validation and verification (7.1.d); inputs for product design and development (7.3.2); and calibration records (7.6). In addition, the standard also requires ?evidence of conformity?, which is either physical evidence or documented records, and in many cases records are preferable and sometimes the only alternative.

Records provide a means of confirming that the quality system is controlled, customer requirements are understood, audits are conducted, customers are heard, problems are found and corrected, non-conforming goods are managed, purchasing information is correct, products are traceable, and incoming goods are inspected.

The method of managing information is generally some combination of 1) a file management program, 2) database files such as Microsoft Access, or 3) hard copy files, i.e., binders, file cabinets and manila folders, all of which have advantages and disadvantages.

File Management Programs ? File management programs are typically tamper-proof and capable of handling a large volume of information. They?re designed to be paperless systems. Assignments, authorization levels, and additions and revisions to records are keyed into the program, which, under certain conditions, trigger action commands that are communicated via email. There are a few programs tailored to manage primarily ISO 9000 records, but most are universal in nature and designed to manage all types of records. The user is normally responsible for developing the forms and reports needed to manage specific types of records.

The programs are expensive; they come with annual and sometimes monthly maintenance fees; and there are usually costs associated with installation, the number of users, data migration, and training. Many have their own programming language, which makes the user dependent on people with that language skill. And some are web based, which means the program is running on someone else?s server. Generally, they are best suited for companies with a lot of people dealing with a large volume of information.

Database Files ? Database files are less expensive, more flexible, and easier to manage. You can either develop your own files or purchase files that have been programmed to deal with specific types of records.

The majority use Microsoft Access and run on a Microsoft Windows operating system. The cost is the cost of the files plus the cost of the Microsoft programs. (The 9000 Advisers offer individual Access files for all the ISO 9001 record keeping requirements.) The files are placed on a server and secured by whatever means is used to secure the server files. Changes and enhancements can be made by anyone who understands Microsoft Access. In most cases there are no user fees or reoccurring maintenance fees, and existing database files can be transferred into the files with the migration functions of the Access program.

Hard Copy Records ? Almost everyone ends up with some hard copy records: documents that can?t be scanned, documents with signatures, and documents that are available to all employees. However, building a record keeping policy completely around this approach is risky, even for small companies. It is too easy to misplace documents that move from one person to the next; and it is difficult to manage information that is located in various files, in different offices, and assigned to different people. Responsibilities change and individuals tend to change the way information is gathered and filed. Manual record keeping frequently results in unnecessary duplication, e.g., sales using a different customer list than the person keeping track of the customer complaints. It is also difficult to gather, analyze, and disseminate information. File cabinets are not as accessible as computers and don?t have the sorting, reporting, linking and analytical capabilities of database files.

Operational Changes

The final component of the implementation process is the operational changes, which are the changes needed in order to meet the procedural requirements of a system. They include both the things that are done in order to ensure that the products and services comply with the requirements specified by the customer, as well as the measure taken to in order to improve products and services and the processes used to produce the products and services.

Some of the more common ones include:

Administration ? 1) Conduct at least one management review meeting. 2) Communicate system developments to all employees. 3) Demonstrate that the key performance indicators are measured, evaluated, and communicated.

ISO Representative ? 1) Make sure that the auditors are adequately trained. 2) Develop an audit schedule and conduct audits on all of the system procedures. 3) Demonstrate that the corrective and preventive action processes are working. 4) Make system procedures and forms available to employees.

Human Resources ?1) Verify that all employees have a basic understanding of the ISO 9000 system. 2) Prove that all employees are capable of performing their respective work assignments, including the top-level executives. 2) Establish a training program for developing employee skills.

Purchasing ? 1) Demonstrate that all of the primary vendors are qualified and that their performance is routinely evaluated. 2) Prove that material specifications are verified before they are released to vendors.

Sales/Customer Service ? 1) Demonstrate that customer feedback is gathered and analyzed, including records of complaints. 2) Prove that processing capabilities are reviewed before orders for new products are confirmed.

Engineering ? 1) Demonstrate that the information released to production is current, accurate, and complies with customer requirements. 2) Demonstrate that product changes affecting form, fit, or function are not implemented without customer approval.

Production ? 1) Establish a calibration program that complies with the requirements of the standard. 2) Demonstrate that machinery capabilities have been validated. 3) Prove that nonconforming materials are not mixed in with satisfactory materials. 4) Prove that that shipments comply with the customer requirements. 5) Prove that incoming materials comply with purchase specifications. 6) Prove that operators are provided with the information required to produce products that conform to customer requirements. 7) Demonstrate how materials with shelf life are managed.

System documentation and information management are the paperwork part of the system. The operational changes are the action part and represent the part of the implementation process that makes the system work.

John is founder and president of http://9000advisers.com/ : a consulting firm specializing in implementing ISO quality management systems. He has over thirty years of manufacturing management experience in the metalworking industry and another six years of consulting experience implementing quality and costing systems. He has a BS in Metallurgical Engineering and an MBA.