ISO 9001:2000 is designed as a generic quality management standard. It can be used by just about any manufacturing organization to control the production of its components in such a way as to ensure control, visibility, and adjustability in meeting preset quality objectives. There are distinct advantages to implementing a 9001 program, but the degree to which you are bound by the design and structure of the program depends upon one factor: whether you wish your organization to become ISO-registered.
ISO registration is the process of having your 9001 Quality System audited and then having compliance rated against the Standard. If you pass the audit, your organization can register this result (active for a period of three years) with the ISO. You are then recognized as operating in a way that satisfies the performance criteria in the Standard. ISO registration is seen as a mark of distinction, as a competitive advantage, and as a required entry into certain market segments. But registration is not a required activity for all those who adopt ISO 9001. 9001 can deliver its benefits to an organization without that organization needing to move through the registration process.
With this objective removed, an organization is free to use any or all parts of 9001, in full or partial implementation, in such a way as to improve the areas it wishes to improve. This approach—implementation without third-party recognition—probably represents the best approach to process improvement. (And as we saw in Part 1, this is probably the best approach no matter which standard you select.) Using this approach, the organization takes on the commitment to get better, not to get applauded. And so a software development group, a washing machine factory, and a landscaping company might all adopt ISO 9001. They would use the same specification, but out of it would be born three distinct programs. However, to implement it in its intended spirit, all three would be bound by the standard's structure. Basically, there are three stipulations the Standard makes of its implementers.
The first is to recognize the word "shall" as a requirement of the Standard. You'll find many such "shall" statements throughout ISO 9001: "The organization shall maintain control over nonconforming product." "Management shall establish and maintain a quality manual." And so on. There is a lot of flexibility and room for interpretation in the Standard, but if you want to be in compliance, you must (you shall) do what each shall statement defines. These are required components of ISO 9001.
The next structural component is the collection and maintenance of required records. As you implement ISO 9001, you'll no doubt encounter many opportunities to record activity, events, data, and other artifacts. But there is a core set of records that you are required to keep. All in all, there are about 23 required records defined in the Standard. For example, you are required to keep an updated Quality Manual (that's considered a record). You are required to keep records of what you did with defective products. You are required to keep records of management reviews. And so on. You are free to format and shape these records according to the needs of the organization, but they must appear in some form or another and meet their defined intentions.
All organizations implementing ISO 9001 will create a Quality Management System that is, by and large, composed of four major sections. These sections may be integrated or segmented in any manner best suited to the organization. But they will need to demonstrate some degree of traceability back to the Standard's specifications. This common structure is briefly described here and then expanded in later sections of this chapter.
The Quality Management System is a collection of policies, procedures, and processes used to manage selected work in the organization. The QMS will be realized in some external form, such as a Quality Manual. This manual will include requirements on how the organization will control the use and retention of documents impacting project work activities, and how it will control the use and retention of records concerning project work activities.
The Quality Management System will also contain procedures to define management responsibilities for the system's use and upkeep. This includes establishing a high-level management commitment to the QMS and ensuring that the system is focused on customer satisfaction. This is typically achieved through the use of a Quality Policy. Management responsibility will also include establishing the quality objectives the QMS should address and then planning the QMS so as to meet those objectives. Management is also responsible for assigning appropriate stakeholders to maintain, manage, and use the QMS, and to provide open communication channels among those stakeholders. Finally, management is responsible for periodically reviewing facets of the QMS (inputs and outputs) to ensure the system is operating efficiently and effectively, and in line with the established quality objectives.
The next common element of an ISO 9001 quality program is resource management. Each program will identify how it will provide material and technical resources to support program operation. It will also identify how it will provide qualified human resources to execute program operations.
All ISO 9001 programs will also contain definitions and processes for managing the activities involved in product realization—creating the components or products asked for by its customer. This will include definitions for planning product realization, for determining requirements related to the product, and for establishing customer communications. It will also contain processes and procedures for planning design and development, the inputs and outputs required for each, and the adequate reviews and approvals of production milestones. Product realization will also define how activities around purchasing will be managed, how production and service provisioning will be carried out, and how the measuring and monitoring devices in the production process will be controlled.
Lastly, all ISO 9001 quality programs will contain management procedures for measuring the effectiveness of the quality program, analyzing these measures for meaning, and then improving the program based on these analyses. The program will include mechanisms to measure customer satisfaction, process effectiveness and efficiency, and product quality, and to define how the organization will deal with nonconforming products. This part of the program will also describe methods for acting on this information: ways to remove causes of defects in the production process and ways to prevent defect potentials from entering the production process.
That's a brief look at the design and structure of the ISO 9001:2000 Standard. Now let's begin to move deeper by looking at the first three sections of the specification.