Introduction To ISO 9000

1. Introduction To ISO 9000 Cheng, Jing (2/01/04) Software School,Hunan University

2. Objectives • To introduce the Quality Management • System (QMS) • To introduce the ISO and ISO 9000 • The Standard Quagmire • ISO – 9000 History • Comparing ISO – 9001 and CMM • ISO - Based SPI

3. The Quality Management System The first consideration in designing a system or a process is to produce a specific desired result. In addition to the basic process that creates the output, the following four factors need to be designed into all systems and processes: • Ways to prevent errors • Ways to segregate good items from bad items • Ways to correct bad items • Ways to prevent errors from recurring

4. QMS Impacts All Areas at an Organization

5. TQM And QMS of ISO Dr. Armand, V. Feigenbaum, 1950 TQM CMM QMS SEI, 1986 ISO, 1987

6. What is ISO? ISO is the International Organization for Standardization. Because the name of the organization would have different Abbreviations (IOS in English, OIN in French), it was Decided to use a word derived from Greek isos, meaning “equal”. Therefore, the short form of the Organization’s Name is always ISO.ISO is made up of national standards Institutes from countries large and small, industrialized and Developing, in all regions of the world. It develops voluntary Technical standards which add value to all types of business Operations. ISO’s web site is http://www.iso.org ISO is pronounced “Eye-So” .

7. What is ISO? • Geneva-based consortium formed in 1946 comprised of standards-setting bodies from 110 nations. • USA is represented by the American National Standards Institute (ANSI). • Published the first internationally recognized Quality System standard in 1987, revised in 1994. Latest version is known as ISO 9000:2000

11. ISO Certificates – Highest Growth

12. Highest Number of Certificates By Industrial Sector

13. IT ISO 9000 Certificate Trend

14. Examples of ISO 9000 In IT Use • A computer software developer serving a niche market recognized that as their user base expanded they would be faced with issues concerning product management and configuration control. Changes to base products, user hardware and regulatory requirements were compounding customer service issues. ISO 9004:2000 provided the guidance they needed to establish documented procedures to control process change and improvement. ISO 10006:1997 and ISO 10007:1995 provided additional assistance as they managed the project and prepared procedures for configuration management. They later acquired another software developer and were able to use their quality management system to integrate the acquisition into their own structure very quickly with a minimum of disruption to customers.

15. Examples of ISO 9000 In IT Use • A bank decided to implement a quality management system for its on-line Internet banking services. They ensured that their quality manual made clear that their other conventional banking services were not included in their quality management system. While adopting the requirements of ISO 9001:2000, the bank obtained guidance from ISO 9000:2000 to interpret words and phrases used in the standard for their application. They applied all the requirements of Clause 7, recognizing that design and development is an important part of creating new service processes. The bank used ISO 10013:1995 to prepare their documentation, which they posted on their internal computer network to ensure current procedures are available to their staff

16. Advantages Of a Good QMS • Management’s expectations are clearly communicated to the employees. • The organization performance much more predictably. • There is international acceptance of the organization’s QMS. • It provides a base for all the organization’s improvement activities. • It minimizes the number of errors that occur because work instructions are not documented. • It reduces the time required to train a reassigned employee. • It is required by many organizations as part of their contract with their suppliers and/or subcontractors. • It saves time because they procedures are documented, eliminating the need to reinvent the wheel each time. • Third-party registration reduces the number of second-party audits. • It provides a base that ensures that improvement gains are captured and internalized.

17. ISO 9000 Prevents Losing Ground ISO Improvement

18. Generic Management System Standards • The vast majority of ISO standards are highly specific to a particular product, material, or process. However, both ISO 9000 is known as one of the generic management system standards. • Generic means that the same standards can be applied to any organization, large or small, whatever its product – including whether its "product" is actually a service – in any sector of activity, and whether it is a business enterprise, a public administration, or a government department. • Management system refers to what the organization does to manage its processes, or activities. In a very small organization, there is probably no "system", as such, just "our way of doing things", and "our way" is probably not written down, but all in the manager's or owner's head. The larger the organization, and the more people involved, the more the likelihood that there are some written procedures, instructions, forms or records. These help ensure that everyone is not just "doing his or her thing", and that there is a minimum of order in the way the organization goes about its business, so that time, money and other resources are utilized efficiently.

19. Generic Management System Standards • To be really efficient and effective, the organization can manage its way of doing things by systemizing it. This ensures that nothing important is left out and that everyone is clear about who is responsible for doing what, when, how, why and where. • Management system standards provide the organization with a model to follow in setting up and operating the management system. This model incorporates the features which experts in the field have agreed upon as representing the state of the art. A management system which follows the model – or "conforms to the standard" – is built on a firm foundation of state-of-the-art practices. • Large organizations, or ones with complicated processes, could not function well without management systems – although they may have been called by some other name. Companies in such fields as aerospace, automobiles, defence, or health products have been operating management systems for years. • ISO's management system standards now make these successful practices available for all organizations.

20. ISO 9000 in Plain Language • "ISO 9000“ is actually families of standards which are referred to under these generic titles for convenience. Both families consist of standards and guidelines relating to management systems, and related supporting standards on terminology and specific tools, such as auditing (the process of checking that the management system conforms to the standard). • ISO 9000 is primarily concerned with "quality management". Like "beauty", everyone may have his or her idea of what "quality" is. In plain language, the standardized definition of "quality" in ISO 9000 refers to all those features of a product (or service) which are required by the customer. "Quality management" means what the organization does to ensure that its products conform to the customer's requirements.

21. ISO 9000 ‘One-Two-Three' • ISO 9001 sets out the requirements for an organization whose business processes range all the way from design and development, to production, installation and servicing; • for an organization which does not carry out design and development, ISO 9002 is the appropriate standard, since it does not include the design control requirements of ISO 9001 – otherwise, its requirements are identical; • ISO 9003 is the appropriate standard for an organization whose business processes do not include design control, process control, purchasing or servicing, and which basically uses inspection and testing to ensure that final products and services meet specified requirements. • So, an organization chooses that its quality system be certified against ISO 9001, ISO 9002 or ISO 9003 according to the business processes covered by the quality system. There is no difference of quality ranking between the three standards.

22. The Standard Quagmire

23. ISO 9000 – History I • World War II problems with welds on boats – Solution QC inspection in factories • 1959 US developed Mil-Q-9558a “Quality Program Requirements” • 1962 the NASA space program developed its “Quality System Requirements” • 1979 BS 5750 “Guidelines for Quality Assurance” • 1987 BS 5750 became ISO 9000 – 1987 • 1992 DoD has been considering dropping Mil-Q-9558a in favor of ISO 9000

24. ISO 9000 – History II • 1994ISO 9000 – 1987 revised • 2000 ISO 9000 – 1994 revised • “Promote a theory of control, not a better theory of management” • ISO 9000 ’87 & ’94 – a way of managing for conformance (Action or behavior in agreement with current customers, rules, principles, …) • “You comply or we won’t buy” • ISO 9001:2000 – “aims to enhance customer satisfaction”

25. The future evolution of ISO 9000 • In order for the ISO 9000 family to maintain its effectiveness, the standards are periodically reviewed in order to benefit from new developments in the quality management field and also from user feedback. ISO/TC 176, which is made up of experts from businesses and other organizations around the world, monitors the use of the standards to determine how they can be improved to meet user needs and expectations when the next revisions are due in approximately five years' time. • ISO/TC 176 will continue to integrate quality assurance, quality management, sector specific initiatives and various quality awards within the ISO 9000 family. • ISO's commitment to sustaining the ISO 9000 momentum through reviews, improvement and streamlining of the standards guarantees that your investment in ISO 9000 today will continue to provide effective management solutions well into the future.

26. Quality Journey

27. What is Quality? • Conforms to requirements. • User-dependent. • Fitness for use. • Good quality does not necessarily mean high quality... It means a predictable degree of uniformity and dependability at a cost suitable for it’s purpose. “A man who ships bad product is worse than a thief” -Dr. Genichi Taguchi

28. What is System? An ordered set of related parts and methods working together to meet a common goal. Requirements “Effectiveness” “Intent” Production Design “Implementation”

29. Quality System Model Quality System: The organizational structure, responsibilities, procedures, and resources for error detection, correction, and prevention. Detect, Correct, & Prevent Errors “Effectiveness” “Intent” Workplace Activities Procedures and Methods “Implementation”

30. ISO 9000 Quality Standards

31. ISO 9000 Standards Structure ISO 9001 ISO 9002 ISO 9003 Three Quality Management System Models ISO 8402 ISO 9000-1 The Organization’s Quality Management System Selection and Use of the Standards Definition of Concepts ISO 9004-1 Quality Management & Quality System Guidelines

32. ISO 9001:1994Structure 4.1 Management Responsibility 4.2 Quality System 4.14 Corrective & Prev. Action 4.9 Process Control 4.17 Internal Quality Audits 4.3 Contract Review 4.4 Design Control 4.5 Document & Data Control 4.8 Product ID and Traceability 4.13 Control of Nonconforming Prod. 4.16 Control of Quality Records 4.18 Training 4.20 Statistical Techniques 4.6 Purchasing 4.7 Control of Customer-Sup’d Prod. 4.10 Inspection and Testing 4.11 Control of Inspect & Test Equip 4.12 Inspection and Test Status 4.15 Handling, Storage, Packaging 4.19 Servicing

33. 4.1 Management Responsibility • Management is responsible for establishing a Quality policy and quality objectives for the organization that are understood, accessible, and implemented. • Defined responsibilities and authority. • Qualified personnel and resources. • Management representation. • Periodic management reviews.

34. 4.2 Quality System • Establish, document, and implement a quality system that meets the intent of ISO 9001, that is fully implemented, and that is effectively detecting and preventing errors. • Requirements: • A Quality Manual including the quality policy and goals. • Plans for how you will achieve the quality goals. • A documented quality system, including procedures and work instructions.

35. 4.3 Contract Review • Documented procedures for ensuring that what is expected from YOU is: • adequately defined and documented, • that you have the capability to satisfy the requirements, • Documented procedures for amending the contracted requirements.

36. 4.4 Design Control • Documented procedures to control the design of a product/service to ensure it will meet its requirements. • Design and development planning. • Inputs to the design, including group interfaces. • Acceptance criteria/outputs from the completed design. • Design standards, tools, and techniques. • Design review and verification procedures. • Design change management.

37. 4.5 Document and Data Control • You must have documented procedures to control all documents and data, including procedures for: • Review and approval. • Proper marking and nomenclature. • Publishing and distribution. • Amending, archiving, and destroying. • Assuring accessibility. • Maintaining a master list.

38. ISO 9000 Documentation Hierarchy 1. Corporate Quality Manual 2. Policy and Procedures 3. Work Instructions 4. Quality Records 1 2 3 4

39. 4.6 Purchasing • There must be documented procedures to ensure that parts and services obtained from external sources used in production meet their specified requirements. • This includes procedures for verifying third-party products and procedures for selecting and managing subcontractors. Contract with XYZ Corp.

40. 4.7 Control of Customer Supplied Product • There must be procedures for the proper handling, storage, and maintenance of customer-supplied products. • Treat your customer’s property as you would like your property treated.

41. 4.8 Product Identification and Traceability • There must be procedures for the proper identification and tracing of the product, and the components that make up a product, during all stages of production, delivery, and installation.

42. 4.9 Process Control • There must be procedures for the production, installation, and servicing of a product or service, where the absence of such procedures would adversely affect quality. • Controlled conditions must be maintained. • Procedures should include: • Compliance to standards, • Monitoring and verification, and • Workmanship.

43. 4.10 Inspection and Testing • There must be identification of WHEN inspection and testing is required. • Includes peer reviews as well as formal tests. • “When” may include: • Receipt of material. • Various stages during the process. • Upon release or post-installation.

44. 4.11 Control of Inspection, Measuring and Test Equipment • There must be procedures to control, maintain, and calibrate all inspection, measuring, and testing equipment. • Records must be maintained. • Test equipment includes Test Data.

45. 4.12 Inspection and Test Status • There must be the ability to show the status of inspection and test of all products during all stages of production. • Identification by suitable means to indicate conformance or non-conformance.

46. 4.13 Control of Nonconforming Product • There must be procedures to ensure the proper control of all nonconforming products. • This control includes identification, documentation, evaluation, segregation, disposition, and notification to all functions concerned. • Re-work must be re-inspected. !

47. 4.14 Corrective and Preventive Action • Procedures for handling problems, bugs, and complaints, including receipt, documentation of the correction, controls, and communication. • Procedures for proactively preventing problems, including analysis, documentation, feedback, and review. • Root Cause analysis performed on all problems.

48. 4.15 Handling, Storage, Packaging, Preservation, Delivery • There must be documented procedure for the proper handling, storage, packaging, preservation, and delivery of the product or service. • Ensure that once it meets requirements, it stays that way.

49. 4.16 Control of Quality Records • There must be procedures for the proper identification, collection, indexing, access, storage, and disposition of quality records. • Quality records are the “...artifacts that demonstrate conformance to specified requirements, and the effective operation of the quality system.”

50. 4.18 Training • There must be procedures for the: • Identification of training needed by which individuals. • Provision of this required training. • Records that the training has been received. • Internal courses are taken care of by PRISM and ESEE. External courses and contractor training must be recorded manually by the manager through “TRAINREC” or hard-copy records.