Demistfying ISO9001 Part 2

As a follow up to an earlier post about simplifying the terminology of ISO9001, I decided to pick another section that seems to give first timers a bit of grief and break it down into simpler parts.

Section 8.2.4 of the standard covers Monitoring and Measurement of Product. This is another section of the standard that can be quite difficult to apply to non-manufacturing industries.

Broken down into its individual parts though it is a bit more management.

Part 1:

"The organization shall monitor and measure the characteristics of the product to verify that product
requirements have been met."

Ok, so what this is asking you to do is determine what your customers require of your product/service, and how to prove that the requirements have been met. This is still quite a "manufacturing" style requirement but it can still be applied to other business types.

Lets take a construction company for example. By setting check points throughout the construction process, you can accurately determine your adherence to customer requirements without waiting till the end and having to make changes.

Part 2:

The second part of this requirement basically echoes what I said in part 1.

"This shall be carried out at appropriate stages of the product realization process in accordance with the planned arrangements (see 7.1). Evidence of conformity with the acceptance criteria shall be maintained."

What this is asking is that throughout your production/service delivery process, that you set checkpoints (where you see fit) throughout the process to ensure that you are still meeting requirements and keep evidence of it.

So in the case of the construction company, keeping evidence of each verification stage (ie. customer
sign off on decisions) would meet this requirement.

Part 3:

The last part is pretty straightforward


"Records shall indicate the person(s) authorizing release of product for delivery to the customer (see 4.2.4). The release of product and delivery of service to the customer shall not proceed until the planned arrangements
(see 7.1) have been satisfactorily completed, unless otherwise approved by a relevant authority and, whereapplicable, by the customer."

This basically just says whoever is responsible for approving your finished product needs to keep records of approval that all requirements have been met before handing it over to the customer.

Hopefully this makes this section a bit more digestible.

Three Things that Most Certified Businesses are Terrible At

There are three specific ISO9001 requirements that I find most businesses I visit are terrible at.

These are:

- Document Control
- Corrective & Preventative Action; and
- Management Review

I'm not entirely sure why it is, but I think its because it takes a real drive from the top to make it work. Funnily enough the businesses that do it well are generally the ones where the business owner or General Manager has taken a really active role in developing and implementing the Management System.

Implementing Document Controls is an absolute pain when starting to develop a new Management System. Everyone loves to keep a copy of forms in their own personal folder so they don't have to keep looking for them when they're needed. People also love creating their own forms to suit their needs without going through any approval process. This is where the drive from senior management is required. If the boss is strict on document control then everyone tends to fall in line.

Corrective and Preventative Action is also a requirement that tends to get overlooked until right before an audit or until a major issue has occurred. By rewarding identification of potential and actual issues rather than punishing non-conformance it changes the culture of corrective and preventative action. People will be much more inclined to report issues if they won't get in trouble for it and there is an incentive to do so.

Lastly Management Review is probably the most poorly handled ISO9001 requirement that I see on a regular basis. It is rare to see a properly minuted, detailed and beneficial Quality Management Review that covers all of the agenda input items required by ISO9001. The majority I see are done purely to meet auditor requirements and provide no real benefit to the business whatsoever. This is one requirement that really needs a strong leader to ensure it gets done and gets done well.

Home Health & Safety. Christmas Tree Fires

Someone just sent me this video which I thought I might as well post it here seeing as Christmas decorations will start going up in homes around Australia tomorrow.

It's amazing how quickly the Christmas tree on the left (unwatered) goes up in flames versus the one on the right (regularly watered).

If you're going to have a real Christmas tree, ensure that

• You only have lights on when you are around (definitely turn them off before bed)
• You have a fire extinguisher readily available in your house.
• You check your lights for cable damage (Some can be ooooold and may be frayed); and
• You regularly water your tree to make it last longer and less flammable

Demistifying ISO9001 part 1

the ISO9001 standard (whilst good for its purpose) is a boring document that can be quite difficult to comprehend for a first timer. There are certain sections of the standard that can seem really difficult to apply to some industries if you haven't been through the process before.

For example lets look at Product & Service Provision.

7.5.3 Identification and traceability
Where appropriate, the organization shall identify the product by suitable means throughout product realization.
The organization shall identify the product status with respect to monitoring and measurement requirements throughout product realization.
Where traceability is a requirement, the organization shall control the unique identification of the product and maintain records (see 4.2.4).

For a company in a service industry, this requirement can be as confusing as hell.

Sometimes it's a matter of tweaking the terminology a bit and asking the question in a different way.

If you were an accountant for example your product is your time, advice, reports etc. So in this case, what kind of identification methods do you use to differentiate clients? Do you have a numbering system for reports? How do you track your time spent with a client for invoicing.

The next paragraph is a bit trickier. How do you identify the status of the work you're carrying out throughout the process? Using the accountant example again, how would you identify work in progress versus work completed? Perhaps you save all work in progress in a separate folder and mark it as draft?

The final paragraph may apply to you, it may not. What you need to ask yourself is "Does the product/service I'm providing need to be tracked or identified in some way. If it does, you need to keep records of it as per your records control procedure. Using the accounting example again, the product might be a tax return. You might save them with an individual file name or reference number and this would be listed somewhere (ie. records control register)

I hope this helps make at least one requirement of the standard easier to apply.

Another one for the QA "WTF" files

I posted a blog the other day about companies claiming quality without proving it.

Today's post is a bit different but still along the same lines.

I purchased some new drill bits the other day and when I turned over the packet to open them up I read this on the back.

 

There are two issues here. First one being you're not "accredited to ISO" you are certified. More importantly, ISO 9002 hasn't existed for over 12 years!!! Seriously, who is handling your document control???

I quick check of their website shows they are certified to ISO9001, but there is definitely a gap in the system somewhere.

Businesses Claiming Quality Assurance that aren't Certified

I noticed this yesterday when I was grocery shopping and as someone that works hard to ensure that Quality Assurance means something it annoyed me quite a lot (I should probably get out more)

My problem with this is that although "Quality Assured" is stamped on there with a big tick, Black and Gold is not QA certified, neither is their parent company IGA. It's the equivalent of putting an organic label on something that has not gone through any form of certification process to ensure that it is organic.

I've noticed it a lot lately when I visit company websites. There are plenty of sites out there with a "Quality Assurance" tab and lots of fluffy words about their quality processes which make it look like they are a certified business, but when you look them up on the register of certified companies, they are nowhere to be found.

So that's my rant for the day.

Quality Assurance in Web and App design

I was doing a bit of research this morning on different industries we could approach and I discovered that I could not find a single web design or app design business within Melbourne that had Quality Assurance certification. Many websites had reference to performing QA tests or inspections but I couldn't find any that actually said "we are QA certified".

With so many competitors in the marketplace I was suprised that I could not find a single business that was advertising it at all. There were many that discussed quality assurance processes they follow but none actually certified.

With any new and popular industry there are many new competitors entering the market on a daily basis, the best way to distinguish yourself from the pack is by establishing a point of difference. If it comes down to a decision between one design company and another with similar prices but only one is certified, most people will go with the certified business because they know that they conduct business a certain way and have had to prove that they meet strict ISO guidelines.

By choosing a company with ISO9001 certfication you know:

• They have a strict design and development system in place for all stages of the design process
• They conduct internal audits of their own system to identify issues.
• Any suppliers/subcontractors have been reviewed for suitability to established criteria; and 
• They will be reviewed at minimum on yearly basis by an external certification provider to ensure they remain compliant.

If large businesses are shopping around for a new design firm, these are the kinds of things that help them make their final decision.

I'd be interested to hear if anyone knows of any quality certified companies.

Creating an Evacuation Plan

Legislation regarding safety differs all over Australia but sometimes it doesn't hurt to follow best practice to ensure that you are meeting all of your obligations and ensuring your employee's safety.

A good place to start is by creating an effective evacuation plan for your premises. This can be a frustrating process if you've never done it before and don't know where to begin.

The best place to start is by finding plans of the building in electronic format that you can edit to your liking. Using paintbrush or any other image editing software you can crop, resize and erase parts of the image that you don't require. What you are trying to do is create an outline of the building with most of the detail removed (ie. plants, plumbing etc).

Once you have created this outline you can start adding in important features such as extinguisher locations, first aid kits, exits, muster points etc. These images can be found below and can be cut and pasted to your plan (image taken from www.buildings.com)

Here's an example of one I did for a client a while ago using their building plan. I edited out a lot of the detail and pasted in the important features.

Once you are happy with the plan, add in any important contact details such as police, fire, ambulance, local doctor etc.

When selecting a muster point, ensure that it is safe for employees to wait there whilst emergency crews arrive at the scene. For example if you are on a busy road, it might not be safe to set the muster point at the other side of the road.

Always check legislation to ensure your plan complies with requirements as they may differ from state to state.

Setting Quality Objectives

With any Quality, Safety or Environmental Management System, you are required to set Objectives that you want to achieve with the system over a given period of time. The standard is pretty open in terms of how to go about it as below.

Top management shall ensure that quality objectives, including those needed to meet requirements for product, are established at relevant functions and levels within the organization. The quality objectives shall be measurable and consistent with the quality policy.

This ties in with my post yesterday about writing a Quality Policy as your objectives must be consistent with your policy.

If you are building a new system, I would suggest having a brain storming session with top management and key employees as to what goals you want to set for the business. You can set as many or as few as you like as long as the requirements of the standard are met.

The statement "including those needed to meet requirements for product" is basically saying what are your quality requirements for the product/service that you sell? As a consulting business, our objective could be to ensure that all of our customers pass certification within a certain time frame. This is a measurable objective and something that can be reviewed periodically. I would then go on to set other objectives for relevant functions and levels within the business. For example I can set sales objectives, Customer satisfaction objectives, report writing objectives, anything that is relevant to the business that is measurable.

Go easy on yourself though at first. Setting too many objectives or setting objectives that are unreasonable will make life hard and ultimately hurt you in an audit if you're not achieving them.

Similarly you can't just pick an objective that you know you are already achieving or could achieve without any real input. For example if I am currently getting all of my reports completed within 5 days of audit, I wouldn't set my objective to complete all reports within 5 days.

Another thing to remember when setting objectives is to not set anything that may have a negative effect. For example if you set a target of no-non conformance's, it will discourage people from raising or reporting issues. Similarly setting objectives for no warranty payouts may push staff to abandon good customer service practices in order to reach targets.

The point of objectives is continual improvement, set meaningful goals that you want to achieve and can achieve.

Writing a Quality Policy

Writing any type of policy can be difficult the first time. I bet a lot of people have googled "Quality Policy" and used somebody else's as "inspiration" (also known as copy, change company name, paste).

Writing a policy doesn't have to be difficult and ISO9001 at least gives you some fairly firm guidelines as to what the policy requires (see below).

Top management shall ensure that the quality policy
a) is appropriate to the purpose of the organization,
b) includes a commitment to comply with requirements and continually improve the effectiveness of the quality
management system,
c) provides a framework for establishing and reviewing quality objectives,
d) is communicated and understood within the organization, and
e) is reviewed for continuing suitability.

If we break it down into its individual parts it can actually be pretty easy. There are only 2 things that it has to have, a commitment to requirements and continual improvement and a framework for quality objectives. The rest is up to you to make it appropriate to your business and your goals.

Lets look at requirement A. What does your business do? what do you sell? Who is your target audience? What are your goals? A discussion with Top Management will uncover this information pretty quickly.

Requirement B is even more simple, you can literally copy that sentence word for word from the standard and include it in your policy. It is up to you if you want to elaborate on it further. 

Requirement C is actually the most difficult part of the policy and many people do it poorly. What you are doing here is establishing a "framework" not just telling the reader what your objectives are. You want to say how you will establish your objectives, what you are basing those decisions on an how you will review them. 

As an example, say we are writing a quality policy for an smash repair business. You could say that you have set objectives for customer satisfaction, paint faults in final inspection and turnaround time. You could then elaborate on why these are the chosen objectives, how they are benchmarked, how you have set KPI's and how often it will be reviewed (frequency and method).

Requirement D can be difficult if you have a large business with people spread far and wide, the important thing is demonstrating that you have communicated it and showing evidence that it is understood. Auditors will sometimes ask your staff questions about the policy to see if it has been effectively communicated.

Requirement E is fairly straightforward, you can set your own requirements for review of the policy as long as it shows that it has been reviewed for continuing suitability. 

As a final side note, your CEO/MD etc DOES NOT HAVE TO SIGN THE POLICY. There is nowhere in the standard that says the policy has to be signed by top management. Some auditors will say that you have to because they think that you should, not because you're required to. If you don't want it signed, don't sign it.

Hope this is helpful.

PPE as a Risk Control Measure

This is an  issue that I find coming up more and more lately. Generally it's because more and more people have increased safety management responsibilities in their roles without actually understanding safety.

The issue that I have found is people implementing PPE (Personal Protective Equipment) as a risk control measure when it should really be the last resort.

To illustrate my point I'll give an example.

Company A has had an injury and they are looking at ways of preventing the injury from happening in the future.

When investigating the cause of the injury it was found that one of the steps in the task being conducted involved a risk of a cutting injury if performed incorrectly. In order to fix the issue the company introduced Kevlar gloves for all staff.

The problem I have with this is, why didn't they look at eliminating that step first? If that's not possible then there are more options in the hierarchy of controls that can be investigated before resorting to PPE.

When introducing new PPE there is the possibility of new risks that may make the problem worse. In the example above, the gloves may make items more difficult to grip and pose a manual handling risk.

I find the majority of the time, PPE is introduced as a cheap, lazy option  to fix a problem or because it is seen as an easy fix. It might be cheaper to buy everyone new gloves rather than having guarding re-engineered or making large changes to a process. At the end of the day though has it actually made the process safer, or does it just look safer?

I'm Back!

Hi All,

Sorry there has been such a huge delay in posts, I got caught up in training and day to day running of a business but I hope to start posting more frequently again.

Shoot me an email if there are any particular questions or topics you would like covered.

Spotlight on WH&S in the Real Estate Industry

I was asked by a colleague recently to write a piece for her blog on safety in the Real Estate Industry.

The post can be found below

Click Here

Measuring Customer Satisfaction

Apologies for the massive break in posts. There have been weddings, house moves and lots of work going on so unfortunately the blog has fallen by the wayside. Thankfully things have quietened down again so time to focus again.

The ISO 9001 standard has a requirement for analysis of data. This analysis can cover a wide range of data depending on your type of business but today I am looking at customer satisfaction.

A simple way for businesses with less than 1000 customers is to develop a customer survey using a site like survey monkey. www.surveymonkey.com

Using the templates provided you can determine what information is pertinent to your business and decision making. It also helps cover your customer satisfaction and analysis of data requirements.

Something a bit different

Sorry it has been a loooooooong time since my last post. We have been flat out for the last 4 months which is great leading up to the Christmas Break.

As something a bit different this was a project done by one of my clients for the Royal Children's Hospital.

Risk Assessments are not a one person job

I've been working with quite a large business over the last few weeks and during that time there have been a number of workshops undertaken. One of todays workshops was focused on risk and I have to say it produced a great result.

If you are performing any form of risk assessment (safety, environmental, commercial, technical etc) it pays to do it with a group of people all brain storming and making suggestions as opposed to one OH&S, Environmental, Financial Manager sitting at their desk nutting it out.

I have performed both kinds of risk assessment and it's easy to see which one is more beneficial.

Timeframe for building a Management System

One of the first questions I am always asked by potential clients is "How long will this take?" It is a difficult question to answer because if I say too short, I run the risk of not giving myself enough time to build the system and having to work for free for part of it. Or I can say too long making my price unrealistic.

Some people also expect you to be able to build a system within 3 days and pass an audit no problem.  Funnily enough these are also the same people that don't want to have any involvement in it and generally cause headaches. I tend to turn down those jobs.

In order to build an effective Management System I would suggest at a bare minimum without the assistance of a consultant 1-2 days a week for 2-3 months. This would take into account documenting your system, implementation, auditing, corrective actions and review. With the assistance of a consultant you can shorten this as the learning curve is not as steep. This is assuming you are a small to medium business with around 5-25 employees. 

The main variable however is how complex your business is. For example you may be a large business with a lot of people, however your processes are very simple as opposed to a small business with complex processes. As an example a cleaning business with 250 employees would have less complicated systems than a microchip manufacturer employing 10 people. 

These days I err on the side of caution. I would rather say more time than I think it needed and come in under budget than get halfway through and realise there is no way I will be able to finish the system with the amount of time I've given myself. I've done both and I know which one feels better. 

Reduction of petrol consumption as an Environmental Objective

If you are building a new Environmental Management System and one of your high impacts is the use of vehicles, I highly recommend against using the reduction of petrol consumption as an environmental objective.

It's a pain in the butt to measure and it can also be majorly effected by the growth of your business. 

As an example if you run a small manufacturing business and do a lot of deliveries, you may have vehicle use as one of your aspects. You could set reduction of petrol consumption as an objective but if you have a high growth period and need to do more deliveries you aren't going to meet those objectives.

you're better off setting reduction of unecessary travel as an objective which will give you the same result but allow for growth.

The way I have structured this with one of my clients is by printing the most efficient route to each of their major clients using the www.whereis.com website. This tells you exactly how far it is from the office to the client. The driver then writes down their start and end km's on their delivery docket and it can be matched to how far they should have travelled. Set the objective that no trips should exceed 2km's from the designated route.

This way you can be sure there is no unecessary travel and keep fuel consumption to essential travel only.

1000 views

This blog finally hit 1000 views this morning. Thanks everyone for reading and I hope the articles have helped in some way.

The Cost of Quality

There has been a debate on Linkedin and a couple of other forums raging for some time now. The topic being that there is no cost to quality.

The argument for this statement is that if managed properly, any costs associated with quality will be offset by improvements in efficiency, product and profit. The article below has some really good information about measuring the cost of quality.

http://www.platinumregistration.com/kbfiles/qp0906cokins.pdf

In a perfect world I agree with the statement. If you put effective processes in place that allow you to identify and correct issues early, you will save yourself A LOT of time and money. Finding an issue early in the process chain is a lot cheaper to fix than having it discovered by the customer at the end of the process.

The only time quality isn't cost effective is when it isn't managed properly. If your systems are weak and your Quality Manager is lazy you might as well scrap it all together. Having a system in place and not performing regular audits, identifying non-conformances and continually improving the system is a waste of time and although it may help you win a tender, it won't help you keep the business in the long run.