ISO 9000: The Demands of Quality

The ISO 9000 series of international standards offer a recipe for companies that want to become--and prove they are--high-quality suppliers.

By James R. Haluch

James R. Haluch is manager of the manufacturing division for GPS Technologies, a Pottstown, Pa., training and consulting firm.

Quality is no longer just an overused marketing buzzword or a vague goal mentioned at an annual meeting. Today, quality is survival. In fact, it's becoming increasingly apparent that companies lacking high-quality processes to produce high-quality products and services could be dealing themselves a fatal blow.

While we instinctively recognize a high-quality product or service, it's much tougher to apply the term quality to an entire business. So how does a company ensure that it produces high-quality goods and services? And how can the firm prove it?

For most companies, becoming a quality organization requires a cultural change. It demands a whole new system of management, even a major shift in the way employees think, talk, work, and act. Also, to ensure quality and satisfy customers, a company must be in continuous-improvement mode in all its operations since every part of the organization contributes to the quality of the output. This may sound like a goal that's easier said than done, but there is a tool available to help: ISO 9000, which can enable a company to implement this kind of overall quality system, ensure the system is functioning, and document for its customers and potential customers that it is a high-quality supplier.

What Is ISO 9000?

The ISO 9000 standards specify quality system requirements for use when a contract between two parties requires the supplier to demonstrate its ability to control its processes to ensure that acceptable products or services are supplied. The standards aim at preventing and detecting nonconformity during design, production, and installation, and require regular audits to ensure that a firm is meeting these goals with its products. They are not aimed at the product itself, however. Rather, the ISO 9000 standards are applied to the quality management and quality assurance system that a company employs in the creation of its product.

The standards were established by the International Organization for Standardization (Geneva), a federation of national standards groups, based on U.S., German, and British quality control standards. ISO 9000 is currently accepted in 43 countries, and, although many of these have renamed the standards, they remain virtually identical. (In the United States, the standards are sometimes referred to as Q90.)

The ISO 9000 standards actually encompass five related standards, numbered ISO 9000-9004 but collectively referred to as ISO 9000. ISO 9001, 9002, and 9003 define three quality assurance levels for an organization based on the kinds of functions it performs. ISO 9000 and 9004, meanwhile, define the basic elements of a comprehensive quality assurance system and provide guidance on applying the appropriate quality assurance level. Here is a closer look at each:

ISO 9000, referred to as "Guidelines for Selection and Use," explains fundamental quality concepts, defines terms, and provides guidance on selecting, using, and, if necessary, tailoring ISO 9001, 9002, or 9003 to a specific organization. This standard may help a company determine which specific standard--9001, 9002, or 9003--is applicable to it,

ISO 9001, the "Model for Quality Assurance in Design/Development, Production, Installation, and Servicing," is the most-comprehensive standard in the series. In addition to covering all of the elements in the less-comprehensive ISO 9002 and 9003, which relate to production and testing, it addresses design, development, and service functions.

ISO 9002, the "Model for Quality Assurance in Production and Installation," addresses the prevention, detection, and correction of problems related to production and installation. This standard covers most of the functions handled by ISO 9001--but not the design function--and is more extensive than ISO 9003.

ISO 9003, the "Model for Quality Assurance in Final Inspection and Test," addresses requirements for the detection and control of problems during final inspection and testing. ISO 9003 is less extensive than ISO 9001 or 9002.

ISO 9004 provides guidance for a supplier to use in developing and implementing a quality system for its own operation as demanded by ISO 9001, 9002, and 9003 and in determining the extent to which each quality system element (described below) is applicable. ISO 9004 can help a company set up an internal auditing system to help meet the standard. It is also used for external auditing purposes.

Quality System Ingredients

These standards are broken down into 20 sections or paragraphs, each of which covers a particular area or function at a company that should be covered by the quality system. Each paragraph lists what is needed in a specific area; it's up to the company to determine how to craft its quality system to meet the needs. Nevertheless, the standards specifically require written procedures in many cases and are very big on documentation. In addition, in some instances, they call on the quality system to include certain procedures "if applicable" or "where appropriate"-decisions left to the company based on its characteristics and whether the item affects the quality of its products. All the paragraphs apply to ISO 900 1; only subgroups apply to ISO 9002 and 9003, while ISO 9000 and 9004 do not specifically require implementation of the section mandates. Details of the paragraphs follow.

Management Responsibilities. This section, referred to as paragraph 4.1, gives upper management specific obligations related to the company's quality program:

Define and document the company's policy related to, objectives for, and commitment to quality. 

Ensure that the policy is understood, implemented, and maintained at all levels.

Define quality-related responsibilities and authorities.

Identify quality verification activities and provide resources for their implementation.

Appoint a management representative to the steering committee managing the ISO 9000  registration effort.

Periodically review the effectiveness of the quality system.

Keep records.

While this section specifically outlines these requirements for upper management, the underlying theme of paragraph 4.1 is that all personnel who have virtually any tie to quality must have clearly defined responsibilities and authority. Quality starts at the top--no one is exempt.

Quality System. Paragraph 4.2 simply requires that a comprehensive quality system be established, effectively implemented, maintained, and documented.

Nowhere does the standard explicitly call for a "quality manual." It merely says a quality system must be in place, and this can be whatever a company defines it to be. Still, the firm must document in some way how it addresses quality issues and then demonstrate to an auditor that the firm actually does what it says it does.

Contract Review. This paragraph, 4.3, is designed to ensure the organization has good contracting procedures. It requires that adequate procedures be in place to ensure that all necessary information is transmitted to contractors and that a system is established to review bids and make sure the contractor has the necessary ability to do the job. It also requires record keeping.

Design Control. Quality requires a company to manage design functions in a controlled fashion, and this section, paragraph 4.4, demands procedures to cover design and development planning, including assigning of activities and establishing clear lines of communication between organizational and technical personnel. Specific procedures must be in place to handle input, output, and verification of designs, as well as design changes. (This paragraph is found only in ISO 9001, the only standard that addresses the design function.)

Document Control. Paragraph 4.5 calls for a company to develop and implement procedures to manage all documents related to its quality system and make sure they are accurate and up-to-date. It specifically requires procedures to:

Control all documents and data related to the quality standards.

Review and approve documents for adequacy prior to issue.

Ensure that correct documents are where they belong.

Remove all obsolete documents.

Maintain master lists of current document status.

These requirements are problematic for many companies. For example, if an auditor reviewing the quality system finds an outdated quality-oriented procedure document out on the floor of the plant more than once, this is justification for the company to fail its audit. Though this may seem petty, it's in keeping with a key goal of the standards, which is to make sure that everyone on every shift is trained in the same way and is using the same procedures and materials. The idea is that if the documentation is in control, it is likely that the process will also be in control.

Purchasing. This section controls the purchase of supplies and data as well as assessment of subcontractor performance. Paragraph 4.6 specifically requires procedures to:

Ensure that purchases conform to specified requirements.

Assess subcontractors on their ability to meet quality requirements.

Ensure that information on order documents is complete.

Enable customers to check supplies at the source, when contractually required.

Monitor and keep records on subcontractor performance.

These requirements are meant to make sure that quality inputs are used by requiring verification of the quality of material received and tracking of the performance of individual suppliers. The theme behind this section is that if all the materials going into the product are basically sound, the final product has a greater chance of maintaining specified quality standards.

Purchaser-Supplied Product. Section 4.7, which has been interpreted differently by different auditors, basically requires that the quality system keep track of materials or "products" that are directly incorporated into the final product, such as a finished part simply installed in a larger machine.

Product Identification and Traceability. The quality system must be able to trace the history of specific products, a task typically managed through use of computer systems and product labels. Thus, paragraph 4.8 requires, where appropriate, procedures that can identify products during all stages of production, delivery, and installation, and confirm that each step has been satisfied and recorded.

Process Control. This key paragraph, 4.9, aims to ensure that products are made under controlled circumstances by requiring implementation of procedures to:

Plan production/installation.

Approve the process and equipment.

Control the work process.

Use work instructions where their absence would adversely affect quality.

Monitor the process.

Stipulate workmanship standards.

Identify and have procedures for each special process.

Maintain records.

Inspection and Testing. Paragraph 4.10 is meant to ensure that the means are in place to make certain that products produced meet quality requirements. Specifically, it calls for the system to:

Ensure incoming material has arrived and meets standards.

Identify and keep records on substandard incoming material.

Inspect and test according to an established plan.

Monitor processing.

Keep inspection and test records.

Identify nonconforming products.

Inspection, Measuring, and Test Equipment. According to section 4.11, all the equipment used to verify each product standard must meet stated specifications. It requires that:

Equipment used to verify that products meet specifications--such as jigs, fixtures, templates, and test software--be calibrated, controlled, and appropriate for the purpose for which they are used. Records be maintained to show equipment type, identity number, location, frequency of check, check methods, and results.

Measurement uncertainty be known.

Equipment be calibrated at prescribed intervals or prior to use and safeguarded from adjustments that would invalidate the calibration settings.

This is a common area for auditors to find mistakes, as calibration of testing devices is easily overlooked.

Inspection and Test Status. This paragraph, 4.12, requires that there be methods established to identify the current status of a product in regard to testing and inspection through use of markings, authorized stamps, inspection records, test software, routing cards, or other suitable means of tracking. It also requires maintaining identification of the product throughout the process and keeping records on who was responsible for testing and inspection.

Control of Nonconforming Product. Paragraph 4.13 calls for a system to segregate products that do not meet specifications from those that do. Procedures must exist to ensure nonconforming products are identified; reviewed for rework, regrading, or rejecting; and reinspected after repair or rework. It also requires detailed record keeping.

Corrective Action. This section is based on the idea that it is necessary to investigate what caused products to not meet quality standards and get beyond the “quick fix" to solve their root cause. Thus, paragraph 4.14 calls for a company to implement procedures for the analysis of processes, operations, plan alterations, quality records, service reports, and customer complaints. In addition, it demands that procedures be in place to direct corrective action to prevent reoccurrence of the problems, including changes in procedures or work instructions if they are faulty, and to maintain records coveting the corrective process.

Handling, Storage, Packaging, and Delivery. Paragraph 4.15 requires use of product handling procedures to prevent damage or deterioration. It also requires that the system ensure packaging is controlled and adequate and that the product is protected in transit. Procedures must also be in place to ensure storage is secure and adequate, assess stored products, and move products in and out of storage.

Quality Records. A company must maintain good, traceable records, according to section 4.16, which calls for procedures for the identification, collection, indexing, filing, storage, maintenance, and disposition of records. It also requires that all records created to demonstrate conformity to the standard be kept for an established length of time and demands that all the records be readily retrievable and protected against damage or loss. In addition, the records must be legible-no more scribbling out notes or instructions.

Internal Quality Audits. Paragraph 4.17, the living heart of a working ISO 9000 system, outlines the need to internally check the organization, objectively, against the standard. It requires procedures to implement internal audits and ensure that the audits are comprehensive, planned, and used to verify the effectiveness of the quality system. Management must review the results of audits and make sure that corrective action has been taken by individuals responsible for any areas found in noncompliance.

Independent auditors are likely to check compliance with this paragraph carefully.

Training. A company must identify and implement training procedures for all personnel performing activities affecting quality, according to paragraph 4.18. This section does not demand that all company personnel be trained, only those who affect quality, which is left up to the company to determine. The organization must, however, prove to an ISO auditor that nothing an employee can do on his job (within reason) will affect quality in order for that person to be exempt from quality training,

As with virtually every other paragraph in the standard, this paragraph notes that appropriate records be maintained. Who defines what is appropriate? The company does, but, again, it must prove to the auditor that the records are sufficient to maintain quality standards.

Servicing. Section 4.19, a minor paragraph found only in ISO 9001, demands that a procedure be in place to ensure that service is provided if promised.

Statistical Techniques. Section 4.20 does not require the use of statistical techniques--the primary method an organization has to monitor its performance to ensure that the process is in control--but it does note that if it is appropriate, statistical techniques must be used to verify the process capability and necessary product characteristics. If statistical techniques are used, procedures must be established that ensure capability studies are used to determine if the system can be monitored statistically and that the methods chosen are adequate.

The Registration Process

ISO 9000 certification, or registration as it's called, simply involves proving to a certified registrar that a company has achieved compliance with the appropriate standards. In the United States, only organizations accredited by the Registrar Accreditation Board are authorized to issue certification of registration.

ISO 9000 registration typically follows these steps:

Selecting a registrar.

Identifying the scope of the registration or selecting the specific standard to be applied and satisfied.

Setting up a steering committee to manage the certification attempt.

Conducting internal audits.

Conforming to the standard.

Performing a preregistration audit, either internally or by the consulting registrar.

Undergoing a registration audit by the registrar.

Performing postregistration monitoring audits (typically an internal function).

Undergoing formal requalification by a registrar every three to five years.

For a company that already has an effective quality system in place, registration may be little more than a formality. But achieving ISO 9000 certification is typically not a simple task and may require some companies to completely change the way they conduct business. In fact, ISO 9000 is a way of doing business.

The costs and benefits of certification will vary from firm to firm, but the process should be considered an investment--like a piece of fine machinery designed to improve a company's capabilities.

For More Information …

Additional information on ISO 9000 is available from the American Society for Quality Control, including a current list of approximately 40 registrars accredited by the Registrar Accreditation Board and descriptions of publications and classes on ISO 9000 (and other quality-related topics) that the association offers. Call 800/248-1946; 414/272-1247 (fax). •