How to Start ISO Automation
The processes followed by most small- and medium-sized companies to prepare for or maintain an ISO 9001 registration have been largely manual rather than computerized. Employees are expected to key in or type the required quality documents, physically draw process diagrams, and spend hours creating and crossfooting reports and validating data to show ISO auditors that the business has actually followed the documented processes.
Likewise, internal and external ISO 9001 auditors can spend many days looking for paperwork, and manually assessing the reasonableness of data compared to company specifics.
This is particularly ironic, because most of the systems being certified are computer-based, and computers were designed to reduce the errors and inefficiencies of highly manual operations. The facts are that ISO 9001 registrations in manual environments still cost most small companies more than $100,000, and take an average of one year of preparation. There is evidence that up to 50 percent of these registrations fail at the time of recertification, due to the inability of a company to maintain and scale manual processes.
Why haven’t we used computers more to improve and automate ISO 9001 processes as well as the underlying business processes? My interviews with ISO 9001 auditors who have years of experience in this area, combined with my own experience as a software executive with large and small companies, leads me to the following conclusion: Quality assurance personnel often don’t have the skills and training to install and support complex software tools, and they don’t have the clout or budget to get it done quickly through the information technology (IT) department.
Thus my top 10 recommendations are focused on starting with the most critical aspects, and utilizing technology that is more pervasive, less expensive, and accessible to everyone in the organization.
#1. Start with a simple document management system
The keystone of all ISO 9001 standards is a documented quality management system, which consists of an interlocked set of documented objectives for a company, documented processes and training to achieve these objectives, and documented results that show acceptable delivery and continuous improvement.
My first recommendation for most companies is to acquire a prepackaged set of electronic quality-management documents available from existing vendors, rather than designing and developing your own set. These will already have the required elements and format and will likely need only modest customization to match your quality objectives.
The next step is to store and maintain these documents online in a document-management system (DMS). If your company has any IT system installed, it probably already has a DMS available for your use. Examples include the Microsoft Office SharePoint Server, FileNET, Documentum, and database software from all major IT vendors. Key attributes that you need are access security, versioning, authorization levels, and audit tracking for all changes.
Companies such as Intelligent Data Technologies Inc. and MasterControl offer the required document-management capabilities already integrated in other functions, optimized for ISO 9001 requirements, and available over the Internet for a low monthly subscription charge. These can be setup with virtually no IT involvement or budget.
The final alternative is simply to acquire a conventional personal computer, and use one of the common word processing packages, such as Microsoft Office, Microsoft Works, or OpenOffice. This approach will dramatically improve your ability to manage and update the documentation, but won’t facilitate access, distribution, and control of documents across the quality assurance team.
#2. Implement electronic forms (e-forms)
Electronic forms (e-forms) are computer-based forms that are fast replacing traditional paper forms in industrialized countries because traditional paper forms are impossible to manage effectively, and the people-hours associated with them cost much more.
E-forms are now standard in many governmental, financial, judicial, legal, insurance, and private organizations and offices, and can dramatically simplify and expedite your standards control processes, assuming your implementation meets ISO 9001 requirements. You can design, fill, save, print, e-mail, and track these forms via the desktop and Web applications and easily move them through the Internet.
As with document-management systems, there are a wide range of e-forms alternatives, from do-it-yourself free templates on the Internet, to sophisticated and expensive software. In the last few years, vendor offerings have improved dramatically, with each vendor's approach being different.
“Adobe is a leader in this area, bringing together a user-friendly forms-design environment with the ubiquitous Acrobat Reader rich client. IBM is a leader in providing unparalleled XML and digital signature support. Cardiff Software and Microsoft are strong performers, offering e-forms products appropriate for forms-driven horizontal business processes. And FileNet is a strong performer with an e-forms product aimed squarely at integrating forms into enterprise business processes,” according to Forrester, a market research firm.
#3. Use automated issue management for quality improvement
Automated issue management and problem tracking simply suggests the use of a computer application to manage quality issues, rather than the manual clipboard approach. Spreadsheets and word processors will work, but these have been generally superseded by more specialized tools that support team environments, implement and update access and security levels, and provide the audit trails required by ISO 9001. The key to a good system is the ability to tailor it to your process and standards.
One of the most popular open source (free) packages in this arena is called Bugzilla. It’s readily available and downloadable from the Internet. Bugzilla is a Web-based general-purpose bug tracker originally developed and used by the Mozilla project. Bugzilla has been adopted by a large number of organizations for use as a defect tracker or general issue tracker.
On the other end of the cost spectrum is Rational ClearQuest, a sophisticated issue-management automation tool from the Rational Software division of IBM. This tool can be linked to Microsoft Project to create ordered steps for resources assigned to specific quality goals.
In addition, there are now many offerings that more specifically address ISO 9001 standards requirements. A good source for these is the Quality Digest 2007 ISO Standards Software Directory, available online at http://www.qualitydigest.com/pdfs/isosoft.pdf.
Issue-management tools are particularly effective in addressing corrective action and preventive action (CAPA). The purpose of CAPA is to ensure that the root cause of any problem is addressed so that current or future problems will be alleviated.
#4. Utilize personnel software for controls and training
Personnel systems are typically among the first software packages acquired or built by a new company, so the chances are that your company already has one. Hopefully, it already has the controls you need to assist with ISO 9001 registration, and the features to track training status and requirements.
Without a personnel system, the first step is to investigate the availability of “add-ons” or extensions to your existing system. If such software isn’t available, it may be time for a new personnel system, such as PeopleSoft Personnel, or one of many systems advertised on the Internet. Features that have particular value in maintaining ISO 9001 standards include employee-training records, job tenure and qualifications, job titles and descriptions, organizational structures, and personnel access controls.
To be most effective and current, personnel systems must have features that are accessible by every employee at his work location, or over the Internet. Personal employee information can thus be maintained by the employee, and company training and vacation information can be viewed as desired.
The personnel system should be integrated with other subsystems, so that all approval and access security mechanisms can be driven by a single organizational structure imbedded in the base personnel system. This can help you avoid a major ISO 9001 registration failure—inconsistent maintenance of critical information in multiple subsystems.
#5. Use e-mail for remote links and approvals
In today’s environment of highly mobile workers, home offices, and international travel, it’s virtually impossible to get timely hand-written approvals for updates, production schedules, or even conventional travel and vacation authorizations.
Yet everyone has e-mail, and with the proper controls in place, this can be used to provide timely notification of action requests, and even links to signature mechanisms. As mentioned earlier, many e-forms applications already are set up to use e-mail as the delivery vehicle.
The most common e-mail packages in use for business today include Microsoft Outlook and Lotus Notes. Both of these have a wealth of add-ins that facilitate remote approvals, mail forwarding to personal data assistants (e.g., a Blackberry), and the security and filtering mechanisms to meet ISO 9001 requirements.
The concept of remote communication and approvals has even been extended to cell phones, via the text messaging or small message services (SMS) features. Imagine being able to get your boss to approve your parts requisition, even while he or she is vacationing on the beach in Hawaii.
#6. Consider a generic reporting package
Reporting quality status and results is one of the most critical capabilities for ISO 9001 compliance, and often one of the most expensive and time consuming. Everyone wants their reports customized, and everyone thinks they can produce the ultimate report.
Rather than writing your own reports, the place to start is with a professional reporting package, like Crystal Reports, now available from Business Objects. It provides connectivity to most PC-based data sources and databases, and uses a visual report designer to access and format data quickly. Customizable templates provided with the package will help you create reports fast and consistently.
There are also a plethora of alternative packages available for free downloading as shareware, or as open source on the Internet. JasperReports from JasperSoft is one of the most popular ones for Java environments. It consists of an embeddable Java reporting library for developers, a comprehensive XML-based report-definition format, and a powerful graphical report design tool for report developers.
This is also an area where you can get ISO 9001-specific solutions from vendors. See the 2007 ISO Standards Software Directory, noted earlier, for specifics.
#7. Take advantage of open source and shareware
In all cases, before approaching your IT organization, or designing your own automated solution to any specific ISO 9001 requirements, do research on the Internet for relevant tools that may be downloaded free as shareware or from open source vendors.
The normal caveats for searching the Internet apply—make sure you have a current antivirus program active, and that your system is protected from attacks by an active firewall. Also recognize that free software will likely not be as robust and high quality as enterprise-level licensed packages.
The potential return here is huge—a recent search request to Google for “ISO shareware free download” yielded more 2 million hits. For a quick solution to get you started, or to get past a snag in your overall ISO 9001 plan, this may be the place to start.
#8. Skip the IT organization and go to SaaS
Software as a Service (SaaS) is a rapidly growing software-distribution model in which applications are hosted by a vendor or service provider and made available to customers over a network, typically the Internet.
A major benefit for young companies is a dramatic reduction in startup IT costs, and no long-term commitment. Other benefits of the SaaS model include easy administration, automatic updates, easy collaboration, and global accessibility.
With the SaaS model, each employee, manager, and executive of a small company can have instant access to personal and company data via a user identification, password, and secure link to the host system in a secure, remote data center, with nominal subscription charges and a minimal IT investment. The only software required locally is a browser.
#9. Use existing Internet and intranet facilities
Whether you use SaaS or licensed software, the Internet offers worldwide access to information and communication services. Using the Internet, you have access to millions of pages of information. Internet browsing requires only a Web browser.
As mentioned in earlier sections, your first step toward ISO 9001 registration automation should be to use the Internet for research, education, downloads, and for communication to peers and executives.
If your company has a protected network that is contained within the enterprise, this is called an “intranet.” It may consist of many interlinked local area networks and use leased lines in the wide area network. Typically, an intranet includes connections through one or more gateway computers to the Internet. The main advantage of an intranet is that it can be used safely to share company information and computing resources among employees. An intranet can also be used to facilitate team efforts and for teleconferences.
#10. Invest in an integrated ISO 9001 automation solution
If you’re a bit further along in your ISO 9001 implementation efforts, you will recognize that, to be most effective, ISO 9001 quality processes must be integrated into or have access to all the horizontal applications of the company. These include human resources, training management, project management, problem tracking, and business process management. In the past, this hasn’t been easy or even possible with most of the specialized and independent applications generally available.
Also, the software technology to measure and assess the effectiveness of other business processes is complex, and has only recently begun to emerge in cost-effective solutions. New technology implementations include executive dashboards, which provide real-time operational monitoring, and ISO readiness assessment algorithms, now being patented and delivered in new tools.
The topics discussed here are just an introduction to the many ways that computer systems can help you in automating your ISO 9001 registration efforts. But from these ten ideas and recommendations, I trust that you can see the value of automation and ways to get started quickly. Obviously, there are many additional elements that can be added, without huge investments in time and cost.
The importance of ISO 9001 registration is increasing as we move to a more global economy. For new companies, and companies outside the United States, ISO 9001 registration has become a condition of entry into the world market, as well as a clear competitive differentiator. Software technology is as critical to this aspect of your business as it is to your core business processes. Now is the time to start using it.
About the author
Martin Zwilling is the founding partner of Southwest Software Ventures & Consulting. He’s a member of the Advisory Board of Intelligent Data Technologies Inc. and the author of a patent pending (60/823,142) on new ISO automation technology. He has an extensive technology background including a career with IBM and as a consultant and mentor for large and small companies.
Click here to return to the Quality Digest home page.