QUALITY MANAGEMENT SYSTEM (QMS) DESIGN (ISO 9001:2000)

QUALITY MANAGEMENT SYSTEM (QMS) DESIGN (ISO 9001:2000)

Oleh : Bayu Nurwinanto

The ISO 9001:2000 Quality Management System Design

The ISO 9000 QMS Design Context

The process used to create an effective QMS based on the ISO 9001:2000 International Standard extends directly to the creation of any QMS based on a standard.

By a standard, we mean a document published by either a national or international organization that has achieved a relatively high level of industry recognition and credibility in its specific area of expertise. There are of course ad hoc standards that are created and distributed within specific technical fields. Such ad hoc standards are extremely useful but are generally not recognized at so high a national or international level.

Examples of widely recognized national and international standards include QS-9000 for the automotive industry; AS9100 and IAQS 9100:2000 for aerospace; the Baldrige National Quality Program for total quality management; TL 9000 for telecommunications; and the FDA/CGMP 820, EN46001, and ISO 13485 standards for medical devices.

In many cases, a specific standard is complemented by a series of additional mandatory standards. For medical companies that wish to deliver product into countries that require a product certification (CE mark), it is necessary to comply with the Medical Device Directive 93/43/EEC. Health Canada provides its own Medical Devices Regulations that require specific licensing. In addition, the ISO 14000 standard is used for environmental management systems.

QMS mastery is a journey not a destination. There are literally thousands of standards and supplemental guidelines in use throughout the world. However, no matter how complex the set of standards, the underlying process to create an effective QMS is the same. The mastery of this process is no different than the mastery of any technical regimen.

In our text, we focus this optimization process on the international standard, ISO 9001:2000 Quality Management System: Requirements. Throughout the text, the term Standard (capitalized) is used to denote the ISO 9001:2000 International Standard.

Effective Quality Management System Processes

The impact of ISO 9000 certification on performance is a popular topic for speculation. However, rigorous evidence of performance improvement and cost reduction has begun to appear in the literature.

• The process to produce an effective QMS requires the following :
• The analysis of the tandard’s requirements—these are stated in terms of SHALLS;
• The introduction of an interpretive scheme based on the author’s experience and technical background;
• The top management decision on the total effort to be expended to produce the QMS (i.e., the degree of responsiveness);
• The integration of business strategy with strategic quality management goals;
• The clear presentation of the strategic organizational policies documented in a quality manual (manual);
• The aggressive implementation of the designed QMS;
• The demonstration that the QMS is effective through the analysis of data that tracks QMS performance against quality objectives.

In practice, ISO 9000 systems exist somewhere between the two limits of either a fully responsive QMS based on clearly defined and stated organizational policies or a QMS based on policies formed from just a repetition of the Standard’s phrases. In my experience, the primary reason that fully responsive QMS structures are hard to find is that the documentation teams are unaware that there is a systematic design approach upon which to base their efforts. Once the teams are made aware of such an approach, their ability to optimize the flow of information throughout the QMS significantly improves. The response time in resolving organizational issues decreases and the overall gain in productivity improves via an enhanced knowledge by every employee on just what the organization’s objectives are.

As a result, our goal is to present a set of QMS design rules that we believe can produce a fully responsive QMS that is both in compliance with the Standard and an effective strategic declaration of the organization’s business objectives.

We firmly believe that the intrinsic value of the Standard is its bottom-line focus on productivity and thus profitability—regardless of how the supplier wishes to state such objectives (e.g., lowered customer complaints, increased return on investment, lowered rejects, increased repeat purchase orders, and lowered product-return rates).

The Standard—through its inherent continuous/continual improvement paradigm, stress on customer satisfaction, heightened awareness of a lowered cost of quality, transparent business/quality objectives, and explicit calls for process/procedural analysis—offers the supplier a unique opportunity to improve its competitive advantage.

Specifically, the Standard has integrated the following eight quality management principles into its requirements :

• Customer focus;
• Leadership;
• Involvement of people;
• Process approach;
• System approach to management;
• Continual improvement;
• Factual approach to decision making;
• Mutually beneficial supplier relationships.

As a result, only a fully responsive QMS will include the totality of the eight principles and offer the organization the maximum return against these principles. However, this potential for enhanced marketability, productivity, and profitability is dependent upon the supplier’s desire to fully comply with the Standard, write the documented system in a user-friendly manner for a very wide range of readers, make a total management commitment to this effort, and establish a QMS that can be maintained in a cost effective manner.

The goal is to improve organizational effectiveness, not just get certified. Most importantly, a unified, strategic, business-and-quality policy signals to all employees that the main purpose of the ISO 9000 certification is to improve the effectiveness of the operation, not just achieve certification.

Quality Management System Defined

The characteristics of a QMS in regard to quality include the following :

• The establishment of policy and objectives by an organization to manage resources;
• The assignment of responsibilities and authority to personnel;
• The development of a an organizational structure among the personnel.

Operational Model for ISO 9001:2000

Based on this definition, we can graphically demonstrate the functional relationships between the various parts of a QMS. This concept is shown in Figure.

The difference between Figure is explicitly lists the appropriate section number for each activity. of the Standard is indicated where it is not included in the Standard’s model. Figure also indicates the benefits to the enterprise in terms of increased profitability, productivity, and product performance.

Figure also integrates the three pillars of ISO 9000 (i.e., the documented system, its implementation, and its demonstration of effectiveness).

Operational model for the ISO 9001:2000 QMS

This is not meant to imply that one model is better than the other. We do mean to clearly illustrate how our operational approach adheres in detail with the Standard’s model. In fact, those who have either created the ISO 9001:2000 QMS already or are in the process will often format their process discussions in terms of 5.0 Management Responsibility; 6.0 Resource Management; 7.0 Product Realization; and 8.0 Measurement, Analysis, and Improvement rather than in terms of core competencies. Unfortunately, the 5.0, 6.0,7.0, 8.0 approach can bypass the key process requirements, Quality Management System.

Although I have found little difficulty with the use of the Standard’s sections (instead of core competencies), the approach seems to need a more extensive, careful set of reference links to send the reader from one process to another as compared to core competencies that tend to automatically link functions. But this is really more style than substance.

Regardless of which model you choose, you will always have to integrate into the flow support functions such as management review, control of documents, control of records, control of monitoring and measuring devices, internal audit, and corrective and preventive action. Core competencies tend to highlight these support functions more—witness the missed in the Standard’s model.

We see that the Standard has essentially defined a classic engineering feedback system complete with inputs, outputs, and feedback loops. The inputs of end-user requirements, quality objectives, and quality management protocols are framed by the documentation system and transformed by the implementation system to produce continuously improved processes and products. These lead to outputs that include enhanced products, productivity, profitability, performance, and customer satisfaction.

In summary, between the Standard process model and our operational model—in concert with our plan-do-check/study-act models—it is possible to graphically display the most important aspects of the ISO 9001:2000 requirements designed to create continual improvement.

Pyramid for a Manual

In a similar fashion we can describe the hierarchal content of the manual as illustrated.

We indicate that the manual contains the entire set of organizational quality policies (defined as phase 1). We have chosen to indicate five directly sequenced sections to cover the five operating sections of the Standard (defined as phase 2). This set of definitions is valid for any form of manual sequences or configurations.

Phases 3 and 4 are somewhat more difficult to define because they are parallel processes in that each SHALL of the Standard (phase 4) is responded to with a quality policy statement (phase 3). It is this four-phase process that transforms a descriptive ISO 9001:2000 requirement into a set of prescriptive quality policy statements.

We can clarify the language used in this graphic by a review of previous statements and definitions.

The four phases of the ISO 9001:2000 Quality Manual
(direct sequence with Standard’s)

Quality Policy

Policies are by their nature time-independent (i.e., they do not describe movement, but rather define position), whereas processes and procedures are time dependent (i.e., they describe flow, continuity, and movement). A policy is basically a rule of the house set up by top management. They are prescriptive (have specific direction and/or instruction) and indicate method of approach.

Elemental Policies and Specific ISO 9001:2000 Requirements : 

There are five major sections in the Standard, which contain approximately 364 descriptive requirements in the form of either explicitly stated or implicitly directed SHALLS. In the case chosen, we have assumed that the requirements will be in the manual in five sections on a one-to-one basis with the Standard. More sections can be added as necessary (e.g., to meet regulatory, security, or safety requirements.).

All 364 requirements need to be addressed with prescriptive quality policy statements written into the text against their pertinent elements. Regulatory, security, and safety requirements would add more SHALLS to this number but are to be treated in the same prescriptive manner.

Quality Policy Statement Examples

We have maintained that each SHALL must be addressed if the manual is to clearly define the overall structure of the documented system and its effective implementation. We have previously discussed the requirements for documentation that are to be effectively implemented. Thus, a quality policy statement is required by the supplier in response to each SHALL. The quality policy statement is intended to be prescriptive and to delineate authority/responsibility.

Four Possible Quality Manual Sequences

The actual structure of the manual depends on the nature of the enterprise and the manner in which we intend to propagate information within the QMS. At least four basic configurations for the manual are compliant with the Standard’s requirements.

The Process Document

The document is expressed in many different ways, all of which are identical. For example :

• SOP;
• Process document;
• Hub document;
• Quality-assurance procedure;
• Quality or control plan.

The role that the process document plays in the QMS is to describe the time-dependent behavior of the system after it has been defined in terms of quality policy statements. The importance of the process document cannot be overly emphasized. It is actually the first document that should be drafted prior to any other, including the quality manual (or alternately, the quality policy manual or quality system manual).

The Critical Development of Processes

Because the identification of processes, their sequencing and interaction, and a description of such interactions is the most dramatic revision to the 1994 version, it requires that we carefully analyze the way in that this critical requirement can be responded to effectively.

The Trouble with Tier II

Explicitly, a process document is not a mandatory document. Implicitly, it can be-if it is in the form of a procedure that is required. For example, the audit process could be documented in the form of a SOP that would then be mandatory because an audit procedure is mandatory. This vagueness is not new to the 2000 version; it has always been there and has always been confusing to all QMS developers.

However, several requirements and definitions help to demystify the form of tier II documentation. Such inputs can serve to include the concept of a process document more clearly into the ISO terminology.

First, we must examine the definition of a procedure. With reference to ISO 9000:2000, a procedure is a document that tells you how to accomplish either an activity or a process. In other words, if you want to create a process document, you can call the document a procedure. The common terminology ranges from standard operating procedure, to quality systems procedure, to quality-assurance procedure. The document will then fit into the ISO terminology.

There is another bug in the ointment that is a throwback to the 1987 first release. Procedures can be documented or not. What we did in those days to resolve this issue was to interview several people running the same procedure to indicate either that it was being done differently by different people or it was not. The advent of a multitude of procedures and work instructions is indicative of what was discovered.

However, this requirement, which appears as a note under in the vocabulary, is a real issue that must be considered carefully. For example, many a machine shop has extremely well-qualified and experienced machinists who perform a multitude of complex tasks without written procedures. To require written procedures in this case would be a waste of resources. As long

as both the inputs and outputs of the machining process are controlled and the appropriate records are kept, there is no sensible reason to document how the machinists set up their work, implement the drawings, and inspect and move the product along to the next cell. On the other hand, for example, it is ludicrous to argue that it is reasonable to perform complex test plans from memory.

The next step in our attempt to validate the process document as a viable tier II text is based upon the definition of a quality plan. With reference to ISO 9000:2000,  a quality plan tells you that procedure(s) and resources are required by those who do work, regardless of the type of work that has to be done. Sounds like a process to me. It has inputs (procedures, resources, people), transformations (inputs applied and changed), and outputs (projects, products, processes, contracts). As a result, quality plans are really process documents. The terminology used includes quality-assurance plan, manufacturing control plan, and design control plan. Work orders and travelers are sometimes in the form of a quality plan. This is why we have placed the requirements for plans under the category tier II documents.

ISO 9000 Quality Plans—Optional

The optional requirement for quality plans is stated as a note in ISO 9001:2000, 7.1: Planning of Product Realization, and its definition was discussed previously. About 40 years ago, quality plans were very common in MIL-Q-9858 quality-control systems and consisted of bubble flow charts with all of the associated documentation affixed to the chart. Today, quality plans vary greatly and are an integral part of the QS-9000 requirements, and are discussed in some detail in ISO 10005:1995(E).

Sounds Like a Process

A quality plan sure sounds like a process, and indeed it is (i.e., it is a description of a set of interrelated or interacting activities that transform inputs into outputs). As a result, the old bubble chart configuration is as true today as it was 40 years ago and is a very useful rule in the creation of a quality plan graphic (see Figure).

Quality plan to build an electronic device. Process flow with documentation
= quality plan (when documentation stipulates resources required

Device Master Record Technique

Another technique used to create a quality plan is to form a device master record (DMR) that either contains or sends the reader to the following :

• Device/system specifications;
• Total manufacturing process specifications;
• Quality-assurance procedures and specifications;
• Packaging specifications;
• Labeling specifications;
• Installation procedures and methods;
• Maintenance procedures and methods;
• Servicing procedures and methods.

product is formed by the DMR. The DMR is complete when you can prove that the required device can be completely built and shipped to its performance specifications based on only the DMR protocols.

For this medical device protocol, the actual performance of the device throughout its life cycle is captured in the device history record (DHR). The design phases are maintained in the design history file (DHF). The manner in which the device meets its compliance requirements is kept in a technical file. The higher-level documentation is maintained in the quality system record (QSR)—that is, documents not specific to a particular device such as management reviews and metrology procedures. The technique is readily expandable to any organizational product structure and can be termed, for example, the systems master record (SMR), the systems history record (SHR), and so forth.

Process Flow Charts

A number of flow chart software programs are available that are quite capable of clearly defined process flows. The key thing to remember, however, is that a flow chart without reference to associated documents is only half the story. In addition, not all information can be readily placed in a flow chart without obscuring its clarity. As a result, there is always room for supplemental text and complementary tables (e.g., lists of document numbers, forms to be used, and special instructions to the user).

Primary information—most importantly, if a flow chart is chosen as the means of communication, it should be the primary source of information. If it shares the same data with another document, there is an excellent chance for redundancy and its tendency to confuse the reader. We have observed flow charts used successfully in both the manual and in lower tier documents. Flow charts are an excellent technique to use to describe both process and the interaction of processe.

The combination of a supplemental text and a flow chart form the informational document. It’s the same document! We have observed that this concept is difficult to grasp. As a result, we have described this issue in Figure 1. The details of a typical flow chart are shown in Figure 2. Notice the use of documentation references in both of the examples.

A typical flow-charted process structure.

Example of a flow-charted process

Endnotes :

• See, for example, Advanced Product Quality Planning (APQP), Reference Manual, from AIAG, June 1994;
• ISO 10005:1995(E) presents several typical quality plan configurations that include plans for service Organizations, manufactured product, processed material, and a software life cycle;
• 21 CFR Part 820 Quality System Regulation, FDA/CGMP Sec. 820.181, October 7, 1996.