ISO 9001 and occupational health and safety

Adopting ISO 9001 might lead to improvements in occupational health and safety in a variety of ways. In the process of formally documenting procedures, for example, managers can identify and eliminate hazardous practices and add safety precautions. Moreover, by fostering more focused attention to detail,ISO 9001 adoption can reveal new “win-win” opportunities to improve quality or efficiency and occupational health and safety that were previously obscured by indirect and distributed costs and benefits.

Additionally, processes that provide warning signals and prompt corrective action can forestall serious accidents. Finally, routine auditing and corrective action procedures required by ISO 9001 to address management system failures encourage root-cause analysis that can identify problematic work practices that might otherwise precipitate not only quality failures, but occupational health and safety concerns.

Departments charged with managing quality sometimes also manage health and safety, and companies are increasingly implementing integrated management systems that incorporate all these considerations. Occupational health and safety can be improved by applying the tools of continuous improvement associated with ISO 9001 certification. Employees who know how to identify root causes of quality problems, for example, also have the skills to identify root causes of safety problems.

The high rates of repetition and increased monitoring implicit in the emphasis of ISO 9001 on routinization and standardization of tasks can increase stress and repetitive motion injuries, potentially worsening the safety records of plants with quality program. Moreover, to the extent that the higher equipment utilization associated with ISO 9001 adoption translates into reduced employee downtime, employee fatigue, a major cause of injuries, might be expected to increase. Additionally, new quality management procedures implemented in association with ISO 9001 that add inspection tasks to work processes optimized for production can occasion poor ergonomic conditions that leave employees susceptible to injuries.

Read more on ISO 9001 at http://www.e-wia.com

Process Approach In ISO 9001 Standards

The ISO 9001 International Standard promotes the adoption of a process approach when developing, implementing and improving the effectiveness of a quality management system, to enhance customer satisfaction by meeting customer requirements.

For an organization to function effectively, it has to determine and manage numerous linked activities. An activity or set of activities using resources, and managed in order to enable the transformation of inputs into outputs, can be considered as a process. Often the output from one process directly forms the input to the next.

The application of a system of processes within an organization, together with the identification and interactions of these processes, and their management to produce the desired outcome, can be referred to as the “process approach”.

An advantage of the process approach is the ongoing control that it provides over the linkage between the individual processes within the system of processes, as well as over their combination and interaction.

When used within a quality management system, such an approach emphasizes the importance of

a) understanding and meeting requirements,

b) the need to consider processes in terms of added value,

c) obtaining results of process performance and effectiveness, and

d) continual improvement of processes based on objective measurement

Six Sigma Vs ISO 9000

The debate over whether or not to choose Six Sigma over ISO 9000 is getting more interesting with each passing day. In an attempt to determine which of these is the better of the two, it is highly pertinent to discuss that in the context of applicability of them to industries. And there exists a huge amount of difference between the approaches of these two methodologies in tackling the issues.

Six Sigma – A Critical View

Six Sigma utilizes a multi-faceted approach to doing business with total improvement of the end product being the goal. In doing so, Six Sigma defines and analyzes the processes critically almost always focusing on process improvements. The statistical tools used in Six Sigma help not just in the adoption of processes but are also critical tools of Six Sigma implementation.

Process Development Stages

Let us examine the above statement as applicable to a process for easier understanding. While working on process improvement, the Black Belts break up the original sequence of different events that comprise the entire process and each event is further subdivided internally. This enables the “belts” to take an entirely different view of the process via the entire process as a whole. The powerful statistical tools employed at this stage of evaluation make the picture clearer and help the “belts” to arrive at decisions about the value additions those made to the process by different events.

This principle obviously goes beyond standardizing the processes and setting the pathway for being vigilant about adherence to the Six Sigma methodology. Useless values which have lost meaning make way for more meaningful events and eventually more robust and comprehensive processes. In a Six Sigma environment, customer demands will assume a key role in driving the processes towards aligning all activities with the vision of the leader of the company. The approach is “how to” rather than “what to” deliver.

The ISO 9000 Approach

The ISO approach towards quality management concentrates on standardization of the activities of production. The eight quality principles of ISO 9000, along with its twenty-four requirements outline business processes. The emphasis here is on the control of events in each aspect of doing business by documenting evidence and reports. The eight principles of ISO 9000 include prioritizing customer data, purchasing and quality systems, among other critical aspects. ISO 9000 recognizes each process, whose end goals are the same, as an independent entity. Documented quality requirements typically decide, based on set rules, whether or not a particular process adhered to that standard.

Document and Process Control

Maintenance of quality is achieved by adhering to key process and document control. Operating procedures and process control documents restrict deviations outside the concepts of what you should be doing in every process. What-you-should-be-doing is given emphasis under standard conditions rather than dealing with process improvement.

Stalwarts in industry are examining the possibility of merging the best practices of the two. Several industry leaders have already acknowledged the benefits of using both methodologies to compliment each other. Another view is that, as Six Sigma implementation is what you do within your company (unlike the certification in ISO) the company does not get recognition for achieving successful Six Sigma implementation. However, as long as the culmination of a business activity is defined by both methodologies as retaining and improving the customer base along with maximizing the bottom line, rejection of one in favor of other will be hard to justify.

ISO 14001 Standards Audit

ISO 14001 sets out a system that can be audited and certified. In many cases, it is the issue of certification that is critical or controversial and is at the heart of the discussion about the trade implications.Certification means that a qualified body (an accredited certifier) has inspected the EMS system that has been put in place and has made a formal declaration that the system is consistent with the requirements of ISO 14001.The standard allows for self-certification, a declaration by an enterprise that it conforms to ISO 14001. There is considerable skepticism as to whether this approach would be widely accepted, especially when certification has legal or commercial consequences. At the same time, obtaining certification can entail significant costs, and there are issues relating to the international acceptanceof national certification that may make it particularly difficult for companies in some countries to achieve credible certification at a reasonable cost. For firms concerned about having certification that carries real credibility, the costs of bringing in international auditors are typically quite high, partly because the number of internationally recognized firms of certifiers is limited at present.2The issue of accreditation of certifiers is becoming increasingly important as the demand increases.Countries that have adopted ISO 14001 as a national standard can accredit qualified companies as certifiers, and this will satisfy national legal or contractual requirements. However, the fundamental purpose of ISO is to achieve consistency internationally. If certificates from certain countries or agencies are not fully accepted or are regarded as second class, the goal will not have been achieved. It is probable that the international marketplace will eventually put areal commercial value on high-quality certificates, but this level of sophistication and discrimination has not yet been achieved. It is essential to the ultimate success of the whole system that there be a mechanism to ensure that certification in any one country has credibility and acceptability elsewhere.The ISO has outlined procedures for accreditation and certification (Guides 61 and 62), and a formal body, QSAR, has been established to operationalize the process. At the same time, a number of established national accreditation bodiesheavily involved in ISO have set up the informal International Accreditation Forum (IAF) to examine mechanisms for achieving international reciprocity through multilateral agreements (MLAs). However, these systems are in the earlystages, and many enterprises continue to use the established international certifiers, even at additional cost, because of lack of confidence in the acceptability of local certifiers.Given the variability in the design of individual EMS and the substantial costs of the ISO 14000 certification process, there is a growing tendency for large companies that are implementing EMS approaches to pause before taking thislast step. After implementing an EMS and confirming that the enterprise is broadly in conformance with ISO 14001, it is becoming routine to carry out a gap analysis to determine exactly what further actions would be required to achievecertification and to examine the benefits and costs of bringing in third-party certifiers.
ISO 14001 Standards Certification

ISO 14001 Standards sets out a system that can be audited and certified. In many cases, it is the issue of certification that is critical or controversial and is at the heart of the discussion about the trade implications.

Certification means that a qualified body (an accredited certifier) has inspected the EMS system that has been put in place and has made a formal declaration that the system is consistent with the requirements of ISO 14001 Standards.

The standard allows for self-certification, a declaration by an enterprise that it conforms to ISO 14001 Standards. There is considerable skepticism as to whether this approach would be widely accepted, especially when certification has legal or commercial consequences. At the same time, obtaining certification can entail significant costs, and there are issues relating to the international acceptance of national certification that may make it particularly difficult for companies in some countries to achieve credible certification at a reasonable cost. For firms concerned about having certification that carries real credibility, the costs of bringing in international auditors are typically quite high, partly because the number of internationally recognized firms of certifiers is limited at present.

The issue of accreditation of certifiers is becoming increasingly important as the demand increases.

Extreme Programming For ICT In ISO 9001 Standards

Extreme Programming represents a new wave in software development known as the approach. Tom de Marco, the father of structural analysis, calls Extreme Programming the most important movement in software engineering. The strong points of Extreme Programming in the ICT context are as follows:

– Risk minimization. ICT is developing very fast. To catch up with current developments it is necessary to make investments in new technologies and try new tools out. On the other hand, new tools and technologies are immature and one cannot depend on them. The best approach is to make some (preferably small) investment now and after some time invest more or give up, depending on the developments (it is like buying an option on the stock exchange). Extreme Programming is based on incremental software development and its suites the strategy very well.

– Customer orientation. In Extreme Programming all the business decisions are made by the customer and he has the full control over the development process.

– Lack of excessive paperwork. In Extreme Programming programmers concentrate on programming, not on writing documentation. The only artifacts they have to produce are test cases and code.

– Quality assurance through intensive testing. In XP programmers first create test cases then they write code. Automated tests and integration are performed several times a day and they drive the development process.

– Lack of overtime. Short releases and increments allow to gain experience very fast. This makes planning easier and more dependable. As a result programmer do not have to (always) work overtime.

Extreme Programming has also weak points. The most important are problems with software maintenance.

Since the only artifacts are test cases and code, after some time it can be very difficult to maintain the software. It would be also the problem from the ISO 9001 point of view. In the remaining part of the paper we propose how to solve that problem

.Kindly go to http://www.e-wia.com for more information

ISO 9000 Softwares

1. ISO 9000 Software – ISO 9000 Document Control Software

The concept of document control is integral to ISO 9000. Specifically ISO 9001: 2000, requires the establishment of a document control system that stores and manages documents relating to implementing, maintaining, and continually improving a quality management system. Within the context of ISO 9000, a quality system must be documented and quality records must be maintained. Document control helps ensure effective operation and facilitates better decision-making, by providing a vehicle for employees, customers, and partners to access controlled documentation from any location at anytime.

For high-tech companies that adhere to ISO 14000 environmental management standards, document control procedures are equally necessary to help them continuously improve their environmental management system.

The ISO 9000 Document Control Software is developed & designed to control the ISO 9000 Quality Manual, Operating Procedure, Forms & Documents digitally. System will track the all ISO 9000 Documents by ISO Document No. through out the system.

The ISO 9000 Document Control Software Provides:-

Tracking of Documents- Provides secure tracking of all your ISO 9000 Quality Manual, Operating Procedure & Forms & Documents in any format either in Microsoft Word, Excel, PDF or etc.
Efficiency Document Control- It’s uniquely qualified to be the focal point of a quality management system because it can handle all types of documents regardless of the software used to create them. It provides a secure and centralized document control repository that makes search and retrieval easy during inspections and audits.
Revision Control- Tracking of Document revisions, approval & Release Date. Manually Tracking down any revision on the ISO 9000 document activity is difficult . The ISO 9000 Document Control Software will help to keep track the numbers of revision have been carried out, and also maintain the various revision copies of the documents.
Multiple File Location – System will be able to keep track the directories & folder where the original location is saved.
Centralize Of Document Control – Do not worry about the various department is getting the correct edition of the documents, because all documents have been managed by a centralize software. Document reviews are conveniently scheduled and documented.
Security:System provide User Right Control module which enable System Administrator to define the access right to authorized users and activity allowed.
2. ISO 9000 Software – ISO 9000 Audit Control Software

The ISO 9000 Audit Control Softwarewere designed to handle all aspects of an internal or external audit programme, from planning audits to the follow-up of corrective actions against deficiencies found.

The Control Software increases the accountability and efficiency of your internal/external audits by developing core processes with clearly defined audit plans, step-by-step procedures, and standardized auditor roles and responsibilities. It will help to put you to the right path toward developing a well-organized ISO9001:2000 internal /external audit system.

The ISO 9000 Audit Control Software Provides:-

Audit Schedule – maintains the audit schedule, checklist preparation and all audit info.
Track Non-Conformance – System will help to track all non-conformances found during the audit, including actions & verification.
Corrective Action Report (CAR) – Update of the corrective action.
Security: System provide User Right Control module which enable System Administrator to define the access right to authorized users and activity allowed.

Read more on ISO 9001 Standards at http://www.iso9001store.com

Training In ISO 9001 Standards

Implementing ISO 9001 in any organization first requires the development of the necessary knowledge, skills and understanding to enable the practical application of the standard. At this stage organizations often seek the help of a consultant but this is often unnecessary since the required understanding can easily be sought for free.

The training section provided by ISO 9001 Checklist is intended to give any business a knowledgeable foundation that ensures their quality management system is highly robust. It could save you £0000′s in consultancy fees.

The Concept behind ISO 9001 Training

ISO 9001 training is a unique internet browser based tutorial solution that provides expert practical guidance for businesses wishing to interpret ISO 9000 fundamentals to help better understand and implement the requirements of ISO 9001:2008. It could help your business to get the most out of your quality management system, and it’s free to use!

The ISO 9001 training section represents a body of knowledge which explains the requirements of the standard in plain English coupled with practical guidance and interpretation. The online ISO 9001 training section divides the standard into four sections that follow the Plan, Do, Check and Act cycle. The page menu then subdivides each section into Principles, Base Clauses and Requirements for easy comparison. Each stage of the cycle then relates each clause of ISO 9001:2008 to the key concepts that lie at the heart of quality management.

How does it Work?

Simple, it encourages the use of the PDCA cycle as a means to implement your quality management system by prompting the user to:

PLAN your quality system’s high level processes, define your quality policy and establish your quality objectives in accordance with the expected output. Consider; how will the quality management system be documented, what resources will be needed, who will have responsibility for what and how will the effectiveness of the system be evaluated and communicated.

DO carry out day-to-day activities by performing the necessary processes in accordance with any planned arrangements. Gather performance information by undertaking audits and other measurements as planned.

CHECK the results and analyse the information gathered through various measurements and monitoring activities to determine whether the quality management system has achieved what it set out to do.

ACT by using the results from internal audits, preventive actions and management reviews to ensure the continual improvement of your quality management system; continual improvement should be the organization’s permanent objective.What Happens after Implementation?

You need to choose a registrar. The registrar is a third party certification auditor who will assess your quality management system and issue a certificate if it meets the requirements of ISO 9001:2008. In choosing a registrar you should consider their industry experience, geographic coverage, price and service level offered. The key is to find a registrar who can meet your requirements. For further information regarding national accredited certification bodies, please visit UKAS.

Pre-assessment by your registrar normally takes place about 6 weeks before registration. The purpose of the pre-assessment audit is to identify areas where you may not be operating in accordance with the standard. This allows you to correct any deficiencies before registration.

Prior to registration, you should arrange an initial assessment with your registrar. At this point the registrar will review your quality management system (by interviewing staff, observing activities and checking records) to decide whether you should be recommended for registration.

The ISO 9001 Standards Training DVD can be obtained at http://www.iso9001store.com

ISO 14000 & Environment

International ISO standards facilitate trade, spread knowledge, and share technological advances and good management practices.

Published under the designation of International Standards, ISO standards represent an international consensus on the state of the art in the technology or good practice concerned.

ISO has a multi-faceted approach to meeting the needs of all stakeholders from business, industry, governmental authorities and nongovernmental organizations, as well as consumers, in the field of the environment. ISO has developed:

1. Standards that help organizations to take a proactive approach to managing environmental issues: the ISO 14000 family of environmental management standards which can be implemented in any type of organization in either public or private sectors – from companies to administrations to public utilities.

2. ISO is helping to meet the challenges of climate change with standards for greenhouse gas accounting, verification and emissions trading, and for measuring the carbon footprint of products.

3. ISO develops normative documents to facilitate the fusion of business and environmental goals by encouraging the inclusion of environmental aspects in product design.

4. ISO offers a wide-ranging portfolio of standards for sampling and test methods to deal with specific environmental challenges. It has developed some 570 International Standards for the monitoring of such aspects as the quality of air, water and the soil, as well as noise, radiation, and for controlling the transport of dangerous goods. They also serve in a number of countries as the technical basis for environmental regulations.

Organizations around the world, as well as their stakeholders, are becoming increasingly aware of the need for environmental management, socially responsible behavior, and sustainable growth and development.

Accordingly, as the proactive management of environmental aspects converges with enterprise risk management, corporate governance, and sound operational and financial practices and performance, International Standards are becoming increasingly important for organizations to work towards common and comparable environmental management practices to support the sustainability of their organizations, products, and services.

Furthermore, governments and regulatory bodies are increasingly looking to ISO standards to provide a framework to ensure alignment and consistency both nationally and internationally.

ISO International Standards and related normative documents provide consumers, regulators and organizations in both public and private sectors with environmental tools with the following characteristics:

- Technically credible as ISO standards represent the sum of knowledge of a broad pool of international expertise and stakeholders

- Fulfill stakeholder needs as the ISO standards development process is based on international input and consensus

- Facilitate the development of uniform requirements as the ISO standards development process is built on participation by its national member institutes from all regions of the world

- Promote efficiencies when the same standards are implemented across markets, sectors, and/or jurisdictions

- Support regulatory compliance when the standards are used to meet market and regulatory needs

- Enhance investor confidence because the standards can be used for conformity assessment such as by audit, inspection or certification. This enhances confidence in products, services and systems that can be demonstrated to conform to ISO standards and provides practical support for regulation.

ISO standards developed for Environmental Management covers the following areas:

• Environmental management systems

• Environmental auditing and related environmental investigations

• Environmental performance evaluation

• Environmental labelling

• Life cycle assessment

• Environmental communication

• Environmental aspects of product design and development

• Environmental aspects in product standards

• Terms and definitions

• Greenhouse gas management and related activities

• Measuring the carbon footprint of products.

The ISO 14000 family of standards reflects international consensus on good environmental and business practice that can be applied by organizations all over the world in their specific context. The ISO family of standards includes:

- ISO 14001 is the world’s most recognized framework for environmental management systems (EMS) -that helps organizations to manage better the impact of their activities on the environment and to demonstrate sound environmental management. ISO 14001 has been adopted as a national standard by more than half of the 160 national members of ISO and its use is encouraged by governments around the world.

- ISO 14004, which complements ISO 14001 by providing additional guidance and useful explanations.

- Environmental audits are important tools for assessing whether an EMS is properly implemented and maintained. The auditing standard, ISO 19011, is equally useful for EMS and quality management system audits. It provides guidance on principles of auditing, managing audit programmes, the conduct of audits and on the competence of auditors.

- ISO 14031 provides guidance on how an organization can evaluate its environmental performance. The standard also addresses the selection of suitable performance indicators, so that performance can be assessed against criteria set by management. This information can be used as a basis for internal and external reporting on environmental performance.

- The ISO 14020 series of standards addresses a range of different approaches to environmental labels and declarations, including eco-labels (seals of approval), self-declared environmental claims, and quantified environmental information about products and services.

- ISO 14001 addresses not only the environmental aspects of an organization’s processes, but also those of its products and services. Therefore ISO has developed additional tools to assist in addressing such aspects. Life-cycle assessment (LCA) is a tool for identifying and evaluating the environmental aspects of products and services from the “cradle to the grave”: from the extraction of resource inputs to the eventual disposal of the product or its waste. The ISO 14040 standards give guidelines on the principles and conduct of LCA studies that provide an organization with information on how to reduce the overall environmental impact of its products and services.

- ISO 14064 part 1, 2 and 3 are international greenhouse gas (GHG) accounting and verification standards which provide a set of clear and verifiable requirements to support organizations and proponents of GHG emission reduction projects.

- ISO 14065 complements ISO 14064 by specifying requirements to accredit or recognize organizational bodies that undertake GHG validation or verification using ISO 14064 or other relevant standards or specifications.

- ISO 14063 addresses environmental communication guidelines and examples, helps companies to make the important link to external stakeholders.

International ISO standards facilitate trade, spread knowledge, and share technological advances and good management practices.Published under the designation of International Standards, ISO standards represent an international consensus on the state of the art in the technology or good practice concerned.ISO has a multi-faceted approach to meeting the needs of all stakeholders from business, industry, governmental authorities and nongovernmental organizations, as well as consumers, in the field of the environment. ISO has developed:1. Standards that help organizations to take a proactive approach to managing environmental issues: the ISO 14000 family of environmental management standards which can be implemented in any type of organization in either public or private sectors – from companies to administrations to public utilities.2. ISO is helping to meet the challenges of climate change with standards for greenhouse gas accounting, verification and emissions trading, and for measuring the carbon footprint of products.3. ISO develops normative documents to facilitate the fusion of business and environmental goals by encouraging the inclusion of environmental aspects in product design.4. ISO offers a wide-ranging portfolio of standards for sampling and test methods to deal with specific environmental challenges. It has developed some 570 International Standards for the monitoring of such aspects as the quality of air, water and the soil, as well as noise, radiation, and for controlling the transport of dangerous goods. They also serve in a number of countries as the technical basis for environmental regulations.Organizations around the world, as well as their stakeholders, are becoming increasingly aware of the need for environmental management, socially responsible behavior, and sustainable growth and development.Accordingly, as the proactive management of environmental aspects converges with enterprise risk management, corporate governance, and sound operational and financial practices and performance, International Standards are becoming increasingly important for organizations to work towards common and comparable environmental management practices to support the sustainability of their organizations, products, and services.Furthermore, governments and regulatory bodies are increasingly looking to ISO standards to provide a framework to ensure alignment and consistency both nationally and internationally.ISO International Standards and related normative documents provide consumers, regulators and organizations in both public and private sectors with environmental tools with the following characteristics:- Technically credible as ISO standards represent the sum of knowledge of a broad pool of international expertise and stakeholders- Fulfill stakeholder needs as the ISO standards development process is based on international input and consensus- Facilitate the development of uniform requirements as the ISO standards development process is built on participation by its national member institutes from all regions of the world- Promote efficiencies when the same standards are implemented across markets, sectors, and/or jurisdictions- Support regulatory compliance when the standards are used to meet market and regulatory needs- Enhance investor confidence because the standards can be used for conformity assessment such as by audit, inspection or certification. This enhances confidence in products, services and systems that can be demonstrated to conform to ISO standards and provides practical support for regulation.ISO standards developed for Environmental Management covers the following areas:• Environmental management systems• Environmental auditing and related environmental investigations• Environmental performance evaluation• Environmental labelling• Life cycle assessment• Environmental communication• Environmental aspects of product design and development• Environmental aspects in product standards• Terms and definitions• Greenhouse gas management and related activities• Measuring the carbon footprint of products.The ISO 14000 family of standards reflects international consensus on good environmental and business practice that can be applied by organizations all over the world in their specific context. The ISO family of standards includes:- ISO 14001 is the world’s most recognized framework for environmental management systems (EMS) -that helps organizations to manage better the impact of their activities on the environment and to demonstrate sound environmental management. ISO 14001 has been adopted as a national standard by more than half of the 160 national members of ISO and its use is encouraged by governments around the world.- ISO 14004, which complements ISO 14001 by providing additional guidance and useful explanations.- Environmental audits are important tools for assessing whether an EMS is properly implemented and maintained. The auditing standard, ISO 19011, is equally useful for EMS and quality management system audits. It provides guidance on principles of auditing, managing audit programmes, the conduct of audits and on the competence of auditors.- ISO 14031 provides guidance on how an organization can evaluate its environmental performance. The standard also addresses the selection of suitable performance indicators, so that performance can be assessed against criteria set by management. This information can be used as a basis for internal and external reporting on environmental performance.- The ISO 14020 series of standards addresses a range of different approaches to environmental labels and declarations, including eco-labels (seals of approval), self-declared environmental claims, and quantified environmental information about products and services.- ISO 14001 addresses not only the environmental aspects of an organization’s processes, but also those of its products and services. Therefore ISO has developed additional tools to assist in addressing such aspects. Life-cycle assessment (LCA) is a tool for identifying and evaluating the environmental aspects of products and services from the “cradle to the grave”: from the extraction of resource inputs to the eventual disposal of the product or its waste. The ISO 14040 standards give guidelines on the principles and conduct of LCA studies that provide an organization with information on how to reduce the overall environmental impact of its products and services.- ISO 14064 part 1, 2 and 3 are international greenhouse gas (GHG) accounting and verification standards which provide a set of clear and verifiable requirements to support organizations and proponents of GHG emission reduction projects.- ISO 14065 complements ISO 14064 by specifying requirements to accredit or recognize organizational bodies that undertake GHG validation or verification using ISO 14064 or other relevant standards or specifications.- ISO 14063 addresses environmental communication guidelines and examples, helps companies to make the important link to external stakeholders.

Visit http://www.iso9001store.com for more information.

ISO 9001 And Configuration Management

Configuration management is about managing change of the multiple items composing an information system. This article puts in reference the configuration management function andthe ISO 9001 standard. This standard offers a wide range of advice on how todeal with this important, but often neglected, aspect of software engineering.

The software engineering practices associated with software configuration management (SCM or CM) offer a number of opportunities to addressrequirements found in the International Standard, ISO 9001. From a managementperspective, the principles and practices of CM represent an accepted andunderstood foundation for implementing ISO-compliant processes in softwareengineering organizations. In addition, the growing number of tools forautomating CM practices is chance for improving the efficiency and effectiveness of these processes.

This article begins with brief, general definitions of configuration management and of ISO 9001.

While there is no single definition of CM, there are three widely disseminated views from three different sources: the Institute ofElectrical and Electronics Engineers (IEEE), The International Organisation forStandardisation (ISO), and the Software Engineering Institute (SEI) at Carnegie Mellon University.

A most widely understood description of the practices associated with configuration management is found in the IEEE Standard 828-1990,Software Configuration Management Plans.

[Numbers in brackets are added]

“SCM activities are traditionally grouped into four functions: [1] configuration identification, [2] configuration control, [3]status accounting, and [4] configuration audits and reviews.”

IEEE Standard 828-1990 goes on to list specific activities associated with each of the four functions (the number of the paragraphcontaining the reference appears in parentheses):

• Identification: identify, name, and describe the documented physical and functional characteristics of the code, specifications, design, and data elements to be controlled for the project. (Paragraph 2.3.1)
• Control: request, evaluate, approve or disapprove, and implement changes (Paragraph 2.3.2)
• Status accounting: record and report the status of project configuration items [initial approved version. status of requested changes, implementation status of approved changes] (Paragraph 2.3.3)
• Audits and reviews: determine to what extent the actual configuration item reflects the required physical and functional characteristics (Paragraph 2.3.4)

This list is similar to the set of activities noted by Pressman:

“Software configuration management is an umbrella activity … developed to (1) identify change, (2) control change, (3) ensure that change is being properly implemented, and (4) report change to others who may have an interest.”

In the guideline document, ISO 9000-3:1991 Guidelines for the application of ISO 9001 to the development, supply and maintenance of software, the International Organisation for Standardisation identifies a similar set of practices as CM:

“Configuration management provides a mechanism for identifying, controlling and tracking the versions of each software item. In many cases earlier versions still in use must also be maintained and controlled.

“The [CM] system should

“a) identify uniquely the versions of each software item;

“b) identify the versions of each software item which together constitute a specific version of a complete product;

“c) identity the build status of software products in development or delivered and installed;

“d) control simultaneous updating of a given software item by more than one person;

“e) provide coordination for the updating of multiple products in one or more locations as required;

“f) identify and track all actions and changes resulting from a change request, from initiation … to release.”

Based on a review of currently available tools and an evolving understanding of the organizational role of CM, the SEI advocates a broader definition of CM in SEI-92-TR-8:

“The standard definition for CM taken from IEEE standard 729-1983 [updated as IEEE Std 610.12-1990] includes:

“Identification: identifying the structure of the product, its components and their type, and making them unique and accessible in some form

“Control: controlling the release of product and changes to it throughout the life cycle …

“Status Accounting: recording and reporting the status of components and change requests, and gathering vital statistics about components in the product

“Audit and review: validating the completeness of a product and maintaining consistency among the components …

“[The IEEE] definition of CM … needs to be broadened to encompass … :

“Manufacturing: managing the construction and building of the product

“Process management: ensuring the correct execution of the organization’s procedures, policies, and life-cycle model

“Team work: controlling the work and interactions between multiple developers on a product.”

In 1987, the International Organisation for Standardisation in Geneva Switzerland published ISO 9001, Quality Systems – Model for quality assurance in design / development, production, installation, and servicing.

ISO 9001 is the most comprehensive model in the ISO 9000 series of standards. It describes a minimum set of activities found in companies and organizations that consistently produce products that satisfy customer requirements. The policies, procedures, standards, records, and associated business activities are the quality system. While ISO 9001 is written to describe any company providing any product or service, it tends to employ manufacturing terminology, which must be interpreted for non-manufacturing environments, including service and software providers.

To ensure a uniform interpretation of ISO 9001 for software engineering organizations, ISO published ISO 9000-3, Guidelines for the Application of ISO 9001 to the development, supply and maintenance of software.

The key issues ISO 9000-3 addresses are those:

• Product exists earlier in software (during design and development)
• Software product can be proliferated easily

Focusing on these issues mirrors the guidance in Clause 7.4 of ISO 9000-1:1994:

The process of development, supply, and maintenance of software is different from that of most other types of industrial products in that there is no distinct manufacturing phase. Software does not “wear out” and, consequently, quality activities during the design phase are of paramount importance to the final quality of the product.

Note that ISO 9000-1 and ISO 9000-3 provides guidance. ISO 9001 is the only source of the requirements against which compliance in software engineering practices is assessed.

ISO 9001 and Configuration Management

Tracing the relationship between ISO 9001′s requirements and CM practices begins with an examination of the guidance in ISO 9000-3.

ISO 9000-3 and configuration management

ISO 9000-3 contains two appendices, Annex A and Annex B, that provide cross-references between ISO 9001 and ISO 9000-3. According to Annex A, five sections of ISO 9001 correlate to ISO 9000-3, Paragraph 6.1, Configuration Management:

• 4.4 Design control
• 4.5 Document data control
• 4.8 Product identification and traceability
• 4.12 Inspection and test status
• 4.13 Control of nonconforming product

Each of these sections of ISO 9001 contains a portion of the traditional CM process.

4.4 Design control addresses all of the steps in the software development life cycle: planning, specification, design, coding, testing

Section 4.4 requires that design inputs and outputs be documented, reviewed, verified, controlled, approved, and modified according todocumented procedures. Design inputs and outputs include plans(project life cycle definition), specifications, prototypes, requirementsdocuments, progress reports, review results, test plans, test cases/scripts, development tools, code, and test reports.

ISO 9001 4.4.9 Design changes, in conjunction with ISO 9001 4.14.2 Corrective action, and 4.13 Control ofnonconforming product, requires that each change be traceable to an appropriate source and approval.

For software product there should be a clear path between a change request spawned by a fault report or enhancement request and a change ina specific product component to correct the fault or to implement the enhancement.

An interested party should be able to pick up the path at any point and follow it forward to the released change and backward to the changerequest or to the fault report.

4.5 Document and data control addresses the identification, protection, approval, and availability of current issues of allpertinent product- and project-related documents, including designs, specifications, plans, and schedules.

Because a fundamental function of CM is making current configuration items available, the CM practices and tools can be applied to thecontrol of product- and process-related documentation and data.

4.8 Product identification and traceability requires that each version of a configuration item be identified by some appropriate means.

4.12 Inspection and Test Status requires procedures to identify what verification steps and tests have been completed and what resultshave been achieved by the product or product components at each phase in the defined development life cycle.

4.13 Control of Nonconforming Product requires procedures to ensure that untested, defective, or incorrect versions (e.g., down level) ofthe product are not inadvertently used. This paragraph of ISO 9001also requires a procedure to determine the disposition of nonconforming product at all stages.

For software, the bulk of the activity related to non-conforming product is in the correction of faults identified during allphases of development (e.g., during requirements definition, prototyping,integration testing, and beta testing) and after the product has been released (e.g., customer reported faults).