The Small Business Owner’s Simplified Guide To ISO 9001

Transcription

White PaperThe Small Business Owner’sSimplified Guide to ISO 9001and Business ImprovementBy Mike Pearson, Consultant

The Small Business Owner’s Simplified Guide to ISO 9001 and Business Improvementbsigroup.comIntroductionWith ever increasing demands on small and micro businesses on quality, price and service,the most effective way to enhance the confidence of customers is through a structuredcertificated Quality Management System (QMS). For a small business, this is not as daunting asit might appear, as it should always be based on how your business systems currently operate.The updated version of ISO 9001 is due for issue in September this year. It has been revisedby an international community of quality management experts, which included strong UKleadership and representation. Consideration was given to the small and micro business sector,recognizing its employment and financial importance. This is reflected in the updated standardand this white paper is aimed at you as an entrepreneurial small or micro business owner,to guide and encourage you to take up the standard in your business in order to gain theconsiderable potential for operational business improvement opportunities that it can provide.This paper sets out to inform and advise you as a small or micro business owner of therequirements and benefits of adopting the Quality Management Standard, ISO 9001:2015.Challenging prevailing assumptionsThe generally held consensus is that small businesses consider theimplementation of the standard to be a daunting and expensiveprospect, with high on-going costs. There is an assumption that itwill require a whole new set of systems and procedures, and that thesystem requires complex, documented, detailed procedures, formsand records. It is often seen by small businesses as regulatory-driventhrough the document structure and terminology. This reaction isborne out of the burden of regulation on small and micro businesses.In reality, these assumptions are unfounded.Another major concern is that the wording of the standard appears torequire a dedicated person to be responsible for the QMS. This is notpossible with a small multi-function workforce, where each employeehas to be responsible for a number of functions in order to effectivelyoperate the business. Overall it is regarded as a standard aimed atlarge companies or organizations. Nothing could be further from thetruth. The standard is written for and is applicable to any business ofany size.These perceptions regrettably result in the standard only being seenas a business requirement when necessary to meet a contractualdemand, and where no such requirement is needed it is dismissedas ‘not for us’. This document goes into more detail to debunkthese assumptions.This paper sets out to demonstrate to small and micro businessowners that the standard is inclusive of all sizes of business andprovides the opportunity for significant business improvements.This is possible – adoption is not complex and is based on yourcurrent operating systems.Depending on your current systems, implementing a QMS can be: Low cost Low maintenance, with little documentation neededThe standard is written forany business of any size2

The Small Business Owner’s Simplified Guide to ISO 9001 and Business Improvementbsigroup.comWhy ISO 9001?The standard is the foundation for: real opportunity for increasing business, and thereby profitability, Aby being able to pursue contracts with those customers for whomcertification is a contractual requirement. The possible increasein turnover compensates for any on-going cost of maintainingcertification roviding you with the opportunity to gain a clearer understanding Pof your business through the information and data that the systemgives you. Understandably, you feel that you already intimatelyknow your business, however, many businesses of your size thathave adopted the standard and used it as intended have benefittedas a result. The information provides the means for improving thebusiness, customer focus, enhanced risk management, increasingefficiency, productivity, cost savings, and reducing and overcomingproduct or service problems eveloping a system which provides the building blocks a small Dor micro business needs to progress in that it enhances therecognition of your team members through involving them inconsiderations, development and implementation. This in turnsignificantly improves communication and understanding togetherwith a faster response in resolving any issues that ariseAll of this is achieved through your confidence that the systemprovides reliable, recorded information and data to base potentialimprovements on. Although known as a Quality ManagementStandard, it is far better for you to see it as a businessdevelopment opportunity.Although known as a QMS standard, it isbetter seen as a business development opportunityWhat are the external benefits to a small and micro businessof ISO 9001? I SO 9001 is the recognized quality management system standardworldwide. It confirms that you have put in the effort to enhanceyour systems to meet the standard, in order to continue supplyinga product or service that consistently meets your customers’requirements T hrough the process of continuing to review and improvesystems, the standard can positively help your business toensure a high level of customer satisfaction and increase theeffectiveness of your operations. This will in turn provideopportunities for orders, increased profitability and stabilityin the business SI’s customer research (BSI voice of the customer survey 2012 Bto 2015) has shown that 50.6% of businesses attract newcustomers, as a result of implementing and gaining certification.Further, 62.2% report improvements in products or services,60.8% report an increase in trust in their businessThe benefits of conformance can include improving levels of customer satisfaction3

The Small Business Owner’s Simplified Guide to ISO 9001 and Business Improvementbsigroup.comWhat are the internal benefits of ISO 9001 to a smalland micro business? Your staff will have a common, logical system with consistentand repeatable processes for consistently getting things right You and your staff, having all been involved in the initialdevelopment and review, will appreciate the benefits of theQMS being the clearly defined and agreed processes, which willeffectively support everybody day-to-day and in any situationthat could arise Through the enhanced system you will all have a clearerunderstanding of what each person needs to do and how,which means you do not have to waste time memory testing,and searching for information Certification enables you to tender potential new customers andincrease business. This is possible as the certificate gives themconfidence in your business The team are able to speedily respond if things go wrong andagree a course of corrective action to prevent risk of a moreserious outcome As problems are recorded as a result of the system, the team hasthe ability to collectively consider actions to correct and preventrecurrence. Should another problem arise there is a processes inplace that the team can use to identify and resolve the problemmore speedily Through the improvement in business control and reporting youwill have a clearer view of how the business is doing and anyaspects that should be looked at in more detail To quote BSI’s research again, 61.8% of businesses have seena reduction in the likelihood of mistakesAll the above contributes ultimately to an improved customerexperience.What are the main changes in the 2015 revision of ISO 9001 thatbenefit small and micro businesses? A number of the changes are intended to be more inclusive andunderstanding of the small and micro business sector. This is as aresult of the recognition by those involved in the re-drafting of theimportance of your business sector. An implementation guidancedocument, ISO 9002, is currently being written and will includeexamples of how requirements apply to smaller businesses,recognizing that terms such as ‘organization’ and ‘top management’are intended to be fully inclusive A relaxation in the requirement for detailed documentedprocedures. This is a major element of the revision throughthe recognition that systems, processes and records you needto formalize only the need to be in the simplest format necessaryfor the size and complexity of your business The requirement for you to be actively involved in the QMS hasbeen significantly revised. As the owner you already have to beinvolved in all aspects of your business as a matter of course,so this clause is readily met by default. You only need to referencethis in the processes through the undertaking of audits and reviewsPlanning the operational aspects of the QMSand recognize that as the top decision maker you are accountablefor the effectiveness of the QMS and building quality into youroverall business strategy The elements of risk (threats and challenges to the business) andopportunity, with regard to quality management, which werepreviously implicit are now more explicit and need to be integralto the QMS. It likely to be something you cover already, evensubconsciously within your business operation in determiningthe risks and identifying improvement opportunities. By adoptingrisk-based thinking in a more structured way, you will makepreventative action part of your routine approachHow is the standard structured and interpreted for smallor micro businesses?There are ten main clauses that you need to cover to achieveconformance or certification. All of the clauses have relatedsubclauses. On reading the standard it might appear lengthy andcomplex to interpret. However it is most important for you to realisethat it is only necessary to understand the underlying principle andobjective of each clause. This then allows you to plan and develop asimple and straightforward QMS that has to be built around the way4

The Small Business Owner’s Simplified Guide to ISO 9001 and Business Improvementyou currently operate, but is formalized with processes developedwhere any gaps are identified, to meet the standard. All of this isreadily achievable by using the simplest route necessary accordingto the size and complexity of your business.The following outlines each clause and provides a small or microbusiness-specific interpretation: It is recommended that you read through the standard carefullyand concentrate on understanding the underlying intention of eachclause. Don’t get distracted by the wording and terminology, as it isthe general purpose that is important1ScopeThis defines the purpose and aims of the standard The overall purpose of this standard is to have a formalized systemthat provides confidence to your customers that you are committedto providing a consistent quality of service. This is achieved throughreviewing your current operational systems to ensure they cover allyour process stages and check or test points to confirm their abilityto consistently provide a product or service that fully meetscustomer requirements When your formalized system is in place it should be regularlyreviewed with the aim of identifying any opportunity for improvementin your operations, thereby enhancing customer satisfaction Action:- You only need to have a simply worded policy statement of yourbusiness’s approach to quality and customers, plus a reference tomeeting any statutory or regulatory requirements as applicable- In order to demonstrate compliance with the above scope youshould develop a simple, straightforward, structured set ofrecords. These records should then be used as part of yourinternal audits and these will be of value in external audits2Normative Referencesbsigroup.com4Context of the Organization This clause requires you to determine any external and internalissues that have an effect on the operations of your business.This can include positive and negative factors or conditionsfor consideration You should consider the following:- Factors arising from legal, technological, competitive, market,cultural, social and economic environments, whether local or wider- The needs and expectations of interested parties. These couldbe customers, but also statutory and regulatory bodies- The processes needed to operate the QMS Action:- Understand the potential effect these might have, including anyrisks. Risk in the context of the standard means any threats orchallenges to the business, as opposed to Health and Safetyissues. Then make sure that in developing your QMS you takethese into account in your systems. It should also includemaintaining a routine awareness of any potential risk whichmight impact on the business- Experience shows that this is generally readily achieved, as closecontact with customers and suppliers, led primarily by you, is theaccepted process in a small or micro business, in order to meetrequirements and remain competitive. All that will be required isfor you to formalize the procedures used for this, including statingboth your own and delegated responsibilities, as applicable- As you develop your QMS you should also consider what is notapplicable, ensuring that these factors don’t impact on your abilityto deliver your product or service, or customer satisfaction5Leadership This refers to you as the owner. With your leadership commitmentto the QMS, leadership merely needs to be clearly seen in thedevelopment, audits and reviews of your systems ISO 9000:2015, Quality Management System —Fundamentals and vocabulary A major element of your close involvement will be to ensure theeffectiveness of the QMS in meeting your business objectives Action: Action:- ISO 9000:2015 is a mandatory reference document. It containsall of the technical definitions of terms used in ISO 9001 and youneed to make sure that words used are only interpreted in the wayISO 9000 directs you to3- With a small workforce, you will already involve your staff and nodoubt will lead and involve them in developing your QMS policyand systems, thus ensuring each accepts and understands whyand what needs to be done to consistently operate and maintain itTerms and definitions This clause as above references ISO 9001:2015 Action:- No terms or definitions are included in ISO 9001:2015. To fullyunderstand the technical meaning of terms, it is important thatyou refer to ISO 9000:2015. These definitions can also be foundon the ISO website (see below for link)5

The Small Business Owner’s Simplified Guide to ISO 9001 and Business Improvement6bsigroup.comPlanning The intention of this clause is to develop a number of requirementstaken from its subclauses. These include:- When you are planning the QMS any risks or opportunitiesidentified in the business should be considered and a processfor monitoring developed, aimed at enhancing desirable effects,preventing undesirable effects, and achieving improvement- Always check at each phase of systems development thatyour QMS is following your intended course- Include in your planning how you avoid or limit any adverseissues that can have the potential to be damaging to theoperation of the business- Through your audits and reviews, you should also ensure thatconsideration is given to the means of achieving improvement,together with the process needed to implement and monitorany resultant changes Action:- Here again the most logical approach for a small or micro businessis working as a team led by you, to confirm how things currentlyoperate and noting this, to consider any gaps or inter-functionalissues identified, and to then agree on a formal operationalsystem. It would be useful to consider the adoption of simpleflowcharts (see Figures 1 and 2) as these will visually show theprogression stages of processes and highlight any gaps orhiccups in the systems7Support Put simply, this means making sure you have considered whatis needed to effectively operate the business and make plans toensure that you have the right number in the team with necessaryskills and experience, together with determining any necessaryresources to undertake and complete the work to specification.These overall operational demands should be monitored toensure that the effectiveness is being maintained Action:Ensure that:- Your business, with its small team, can readily plan for whatis needed in this respect, and you are able to determine whereresponsibilities lie- Equipment needed and the environment in which the work needsto be carried out also forms part of your team planning process- You and the team as part of that planning, take account of allnecessary skills and competence needed to undertake thecontracts, with you taking action accordingly to ensure contractsare met and customer satisfaction maintained- It will be necessary in formalizing your process to maintainsimple documented information. This will provide many benefitsespecially for internal auditing and reviews and most certainly withexternal auditors. The documents can be either a mix of paper orcomputer records of the main points and stages, together with asummary record on decisions reachedChecking and recording defects in production8Operation This clause is very similar to Clause 7 but is relative to how youin your business should plan for the operational aspects of thebusiness in order to provide the products and services, and forcommunicating with customers. This includes the design anddevelopment aspects of operations, as well as delivery of productsor services. It is achieved by determining the control and checkprocedures necessary to ensure conformity, and by recordingthe results to confirm this Action:- You and the team should review the processes and considercheck or test points necessary to confirm that when a stage inthe process is completed, the check or test is carried out and theresult recorded to ensure that it is correct to be processed throughto the next stage. Here again a simple flow chart is useful (seeFigures 1 and 2)- You should detail the procedures used when a non-conformancearises and such events should be recorded. The record shouldinclude the nature of non-conformance. Where rework is notpossible, how the non-conformance is identified to ensure itcannot get back into system, and where rework is possiblehow this is achieved. This should be followed by a review of thenon-conformance, in order to plan and implement preventiveaction to eliminate a recurrence- Where you have any product or service design requirementsthroughout this process, there is an agreed process in placethat includes reviews of design and development stages to ensurethat the final design fully meets with business or contractualrequirements. Simple but clear documented information shouldbe planned and retained to confirm that design and developmentrequirements have been met6

The Small Business Owner’s Simplified Guide to ISO 9001 and Business Improvement9Performance Evaluation10bsigroup.comImprovement Here you will need to carefully review all aspects of the businessincluding your operational performance, customer satisfactionlevels and the performance of any suppliers This clause deals with the general approach to taking all steps whenopportunities are identified to consider means of improvement,plan what is needed, implement and monitor for effectiveness It also covers the need for internal auditing and management review Action: Action:- It is suggested that you take a leading role in this but consider jointaudits with an appropriate employee to undertake regular internalaudits. The results should form part of your business managementreview, ideally involving all employees. If the result of the reviewshows all aspects to be satisfactory then future audit planningshould be considered. Where an audit identified processes is foundwanting, consider and plan what is needed to improve systems,agree action necessary and implement and monitor for effectiveness- You as owner will generally work towards improving processes inorder to enhance customer satisfaction and remain competitive,to retain and gain contracts. To show that this is the case aprocess should be mapped out to show that you are closelyinvolved with team members, suppliers and customers, in orderto identify any concerns or opportunities to further improve thebusiness operationGetting ready to conform ina small or micro business To conform to ISO 9001:2015 you will need to take responsibility forthe QMS within the business. However, as the system develops andis operational, some day-to-day responsibility can be delegated toan employee. The overall responsibility remains with you It is strongly recommended that from the onset all employees aremade aware of the aims and objectives in order for them to beactively involved with system development in working towardsconformance as this will speed the process along through thecollective experience based input, as well as all being fully awareof the resultant system The system can be either written or computerized, including useof cloud services Assuming that your business is operating successfully, it is ofparamount importance that your existing operating system isused as the foundation for the formalization of the system andits processes, and where any gaps are identified these should beaddressed, as far as possible, using current practice. If you engagethe services of a consultant then make sure they appreciate thisand do not allow them to suggest that in order to achieveconformance you need to put in place a different system, as thiswould be alien to you and will inevitably result in operationaldifficulties as a result of you and your team trying to work tothis different system Although the standard has relaxed but not entirely eliminated theneed for documented procedures and records, it will be of benefitto map out a simple end-to-end flow chart (see Figures 1 and 2) foryour business operation with branches off – fishbone style – foreach phase of the process, showing the progression, inputs andoutputs with check or test points and any records as applicable.These will assist in internal auditing of the system and providesupportive evidence of the system to external auditors Whilst not a requirement, you might consider it beneficial toemploy the services of a consultant to assist in developing yourQMS. It might also be useful to focus on those consultants thatoffer computer or web-based management systems that canreduce a lot of the work required, but care is needed to ensurethat their approach does not conflict with your current operationalculture. Alternatively, undertake a training course to become awareof what implementing a QMS involves and how to go about it whenapplied to your business If your business does not have contractually sourced customers,but operates through providing a product or service direct to thepublic, it is still of benefit to develop a QMS, adopting the principlesof the standard as good business practice, and using it as amanagement and improvement tool without the need for anaccredited external body certification When setting out to formalize the system it is important thatyou do not rush the process or cut corners as this will only leadto an incomplete QMS containing errors, which when identifiedthrough use or audit will require you to go back to square one.Work closely with your team to ensure an accurate understandingof each process7

The Small Business Owner’s Simplified Guide to ISO 9001 and Business Improvementbsigroup.comHere are some examples of flow charting:Internal Audit ScopeA: Sales and MarketingExternal Audit ScopeAll limited to processes onlyB: Contracts or OrdersG: Test or ConfirmC: Suppliers or ProvidersH: Despatch or PresentD: Design Product or ServiceI: Customer ServiceE: Plan Production or ServiceJ: Review and ImprovementF: Manufacture or Develop ProvisionFigure 1 — The scope of internal and external auditsThis flow chart example shows that the best starting point inimplementing the standard is to carefully look at your businessoperationally and map out from A to Z all major stages of operation.This then forms a foundation structure around which you canexamine your processes more closely and map out each at everystage. See flow chart 2 for more detail.excludes your sales and marketing processes from audit as this processis confidential. The only element of this that can be audited is theprocess you undertake to convert orders/sales into your production/service plans in order to ensure you meet customer requirements.Another ‘no go’ area for external audit is any business expansionor development planning, as it is only improvements on existingprocesses that are auditable by external auditors.The outer boundary line shows the most beneficial scope for you toaudit. This end-to-end cover makes for good business practice as itprovides comprehensive information to review. The external audit lineWork closely with your team to ensure anaccurate understanding of each process8

The Small Business Owner’s Simplified Guide to ISO 9001 and Business ImprovementE: Plan Production or ServiceC: Suppliers or ProvidersCompleterecordbsigroup.comSelect and check your suppliersSupplier checkpoints formSpecify stages of processVisit to discuss contract andlook at their systemsDocument flowchart processDevelop a plan for each phasesof Production or ServiceIs everything satisfactory?Has the plan been reviewedand complete?NoYesPlus anyrecordsrequirementNoYesD: Design Product or ServiceF: Manufacture or Develop ProvisionFigure 2 — A detailed look at stages C and F from aboveThis sample flow chart shows the simple approach to looking in more detail at those processes used in stage C and F (see Figure 1).These look carefully at all inputs, operations and outputs, including any tests or checks applicable, and whether any records are required.MethodologyISO 9001:2015 uses the process approach as a model, including the Plan - Do - Check - Act (PDCA)cycle, and this should be taken into account when putting your system into place and developingimprovements. This should initially be led by you and when appropriate the process can be takenforward by team members.PlanCheckEstablish the aim and objective of each componentof the system and confirm how each team member(s),as applicable, has the operational responsibility forthis stage together with confirming the resourcesand support needed to deliver results to meet withcustomer requirements and the business policy.Once the formalized process is in place, monitorand evaluate the processes to ensure that they areoperating as agreed and meeting the objectives ofthe business policy.DoWork to the agreed formalized procedureand/or process.It is beneficial to formally note this action with outcomesand where any gaps or possible improvements areidentified, then:ActConsider what is needed to fill those gapsand what actions can be taken to improveprocess performance.9

The Small Business Owner’s Simplified Guide to ISO 9001 and Business Improvementbsigroup.comIf you are choosing the certification route:It is very important to undertake some research on certificationbodies and ideally employ the services of a certification body thatis suitable. It is necessary to establish that they are accredited andthat their accreditation has traceability to an internationallyacknowledged reputable body. This is essential to avoid the risk ofcertification that is not recognized by or unacceptable to customers,especially those in the government agencies or public sectors.You could even confirm acceptance of your selection with customersbefore proceeding.During the closing meeting following the audit they will report ontheir findings directly to you highlighting any areas requiring attentionin order for them to undertake the certification process. At this pointyou and your team need to take every opportunity to discuss anyconcerns or issues and seek advice.When the formalizing of the operational system is nearingcompletion, for example ‘final draft’ format, your selected certificationbody will visit to undertake their initial audit review of the system.Achieving on-going benefits in the business.Whether you wish to achieve certification or merely self-certifiedconformance to the standard, the best and most practical approachto further develop your system is achieved through continuing theuse of the PDCA cycle (described earlier and detailed in the standard),as this sets the discipline of ensuring that each stage is valid.What can be achieved?Here are some examples of the benefits achieved by small and microbusinesses that have taken up the standard and used the resultantQMS effectively: A small business that is involved in a variety of componentmachining for customers, with ten team members, had not kept anyrecords of rejects prior to adopting ISO 9001. However, when theteam accurately recorded and reviewed the results, they not onlyidentified the causes of the errors, but in order to preventrecurrence agreed to increase the number of check points duringprocessing. One result of this review was the realization that currentmaterial wastage could be reduced by specifying the preproduction cutting dimensions of materials, thereby reducingmaterial consumption. A significant cost saving was realizedtogether with improving production flow A micro business in outside catering with five team members, onauditing to ISO 9001 that included reviewing customer feedback onthe standard of food and service, became more closely aware of theamount of food wastage at customer venues, which up to this pointhad not been monitored. Realizing this they undertook to collect theuneaten food themselves for a period and use the results toaverage out the volume and type of the food. The outcome of thisenabled them to more accurately provide sufficient quantities alliedto th

What are the main changes in the 2015 revision of ISO 9001 that benefit small and micro businesses? A number of the changes are intended to be more inclusive and understanding of the small and micro business sector. This is as a result of the recognition by those involved in t