Archive for April, 2008

Notes on ISO9001:2000 Management Review

Monday, April 21st, 2008

Your ISO9001:2000 quality management system requires you to perform a management review at planned intervals. In practical terms, the minimum is once per year. For a new quality management system I’d recommend you have management review meetings from 2 to 4 times per year. They don’t necessarily have to take all that long, unless you have some particularly long-winded people in your organization. After 3 or 4 years, once your quality management system has matured and people know their roles, you might think about reducing the frequency of management reviews to once or twice per year.

Its up to you to decide who attends your management review meeting. Members of top management should attend, along with relevant quality people and possibly department heads.

You must keep records of your management review meetings, including who attended.

You should have an agenda going into the meeting. Inputs to your meeting should include, at the mimimum:
-follow-up on previous management review meeting
-results of previous audits
-process performance and product conformity
-customer feedback
-status of preventive and corrective actions
-changes to your company that could affect the quality management system
-recommendations for improvement

One person, usually the quality manager or the management representative to the quality system, should prepare the agenda, notify everyone who should attend, and conduct the meeting.

Once you’ve gone thru all the items on your agenda, you’ll have generated some outputs. Management review outputs typically include:
-a record of the meeting
-corrective and/or preventive actions
-resource needs
-any other improvements to the effectiveness of the quality system, its processes, and/or your product or service.

Management review meetings may sound like some ominous burden, but in reality they may take as little as 30 minutes. It all depends on how prepared the people are, the complexity of your company, and the effectiveness of the person running the meeting.

ISO9001:2000: Is An Easy Auditor a Good Thing?

Saturday, April 5th, 2008

In the world of ISO9001:2000, I divide organizations into 2 camps. The first, and far more popular, are the companies that need to get certified due to customer pressure. They look at ISO9001 as a necessary evil, a royal pain in the ass, but they have to do it. The second camp, not quite so common, are the companies that want ISO9001 for the organizational and efficiency benefits that can be derived from following the standard.

Not long ago I consulted with a company that wanted to get their ISO9001:2000 certificatation for the usual reason- customer pressure. They were a pretty good group of people, but clearly they thought they had better things to do than follow some silly quality standard, keeping unnecessary records, having more boring meetings, conducting useless audits. Anyway, we got through the process without too much trouble, and scheduled a visit from our friendly auditor.

The auditor, Al, turned out to be a very nice man, obviously with many years of experience. Al had a lot of wisdom to share with us, and wasn’t afraid to chat endlessly on topics ranging from the Dodgers and home repair to travels in Europe and antique car restoration. Oh, yeah, there was some talk about the ISO9001 standard too.

Al didn’t seem all that interested in getting up out of his comfortable chair, and would ask someone to get certain files for him. This, of course, allowed the audited person to pick and choose which files he brought to the auditor. In fact, Al didn’t even check quite a few records that I sure would have if I were lead auditor.

This got me to thinking, is an easy auditor a good thing? Sure the company is happy that they got through the audit easily, and I’m happy that my consulting skills resulted in another ISO9001 :2000 certification. But has the easy auditor really done them any favors? Will this company be prepared in the future if a tougher auditor visits?

Now I had done my best to prepare my client company for a “real” ISO9001 audit. I thought they were in pretty good shape. During the audit, however, two of the employees unwittingly sabotaged my efforts by creating forms for their own department’s use, and not informing anyone outside the department. While I spotted this, our easy auditor didn’t seem to notice.

I’d like to think that, maybe, that it was immediately obvious to the auditor that I had done a great job preparing this company for ISO9001, and that actually checking records was not needed. Maybe the auditor, with his years of experience, quickly spotted a company that had its act together, so decided to take it easy for a few days. Maybe.