RISKY BUSINESS. Surviving the Future of ISO 9001:2015. Fordham University NYC - ASQ Section 300. Christopher Paris November 12, 2014

Transcription

1 RISKY BUSINESS Surviving the Future of ISO 9001:2015 Christopher Paris November 12, 2014 Fordham University NYC - ASQ Section 300

2 2

3 3

4 4 ISO s Biological Clock MAJOR CHANGE MINOR CHANGE ISO 9001:1987 ISO 9001:1994 ISO 9001:2000 ISO 9001:2008 ISO 9001:2015 ISO 9001:2022?

5 5 Inspectionbased Processbased Riskbased ISO s Biological Clock MAJOR CHANGE MINOR CHANGE ISO 9001:1987 ISO 9001:1994 ISO 9001:2000 ISO 9001:2008 ISO 9001:2015 ISO 9001:2022?

6 6 Inspectionbased Processbased Riskbased Faithbased ISO s Biological Clock MAJOR CHANGE MINOR CHANGE ISO 9001:1987 ISO 9001:1994 ISO 9001:2000 ISO 9001:2008 ISO 9001:2015 ISO 9001:2022?

7 7 The Players

8 8 The Players o ISO Technical Committee 176 (TC 176) Responsible for ISO 9000 family of standards Comprised of delegates from 170+ member nations Draft consensus standards Vote on drafts prior to publication

9 9 The Players o ISO Technical Management Board (TMB) Responsible for setting policies and managing all TCs Sets rules for how TCs will function and operate Can form or disband TCs Develop ISO Guides and some standards

10 10 Design Spec Survey o Major Change o Minor Change o Amendment (clarifications only) o Ratify as is o Withdraw

11 11 Design Spec Survey o Major Change o Minor Change o Amendment (clarifications only) o Ratify as is o Withdraw WIN!

12 12 The Plot

13 13 The Sub-Plot

14 14 Enter the Aussies o 1994: Australia and New Zealand publish AS/NZS 4360 on Risk Management. o Kevin Knight is a top contributor. o Supported by Japan and Canada

15 15 Enter the Aussies o 1998: Perhaps prompted by Japan, the TMB considers a standard on risk terminology. o 1998: A TMB Working Group is formed, with Japan as secretariat, and Kevin Knight as convener o 2002: ISO/IEC Guide 73 is published.

16 16 Enter the Aussies o 2004?: Kevin Knight approaches the TMB with a plan to convert AS/NZS 4360 into a full ISO standard on risk management. o TMB agrees, takes on the task itself without forming a TC. Appoints Knight as head of the Working Group.

17 17 Enter the Aussies o 2004?: Kevin Knight approaches the TMB with a plan to convert AS/NZS 4360 into a full ISO standard on risk management. o TMB agrees, takes on the task itself without forming a TC. Appoints Knight as head of the Working Group. ADD RISK!

18 18 Enter the Aussies o 2004?: Kevin Knight approaches the TMB with a plan to convert AS/NZS 4360 into a full ISO standard on risk management. o TMB agrees, takes on the task itself without forming a TC. Appoints Knight as head of the Working Group.

19 19 Enter the Aussies o 2004?: Kevin Knight approaches the TMB with a plan to convert AS/NZS 4360 into a full ISO standard on risk management. o TMB agrees, takes on the task itself without forming a TC. Appoints Knight as head of the Working Group.

20 20 Enter the Aussies o 2004?: Kevin Knight approaches the TMB with a plan to convert AS/NZS 4360 into a full ISO standard on risk management. o TMB agrees, takes on the task itself without forming a TC. Appoints Knight as head of the Working Group. o 2009: TMB publishes ISO as a risk management standard. There is still no TC for risk management formed.

21 21 Enter the Aussies o 2004?: Kevin Knight approaches the TMB with a plan to convert AS/NZS 4360 into a full ISO standard on risk management. o TMB agrees, takes on the task itself without forming a TC. Appoints Knight as head of the Working Group.

22 22 Enter the Aussies o 2004?: Kevin Knight approaches the TMB with a plan to convert AS/NZS 4360 into a full ISO standard on risk management. o TMB agrees, takes on the task itself without forming a TC. Appoints Knight as head of the Working Group. Rejected Guide 83 text inserted as Annex SL

23 23 Organizational structure Development of deliverables Procedure for calling a meeting Languages at meetings Distribution of documents

24 24

25 25 THIRD EDITION

26 26 FOURTH EDITION THIRD EDITION

27 27 The Plot WIN!

28 28 Enter the Aussies o 2004?: Kevin Knight approaches the TMB with a plan to convert AS/NZS 4360 into a full ISO standard on risk management. o TMB agrees, takes on the task itself without forming a TC. Appoints Knight as head of the Working Group.

29 29 Enter the Aussies o 2004?: Kevin Knight approaches the TMB with a plan to convert AS/NZS 4360 into a full ISO standard on risk management. o TMB agrees, takes on the task itself without forming a TC. Appoints Knight as head of the Working Group.

30 30 Enter the Aussies o 2004?: Kevin Knight approaches the TMB with a plan to convert AS/NZS 4360 into a full ISO standard on risk management. o TMB agrees, takes on the task itself without forming a TC. Appoints Knight as head of the Working Group.

31 31 Enter the Aussies o 2004?: Kevin Knight approaches the TMB with a plan to convert AS/NZS 4360 into a full ISO standard on risk management. o TMB agrees, takes on the task itself without forming a TC. Appoints Knight as head of the Working Group.

32 32 Enter the Aussies o 2004?: Kevin Knight approaches the TMB with a plan to convert AS/NZS 4360 into a full ISO standard on risk management. o TMB agrees, takes on the task itself without forming a TC. Appoints Knight as head of the Working Group.

33 33 The Plot

34 34 The Plot

35 :2015 Development Timeline WORKING DRAFT (WD) 0 Complete WORKING DRAFT (WD) 1 COMMITTEE DRAFT (CD) 1 Complete Complete COMMITTEE DRAFT (CD) 2 Skipped? DRAFT INTERNATIONAL STANDARD (DIS) FINAL DRAFT INTERNATIONAL STANDARD (FDIS) Complete (but late, was due April 2014) We are here; to be skipped? No significant changes expected from CD1 INTERNATIONAL STANDARD (IS) Due September 2015 formalities & translations only

36 36 Wordsmithing o Major focus was wordsmithing, not on improving content

37 37 Wordsmithing

38 38 Shortcuts o Develop Quality Management Principles in parallel with standard, rather than prior to standard. o Apply bulk of effort into aligning existing requirements to Annex SL (paragraph shuffling) o Don t explore major new concepts or advances; leave them for 2020 s o Run DIS translation and review stages in parallel, to save time. o Skip FDIS?

39 39 Shortcuts o Leave processing of reviewer comments to off-line select team members, not full committee. o Ignore 550+ comments about Annex SL altogether. o Ignore ISO User Survey results entirely. o Combine the problems of preventive action and the risk mandate into a single solution: Risk-Based Thinking

40 40 ISO Fibs o Risk was included because of user feedback from the ISO Survey. o ISO 9001 has always been about risk o ISO 9001 was developed by consensus. o ISO standards taste like chocolate.

41 41 Risk-Based Thinking

42 42 Risk-Based Thinking Not based on any known Risk Management practice or principle

43 43 Risk-Based Thinking Not based on any known Risk Management practice or principle Not mentioned in any BoK, curriculum or text

44 44 Risk-Based Thinking Not based on any known Risk Management practice or principle Not mentioned in any BoK, curriculum or text Not mentioned by any known Quality guru

45 45 Risk-Based Thinking Not based on any known Risk Management practice or principle Not mentioned in any BoK, curriculum or text Not mentioned by any known Quality guru Denounced by Risk professionals, including those in TC 262 on Risk Management

46 46 Positive Risk o Very controversial, ISO has bought into the idea that positive risk (opportunities) should be managed the same way as negative risk. o This idea is not even shared universally in the risk management profession. o This defies the dictionary.

47 47 Everything W. Edwards Deming Ever Said About Risk

48 48 TC 176 vs. Godzilla o TC 176 inserted a note under the definition of risk which contradicts the note mandated by Annex SL, revealing the conflict.

49 Risk-Based Thinking No requirements for processes No requirements for procedures No requirements for records No requirements for evidence Risk-based thinking does not ever require risk management 49

50 50 The emperor has no clothes! What on earth was he thinking? RISK, baby!

51 51 Impact o RBT presents the first time ISO TC 176 has invented a requirement, rather than insert a requirement based on established best practices o There is no established evidence that it works. o As a result, the entire world is the laboratory for TC 176 s experiment in risk-based thinking. o What could go wrong?

52 52 28,400 US certificates lost since 2003

53 53 Auditing Risk-Based Thinking Now think about risk

54 54 Where 9001:2015 Calls Out Risk o Related to satisfying customer requirements risks and opportunities that can affect conformity of products and services and the ability to enhance customer satisfaction o Level of post delivery support determined by reviewing risks related to products and services o During management review, assessment of effectiveness of risk review actions

55 55 Other New Requirements

56 56 Quality Principles o Due to deadlines, the Quality Principles were largely unchanged. Customer Focus Leadership Engagement of People Process Approach Improvement Evidence-Based Decision Making Relationship Management

57 57 Quality Principles o Apparently due to deadlines, the Quality Principles were largely unchanged. Customer Focus Leadership Engagement of People Process Approach Improvement Does away with System Approach Evidence-Based Decision Making Relationship Management

58 58 Quality Principles o Apparently due to deadlines, the Quality Principles were largely unchanged. Customer Focus Leadership Engagement of People Process Approach Improvement Evidence-Based Decision Making Relationship Management Greatly expanded beyond just supplier relationships

59 59 Annex SL Clause Structure 1. Scope 2. Normative References 3. Terms and Definitions 4. Context of the Organization 5. Leadership 6. Planning 7. Support 8. Operation 9. Performance Evaluation 10. Improvement

60 60 PDCA Model Intact 1. Scope 2. Normative References 3. Terms and Definitions 4. Context of the Organization 5. Leadership 6. Planning 7. Support 8. Operation 9. Performance Evaluation 10. Improvement Plan Do Check Act

61 61 HLS vs 9001:2008 Clauses (Rough) 1. Scope 1. Scope 2. Normative References 3. Terms and Definitions 2. Normative References 3. Terms and Definitions 4. Context of the Organization 5. Leadership 6. Planning 7. Support 8. Operation 9. Performance Evaluation 10. Improvement 5. Management Responsibility 5.4 Planning 4. General Requirements & 6. Resource Management 7. Product Realization 8 Measurement, Analysis & Improvement

62 62 Human Factors o Although not named as such, Human Factors has crept into the standard. o TC 176 requires assessment of social and psychological factors to determine suitability of the workplace. o Good luck with that.

63 63 Documented Information o TC 176 has combined the concepts of documentation and records into a single thing. o This confuses the requirements for document vs record control.

64 64 Change Control Finally, TC 176 addresses controlled change to the QMS and processes

65 65 Organizational Knowledge o Companies must determine and maintain the knowledge necessary for the operation of its processes and to achieve conformity o Knowledge is impossibly defined: available collection of information being a justified belief and having a high certainty to be true

66 66 Context of the Organization o Perhaps the best new addition, it requires the organization to understand itself before understanding ISO o Largely a one-time exercise, it requires determining and understanding stakeholders, internal issues, external issues, goals. o These then tie into the strategic direction of the organization

67 67 Legacy Concerns o Still manufacturing biased; service sector will continue to be alienated, or seek alternative standards such as CMMI o Document control still biased towards hardcopy binders, despite bluster from TC 176 o Process approach only slightly more clearly defined o Removal of preventive action will only confuse the issue further, not clarify it o Still assumes human beings operate by following a master Policy

68 68 Legacy Concerns o Design model is still too rigid, anti-agile. o Design of services not addressed o Process design not addressed o Still relies on top-down management by dictate, no employee co-participation o No mutually beneficial supplier relations still assumes you beat your suppliers into submission

69 69 Legacy Concerns o Still very much Anti- Deming Ya just don t get it, do ya?

70 70 Career Paths o Risk management, knowledge management and human factors are career-path disciplines, not to be thrown into a few sentences without a study of their impact.

71 71 Process, Shmocess o Standard uses word process in different contexts: Process Programme Business Processes Activities Arrangements Functions

72 72 Not All Bad

73 73 Immediate Benefits o It s not a major change, despite the claims by ISO and certification bodies selling upgrades o Implementation of integrated management systems will be much, much easier. WIN! o High Level Structure should remain fixed for the next 1,000 years

74 74 Survival Strategy

75 TAILORING TAILORING TAILORING TAILORING

76 76 Tailoring Steps o Read and understand ISO 9001:2015 o Determine your interpretation of the requirements o Document those in a policy manual of some sort o Provide this to third parties upon request (customers, auditors) o Defend it!

77 What That Might Look Like 77

78 What That Might Look Like QUOTE THE REQUIREMENT DEFINE YOUR POLICY DEFINE YOUR INTERPRETATION 78

79 What That Might Look Like QUOTE THE REQUIREMENT DEFINE YOUR POLICY DEFINE YOUR INTERPRETATION MAY INCLUDE CONTROVERSIAL POSITIONS SPECIFIC TO YOUR ORG! 79

80 What That Might Look Like QUOTE THE REQUIREMENT DEFINE YOUR POLICY DEFINE YOUR INTERPRETATION 80 REFERENCE ANY SUPPORTING DOCUMENTS

81 81 DETERMINE YOUR APPROACH DOCUMENT THE APPROACH DEFEND IT! PROVIDE DOCUMENT TO AUDITORS

82 82 Example: Risk-Based Thinking DETERMINE YOUR APPROACH DOCUMENT THE APPROACH Use SWOT and PEST RISK PROCEDURE: PROVIDE DOCUMENT TO AUDITORS We utilize SWOT and PEST

83 83 Example: Risk-Based Thinking Auditor

84 84 Example: Risk-Based Thinking Oh, well. Suck it. Auditor Client

85 85 Example: Interested Parties DETERMINE YOUR APPROACH Employees are an interested party DOCUMENT THE APPROACH PROCEDURE: Employees are an interested party. PROVIDE DOCUMENT TO AUDITORS

86 86 Example: Interested Parties Auditor

87 87 Example: Interested Parties The sound you hear is the door hitting your ass. Auditor Client

88 88 Best Approach: Documentation o Do not align document numbers with the standard! o Only develop documentation where there is a benefit to do so. o Use documents to define potentially controversial interpretations. o Quality Manual not required now but customers may still expect it.

89 89 Best Approach: Process Management o Ensure that the process approach has been implemented. o May be more important than ever to identify and management processes properly o Assign measurable quality objectives to each process

90 90 Best Approach: Process Management o Assign at least one objective to each process o Assign a measureable metric to each objective. o Set goals for each metric. o Measure the metric to determine process effectiveness. o Take corrective action when goals are not achieved.

91 91 Best Approach: Process Management PROCESS: Purchasing OBJECTIVE: To ensure purchased materials meet requirements.

92 92 Best Approach: Process Management PROCESS: Purchasing OBJECTIVE: To ensure purchased materials meet requirements. METRIC: Measure % material returned to supplier, last 90 days.

93 93 Best Approach: Process Management PROCESS: Purchasing OBJECTIVE: To ensure purchased materials meet requirements. METRIC: Measure % material returned to supplier, last 90 days. GOAL: < 1% material returned to supplier, last 90 days.

94 94 Best Approach: Process Management PROCESS: Purchasing OBJECTIVE: To ensure purchased materials meet requirements. METRIC: Measure % material returned to supplier, last 90 days. GOAL: < 1% material returned to supplier, last 90 days. CURRENT STATE: 5% material returned to supplier, last 90 days.

95 95 Best Approach: Process Management PROCESS: Purchasing OBJECTIVE: To ensure purchased materials meet requirements. METRIC: Measure % material returned to supplier, last 90 days. GOAL: < 1% material returned to supplier, last 90 days. CURRENT STATE: 5% material returned to supplier, last 90 days. Goal not met! Corrective Action required!

96 96 Defend Your Interpretation o Because of the vague language in 9001:2015, it will be more important than ever to defend your interpretation to third parties. o Do not adopt practices of other companies solely because an external auditor tells you to.

97 97 The Inevitable Auditor Battle o Auditors are unlikely to receive more than 15 minutes of training on key requirements such as risk. o In fact, they may not be required to receive any training at all! o A crash between your interpretation and the auditor s is inevitable.

98 98 The Inevitable Auditor Battle o Arm yourself with information. o Know your rights for appeals, complaints and escalations. o Don t be afraid to challenge your auditor. o An auditor cannot punitively deny certification for a legitimate challenge!

99 99 The Other Guys Playbooks o ISO 17021: rules that govern third party auditors and certifications o ISO 17011: rules that govern the oversight of the Certification Bodies by their accreditors.

100 100 Reduce Upgrade Costs o Attempt upgrading without consultant, use internal staff o Abandon alignment with ISO 9001 clauses, reduce document re-writes o Limit risk management to areas you determine; don t overdo it. o Do not listen to marketers selling upgrade classes

101 101 Reduce Upgrade Costs o Do not buy ISO 9001:2015 internal auditor training courses if auditors are already trained to ISO 9001:2000 / o Do not pay for ISO 9001:2015 preassessment audits by Certification Bodies, if already registered. o Do not implement based on Certification Body interpretation guidelines that s not their job!

102 102 Advertise Your Certification! o Once certified: Tell everyone! Promote the certification to not only customers, but suppliers and the public. Add ISO 9001 Certified to advertising and promotions. Educate the public on how ISO 9001 improves your quality products or services. Blogs Editorials Forums

103 103 Relax o Final deadline for updating systems: 2018

104 Questions? Image credits: Various images used under paid license with Corbis Various images Oxebridge Quality Resources International LLC Doctor Who BBC War of the Gargantuas Toho Co. / UPA Mad Max 2: The Road Warrior Kennedy Miller Entertainment Young Frankenstein Gruskoff/Venture Films Screencaps of ISO standards and documents excerpted under Fair Use provisions. Other images taken from sources within the public domain.