ISO certification –
What it is, why you might want it and how you can accomplish it
By Mary Louise Ray
Nearly everyone has heard of ISO 9000, but not a lot of people can tell
you what it is. What exactly is ISO certification, and how do you know
if your company will benefit from it? If you decide ISO certification
is right for your organization, exactly how do you go about it?
Pennsylvania’s Industrial Resource Centers (IRCs) have been working
with small and medium-sized manufacturers to attain compliance with
ISO standards for almost 15 years. They partner with manufacturers to
guide, consult, and in some cases, manage the manufacturer’s ISO
certification efforts.
What is ISO certification?
ISO (from the Greek word meaning “equal”) refers to the
International Organization of Standardization (www.iso.ch), a network
of standards organizations in 146 countries. The network is administered
by a secretariat in Geneva, Switzerland, and it has been developing
technical standards for more than 50 years. Most of the standards are
extremely specific in nature, such as the standardization of nuts, bolts
and screw sizing, and focus on specific industries, such as telecommunications
and aerospace manufacturing. Developed through a global consensus of
industry representatives, the standards specify, with great precision,
characteristics to ensure that materials, products and processes are
appropriate for their purpose and that they lead to the manufacture
of consistent products.
It is the voluntary acceptance of these standards by manufacturers and
service providers that allows you, for example, to swipe your credit
card through a magnetic card reader in nearly any country and successfully
charge a purchase. Or to be comforted by the fact that rivets manufactured
in Mexico, which hold together an airplane assembled in the U.S., are
made from an appropriate material, are manufactured in a process that
ensures quality and consistency, and are measured and tested against
the same standards as the same rivets produced by another manufacturer
in a different country.
In 1987, the International Standards Organization released ISO 9000,
a generic standard addressing quality management systems (QMSs). The
standard is generic in that it can be applied to any manufacturing field,
and indeed, any enterprise that employs a process to deliver goods and
services. Instead of addressing the measurements of a #10 screw or other
technical arcana, ISO 9000 quantifies an enterprise’s processes,
principally through the documentation of the activities an enterprise
engages in to produce their product, whether a tangible good or a service.
The benefits of ISO certification
Companies embark on ISO certification programs for three primary reasons:
to improve the operation of their business, to meet customer requirements
or a combination of both. Customer requirement can be a significant
force. If potential customers will only accept bids or quotations from
ISO-certified vendors, obtaining ISO certification becomes a necessity
for doing business. Or, if ISO certification becomes ubiquitous within
a particular industry
or market sector, companies are compelled to attain ISO certification
just to remain competitive from a marketing standpoint.
While ISO certification frequently serves as a sales and marketing tool,
the most important benefit from the certification process is an improved
QMS. “Companies should be looking at their quality management
systems, regardless of ISO certification,” says Sharon Hoffman,
Program Manager of Workforce Development and Quality Systems at the
Industrial Modernization Center (IMC) IRC in Williamsport.
Improving business processes through ISO certification does seem to
be the trend, according to Doug Plikaitis, Manufacturing Extension Manager
at the Manufacturers Resource Center (MRC) IRC in Bethlehem. He says
that, initially, companies were interested in ISO certification because
of customer demand, but that has changed in the past several years.
“Historically, most of the reasons were customer demand –
that is not the driver today. Today, companies are looking at ISO as
a process for running their business. They are doing it to stay competitive,”
according to Plikaitis.
Untangling the ISO numbering system
If you are new to the world of ISO, the nomenclature of the different
standards can be confusing. While there are numerous standards issued
by the International Organization of Standards that address many industries
and activities in great detail, the two generic standards – the
ISO 9000 family and the ISO 14000 family – are applicable to all
industries selling goods or services. According to the International
Organization of Standards, “Both families consist of standards
and guidelines relating to management systems, and related supporting
standards on terminology and specific tools, such as auditing (the process
of checking that the management system conforms to the standard).”
The ISO 9000 Family
The ISO 9000 generic standard quantifies quality management. “Quality”
means that the final product or service delivered to the customer meets
the customer’s requirements. Despite that definition, the ISO
9000 family of standards does not address the end product or service;
it addresses the processes an organization employs to reach the end
product.
The primary feature of the ISO 9000 standard, as well as the ISO 14000
standard, is the documentation of processes. Every product produced
by a manufacturer is a result of a series of steps or procedures. There
may be 10 steps or 100 steps – the number of procedures is dependent
upon the complexity of the product or the complexity of the process
required to manufacture the product. Each one of these procedures happens
in a prescribed manner and order, and each procedure ends with a measurable
result.
When implementing a QMS, a company is required to document these procedures.
It is not unusual, particularly in small companies, for intellectual
assets to be stored in employees’ heads, as opposed to documented
on paper. But if “George” is the acknowledged master of
a particular process in your organization, what happens if he gets sick
or leaves the organization? Can another employee take over George’s
responsibilities without slowing production or adversely affecting the
quality of the finished good? Or, in the worst case scenario, would
the loss of George’s specialized knowledge and experience halt
production altogether?
A robust QMS documents, in detail, every procedure. If George left the
organization, any competent employee with appropriate training should
be able to take over his responsibilities with little or no adverse
impact on scheduling or quality. While the ISO 9000 standard does not
address specifically how the processes should be documented, it does
specify that the organization must:
- document the processes;
- develop a training program that teaches other employees how to
perform those operations; and
- review and audit both the procedural documentation and the training
program periodically.
ISO 9000 standards, as well as QMSs, are not limited to documenting
the manufacturing process; they address other aspects of the business,
as well, such as product design, organizational management, employee
training and customer satisfaction. All departments of an organization
must be involved with the QMS, because producing a quality product hinges
on the successful operation of all of the departments.
ISO 9001, 9002, 9003
The International Organization of Standards periodically updates the
standards, which results in naming conventions that can be confusing
to the uninitiated. The first ISO 9000 standard was issued in 1987.
Those organizations that conformed to the standard were certified to
the “ISO 9000” standard. The ISO 9000 standards were revised
in 1994, with the added wrinkle of categories of certification –
ISO 9001, 9002 and 9003:
• ISO 9001 standards are for organizations that design, develop
and manufacture products (and install and service the products, when
applicable).
• ISO 9002 standards are the same as the ISO 9001 standards, except
the design control portion of the standards are removed to address organizations
that do not engage in product design or development.
• ISO 9003 standards are for organizations engaged in inspection
and testing services only.
Therefore, a manufacturer certified to the 1994 ISO 9001 standard would
be certified as conforming with “ISO 9001:1994.” Similarly,
a laboratory certified to the 1994 ISO 9003 standard would be certified
as conforming with “ISO 9003:1994.”
The International Organization of Standards’ most recent revision
of the ISO 9000 standards was released in 2000. The numerical distinction
between the three activity classifications (9001, 9002 and 9003) was
abandoned, however. Currently, all organizations certified as conforming
to the 2000 standards receive the “ISO 9001:2000” distinction.
The activity classifications are now noted as exceptions. For example,
a manufacturer that does not engage in product design or development
activities would be certified as compliant to “ISO 9001:2000 (without
design).”
The deadline for transitioning from the 1994 standards to the 2000 standards
is Dec. 15, 2003. Several IRCs have noted an increase in requests for
assistance this year on the transition process. Becky Deiter, Quality
Systems Analyst at the Catalyst Connection IRC in Pittsburgh, says that
she has seen an increase in ISO-related activities as the deadline nears.
“Currently, most folks are driven by the demand to hit that date.”
ISO 14000 family
The ISO 14000 family addresses the management of environmental issues
within an organization. Introduced in 1996, the ISO 14000 standards
are a management tool that can be used by any organization to minimize
their impact on the environment. “The system measures processes
and allows the tracking of environmental performance,” according
to John Taylor, Director of Manufacturing Services, at the Northeast
Pennsylvania IRC (NEPIRC).
As in the case of ISO 9000, the naming conventions can get confusing.
While “ISO 14000” is the original (and most popular) term
for the standard, the International Organization of Standards states
the “ISO 14001” is the correct term; it was changed to be
consistent with the “ISO 9001” name change in 2000.
Industry-based standards
Some standards have been customized for particular industries and commercial
sectors. For example, “QS-9000 is the U.S. automotive industry's
current quality system standard and is modeled after ISO 9001. QS-9000
encompasses all of ISO 9001:1994, plus additional automotive-specific
and customer-specific requirements,” according to Taylor. These
standards are not generic and should not be confused with the ISO 9000
or ISO 14000 generic standards.
The three steps to certification
The process for obtaining ISO certification is described simply in three
steps – but the work involved in accomplishing the steps can often
be anything but simple.
Assessment
The assessment phase compares your company’s existing QMS with
the ISO standard. Also called a “gap analysis,” the assessment
defines which parts of your QMS need to be revised, improved or documented
to meet the standard. The analysis can be done internally, but it is
typically done by an outside resource, such as an IRC, independent consultants
specializing in the ISO certification process, or a combination of internal
and external resources. IRCs frequently serve as program managers, working
with both the company and consultants.
Implementation
Once the problem areas (known as “non-conformities”) have
been identified, the company revises, improves and documents those areas
that must be brought up to the ISO standard. While this may sound simple
enough, it can be quite a large project. For example, if numerous processes
have never been documented, the company must start from scratch; if
no formal employee training programs exist, they must be developed and
implemented.
As a preparation for the next step, the outside resources (IRC, independent
consultants) typically perform an audit to identify non-conformities
so that they can be corrected in advance of the official registration
audit.
Auditing and registration
The International Organization of Standards does not perform ISO audits
or issue ISO certificates. Companies seeking ISO certification must
hire an independent entity (called a registrar), trained and certified
to perform ISO audits and registrations.
“Inevitably, they will find fault with what you did and ask you
to correct it,” says Pete Wright, Quality Field Agent, of the
Northwest Pennsylvania IRC (NWIRC) in Erie. When the non-conformities
are
corrected, the auditors return and perform a second audit.
Wright adds that the finding of additional non-conformities during the
second audit is a fairly typical experience. The auditing process concludes
when all the non-conformities have been corrected. At that point, the
auditors declare that the company conforms to the ISO standards and
registers the company as certified to ISO standards (either ISO 9000
or ISO 14000, depending on the certification the company is pursuing).
IRC ISO assistance
The costs associated with ISO certification are frequently a concern
for companies contemplating the certification process.
The total cost can vary considerably, depending upon how much outside
assistance the company seeks at the assessment and implementation phase,
and the number and complexity of the documented processes examined during
the auditing/registration phase.
A rough estimate of the cost for the auditing/registration phase for
a small company (approximately 50 employees or fewer) is between $5,000
and $10,000, while a company with approximately 200 employees may pay
between $25,000 and $30,000, according to Hoffman of the IMC. These
costs do not include any external resources hired by the company to
assist with the assessment and implementation phases.
Time is another important consideration. Depending on the initial quality
of a company’s QMS, IRC experts estimate that the entire process
may range from five to 18 months, depending upon the size of the company,
the number and complexity of processes and the type of resources (internal
and external) deployed.
Companies with scarce resources may choose to use software solutions
specifically designed for building and maintaining a QMS, which can
help them with the assessment and implementation phases. Deiter of the
Catalyst Connection recommends Q-Pulse (www.gaelquality.com), a software
application that assists companies in managing compliance-based QMSs.
Catalyst Connection is a reseller of the software product and provides
training to companies that are implementing the software at their site.
Another option is the Web-based equationASP by Prism eSolutions (www.prismesolutions.com),
which is recommended by Plikaitis of the MRC. The server-based product
supports small- and mid-sized companies that are implementing ISO 9000,
ISO 14000 and other quality standards.
While doing it yourself may sound attractive from a cost-savings point
of view, Keith Ashlock, Director, County Client Managers, of the Delaware
Valley IRC (DVIRC) recommends companies consider a turnkey operation
instead. “The best way for a company to [obtain ISO certification]
is a turnkey service that is a fixed price for a fixed time period.”
He says that in his experience, companies that try to do the assessment
and implementation on their own are rarely successful.
“They spend a lot of time writing documentation that doesn’t
get them anywhere and it goes on forever.” He estimates that in
his nine years of working in the ISO certification field, he has only
seen two companies do it successfully on their own. He adds, “Companies
are not in the business of getting ISO certified; they can easily get
off track.”
No matter which model you choose for your business, the IRCs can help
you. Most IRCs can perform the assessment phase, and many offer auditing
services to help you prepare for the formal registration audit.
If you choose to hire outside consulting services, either those that
assist you in the process or those that provide a complete turnkey service,
the IRCs can help match your company with consultants that have expertise
in your manufacturing area, according to Jeff Davis of MANTEC. IRC personnel
will also serve as program managers, overseeing the progress and helping
to manage any issues that arise while your company and your consultants
are working through the ISO certification process. Training in QMSs
and internal auditing is also offered by most of the IRCs.
For those companies interested in ISO 14000 certification, many IRCs
can help with the assessment and implementation phases. For example,
MANTEC, a York-based IRC, has a certified environmental management system
auditor on staff, according to Davis.
A foundation for improvement
Once you obtain ISO certification, you cannot sit back and rest easy.
ISO certification documents that your company has designed and implemented
a QMS, but at the heart of a QMS is continuous improvement.
Says Wright of NWIRC, “ISO 9000 is a dynamic system – if
the company is not constantly getting better and improving, [the registrar]
will lift your certification.” While ISO certification is a significant
achievement, it is also a signal to your employees and your customers
that not only has your company improved its processes, it will continue
to do so in the future.
Allegheny Color decreases costs and increases sales following
ISO 9000 certification
Allegheny Color Corporation, a division of Apollo Colors, Inc., saw
ISO certification as a way to add credibility to their company.
The Ridgeway-based manufacturer of organic pigments, which are used
in paints, plastics, inks and other products, was trying to expand its
customer base to include large manufacturers. But the company was competing
against larger pigment suppliers for the business.
So, Allegheny Color identified ISO certification as a means of associating
their company with quality manufacturing.
“None of our customers said, ‘Hey, you need to get ISO certification,’”
says Ryan Luchs, Allegheny Color’s Quality Assurance Manager,
“We just thought it was a good thing to do to add credibility.”
Allegheny Color began the process in the first quarter of 2001 by asking
the Northwest Pennsylvania IRC (NWIRC) in Erie for assistance. NWIRC
Quality Manager Dr. Adrien Adelman first performed a gap analysis of
the company’s documentation to determine what changes and improvements
Allegheny Color would have to accomplish to meet the ISO 9000 standard.
During the assessment, Adelman asked some salient questions that caused
Allegheny Color to examine their existing production process.
For example, part of the production process is to wash the pigment with
hot water to remove undesired materials. The current process specified
that the water be heated to 160° F. Dr. Adelman asked, “Why?”
Did the water really need to be heated to that high of a temperature?
Would a lower water temperature adversely affect the quality of the
final product? Consequent testing proved that Allegheny Color could
heat the water to only 120° F and achieve the same results.
The cost savings were substantial, according to Luchs, because “we
were heating 75,000 gallons of water per day.” This change in
process, as well as other process changes, resulted in a 20 percent
reduction in water, electricity and gas usage, estimates Luchs.
Rethinking the status quo is one of the great benefits of the ISO certification
process, according to Pete Wright, Quality Field Agent, of the NWIRC.
As the Allegheny Color example illustrates, some tasks are done in the
same manner for such a long period of time that no one questions the
reasoning behind it. But preparing for ISO certification presents an
opportunity to scrutinize the process. “Instead of documenting
an inefficient procedure, why not improve the procedure and then document
it?” asks Wright.
The NWIRC’s assistance included helping Allegheny Color develop
and implement policies, procedures, work instructions and other documentation,
as well as providing employee training in ISO standards and internal
auditing. When the quality management system was ready for the ISO registration
audit, NWIRC was there to help them to correct non-conformities identified
during the auditing process.
Allegheny Color received its ISO 9002:1994 registration nine months
after they initiated the project; this year, they successfully transitioned
to ISO 9001:2000. Luchs believes the process was worthy of their time,
effort and investment. In addition to increasing production efficiencies
and lowering utility costs, the improved quality management system has
simplified employee training.
“When new people come in, you are not relying on people’s
memory for training – it is all written down now,” he says.
Perhaps the most notable result of the certification process is that
Allegheny Color achieved its initial objective: “It has increased
sales,” says Luchs.
|