Pay your suppliers

A few weeks ago, Christopher Paris published an article about companies who don't pay their suppliers—or rather, strictly speaking, companies who make their suppliers wait four, five, or six months to get paid, even when the contract plainly requires payment in 15 days net. He describes having dealt with companies just like this, and I believe it.

Gothmog rejecting an invoice.

Back when I was first starting out, I worked indirectly with a company I'll call Gothmog Enterprises. (Don't even try to guess who they were in real life; my LinkedIn profile doesn't go back that far.) Gothmog Enterprises was a very large company. And there were persistent rumors that they preferentially did business with small, local suppliers who were desperate for the orders. Then when the invoice arrived—so the rumors used to claim—Gothmog Enterprises would pay 60% and stamp it "Payment in Full." This left the suppliers with a painful choice: continue to do business with Gothmog, knowing that they would only ever get 60 cents on the dollar; or cut them off, and be cut out of the massive volume of business that Gothmog made available. Of course it was a terrible choice for the suppliers, and for Gothmog to force it on them was unambiguously evil. 

Maybe it was only a rumor and never really happened.

"ISO 9001 would never let you
mistreat your suppliers!"

Now, Chris Paris sells consulting related to management systems, for example (but not only) those certified to ISO 9001 or AS9100. So it would be tempting to think he shouldn't have to deal with this kind of problem. You might even think to yourself, Surely a company with a functioning quality system wouldn't be allowed to play games like this with their suppliers! But this would be to look at the world through rose-colored glasses. Not sure you agree? Let's check.

ISO 9001:2026 covers all the requirements relating to suppliers in clause 8.4. (Property belonging to suppliers but stored at your workplace is covered in clause 8.5.3.) There is no prefatory material in clause 8.4, but just three subclauses.

• Clause 8.4.1 says that anything provided by a supplier and ultimately bound for your customers must conform to requirements, and must be put under a suitable control to ensure that it conforms.  
• Clause 8.4.2 says that you have to figure out what controls are appropriate, and whether to apply them to the things you buy, or to the suppliers themselves, or both.
• Clause 8.4.3 says you have to tell the supplier about all your requirements, and about all the controls you intend to apply.
• There's nothing about paying your bill afterwards.

And that's it! Oh, I suppose with this latest edition of the standard you could try to build an argument around clause 5.1.1(i), which says that top management is supposed to "promot[e] quality culture and ethical behavior." Maybe you could argue that letting your suppliers wait for months before they are paid is a funny kind of "ethical behavior." It would certainly be worth making the argument. But don't expect to win.

This might look like a gap in ISO 9001, but I'm not sure I agree. I'd rather call it a limitation of scope. ISO 9001 was never intended to describe ever single thing a company should do in order to qualify as praiseworthy or good. It is specifically a quality management system standard, which means that it should be focused strictly on customer satisfaction. If I can make my customers happy while being an unethical jerk to my suppliers, ... well, morally I still shouldn't do it; but as long as my customers don't know that I am an unethical jerk they won't care. In the short term, before my picture starts showing up on social media headlining lurid exposés of my crimes and misdeeeds, my customers will still be satisfied. And in that sense—for that short term—my orc-ish behavior towards my suppliers is out of scope for ISO 9001.

Where the treatment of suppliers does re-enter the larger Quality ecosystem is in the more general consideration of the seven Quality principles (spelled out in ISO 9000). One of these principles is Relationship management, which covers relationships with all interested parties. And in case it's not already obvious, suppliers are always interested parties. The point of the discussion of these principles in ISO 9000 is that even if yes, technically a company can get away with observing the letter of the ISO 9001 requirements while still being a scoundrel in other respects, in the long run it's not a sustainable strategy. Over time, suppliers will walk away from them, blacklist them, and refuse to do business with them—exactly the way that Chris Paris describes in the article I mentioned at the beginning of this post! Any company who wants to secure the ability to do business in the long term has to do more than narrowly follow the rules. 

Among other things, this means paying suppliers.  

           

When half a loaf is worse than none

You work in a small office that's part of a big organization, and the experts at Headquarters just issued a new regulation. Everyone has to comply. You don't have the budget to implement the whole thing, but you could do half of it with no trouble. Should you do that half, just to show good faith? Isn't half a loaf better than none? 

Not so fast. It all depends.

Of course sometimes that's the right thing to do. Implement Part One now, and make a plan to implement Part Two next year when you can afford it. Communicate with the people at Headquarters so everyone understands the situation, and make incremental progress.

But evaluate every situation on its own. Sometimes implementing half a loaf will undermine you, and you would do better to wait till you can do the whole thing at once.

I was in exactly this situation once, years ago. I was working for a small, entrepreneurial startup that had just been acquired by a global company. The global company had a lot of systems and regulations that we had to learn in a hurry.

One bundle of regulations addressed security. Every office and every plant worldwide—except ours—issued employee badges. Those badges let you into the building at your site. If there were restricted areas at your site, your badge could be fine-tuned to let you into exactly the areas you were allowed to access. If you went to work in a new location, your badge could be reprogrammed to open the doors at the new location instead. It was a complex, interconnected system.

We had none of that.

And right away, visitors started to comment. 

"What, no badges? How can you work for Big Company without badges?" 

"Gosh, the next time I need a new printer I'll just fly out here and take one from your office since your security is so lax."

"Does Headquarters know that you guys don't have badges?"

Someone in my department decided we should do something right away. She started scheduling appointments for everyone in our office to have a picture taken, and ordered a box of badge blanks. She was halfway through taking all the pictures before I had a chance to sit down with her and ask what she was thinking.

"Well everyone keeps saying we need badges. I figured I could make badges, and then our guests would be happy."

"But badges are just part of the picture," I reminded her. "What about the electronic keys and the huge IT infrastructure that links us into the rest of Big Company worldwide? Where is the budget for that going to come from, and who is going to implement it?"

"I thought we could do that later."

That was the key. She figured half a loaf is better than none, and in a different case she might have been right. But in this specific case, it didn't work, and couldn't possibly work.

I told her, "Think a minute. Suppose it is the day after you issue badges to everyone, and explain they are mandatory. How are you going to enforce them?"

"What?"

"Say that Frank forgets his badge at home. But he can still get into the building, right? Because the badge isn't an electronic key, so it isn't hooked into the security system. Did you think we were going to hire guards to stand at the door and stop people without badges?"

"No."

"That's right. There's no budget for that. Only then what happens is that everyone realizes the rule about wearing badges has no teeth. They can openly ignore it, with no consequences. And then the next time we have to implement a new rule from Big Company, it'll be twice as hard."

"So what do you want me to do? Should I run around the building every day to check that people have their badges on?"

"No. What I want is for us to wait and do nothing until we can afford to implement the whole package all at once."

That's what we did, and it took a couple of years until the electronic entry system became a high enough priority for our management to pay for it. In the meantime, Big Company understood that we were non-compliant with that specific set of security requirements, and treated the situation as a known risk to be managed. Mostly it didn't take a lot of attention, and we all went about our business just fine. When the day finally came, we did everything at once; we were fully integrated into Big Company's IT infrastructure; and, yes, we got our badges.

Every case is different. There is no substitute for thinking through all the details to understand what happens if you take this option or that one. But sometimes it is simpler just to be noncompliant—fully above-board, so that you are known to be non-compliant—than to get tangled in the complexities of trying to do something halfway.

           

Quality methods for the win!

I've often argued that Quality methods are just as useful in real life as they are in the workplace, but this month's issue of Quality Progress is running a story that makes the point better than I ever could. Jared Watson, a senior quality engineering specialist at L3Harris Technologies, published an article about how he used systematic quality improvement methodologies to win big on the game show "Jeopardy!" 

You can read the full article online. But to summarize, Watson won his first rounds (in June 2023) with only "a month of preparation and a lifetime of enthusiastic—if amateur—curiosity." But then he was invited to compete in the Tournament of Champions, and he realized that his preparation would have to reach a whole new level. So he analyzed his gaps as clearly as possible, and made a plan to address them.

The first step was honesty. In my original run, I’d lost thousands of dollars on geography clues, including two Daily Doubles, and geography is the most frequently tested “Jeopardy!” category. If I didn’t confront that weakness, it would beat me again.

Next came help. Improvement accelerates when we invite others into the process. In my case, I had a sleeping trivia giant in my house ...: my wife, Jasmin. What began as a simple request for a few flash cards turned into more than 10,000 handcrafted study prompts .... Her support became the backbone of my preparation.

But tools and support only matter if you put in the work. Early on, I tried to master new material in a single sitting by drilling the same cards until I was frustrated. It didn’t work. What did work was steady, sustainable repetition: reviewing each card no more than twice a day, trusting that consistency—not perfection—would lock in the knowledge over time. And it did....

This lesson is one our field knows well: Quality improves through honest assessment, smart use of resources and disciplined, incremental effort. Whether on the “Jeopardy!” stage or in our organizations, consistent practice beats the illusion of overnight mastery every time. 

With this solid preparation, Watson posted a perfect performance during the quarterfinals, answering 21 for 21 and all three Daily Doubles. Later he was eliminated in the semifinals, but the power of the method to get him that far was absolutely clear. As Watson himself concluded, "That’s what quality looks like in practice: A commitment to the process, not just the final score."

Congratulations!

           

Where to buy ISO standards

Now that the International Organization for Standardization has released ISO 9001:2026, the latest edition of the world's most famous quality management systems standard, you may be wondering where you can buy a copy? Fortunately there are lots of options. Never let it be said that the Internet passed up a chance to sell a popular item.

Of course, you may already have a well-established channel for getting copies of standards. Maybe the Certification Body that you always work with has already arranged for you to get a copy of the new standard. If you work for a large company, there may be a central office responsible for distributing standards to whoever needs them. Certainly back when I worked for global companies, that was my experience. Even though my own office might be small or easily ignored in the big picture, I could always contact somebody at headquarters who sent me whatever I needed.

On the other hand, maybe you have no access to such an office, and have to buy your own copy. Where do you turn? There are many choices.

The most obvious choice is to buy directly from ISO themselves. They have a website, from which you can derive a lot of useful information about the standardization process, and about ISO's plans for the future. The website also has a store, where you can search any of the products that ISO publishes and buy them directly. In many ways this is the most obvious option, and for some people it will surely be the simplest.  

But ISO works through national standards bodies to develop standards, and by the same token sells their products through the national standards bodies as well. So in the United States, for example, you can buy ISO standards through the American National Standards Institute (ANSI). Strictly speaking, the standards you buy from ANSI are ANSI standards, but we are still talking about documents with the same words and requirements. ANSI has just adopted the ISO text intact to constitute the equivalent American document. You can find the ANSI website here, and the online webstore here.

Naturally, ANSI isn't the only national standards body that works with ISO. There are many others, and you can buy from any of them that you can reach. With the Internet, it is often easy to reach organizations that are geographically distant. So, for example, you might want to patronize the British Standards Institution, another venerable collaborator with the ISO. Like the other organizations we've mentioned, BSI has a well-established web presence here. And you can buy their standards (including ISO standards that BSI republishes as British national standards) by navigating to this page here.  

Strictly speaking, there is no law that limits the sale of ISO standards to national standards bodies. There are other organizations engaged with the standardization process as well, and some of them are authorized vendors in addition to their other roles. One of the most obvious, at least from where I sit, is ASQ, the American Society for Quality. ASQ works with ANSI to contribute to writing the ISO standards, so it is only natural that ASQ should be an authorized vendor for the final products. You can find ASQ's main home page here, and the online store for publications is here.  

At this point you may have checked several of these online stores, and have discovered that buying your own copy of one of the popular ISO standards can be kind of ... expensive. The prices differ slightly from one site to the next. but if you want a copy of a popular standard like ISO 9001:2026 or ISO 14001:2026, it seems like you can easily pay between two- and three-hundred dollars, or even more. per standard. Is that really the best anyone can offer? Doesn't anyone out there offer a discount?

Right now, yes, there does seem to be an option for budget-conscious customers. Things change fast on the Internet, so I don't know if these offers will still be valid by the time you read this post. But let me recommend that you visit the website of Eesti Standardimis ja Akrediteerimiskeskus, the Estonian Centre for Standardisation and Accreditation. They offer standards in Estonian and in English. They are authorized vendors just like any other national standards body. But as of this writing, their prices on the popular standards seem to run about 10-20% of what everyone else is charging. If you need to pick up a copy of some international standard soon, but can't afford to spend hundreds for it (dollars, euros, pounds ... the unit hardly matters)—check the online webstore in Estonia to see if they have what you need.

Thanks to Chris Paris for his post in LinkedIn that let me know about the prices in Estonia!

P.S.: You might also check this post, to see whether the standard you want is available for free. The terms and conditions are a little awkward, but under the right circumstances it might be just what you need.

           

Political savviness as a leadership tool

Back when he was still editing The American Scholar, Joseph Epstein used to remark that his responsibilities as editor involved little more than "opening the mail." What he meant was that the journal had acquired enough of a reputation that good writers regularly submitted solid and thoughtful pieces for publication with no prompting from his side. All he had to do—or so he claimed—was to open the mail, see what had come in this month, and then send it to the printer.

A blogger's job is rarely so easy, but I am always delighted when I find something I can share with you. This week it is a short video that I found posted on myASQ, ASQ's social media platform. Its title is "Political savviness as a leadership tool," and it was originally posted by Luigi Sille of ASQ's Human Development & Leadership Division. Mr. Sille and the HD&L Division retain all rights to this video, and I gratefully acknowledge their permission to share it here.

The central message of the video is a simple one: political skill is a fundamental leadership tool. It doesn't get the acclaim of talents like vision and strategy, but it is just as important. No matter how inspiring the vision or how brilliant the strategy, there will always be internal friction in any organization when you try to implement them—simply because there is always friction when people work together. Political skill is nothing more than the lubricant for that friction, the ability to work with others inside an organization in order to get things done. 

Many people hear the words "political skill" and think of something bad; they associate the concept with force or fraud, with coercion or manipulation. Of course sometimes those things do happen inside organizations, but they are dysfunctions and they are the exception. Most organizations get along fine without them. And associating political skill with those kinds of behaviors is like associating weather with hurricanes and tornadoes: sure, they are dramatic, but they aren't the whole story.

It's a good video, and it will cost you only a minute. I hope you enjoy it.

  

           

It's published! Now what?

Yesterday, September 16, after months of waiting and hype, the 2026 edition of the ISO 9001 quality management system standard was formally published. You can buy a copy from the ISO themselves, or wherever you normally acquire standards.

Great news! Now what?

Well, that depends. Overall there is a three-year transition period from the 2015 edition to the 2026 edition. But what you have to do during that time depends on how you interact with the standard.

• Do you work for a company that is certified to ISO 9001?
• Do you work for a Certifying Body (CB) that certifies other companies?
• Do you work for an Accrediting Body (AB), that accredits CBs so they can be allowed to certify companies?

In each case the requirements are a little different.

If you work for a regular company certified to ISO 9001—but not a CB or an AB—the requirement is that you need to acquire an updated certificate reflecting the new edition of the standard no later than September 30, 2029. The only way to get a new certificate is for your CB to conduct an audit to the new standard, either as part of your normal schedule or else as an extra, out-of-sequence audit. It will take your CB some time after conducting the audit to process the results and issue your certificate. So you would be well-advised to contact your CB, and ask how much time they need. Then schedule the transition audit early enough to give them more time than they asked for. Unexpected issues always come up towards the end of any transition period, and you don't want someone else's unrelated accident to jeopardize the timely issuance of your certificate.

What do you need to do on your side to get ready for the transition audit? Fortunately, not much. Several months ago I wrote about the changes that were planned for this edition, and not much has shifted between then and now. The consequence is that the updates in this edition are few, and they are mostly pretty intuitive. You shouldn't have to change much about your current management system in order to comply with them. Be sure to read the new edition, of course! Once you do, you'll find in many cases that your current system already meets the new requirements without the need for any change at all (except maybe in terminology). Explain that to your auditor, and you are done. If you do have to adjust something, then plan and implement the updates in a systematic way like you would do with any other changes. But you shouldn't find it a burden.

If you work for a CB or an AB, the requirements are a little more detailed. I'll summarize them here, but they have been compiled into a document published by the Global Accreditation Cooperation Incorporated (Global ACI), the international authority on the accreditation of laboratories, certification bodies, and others. You'll want to download the document for reference. (See links below.🡳🡳)   

In a nutshell, a CB has to develop and implement a transition plan, including communication with all existing clients. As part of their transition plan, they have to communicate with their AB and provide all documentation the AB might request. In the end, the CB must communicate to their AB no later than June 30, 2027 that they can certify companies to the new edition. Then the AB has three months (latest September 30, 2027) to decide whether the CB has made the transition adequately. After that decision, the AB must conduct at least one (preferably more) witness audit of the CB where the CB is auditing a client to ISO 9001:2026.

An AB, for their part, has to be ready to accredit CBs to the new edition no later than March 31, 2027. They too have to prepare a transition plan, and to communicate with both their CBs and Global ACI.

Any new or initial certification to ISO 9001 after March 31, 2028, must be to the 2026 edition.

For more details, please see the documents linked below.   

Global ACI transition requirements for ISO 9001:2026

Global ACI transition requirements for ISO 14001:2026

Global ACI downloadable transition requirements documents page

           

Writing a wiki

Last week, Johnathan Gonzalez of Worthington Enterprises posted a question on a myASQ discussion board, and it has gotten a lot of traffic. He asked, "When Quality depends on one person, do you really have a system?" Then he expanded the question with a little more detail.

Sometimes a process works because the process is strong. Sometimes it works because one person is really good at holding everything together.

Those two situations can look exactly the same until that person goes on vacation, changes roles, or leaves.

Most of us have probably worked with someone like that. They know the history behind a recurring issue. They know which supplier needs extra follow up. They know who to call when something goes sideways. They know which part of the process actually matters because they have seen what happens when it fails.

That experience is incredibly valuable.

The problem starts when that person's knowledge becomes the control. At that point, the organization may think it has a strong process when what it really has is a strong individual....

Where have you seen tribal knowledge become a real dependency in a process, and what actually helped transfer that knowledge to others?

Of course he is absolutely right that the two situations can look the same, and also that it is important to distinguish them. If your company depends critically on information that Tom and Larry carry in their heads, then—to put it gently—you are facing an important risk. And until you can get that knowledge spread across more people, you probably want to discourage Tom and Larry from taking up extreme sports or playing the lottery.

How do you spread their knowledge? Of course there are many ways. You can ask them to give talks over lunch. You can assign them to work on projects with junior colleagues, so that the junior colleagues rub shoulders with them and learn by doing. You can ask them to write procedure documents, though that kind of task is often postponed till the last minute because it's not very exciting.

Another approach is to create a wiki. The advantage of a wiki is that you can build it incrementally, a little bit at a time. But how do you remember all the different bits and bobs of topics that have to be included?

I once knew an engineering manager I've called Franz, who solved that exact problem. His organization had, at the tijme, some very senior engineers with decades of experience, and some new graduates who were just starting out. Naturally the new hires often asked the older engineers for advice, particularly around the design and architecture of the company's product line.

Franz introduced the following rule: "Whenever you ask a question, do it in email. And whenever someone asks you a question, don't just reply! Instead, add that question to the wiki. Write your answer in the wiki. Then reply to the original question by sending a link to your answer."

That was the protocol. It was simple. Everyone understood it. And over time it allowed the wiki to capture most of the tribal knowledge that the senior engineers had accumulated throughout their careers.

No single approach does everything. If you have to collect tribal knowledge, use multiple approaches at the same time, each supporting the others. But I have always liked Franz's protocol for filling up the local wiki with the knowledge everyone needed.