It's published! Now what?

Yesterday, September 16, after months of waiting and hype, the 2026 edition of the ISO 9001 quality management system standard was formally published. You can buy a copy from the ISO themselves, or wherever you normally acquire standards.

Great news! Now what?

Well, that depends. Overall there is a three-year transition period from the 2015 edition to the 2026 edition. But what you have to do during that time depends on how you interact with the standard.

• Do you work for a company that is certified to ISO 9001?
• Do you work for a Certifying Body (CB) that certifies other companies?
• Do you work for an Accrediting Body (AB), that accredits CBs so they can be allowed to certify companies?

In each case the requirements are a little different.

If you work for a regular company certified to ISO 9001—but not a CB or an AB—the requirement is that you need to acquire an updated certificate reflecting the new edition of the standard no later than September 30, 2029. The only way to get a new certificate is for your CB to conduct an audit to the new standard, either as part of your normal schedule or else as an extra, out-of-sequence audit. It will take your CB some time after conducting the audit to process the results and issue your certificate. So you would be well-advised to contact your CB, and ask how much time they need. Then schedule the transition audit early enough to give them more time than they asked for. Unexpected issues always come up towards the end of any transition period, and you don't want someone else's unrelated accident to jeopardize the timely issuance of your certificate.

What do you need to do on your side to get ready for the transition audit? Fortunately, not much. Several months ago I wrote about the changes that were planned for this edition, and not much has shifted between then and now. The consequence is that the updates in this edition are few, and they are mostly pretty intuitive. You shouldn't have to change much about your current management system in order to comply with them. Be sure to read the new edition, of course! Once you do, you'll find in many cases that your current system already meets the new requirements without the need for any change at all (except maybe in terminology). Explain that to your auditor, and you are done. If you do have to adjust something, then plan and implement the updates in a systematic way like you would do with any other changes. But you shouldn't find it a burden.

If you work for a CB or an AB, the requirements are a little more detailed. I'll summarize them here, but they have been compiled into a document published by the Global Accreditation Cooperation Incorporated (Global ACI), the international authority on the accreditation of laboratories, certification bodies, and others. You'll want to download the document for reference. (See links below.🡳🡳)   

In a nutshell, a CB has to develop and implement a transition plan, including communication with all existing clients. As part of their transition plan, they have to communicate with their AB and provide all documentation the AB might request. In the end, the CB must communicate to their AB no later than June 30, 2027 that they can certify companies to the new edition. Then the AB has three months (latest September 30, 2027) to decide whether the CB has made the transition adequately. After that decision, the AB must conduct at least one (preferably more) witness audit of the CB where the CB is auditing a client to ISO 9001:2026.

An AB, for their part, has to be ready to accredit CBs to the new edition no later than March 31, 2027. They too have to prepare a transition plan, and to communicate with both their CBs and Global ACI.

Any new or initial certification to ISO 9001 after March 31, 2028, must be to the 2026 edition.

For more details, please see the documents linked below.   

Global ACI transition requirements for ISO 9001:2026

Global ACI transition requirements for ISO 14001:2026

Global ACI downloadable transition requirements documents page

           

Upcoming Changes in ISO 9001

Late last week, Quality Magazine published my article, "Upcoming Changes in ISO 9001." In it, I review the recent DIS9001 and explain the changes that it introduced:

Quality culture and ethical behavior

Opportunity-based thinking

Changes to the terms and definitions

Other changes 

I also explain my conclusion (which I have already stated in other venues) that any company which is securely certified to ISO 9001:2015 should have no trouble upgrading to the new version ... unless some new, massive, unforeseen change is snuck in at the last minute. 

It's their article now so I won't post the text of it here, but you can find it by following the link. I hope you find it useful!

Feedback on Santa's audit!

Wow! I got a lot of comments on last week's post about how far Santa Claus complies with ISO 9001. Thanks especially to Pia Hamrin, Dawn Ringrose, Petro Shoturma, and Jeremy Panitz for their detailed feedback!

What interested me was the remarkable level of unanimity among the responses. Of course each commenter had a unique perspective. But since Santa Claus is fictional,* any commonality among the responses must be traceable to the second half of the discussion—namely, to the expectations that grow naturally out of working with ISO 9001. Those of us who work with the standard regularly have come to know that some clauses need a lot more attention than others, because the impact they have on organizations is so consequential.

Even if you aren't worried about Santa Claus, ask yourself whether these same clauses aren't important topics in your organization.

Common concerns

It was no surprise to me that the two topics which attracted the most attention were Internal controls and Complaint handling. Businesses differ a lot: organizational contexts can be very different, as can the quality of customer requirements. For some companies those topics might require a lot of attention, while for others the same topics might manage themselves. But internal controls always matter—to everyone. And without complaint handling, you have no feedback on your operations to make sure your customers are satisfied. So nearly everyone agreed to focus on those areas.

Naughty or nice?

Everyone knows that Santa Claus checks whether each child is "naughty or nice," but how does this happen? Dawn's reply assured me that Santa uses a proprietary algorithm. But Pia asked how that algorithm is validated, and whether the sources are documented? Jeremy suggested that Santa consults with children's deities around the world to make his determinations.

Complaint handling

Petro and Pia both raised the issue that there is no publicized mechanism for complaint handling. Jeremy suggested a resolution to this topic, though, by arguing that "If the customer isn't satisfied with the gift they got from Santa Claus, the gift did not come from Santa Claus."**

Less worried

By contrast, nobody was very worried about document retention. Dawn suggested that the children's letters must be fully digitized, and nobody else took up the subject. I think this lack of concern reflects our common experience that yes, of course document retention is important; but on the other hand documentation findings are generally the weakest kind of finding in any audit.

Similarly, Dawn and Jeremy both assured me that internal audits were done by impartial elves, where "no one audits their own toy line." And I think we have all experienced that even in organizations where the Quality Management System is informal or not very mature, it is generally possible to find people who can treat the process objectively, and who can therefore do reliable audits.

Unique observations

Then there were the unique observations, that pushed the discussion in an unexpected direction.

Jeremy argued that Santa Claus is thought of as a toymaker, but that the real focus of his design expertise is in logistics. In commenting on clause 8.3.2 (Design and development planning), he explains, "Santa has only 24 hours to deliver toys and other gifts all across the world. That means he's got to know the weather patterns. So his design and planning is less on toys and gifts and more on safety and delivery of the goods." Jeremy doesn't use this example, but I assume he would compare Santa (in this respect) to McDonald's, who didn't redesign the hamburger but revolutionized how it was delivered to the customer.

For her part, Dawn answered the question about children changing their minds by enunciating the rule, "Last Wish Wins." But that rule means that the audit plan has to spend a lot more time checking scrap and rework under clause 8.7 (Control of nonconforming outputs). As long as the only topic was the elves' workmanship, we could assume that the elves are magical and don't make mistakes; so overall scrap should be minimal. But if children can change their minds late in the game, there is sure to be scrap as earlier gifts are replaced with later ones. Thus does any answer in one part of the audit open up new trails in another part—and this, too, is a familiar experience to all of us.

Naturally I don't mean to suggest that any clause is unimportant. In the right (or wrong) circum­stances, any clause can trip you up. But I found it interesting and reassuring that the feedback on this topic aligned so closely with my own sense about where the critical risks are in any ISO 9001 implementation. Again, even if the North Pole doesn't interest you much, your own organization does. And it is worth looking over where your own risks are.

__________

* Or at any rate I'll assume so for the purposes of this post! 

** It's an interesting idea, to which I note only that, however this principle might work for Santa, it's not available for the rest of us.     

         

Does Santa Claus comply to ISO 9001?

Years ago, when my kids were little, they would spend an hour or so every Christmas Eve watching the NORAD Santa Tracker. You've probably heard the story behind how NORAD tracks Santa's progress through the skies every year. And indeed every year there are press releases updating the public on the current status of the Santa-tracking program.

These days I'm out of touch with the latest developments in aviation, but I'm correspondingly more interested in international standards. So today I find myself wondering, How far does Santa Claus comply with ISO 9001?

It's not an idle question. Last year an investigative reporter went to the North Pole—at least, that's what the article said—to check the operations of Claus Enterprises against OSHA's Top 10 workplace-cited standards for 2024. The results weren't pretty, though Santa himself put the best face on what he called "“an unfortunate misunderstanding," and pledged a prompt corrective action plan.

But even if safety issues have been addressed, what about Quality? Millions of children rely on Santa for presents each year. Can he really be counted on to come down all the right chimneys? Does he stand behind his work, or does he just fly away "like the down on a thistle"?

Up till now I have been unable to find an ISO 9001 certificate* for any part of Santa's operations, neither his workshop nor his delivery service. Partly the problem may be geographic: I'm not aware of any formal Certifying Body with jurisdiction over the North Pole. All the same, surely it's a good idea to do an advance check—like a pre-audit—to find which clauses need the most attention. So Santa, if you are reading this, treat it as a little free consulting, to help you get positioned.**  

These, then, are some clauses of the standard where I would expect discussion in an audit:

4.1 Understanding the organization and its context

Ever since the climate change amendment last year, this clause has included the requirement, "The organization shall determine whether climate change is a relevant issue." Well if the Polar ice cap is about to melt, that sounds relevant to me! Does Santa have plans to relocate? And where?

4.2 Understanding the needs and expectations of interested parties

How often are these needs and expectations reviewed or updated? I assume that the desires of little children have been broadly similar for centuries. But what about other players in the same market? Does Santa face competition from online retailers, or has he worked out some kind of deal?

5.2.1 Establishing the quality policy

What exactly is Santa's Quality Policy? Does he strive for 100% satisfaction? We know that every year some children are disappointed; so if the policy calls for 100%, there might be a problem. And what if a gift is defective, or has to be returned? Does Santa replace it himself, or does he require the parents to do the work? (See also clause 8.4 Control of externally provided processes, products and services.) 

7.5.3 Control of documented information

Children write letters to Santa from all over the world. Are those kept for future reference, in case there is some dispute over what a child really requested? And in what form? (For example, are the original letters kept on paper, or are they digitized?) If the letters are kept on paper, how are they preserved in the harsh Arctic climate?

A second topic is the retention policy: how many years is a letter kept? Santa is always said to be wise and to have a long memory; but the storage requirements for each new year's batch of letters must be enormous. Are they kept for a year? For a decade? For centuries? How are they indexed? How easily can they be retrieved?

8.2.3 Review of the requirements for products and services

There's another kind of control needed for the children's letters: regular review. Some children might request toys that are dangerous, or that are illegal in their place of residence. How is this review conducted, and how are conflicts resolved?

In addition to all the other reviews, subclause 8.2.3.1(c) requires a review of "requirements specified by the organization." Presumably this includes comparing all requests against the List of Who's Naughty and Nice. But how is that list managed and kept up to date? And how often is a naughty child really given a lump of coal instead of some other present? (I can think of children over the years that I thought had earned a lump of coal who never seemed to get one!) 

8.2.4 Changes to requirements for products and services

What about children who change their minds about what they want, and who send multiple letters? Is there a tracking system to allow the second letter to be filed with the first one, or to replace it completely?

8.3.2 Design and development planning

What is the ratio of customized gifts to off-the-shelf toys? The publicity photos of Santa's Workshop look like they are mass-producing toys, but there must be a lot of specialized requests as well. How is this handled? (See also clause 8.5.2 Identification and traceability.)

8.4 Control of externally provided processes, products and services

How much of Santa's work is subcontracted to local merchants, or to parents? And on what terms? Does Santa still get all the credit, in all cases?

8.5.2 Identification and traceability

How far is lot-traceability a relevant issue? (Note that if every job were custom—see also clause 8.3.2 Design and development planning—then lot-traceability would not be a requirement.)

8.5.4 Preservation

The North Pole has a cold, harsh climate. The same is true for much of the lower atmosphere. How does Santa preserve presents in good condition, and keep them from being damaged by the harsh environment?

8.6 Release of products and services

Does Santa keep records of every gift, and are those records filed with (or cross-indexed to) the corresponding request letters? This raises some of the same questions we discussed above under clause 7.5.3 Control of documented information. 

9.1.2 Customer satisfaction

What is Santa's current level of customer satisfaction? Has it been trending up or down? In case of any downward trend, has Santa chosen to implement corrective actions, and what do those look like?

9.2 Internal audit

Who does internal audits for Santa's enterprises? Are the auditors selected in a way that "ensure[s] objectivity and the impartiality of the audit process"? Is the scope of the internal audits the same as the scope of the enterprises, or are there some areas that are off-limits to the auditors? Can I see the results of the latest full audit?

9.3 Management review

Can I see the records of the latest management review? Has Santa ever introduced a major change to the operations as a result of findings in management review?

• If yes, what was it?
• If no, then is the organization really using the management review, or is it just a dog-and-pony show?

10.3 Continual improvement

Tell me about the latest continual improvement initiatives.

Having said all this, I have to admit that it would be the chance of a lifetime to audit Santa's Workshop at the North Pole. An operation with such vast scope, that has to achieve such delicate precision in its outputs, would be amazing to review.

So Santa—again—if you are reading this and want someone to do a test-audit before you call a regular Certifying Body, leave a comment on this post with your contact information and I'm sure we can work something out.

And to everyone else, have a jolly day, a delightful holiday season, and a very happy New Year! 

__________

* I did find one article here that claims Santa Claus is certified to ISO 9001 and a host of other standards as well, but it offers no links to objective evidence.  

** And with a little luck, giving away free consulting might be enough to move me from Naughty to Nice!     

 

Priorities in repair

There are costs when you develop a product. One of the easiest to forget is the cost to repair it later. I don't mean when the customer breaks something by mis-using it; you can charge for repairs like that. I'm thinking of the ordinary cost of warranty repair. What happens when the product breaks down through normal wear and tear, inside the warranty period? Or in a product powered by software, what happens when the customer has an unexpected use-case, and discovers a brand-new bug?

You fix it, of course. All reputable companies do. But that costs time and money. In the high-tech case, it may require the attention of very talented engineers.

Long ago—and yes, it seems like it was in a galaxy far, far away—I worked for a startup that had a problem. We were developing a NewProduct™ that was late. It relied on a very specialized technology. The whole work rested on just one or two of our engineers.

To make things worse, we had recently released an OldProduct™ that relied on similar technology. When problems were reported, they were routed to the same engineers to fix. But every hour those engineers spent fixing a bug in the OldProduct was one more hour they weren't working on the NewProduct. So the NewProduct continued to get later.

One day, our President had had enough. In a moment of frustration, he fired off an email that said, "Effective immediately we will stop fixing bugs on OldProduct until NewProduct is released!" Clearly he hoped that this message would set the right priorities for the company, so that we could finally make some progress.

By coincidence, our annual ISO 9001 surveillance audit was scheduled for just a month later. And you can probably guess what happened. At one point the auditor asked me, "How do you respond to customer complaints?" In the course of the discussion, I mentioned the recent email about OldProduct.

Our auditor took a very dim view of this story. Had we really stopped fixing all bugs on OldProduct? He reminded me that clause 8.5.2 of ISO 9001:2000* specifically requires the organization to review nonconformities, including customer complaints. If we really had stopped fixing all reported bugs, he would have to write that up as a Major process nonconformity in the audit. 

I hadn't worked closely with this product, so I called the Customer Service Department. They explained that no, we hadn't stopped fixing bugs. When he sent that email, our President was just blowing off steam. What we had done in reality was to set up a filtering system to prioritize bug-fixing.

• If OldProduct genuinely didn't work, we fixed the problem.
• But if OldProduct actually did work, but just not the way the customer wanted it to work—this was by far the majority of the cases!—we took the customer's improvement suggestions and put them all in a big pool to be addressed when we had time. This meant we would look at them after NewProduct finally got released.

The Customer Service folks brought objective evidence to prove that yes, one or two bugs really had been addressed since President's email, so the filtering system was working. Our auditor downgraded his finding to a suggestion that it would be helpful if everyone in the organization had the same understanding about this policy, and the rest of the audit was uneventful.

This all took place long ago, but I remember it because the distinction is important. 

• On the one hand, there are things—like repairing genuine flaws under warranty—that you simply have to do: all responsible companies do them, and they are required by external standards like ISO 9001. 
• But on the other hand, you often have broad latitude to prioritize your work in a way that makes sense based on current conditions.

This flexibility can make all the difference. 

__________

* Yes, we were still working to the 2000 edition of the standard. Remember this was many years ago!   

    

What is "ISO thinking"?

A while ago, I ran across a thin little book called Why Adopt ISO Thinking? I use the word thin advisedly, as the whole work is less than 50 pages long. But I was curious about the title. I thought to myself, I'm sure I can think of reasons why to adopt it. But what exactly does the author mean by "ISO thinking" anyway?

I should add that the author doesn't approach the question the way I would, which is part of why I wanted to understand his answer. The author, by the way, is Robbie Sheerin of DV Die Cutting in Danvers, Massachusetts; Quality Manager by day, and fiction writer by night. (You can find his personal website here.) As he explains in the foreword, he came to the ISO 9001 standard from a career in welding, machining, and aluminum dip brazing. His perspective is resolutely practical rather than theoretical. He shows no interest in taking the reader on a guided tour of the seven Quality Management Principles, as I did this spring.

What does he find important? He doesn't break it out this way, but I think the three critical points for him are these:

• Standardization
• Root-cause analysis
• Process approach

Over and over, he explains how these simple points can make all the difference in your business, if you take them seriously.

His description of standardization starts with a hair-raising example: the Great Baltimore Fire of 1904.

Aftermath of the Great Baltimore Fire

"With 1231 firefighters, 57 fire engines, nine trucks, two hose companies, one fire boat and one police boat, the fire still raged on for thirty-plus hours. 1526 buildings were destroyed. A total of 2500 businesses were lost. More than 30,000 people were left unemployed, and a staggering $150 million in damages, which in today's money is into the billions. Incredibly, only one person died. Why was the destruction and cost so large? Threads!! Firefighters could not get enough water because of the variety of threads on the hydrants and the hoses." [page 4.]

Sheerin then explains that standardization does more than save lives. Even when lives aren't at stake, it saves money by simplifying operations.

When he sketches out what the clauses of ISO 9001 represent, he gives multiple examples of the right and wrong ways to correct problems or to address customer complaints. He makes it clear that if you address only surface causes then you will have to keep solving the same problem over and over again. This means that the costs for solving that problem never stop adding up. On the other hand, if you can find and address the root cause, you only have to correct it once. So in the long run, doing it right is far cheaper than doing it fast.

As for the process approach, Sheerin introduces this along with root-cause analysis. If you understand your work in terms of processes, you can tell where to act so that you have the most leverage—whether you are fixing a problem or introducing an improvement. And he gives a concrete example which sounds like it might really have happened (or something much like it).

Let's say the customer wants a brass connector. But every time these are produced, there is a small burr .... It has always been removed by hand .... One day the customer complains that the burr is not completely removed or that there are scratches where the burr was removed. A CAR (Corrective Action Report) is created .... During the investigation, it is discovered that the operator does not have adequate hand tools for this job. It also takes the operator 4 hours to rework 500 parts by hand .... [but] by adding a 5-second pass of the part in the machine, the burr can be removed. Now you have removed the rework op and gone from 4 hours to 41 minutes (extra machine time). [page 19.]

Look at the whole process—study it as a process—and you find ways to make the work both easier and more reliable.

Sheerin insists that you can benefit from adopting one or two clauses of ISO 9001, even if you don't bother to comply to the whole thing. When I first picked up the book, that idea sounded odd to me. But this example illustrates what he means. Any improvement is an improve­ment. If you can't afford to take on the whole standard all at once, something is better than nothing. A bit of standardization here, a bit of root-cause analysis there, and an overall awareness of your work as processes—step by step these can help you improve. 

It's a pragmatic approach, and an encouraging one.    

    

Seven principles

Euclid, By Jusepe de Ribera - J. Paul
Getty Museum, Public Domain.

In day to day work, we often take for granted our basic understanding of Quality as a discipline. This is as it should be. Normally we're busy, we've got problems to solve, and we know that the Quality tools will help us solve them. There's no need to go all the way back to Euclid every time we have to measure a right angle.

But suppose we wanted to go back? What foundations does the Quality discipline actually stand on? Are there any, or is it just something we cooked up among ourselves because it sounded good?

Of course the answer depends on what part of the Quality discipline you ask about. The field's statistical tools are all based (obviously!) on statistics, which is a well-understood branch of mathematics. Problem-solving methods like PDCA are basically an application of the scientific method to industrial or business problems.

What about management systems? Are those based on anything?

Yes, actually they are.

The standard ISO 9000:2015 enumerates seven basic Quality Management Principles, on which rests the whole structure of the ISO quality management system standards, as well as any particular quality management system you or I might implement for our own companies. Because these principles are so fundamental, I thought it could be useful if I take a few weeks to analyze them one at a time, in order to unpack what each principle means and why it is there. That's my plan for the next seven weeks, unless it gets interrupted by something urgent.

But there's a question I'd like to address right at the beginning: Why these principles in particular? Is there really something that makes them more fundamental than any others?

The seven quality management principles are these:

• Customer focus
• Leadership
• Engagement of people
• Process approach
• Improvement
• Evidence-based decision making
• Relationship management    

Clearly they are all important. Clearly they are all good things to do. But what makes them any more fundamental than any other principles you might think of?

The point is that quality management systems are designed for use by organizations. 

• An organization is a social organism. 
• In order to continue to exist (to survive, or especially to prosper), an organization must use rational self-reflection in order to adapt to its environment.
• And in order to pursue Quality, an organization must (by definition) focus on the needs and wants of its customers and interested parties.

All of this follows more or less from the definition of quality management systems, and from basic observations about the nature of organizations. But look at the consequence.

• Customer focus means that the organization has to focus on the needs and wants of its customers and interested parties.
• Leadership and Engagement of people are fundamental to the definition of an organization as a social organism. Without Leadership, there is no unity or common purpose, and therefore no organism. Without Engagement of people there is no organism in another sense, because the people will just wander away.
• The Process approach and a commitment to Improvement give the organization the tools for rational self-reflection.
• Evidence-based decision making and Relationship management both mean that the organization adapts to its environment. Evidence-based decision making is how the organization adapts to the facts in its environment. And Relationship management is how the organization adapts to the other entities (persons, interested parties, or other organizations) in its environment. 

That's what makes these principles so fundamental.

In the coming weeks, we'll unpack them in detail.

When ISO 9001 Fails

This morning, Quality Digest published my article, "When ISO 9001 Fails." It's their article now so I won't post the text of it here, but you can find it by following the link. I hope you find it useful!

            

ISO 9001: What’s in it for you?

This morning, Manufacturing Tomorrow published my article, "ISO 9001: What’s in it for you?." It's their article now so I won't post the text of it here, but you can find it by following the link. I hope you find it useful!

What Does ISO 9001 Have to Do With Climate Change?

This morning, Quality Digest published my article, "What Does ISO 9001 Have to Do With Climate Change?." It's their article now so I won't post the text of it here, but you can find it by following the link. I hope you find it useful!

"But it's such a small change!"

Now that ISO TC 176 has formally announced the decision to start work on a revision of ISO 9001 (see this announcement from 3 August 2023), this may be a good time to revisit the question what constitutes a big change rather than a small one. What's interesting is that often you can't tell from the outside how big an impact a change is going to have.

The question matters because every change introduces churn and disruption. When a global standard like ISO 9001 introduces new requirements or changes old ones, organizations across the world have to stop what they are doing, evaluate the change to see what it means for them, and then make the appropriate changes in their own operations; that last step includes planning the changes (clause 6.3), updating the relevant documented information (clause 7.5.3.2c), introducing the changes in a controlled way (clause 8.5.6), auditing them for effectiveness (clause 9.2.2a) and reviewing the results (clause 9.3.2b). 

Is the serving large or small? Depending on your context (in this case,
the size of the plate) the same serving can look very different!

It's never easy. So it's always a relief when the changes turn out to be small and not big. But what makes for a big change?

It turns out that the answer depends very narrowly on the specific organization's current Quality Management System. Changes that are trivial for one organization might be huge for another.

This point was driven home to me back when the 2008 edition of the standard was being rolled out. At that time I worked for a regional office of a mid-sized global company. My office had started as an independent company of its own, and we still handled many of our operations the way we always had in the past (rather than integrating fully into all of our parent's systems). It made our QMS a little complicated 😀, but in practice it worked fine.

When ISO 9001 rolled from the 2000 edition to the 2008 edition, I looked through the changes. Mostly they looked superficial—minor changes to wording or sentence structure that made the text less ambiguous or more readable. 

• Passive verbs were replaced by active verbs. 
• The phrase "regulatory requirements" was replaced by "statutory or regulatory requirements." 
• Instead of being told to "identify" the processes in its QMS, the organization was told to "determine" them. 

This was the kind of change that I found throughout the document. And when I discussed the changes with our certification auditor (who was always very collegial when he was off-duty), he agreed completely. Neither of us found anything in the document to worry about.

Meanwhile the Home Office reacted to these same changes with panic. During Quality department staff meetings, I kept hearing that the updates in the 2008 edition were momentous, that they could require us to change everything. I didn't like to tell my colleagues they were wrong, but for some time I had no idea what worried them so.

Turns out they were worried over one provision. At one point, seemingly as an afterthought, the authors of the 2008 edition shed light on a requirement that had been more or less implicit before but never spelled out in words: in a clarification of clause 4.1 ("General requirements") the new edition now stated:

NOTE 3: Ensuring control over outsourced processes does not absolve the organization of the responsibility of conformity to all customer, statutory and regulatory requirements.

Why did this alarm the Home Office? I learned that they regularly outsourced certain processes that they did not have the capability to perform themselves, and the contracts with their suppliers made the suppliers responsible for all conformity issues involved. In other words, the Home Office had no systems in place to allow them to accept or exercise this level of responsibility; and the new edition of the standard meant they had to build those systems from scratch in a hurry. 

Our office, by contrast, had always taken that responsibility for granted, even when it wasn't explicitly stated. (You remember I said that many of our operations were left over from when we had been independent.) So for us, locally, this Note required literally no change at all to anything we were doing. And I'm pretty sure (from talking to other people later) that the authors of the standard thought the Note was no more than a restatement of something that had been implied all along.

You never can tell what changes are going to look big until you check the individual cases one at a time. It's remarkable, really.      

           

"Does ISO 9001 really require THAT?"

Everyone who works with ISO 9001 has run into That Person—the one who is convinced that the standard requires something crazy. Maybe it's the person who insists you have to document your paper clip usage ... or the one who tells you that auditors can write findings based on their judgement or opinions, or on a hunch that you might be doing something they personally don't like. Maybe it's The Stupid Label Guy. (See also this post here.) Sometimes, regrettably, it can even be your auditor, so that you have to have a long conversation during the Closing Meeting about why this or that topic really has no place in the report.

Arguing with these people can be exhausting. And sometimes it leaves you wondering, "Am I the crazy one?" When the plain sense of the words obviously means one thing to you, but That Person is totally convinced that it means something else instead, it's natural to wonder if maybe you are confused. Is there anywhere you can go to get an answer? Can anyone provide a clear, unambiguous, authoritative ruling on what the standard really means?

Yes, someone can. For myself, I spent way too many years in this business before I found out about them. So let me save you a little time, I hope, by telling you about them now.  

The authorities in question are a subgroup of the ISO Technical Committee 176, the committee responsible for writing ISO 9001. Their formal designation is ISO/TC 176/SC 2/TG 04, or ISO Technical Committee 176, Subcommittee 2, Task Group 4. And their whole job is to give authoritative answers to questions about what the standard requires.

Note the limitations. They are not there to give advice on how you might best implement the requirements of the standard. They won't analyze your business's special circumstances to suggest what you in particular will find efficient or useful. That's consulting, and there are lots of people willing to do it for a fee. But if you have a straightforward, Yes/No question—something like, "Does ISO 9001 require us to hang a printed copy of our Quality Policy in the lobby, signed by the CEO?"—TG 04 can give you a clear Yes or No that settles what the standard actually means.

There are a few other restrictions. To keep the volume of requests manageable, TG 04 replies only to member bodies—that is, national standards organizations who are themselves members of TC 176. If you or I, as private individuals, have questions of interpretation, our first stop should be our national standards organization. (Since I'm American, for me that means ANSI.) All questions must be phrased so that they can be answered Yes or No. And the website warns questioners not to expect an immediate reply: "As it is an official process, that involves developing consensus among the members of ISO/TC 176/SC 2 to agree on any proposed interpretation, a quick response cannot be expected." You can find a list of detailed guidelines at this link here. 

Still, it's nice to know that this group exists. When That Person tries to tie you in knots by insisting on something crazy because they think "ISO 9001 requires it," it's nice to know there's somewhere to turn to get a clear answer.

And it's especially nice to know you don't have to put a label on your coffee maker. 😀  

          

Oops, my bad—tools CAN'T always calibrate each other!

I goofed last week. I said you can have two tools calibrate each other, and I didn't put any restrictions around that. I was wrong.

You remember the whole topic was whether two tools can calibrate each other. The question I asked was this: "Suppose you calibrate some of your own tools in-house, instead of sending them out. And suppose that when you calibrate Tool-1, you use Tool-2. Normally there's nothing wrong with that, so long as Tool-2 itself is also correctly calibrated. But back when you calibrated Tool-2, you did it using Tool-1. Is that a problem?"

I argued that you can do this, within the parameters of quality system standards like ISO 9001 and ISO 17025. And right away I got helpful feedback from commenters on LinkedIn telling me, "Not so fast!"

Christopher Paris pointed out a technical issue I had forgotten. When I described the calibration history of Tool-1 and Tool-2, I traced them both back to the day you bought them from the manufacturer. I assumed you got a certification from the manufacturer at that point. But Chris observed "that the original calibration certificate from the manufacturer is rarely traceable to national/international standards. It's typically some basic certificate that doesn't really provide much information. So tracking back to that doesn't get you full compliance to ISO 9001. If the OEM's cert doesn't list traceable standards used to calibrate the device, then the device still has to be subject to a third-party lab or some other traceable calibration."

So yes, I accept that correction. Tool-1 and Tool-2 both have to be calibrated at the beginning in a way that is traceable to the correct international standards.

But what about the part where you then use the tools to support each other? What about the way that they leapfrog one another on and on into the future forever?

Scott Kruger and John Schultz each flagged this as an improper use case, and we had some helpful discussions about pragmatic topics to clarify why. But I wanted chapter-and-verse. If this is a bad practice, it should be forbidden by the relevant standards—either that, or there's a hole in the standards and someone is going to exploit it.

I finally found it, but I had to dig. ISO 17025, clause 6.5.1, states: "The laboratory shall establish and maintain metrological traceability of its measurement results by means of a documented unbroken chain of calibrations, each contributing to the measurement uncertainty, linking them to an appropriate reference." [Emphasis mine.]

Let's apply this to my thought experiment in last week's post. Here's what I wrote then.

Remember that when you calibrate any tool, that measurement typically has a validity period. Maybe it's valid for one year. So let's say you calibrate Tool-1 every January, and that calibration is good from January to December. Then you calibrate Tool-2 every July, and that calibration is good from July to June.

Last month was July 2023. Time to calibrate Tool-2.

So you pull out Tool-1. Is it a valid tool to use? Check the sticker. It was calibrated in January 2023, and is good through December 2023. So it must be good to use.

But wait. Let's check the paperwork to make sure. According to the paperwork, when we calibrated it in January 2023 we used Tool-2. Hold on! Isn't that the same tool we're trying to check right now?

No. It's not.

The tool we are trying to check "right now" (meaning last month, when I've set this story) is "Tool-2-as-of-July-2023." The tool we used last winter back when we were calibrating Tool-1 was "Tool-2-as-of-January-2023." If you look at it right those should count as different tools,....

Stop right there.

What I should have seen is that as soon as I treat "Tool-2-as-of-July-2023" and "Tool-2-as-of-January-2023" as different tools, I've got a problem. What does Tool-2's unbroken chain of calibrations look like?

July 2023: Tool-2-as-of-July-2023 was calibrated by Tool-1-as-of-January-2023.

January 2023: Tool-1-as-of-January-2023 was calibrated by Tool-2-as-of-July-2022.

July 2022: Tool-2-as-of-July-2022 was calibrated by Tool-1-as-of-January-2022.

January 2022: Tool-1-as-of-January-2022 was calibrated by Tool-2-as-of-July-2021.

And so on.

Every single one of those measurements introduced an uncertainty. Maybe it was small, but it was there.

Just to make things simple, let's pretend the additional uncertainty is the same each time. (In real life, it might not be.) Call that uncertainty ε. [That's a Greek epsilon.] Then every year that you play this leapfrog game, the uncertainty for each tool increases by 2ε (adding one in January and one in July). If you've been using Tool-1 and Tool-2 to calibrate each other for ten years, you have added 20ε to the uncertainty of each one. 

When does that accumulated uncertainty become too much? At what point does it make the tool worthless?

It all depends what you normally use your tools for. How small an uncertainty do you need? Maybe if the tools start off a lot better than you actually need, you can get away with it for a while. But you must need some level of precision and accuracy, or you wouldn't bother calibrating your tools at all. And you probably didn't spend the extra money to get tools that were 100x more precise and accurate than you really needed. So you can't really play this game too long. Certainly not forever.

As I say, I goofed. I was wrong, and I'm grateful for the corrections. Thank you, all. 

           

How would YOU change ISO 9001?

Let me start by saying that there are no current plans to update ISO 9001. ISO's technical committees review each standard every so often, and at the last review of ISO 9001 the vote was (by a narrow majority) to leave it as-is. I do not know the date of the next review.

But that doesn't stop people from having ideas about things that they'd like to see changed or improved. We've all got opinions about things we'd like to see changed in the world. And for those of us in the Quality business, it's no surprise if some of those opinions have to do with the international Quality standards. Why wouldn't they?

Over the last several months, I've talked and listened to a number of people about this subject, and I've heard a lot of different opinions, both pro and con. So I thought today I'd just list some of the ideas I've heard, to give you an idea of the thinking that's out there in the world right now. And while you are reading, please ask yourself: How would YOU change ISO 9001, if it were up to you?

Please leave comments with your answers. I'd love to get a discussion going.

Address new topics

A lot of the people I've talked or listened to expressed that they would like to see ISO 9001 address topics where it is currently silent. 

• One person wanted to see a better focus on business continuity management, because it is hard to ensure that you can perform reliably when you are at risk from any unexpected disaster. 
• Another wished that ISO 9001 would tie process requirements to business results, so that leaders can see right away their return on any investment in their Quality Management System. 
• A third pointed out that many different sectors of the economy write their own sector-specific standards based on ISO 9001, and added that we could slow the proliferation of this forest of specific standards if ISO 9001 itself took some cognizance of the needs of these sectors. 
• And a fourth suggested that since ISO 9001 is so widely-accepted around the world, maybe it's time to "raise the bar" so that it no longer represents a "bare minimum" set of requirements.*

Quite a few people said that their opinions were based on the world's experience with COVID-19 over the last few years. They pointed out that the lessons from COVID-19 extend far beyond simple business continuity management to touch topics like workforce relations and supply chain disruption. And it goes farther than that. We all know there is a direct linkage between the Context of your Organization (COTO) and your risks; so just as COVID-19 showed us risks we might not have thought of before, it also suggested another dimension to our COTO analyses.

Some organizations have made the switch to a work-from-home (WFH) model, or else a hybrid between WFH and in-office work. Does that change how we engage with our workforce? It might—and so I've heard people suggest that we need to revisit Clause 5 (Leadership) and Clause 7 (Support). Likewise, some registrars are doing a large number of remote audits, which argues for a review of all the guidance to auditors. What is more, organizations with multiple locations are making greater use of remote internal audits, which suggests that we had better review Clause 9.2 (Internal Audit).

Of course, climate change is currently the occasion of much debate, and I've discussed it before in this venue (see here, here, and here). Since the London Declaration specifically commits the ISO to "foster the active consideration of climate science and associated transitions in the development of all new and revised International Standards and publications," some people have argued that there is now a strict requirement to update all standards (for example, ISO 9001) to include verbiage with the word "climate." Others have replied that "active consideration" doesn't have to require changing the text, so long as the committee can prove that they have fully evaluated all sides of the issue. The last time I heard any news on this question, it had not been definitively resolved.

Make editorial improvements

Other suggestions have been of a narrower and more practical sort. 

• There are some clauses that always generate requests for a formal interpretation. There are others that users regularly say they find hard to implement.** Why don't we rewrite these to make them simpler and easier? 
• Someone else pointed out that there are non-prescriptive clauses in the standard which are very hard to audit.*** Maybe we could rewrite these to be easier on auditors? 
• A third person made the much bolder suggestion, "Why don't we just merge ISO 9000 into ISO 9001, instead of requiring so many references back and forth?"****

These are what I mean by "editorial improvements," and for the most part (except maybe that last one) I think they are pretty uncontroversial.

Think about how users see the standard

Some of the ideas I've heard have been more focused on protecting ISO 9001's "brand integrity," or making sure that users continue to see it in a favorable light. One of these came from someone who posed it as a rhetorical question this way: "Any time we decide to update a standard, it takes so long to get it through the review and approval cycle that if we don't hurry up and decide to change something the next edition won't come out till 2030. And who's going to take the standard seriously if it's15 years old?"

On the other hand, it was from people concerned with brand integrity that I heard the most cautionary voices against updating ISO 9001. These were people who all argued, in one way or another, that any change creates churn and uncertainty in industry, drives up supply chain costs, and introduces risk. So unless there is a compelling reason that forces a change, these people argued that the user base will see minor updates as frivolous and this will weaken the standard's prestige. Even people who acknowledged that there are big suggestions on the table—some of the "new topics" I listed above could potentially be huge—followed up by saying that there is no consensus on these topics across the relevant committees, so the warring opinions might cancel each other out and leave us with nothing but the editorial changes that are easy to agree on.

Other thoughts

Finally, a couple of people pointed out that a new edition of ISO 9001 would mean good financial news for ISO, because they sell copies of the standard; and also for consultants and trainers, who could sell more training courses. In almost the same breath, they admitted that the user community would probably resent having to buy an updated edition and pay for all those classes. So the financial argument supports both Pro and Con.

So there's a list of thoughts I've heard from people. I might have missed one or two, but I think it's pretty substantial anyway.

Now I want to hear from you. What's YOUR opinion on changing the standard? How would YOU change ISO 9001, if it were up to you?

Please leave a comment and let me know.

__________

* I didn't have the time right then to discuss this suggestion in detail with the person who proposed it; but in retrospect my own opinion is that we will always need something to define the "bare minimum" acceptable Quality requirements, so that we know the difference between "good enough to squeak by" and "bad enough you have to reject them." If we don't use ISO 9001 for this job, it has to be something else. But in that case, what? And until we define that "something else" I think we have to keep using ISO 9001 to fill that role.    

** Sorry, I didn't think to jot down a list of examples at the time, so I can't offer you one.   

*** Clause 7.4 (Communication) is an example, because it asks the organization to determine something but gives no requirement to document the determination in any kind of record or other auditable artifact.  

**** My only comment on this suggestion is that it would more than double the length of ISO 9001.     

            

ISO's rules of confidentiality

Not the same as TAG 176!
For the original cartoon,
see here.

Last year I joined TAG (Technical Advisory Group) 176: that's the American delegation to ISO's TC (Technical Committee) 176, which is in turn the committee that writes ISO 9001 and related standards. This lets me join discussions about upcoming developments in the standards, but it also imposes some strict limits on what I am allowed to say. I've alluded to these rules briefly in a couple of earlier posts, but maybe it would be useful for me to take a minute and spell them out clearly.

The point behind the rules is straightforward. On the one hand, it's only natural for people to want to talk about their work; and for people on any of the ISO Technical Committees, their committee contributions are an important part of their work in general. On the other hand, when the ISO publishes an international standard, that standard has (by definition) a very wide impact. A lot of people care about what goes into the standards. And it can be hard to focus on a technical discussion if your friends and neighbors are clamoring for you to take one side or the other ... or if opinion columns on the air or in the newspaper are bickering about it. There's also a good chance that the people arguing the loudest might have a weak grasp of the actual technical issues at stake. So for all these reasons it is clear that common sense requires some level of confidentiality for any discussions that are still under way.

The ISO has defined a set of rules governing communication of committee work, and published them in a booklet. You can download it for free from this link here. The booklet covers multiple topics, including how to participate in committee work and how long to retain documents, but I want to focus specifically on one area: what rules govern the communication of information about the work of committees and working groups, from committee members and to external parties.

(Note that the scope of the regulations is limited to committee members. If you go to a fortune-teller who uses psychic powers to divine what's happening inside the ISO committees, I'm pretty sure the pamphlet doesn't apply. At any rate, there's no reference to psychic powers anywhere in the pamphlet—I checked. 😀 But then you have to decide how accurate you think that report is likely to be.)

With all that said, here are the rules that apply to anything I say or write:

• I am not allowed to reveal the personal data of any other committee member. That's fine with me, because I have no interest in talking about persons. All I care about in this context are the ideas and proposals.
• I am allowed to say whether a specific vote passed or failed, but I'm not allowed to reveal how any particular individual or National Standards Body voted. But that's fine too. See above.
• I am not allowed to speak on behalf of any National Standards Body. That's fine; I wouldn't dream of it.
• I am not allowed to share any presentations or working documents. And I won't. If I mention that there was a discussion about this or that topic, I will base my remarks strictly on my own memory or my own notes. And I'll never say who was involved in the discussion, or who else agreed.
• If a committee finally arrives at a consensus opinion, I am allowed to say so.
• And I am allowed to express personal opinions, provided: that I identify them clearly as personal opinions; that I do not criticize or expose the views of others, that I do not speculate on the outcome of future decisions, and that I do not criticize the committee. But, as noted, I never want to talk about persons anyway. And I am confident that the committee will do the best that it can on any of the questions facing it.

These rules are on my mind because there is a Plenary Meeting of TAG 176 ongoing today and tomorrow, and one of the speakers reminded us of them. This speaker was talking about the status of one particular topic that has gotten a lot of attention lately, and urged us to be careful how we spoke about it so that people in the outside community didn't get the wrong idea. Among the specific pieces of advice we were given were these:

• Don't mislead anyone into thinking that changes to this or that standard are imminent. Even if we do decide to change something someday, there's a long process to go through before we get there.
• Don't mislead anyone into thinking that TAG 176 has an official position on the issue. Certain committee members have been involved in this or that discussion, and likely they all have personal opinions. But the TAG itself has not taken a position yet.
• Don't tell your friends they have to make radical changes to their businesses starting tomorrow, when we don't even know if anything will ever be decided ... or how.

All this sounds very practical to me. And it's good to be reminded.