Can things ever get better?

Does it ever seem to you like things are getting slowly worse all the time? It can't be just me. And last week I finally saw a video that explains why.

It's a joke, of course. The video purports to show us "A Day in the Life of an Ensh*ttificator," someone whose job it is to make every product and service a little bit worse. The main character addresses the audience directly, explaining that he inherited his calling from his father before him. And at first he starts off small: cutting holes in the toes of socks, and sawing half an inch off one table leg so that the table rocks. But the Internet allows him to expand his operations. Soon he offers online services for free—just long enough to get users hooked on them—and then incrementally degrades the services to encourage customers to pay for "Premium" status (viz., the same level of service that was free last year). I won't give away the punchline, but the ending is perfectly in line with the dark humor that pervades the rest of the video. It's well worth the four minutes.

Wow, that sounds cynical! Who made it? Some disgruntled undergraduate? 

The "Breaking Free" report

Actually, no. The video was produced by NewsLab, a Norwegian communications agency; but it was commissioned and publicized by Forbrukerrådet, the Norwegian Consumer Council. Their point is to advertise a new report which highlights that this drift towards "enshittification" is a conscious, deliberate policy of the major firms in Big Tech. The report, entitled "BREAKING FREE: Pathways to a fair technological future," spells out the exact steps by which major tech firms hook customers with free or discounted services, and then squeeze them for payment once the cost of leaving the service is too great. Nor do they stop there. Forbrukerrådet winds up the report by identifying a slate of legislative measures to protect consumers from this predatory behavior. And in a logical next step, they and other allied consumer organizations have already sent letters to legislators in Norway, in the European Union, and in the United States urging adoption of these measures.

In case it's not clear in what follows, I wish them well. I agree that life is worse when online services are designed so that you can't easily switch between providers. And it could be interesting to study the slate of concrete measures proposed in the report, to understand how likely they are to achieve their stated goal. If you want me to drill into the details in a future post, please tell me in the comments. What is certain is that even with the best measures, bringing the corporations to heel won't be easy. (Consider the "Alternative to fines" discussion in this post from two years ago.) But what I want to ask right now is a far more basic question. Once the legislators get these letters and read them, what motivation do they have to act on the proposals? What's in it for them?

Finn Lützow-Holm Myrstad,
Director of Digital Policy,
Norwegian Consumer Council

I don't know how politics works in Norway, nor at the pan-European levels of the EU. But in the United States, legislators are generally motivated by re-election. They support measures that will get them re-elected, and they oppose measures that would prevent their re-election. The Big Tech firms contribute generously to the campaign funds of legislators who are disposed to help them. Who contributes to their opponents? Who is out there in the public square, capitalizing on the attention earned by this funny video, mobilizing voters to throw out the rascals who protect Big Tech and to replace them with insurgents defending the Common Man? Can you think of a name? Anyone?       

Because without such mobilization, I think the measures are going nowhere. If legislators are motivated by re-election, then the surest way to make progress on this topic is to convince those legislators that supporting consumers against the depradations of Big Tech is essential to getting re-elected. It might be possible to make such an argument some day, with enough organization. But up till now I have not heard it made.

Maybe it sounds like I'm ranting, or preaching cheap gloom-and-doom. But I'm not. There's an important Quality lesson here, one that applies to every improvement project you undertake—in the office, on the shop floor, or anywhere. The point is this: 

• Every improvement project requires someone in authority to say, "Do it."
• Therefore, every improvement has to look good to the person who authorizes it.
• This means that no matter how much benefit the improvement might bring, it won't happen unless you can persuade the person in authority that he or she is better off approving the project than rejecting it. At some level, there has got to be something in it for him or her.   

Often that "something" is just that your improvement will make things run smoother in the office or on the shop floor, and naturally the boss wants things to run smoother. That might be enough. In other cases, you might have to be a little more persuasive. But the point is that there has to be something. And my biggest concern about the package of reforms that the Forbrukerrådet has proposed to protect common consumers against Big Tech is that these measures benefit everyone except the tech executives themselves and the legislators who have to pass the laws. 

      

"How can we save the polar bears?"

A month ago—almost two, now that I check—I wrote about Kyle Chambers of Texas Quality Assurance, and how he and I came away with totally different understandings when we read the ISO 9001 Auditing Practices Group Guidance on: Auditing Climate Change issues in ISO 9001. Kyle summarized his perspective in a podcast with Caleb Adcock. It's a good podcast, and I suggest you go listen to it if you haven't yet.

My earlier post explained why Kyle and I read the document so differently, but in the course of the podcast he and Caleb raised a number of other topics they didn't have time to explore. For example, at about 19:28 they ask,

"What about the company who says 'We have only 100 employees, so how can we save the polar bears?'"

This is a really good question, and it gets to the heart of ISO 9001's new requirement about climate change. 

What does the requirement say?

The first important point is to recognize that the climate change requirement comes in clause 4.1, so it relates to determining the context of your organization. It never says you have to take this or that concrete action to address climate effects. The full text of the requirement is simply: "The organization shall determine whether climate change is a relevant issue."

To be clear, there is a lot hidden behind that simple statement. If you decide that climate change is a relevant issue for your organization, then ISO 9001 asks you to do something about it. If you say it's relevant and then take no action, you'll have a lot of explaining to do in your next audit.

On the other hand, that requirement is also common sense. The key word is "relevant." If an issue is relevant to your business, that's not the same as saying it's important. "Relevant" means that the issue affects how you do business in some way, that you have to make a change (positive or negative). 

For example, let's say that you sell hot dogs off the pier, and suddenly you learn that a rogue asteroid is going to destroy the Earth in 30 minutes. That asteroid is obviously important. But there is probably nothing you can do to stop it, so there's no point in making any changes to your business in the next half hour. The asteroid is important but not relevant. 

Therefore, if you decide that climate change is a relevant issue for your organization, that means that you have already determined you need to take some kind of action. If you need to take action, you'll do it with or without ISO 9001. So do what you have to do. Then document it for the auditor, and you should be fine. On the other hand, if climate change makes literally no difference to how you conduct business, then that means climate change is not relevant for your organization. That doesn't mean that you are denying climate change.* It's just a technical evaluation about how you do your work. 

What's a small company to DO? 

Fine, but what is a small company to do? How can a small company save the polar bears?

Well, mostly you probably can't. (If you know a small company that makes VOOM or other magical compounds, they might be an exception.) But the key is to go back and think about whether there's anything else you might have to change.

Here's an example:

I know a small company in the Pacific Northwest. They are in an urban area, but all around them are forests. And every summer, for as long as anyone can remember, they've had forest fires. Forest fires generate smoke, so the air quality turns bad. And the company has a few key employees who suffer from impaired breathing for one reason or another. So whenever there's a forest fire, a few employees call in saying they can't come to work.

Things have been like this as long as anyone can remember, and the company has always planned their employee allocations on the assumption that the bad air from forest fires will last three or four days each summer. But in the last couple of years—no one has exactly kept track of the dates, but it seems like a recent development—forest fire season each summer has stretched from a couple of days to a couple of weeks. As a result, the company has had to rethink all their summer staffing, to account for the longer stretches when certain people are unavailable.

Is this the result of climate change? Probably. At least it might be. But honestly, who cares? What is unquestionable is that the worsening air quality is a documented fact, and that it has forced the company to make changes in their staffing plans. This particular company is not certified to ISO 9001. But if they were, I would advise them to document these staffing changes as their response to the requirement that they determine whether climate change is a relevant issue for them.

If you are a small company, think what this example might mean for you. All your details will be different, of course. But look for any points where you find you have to change how you work, in order to account for changes outside you. Those are the points most likely to be relevant. Then do what you have to do.

Most of the time it should be that simple.

__________

* It is not my purpose here to take any position in the public and political debates about climate change itself, because the Quality business has intelligent people on both sides of that divide. My only point at the moment is that arguing whether climate change is real is a totally different question from arguing whether it is formally relevant to this or that specific business.      

Climate change and bad audits

A while ago—six weeks, now that I check—I wrote about how to audit the recent Climate Amendment to ISO 9001. I based my advice on a guidance document issued by the ISO 9001 Auditing Practices Group, entitled (unimaginatively enough) ISO 9001 Auditing Practices Group Guidance on: Auditing Climate Change issues in ISO 9001. At the time, my basic conclusion was that the requirements were not heavy or onerous.

A couple of weeks later, Kyle Chambers and Caleb Adcock of Texas Quality Assurance released a podcast on the exact same topic. (See the YouTube link below.) I usually appreciate Kyle's pragmatic approach to the ISO standard, so I assumed he would see this guidance the same way I did; but it was a while before I had time to listen to his podcast. It turns out, though, that his take is almost the opposite of mine! He summarizes the APG document as "a whole guidance document of gotchas!"

How is this possible? After listening to the rest of Kyle's podcast, I think I see what happened. Like so much in the ISO world, it all comes down to context and interpretation. Also, it seems like some of Kyle's clients have been saddled with really poor auditors. I'll explain what I mean as we go on.

Agreements

Let me start with the parts where we agree. Kyle's basic advice to his clients (around 21:00) is that you shouldn't need to do anything you aren't already doing to manage your business. But you may have to document what you are doing, and wrap it up in the language of risk management. Caleb makes the same point in different words (around 22:10) by spelling out that if you have determined that climate change has a significant impact on your business, then naturally you are going to implement steps to manage that impact so that you can keep your doors open. You'll do this with or without ISO. So just document it.

If you believe that climate change has no impact to your business at all, Kyle suggests (24:48) that you should still keep an eye on the legal and regulatory aspects affecting you, in case they change.

And Caleb makes the critical point (13:53) that "The auditor is not the risk police." In other words, when a business makes this or that determination about the relevance of climate change to their operations, it is not up to the auditor to overrule them.

I agree with all of this. 

Bad audits

Where Kyle and I part company is over what to expect in your audits. When I read the guidance document, I approach it as an auditor and I think about what I would do. Practically speaking, an auditor is constrained by the clock: you've got to get through the whole organization, and you've got only a few hours to cover it all. So mostly you don't have time to add any new topics, because the old topics will already keep you busy enough. (I discuss some of the auditor's mindset in this post here.) Therefore, if I were the auditor, I would scan through the ten-page document to look for two or three extra questions I could ask. Then, depending on the answers, I'd see where the trails led from there. Obviously this guidance document includes a lot more than two or three questions—it's ten pages long, after all!—but there are lots of different companies out there to audit. Questions that work for one won't work for another. So the document includes a lot of examples to choose from. 

But some of Kyle's clients have had auditors who took a very different approach. He describes (at around 8:00 and following) having long arguments with auditors who insisted that the client organizations had to answer every single question in the document, or at least a couple of questions from every section—regard­less whether the questions made any sense for the business! Kyle kept saying, "The company doesn't do that," and the auditor kept insisting, "My Certification Body gave me a form to fill out and I have to put a piece of evidence in every blank. So I don't care if it's irrelevant. Give me an answer anyway!"

This argument went on for a long time.

In a sense I feel bad for the auditor. If the CB really did give him a form like that, and if they really did insist that he had to fill out every blank, then they set him up for failure. But whoever is ultimately responsible, this is bad auditing! How much time did the auditor waste arguing over these points? Whatever it was, he didn't get it back later. The more time he spent barking up the wrong tree on climate change, the less time he had to check calibration, operational controls, handling of noncon­forming material, documents and records, internal audits, or management review. In fact, if a company were unethical, they could use arguments over climate change evidence to run out the clock, so they never had to confront hard questions in other parts of the operation. And any auditor who lets himself be played like this isn't good at his job.

I wish I could say this will never happen, but obviously I'd be wrong because it has. All I can say is that no experienced auditor should let himself get tangled up like this, and I'm sorry that Kyle's clients got stuck with someone who did. 

Other topics

Podcasts are conversations, and conversations meander. In the course of this discussion, Kyle and Caleb raise a number of interesting or tantalizing side topics. 

• At about 15:30, Caleb asks if there's a difference between addressing risks from climate change and addressing risks from natural disasters. (Answer: It depends.) 
• At 18:50, Kyle asks how it is possible for a really big company to get certified to ISO 9001, because it has so many parts that they can't all play together. (Answer: I've worked for global companies that were committed to ISO 9001 certification, so it's possible. But you're right that it ain't easy.) 
• And a little later, at 19:28, they ask, "What about the company who says 'We have only 100 employees, so how can we save the polar bears?'" (Answer: I've talked to small companies too, and yes, that's a concern. But some of the answers are interesting.) 

Each of these deserves a longer answer, along with plenty of other questions that they raise but don't have time to pursue. I won't take the time here. But if you'd like me to address one or another of them, leave a comment to let me know.

Meanwhile here is a link to their podcast on YouTube.

      

Auditing the climate amendment

In February of last year, the ISO formally adopted an Amendment to ISO 9001, relating to climate change. (In a stroke of ironic timing, I published an article with Quality Digest just days before the decision, on the subject, "What would it mean if this amendment were adopted?") And right away, voices began calling out, "How do we audit the new requirement?"

Strictly speaking the Amendment added one new requirement to ISO 9001:2015, and one note. The requirement is added to clause 4.1, which discusses Context of the Organization (including the internal and external issues facing the organization), and it provides:

The organization shall determine whether climate change is a relevant issue.

The note is added to clause 4.2, which discusses the needs and expectations of the organization's interested parties, and it reminds the reader:

Relevant interested parties can have requirements related to climate change.

That's it.

Now, the note is literally just a reminder. It is not auditable, which means that there is no need for the organization to show an auditor any objective evidence related to it. But whenever the ISO standard uses the word "shall," that word creates a requirement. The organization has to do it, and has to be able to prove it to an auditor.

Only, ... what questions can the auditor ask to check whether the organization made the determination they are required to make? Auditors started asking for guidance.

And the ISO 9001 Auditing Practices Group rode to the rescue! I don't remember if I've mentioned this group before, but they write papers on how to audit to ISO 9001. They have a website here, which hosts a large library of these papers available for free download. If you ever want official advice on how to audit some part of the ISO 9001 standard, check their library first.

Sure enough, just a month after the Amendment went into effect, the APG published ISO 9001 Auditing Practices Group Guidance on: Auditing Climate Change issues in ISO 9001. You can find it online for free, located here.

As a side note ... I remember when this document first came out, somebody on LinkedIn remarked that the paper is ten pages long. He argued that for it to be so long "proves" that the new requirement "must be" heavy and onerous. I no longer remember if he went so far as to accuse the Lizard People of using this requirement to crush small businesses, and I have lost the link so I can no longer re-read his post to check. But I almost expected him to.

So as a public service, let me reassure you: There is no sign that any Lizard People wrote this paper, and the requirements are not heavy or onerous.

Fine, what does it say?

The basic advice is simple:

• Stay objective.
• Ask if the organization has decided climate change is relevant to them?
• If yes, what steps are they taking?

Let's look at each of these briefly.

Stay objective

When this amendment was first debated, I heard one person say:

"It is impossible for anyone to pretend they aren't affected by climate change. Therefore the answer to the question 'Is it relevant?' has to be Yes, and if someone says No you can write him up!"

The APG rejects this line of thinking. They point out that each organization has a right to make this decision for themselves. The APG paper goes on to say:

In some parts of the world climate change and its causes are controversial topics. Consistent with ISO 19011:2018 Guide­lines for auditing management systems, auditors are to maintain objectivity and neutrality when auditing climate change issues. They should not express personal beliefs relating to climate change. The role of the auditors is to assess whether the organization determined if climate change issues are relevant or not in relation to their QMS and its intended results and, if that is the case, then how it is addressed within the QMS.

This amendment does not require an organization to have climate change initiatives unless it has been identified as a relevant issue to achieve the intended results of the QMS.

Is it relevant?

So the first thing to ask is whether the organization thinks climate change is relevant to them? This means: Do they think that there is a credible risk that climate change can affect their ability to supply their goods or services to customers?

While you are asking that, the paper suggests that you might also check whether the organization has any statutory or regulatory requirements that could affect the answer? And likewise, do they have any contractual requirements that could affect the answer? Obviously you (as an auditor) want to see that the organization's decision on this point is aligned with their legal or contractual requirements.

And then the paper suggests other directions you might explore:

• Is the organization starting to use renewable materials?
• Have they been asked to move to carbon neutral products and services?
• Have energy issues pushed them to reorganize their operations or infrastructure?
• Are they seeing a greater frequency of storms, floods, fires, or drought? And if so, do those developments affect their employees, their supply chain, or their distribution?

And so on. The paper lists many more questions that you might consider.

What steps are they taking?

If the organization determines that climate change is out of scope for their Quality Management System, the discussion ends there. But if they decide that it is a relevant issue, then the basic logic of ISO 9001 requires that they address it one way or another. Naturally the details will be different for every organization. But you can follow the climate theme as a thread throughout the rest of the audit:

• When you audit the scope of the QMS in clause 4.3, you can check whether they still use the same industry codes as before. Are they still making the same products, or in the same line of work?
• When you audit risks and opportunities in clause 6.1, what risks and opportunities have they explicitly identified that relate to the climate? How have they evaluated them? Have they assigned actions to address the risks or capitalize on the opportunities?
• When you audit changes in clause 6.3, consider all the other changes listed here. Has the organization handled them in a planned and controlled way?
• When you audit the work environment in clause 7.1.4, has it been affected by the climate in any way? Has the organization taken any steps?
• When you audit operations in clause 8, how have their operations been affected? (The APG paper offers a full page of suggested questions for clause 8 alone, but of course the details will always depend on the individual organization.)
• When you audit performance evaluation in clause 9, what aspects of climate impact or climate mitigation are the organization monitoring and measuring? Are they monitoring and measuring data that are related to the impact or the risks they have identified? Are the tools and methods that they use for this monitoring and measuring actually fit for purpose? And how is the organization checking to ensure that the changes they have implemented really work?

Again, the paper gives many more suggestions besides these. And of course you would never use every single question. It all depends on what fits, based on the details of the organization.

None of it is heavy or onerous. And it all flows logically from the actual requirements. But I am glad to know that the suggestions are available, as a support.

If you're not familiar with the Auditing Practices Group, be sure to check out their library.     

    

The Braganza gambit

And now, if I may digress momentarily from the main stream of this evening's symposium,* … I'd like to raise a question which relates more to regulatory compliance than to Quality per se, but which has bothered me from time to time, and which seems to lurk on the margins of other—more normal—Quality topics. (In fact I plan to discuss one of these next week, in a follow-on essay.)

The background is this: First, we all know there is such a thing as global trade. In fact, the whole point of international standards is to facilitate global trade. As I explained once in this forum a couple of years ago, "A standard is like a common language: it allows us to do business with strangers, because we know that we are both talking about the same thing."

Second, we all know there are global (or at any rate multinational) corporations. Over the course of my career I've worked for at least two companies headquartered in Europe (LM Ericsson and Robert Bosch), even though both times my local office was in southern California.

Third, we all understand more or less how companies are regulated. Some authority codifies a set of rules: those rules might be voluntary (like ISO 9001) or legally mandatory (like health and safety regulations). Then the company decides whether they want to abide by these rules. (In the case of mandatory legislation, we should assume that the answer is always Yes.) If yes, the company takes steps to implement the rules; and if they fail, there is some kind of system in place whereby someone can complain. When the authorities get a complaint they check the facts; and if the company has indeed failed to meet the requirements, the authorities react accordingly. In the case of ISO 9001, the responsible Certification Body can decertify the company; in the case of legal noncompliance, the relevant government can impose civil or criminal penalties.

Now finally here's the question: How do you regulate an international company?

I fear that the answer may be: Mostly you can't. I'll explain why, but I would be delighted if you can show me where I am wrong.

Let's say that some local company violates a local regulation. Government inspectors come out to check the status, and—depending on the severity of the issue—they might give the company written notice to correct the problem in a defined time, or they might padlock the doors. If company personnel try to interfere with the government inspectors, they can be arrested. And since it's a local company, that's all it takes to stop them doing whatever Bad Thing they were doing. Problem solved.

Suppose that the company has multiple branches in the same state: then, depending on the nature of the Bad Thing that Law Enforcement is trying to stop, they might have to take a heavier approach. Or they might leave the branches alone but target headquarters. If the company has branches all over the United States, Law Enforcement has to get more ambitious still, because sometimes state laws disagree (so the Bad Thing might be legal in another state). Also, local Law Enforcement is unlikely to have jurisdiction in another state, and so will have to coordinate with other agencies in order to stop the Bad Thing once and for all.

But if the company has offices all over the world, then what? The very most that American Law Enforcement authorities can possibly do is to arrest whichever company personnel happen to be located inside the United States. But they are powerless over the offices in Ruritania or Grand Fenwick.    

In the ordinary course of things, a multinational company will probably find it convenient to comply with routine local regulations, because they will see those regulations as just a cost of doing business. As long as the opportunities in a country are bigger than the costs, they are likely to cooperate. But this cooperation is strictly a voluntary choice on their part. In an extreme case, they can always shut down the local offices and leave.

This strategic departure from a country because you don't like the laws is what I call the Braganza gambit. The Braganza family ruled Portugal and the Portuguese Empire from 1640 until 1910. During the Napoleonic Wars in the early nineteenth century, Napoleon Bonaparte installed many of his relatives in thrones across Europe. His method—used for example in the Peninsular War against Spain—was to defeat a country and capture the royal family; then he could force them to abdicate in favor of one of his relatives and move on to the next country.

By Lumastan - Own work, CC BY-SA 3.0, Link

But not in Portugal. The Braganzas saw what Napoleon was doing and realized they were next. So they moved the entire royal court to Brazil, which was at that point part of the Portuguese Empire. When Napoleon conquered Lisbon, the royal family was nowhere to be found. (In the end they liked it in Brazil, and didn't move back until 1821—long after Napoleon was no longer a threat.)

So there you have it. Multinational corporations have the privilege—unavailable to local corporations—that they can (within limits) decide which legal regulations they feel like following. And in case any regulation is too burdensome for them to tolerate it, they have the option of leaving the country.** 

If a multinational corporation decides to use the Braganza gambit to avoid an onerous regulation, about the only leverage the abandoned country has is to close its markets. "If you won't abide by our rules, you can't sell your goods here." Whether that's a meaningful threat depends very much on the particular details, and of course sometimes the same maneuver plays out in reverse: a company might refuse to sell into a certain country until this or that policy is changed. It is hard to generalize about how effective either tactic is.*** 

What do you think? Am I wrong? Is there something I've neglected?

Or can multinational corporations escape troublesome regulation just by moving abroad? 

Please leave me a comment with your perspective. 

__________

* Tom Lehrer, introduction to "The Elements," Reprise/Warner Bros. Records, track 4 on An Evening Wasted With Tom Lehrer, 1959, LP record.  

** There's even a related line of thought that protects international organizations. Concretely, if you or I (as private citizens) feel wronged by some decision from an international organization like the WEF or the ISO, we may find it hard to sue them for redress because it's not at all clear which court—if any—has the appropriate jurisdiction.

*** Certainly this is the logic behind international economic sanctions, where—in this case—one government requires all the companies subject to it to avoid business in another country until that other country changes its policies. When small countries are subjected to coordinated sanctions, the effects can be crippling. When large countries are subjected to them, the results are not so immediate. Consider, for example, this recent video by a YouTube creator "Eli from Russia," who publishes travel information (and strictly avoids politics). She describes the impact of sanctions on Russia, and the results have been (to say the least) not uniform.

    

What Does ISO 9001 Have to Do With Climate Change?

This morning, Quality Digest published my article, "What Does ISO 9001 Have to Do With Climate Change?." It's their article now so I won't post the text of it here, but you can find it by following the link. I hope you find it useful!

How could ISO 9001 stop climate change?

I was going to write more about systems thinking, but something has come up and I want to address it while it is still timely. Two weeks ago the leadership of TC176 SC2 (that's the subcommittee that writes the ISO 9001 standard) held an ad hoc meeting to discuss what impact the topic of climate change should have on ISO 9001.*

Image by Kanenori from Pixabay

You remember I wrote about this topic last fall in this post here. At the time, I argued that climate change is out of scope for ISO 9001, and that any attempt to shoehorn the topic into the standard would be bad for the ISO brand. Specifically, I think there is a meaningful risk that updating ISO 9001 to address climate change will either push companies to abandon ISO 9001 or else make them more cynical about the process of certification. Or both, of course. I have not changed my opinion in the intervening months. 

But my opinion is, to put it gently, not the only one on the table. So there was a meeting to talk it over.

What was proposed?

Under discussion were two proposals. Both were to add specific wording to the Harmonized Structure for ISO Management System Standards. That means that this wording would appear in management system standards across the board: not only ISO 9001 and ISO 14001, but ISO 20000, ISO 21001, ISO 22000, ISO 28000, ISO 29001, and obviously many others.** 

The first proposed change would add a requirement to subclause 4.1 as follows:

Today the clause reads:

4.1 Understanding the organization and its context

The organization shall determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended result(s) of its XXX management system.

The proposal would add:

The organization shall determine whether climate change is a relevant issue.

The second proposed change would add a note to subclause 4.2 as follows:

Today the clause reads (with minor variation among standards):

4.2 Understanding the needs and expectations of interested parties 

The organization shall determine: 

— the interested parties that are relevant to the XXX management system; 

— the relevant requirements of these interested parties; 

— which of these requirements will be addressed through the XXX management system.

The proposal would add:

NOTE: Relevant interested parties can have requirements related to climate change.

What does the first one mean?

Image by Darwin Laganzon from Pixabay

The first proposal adds a "shall" statement. This is an explicit requirement. It is auditable. Every certified organization would have to comply.

Even so, this "shall" statement would not require that an organization actually do anything about climate change. In fact if the organization were (for example) a hamburger stand—and ISO 9001 is supposed to be applicable to hamburger stands, in case one wants to be certified—there might not be much meaningful that they could do. But they would have to "determine" whether climate change is a relevant issue for them. Since this requirement is auditable, they would have to keep meeting minutes showing the decision. 

Not everyone agrees with me that some organizations might find it hard to take meaningful action against climate change. During the discussion, some people argued that, "There is not one organization in the world that can determine climate change is not a relevant issue. This would de facto mean you have to address your influence on climate change, even without requirements from relevant parties (see 4.2)."

I disagree, and I think the people who argued this have confused two different questions. The problem is that the word relevant is ambiguous. So I think these people have conflated: 

• Will the organization be affected by climate change? ... and ... 
• Can the organization do anything about it?

I am prepared to agree that the answer to the first question is "Yes" for most people (and therefore most organizations). But for small organizations the answer to the second question is often going to be "No". And those organizations should be allowed to say so when they establish their Context.

What does the second one mean?

Chemical Engineer, Public
domain, via Wikimedia Commons

The second proposal simply adds a note. Notes are not auditable, so this would not impose any requirements on the certified organization. In fact, the note doesn't address the certified organization at all: what it tries to do is to read the minds of interested parties by describing what can be included in their requirements. But it is still up to the interested parties to explain their requirements to the organization. It is never the organization's job to tell their interested parties what they should want.

To be sure, as an objective statement of fact the note is completely true. Relevant interested parties can have requirements related to climate change! There is no question about that. Of course, they can also have requirements related to macramé antimacassars, so by itself that's not saying much. Still, it's a true statement that requires nothing from the organization which they aren't going to hear about anyway. In that sense the proposal is completely harmless, and it gets the words "climate change" into every standard that follows the Harmonized Structure without disrupting anything else. From a certain perspective that might look like a win for everyone. 

What was decided?

In a final sense, nothing was decided. What I mean is that there were no formal decisions to make any changes to ISO 9001 or any of the other standards based on this meeting. Lots more votes will be required, at multiple levels, before any changes are formally authorized. But the options were reviewed, and doubtless some suggestions based on this meeting will be forwarded on to the next one.

If you are involved in this decision process, please think about which position you most agree with. If you are on the receiving end of the output, you may find it helpful to know what is being discussed. I hope this helps.

__________

* Since this post, like my earlier one, reports on the deliberations of an ISO Technical Committee, and since I am a member of the American TAG 176 which forms a component of that committee, allow me to repeat the formal regulations that apply to this discussion.

1. I'm not allowed to reveal the personal data of any other committee member. But that's fine, because I have no interest in talking about individuals. My topic is always the ideas and principles.
2. I'm not allowed to reveal how any particular individual or National Standards Body voted. But that's fine too. See above.
3. I'm not allowed to share any presentations or working documents. But I never planned to. If you find such materials anywhere on the Internet, they didn't come from me.
4. I am allowed to share my personal opinions, so long as I clearly identify them as such (and to be clear everything in the body of this post is hereby identified as a personal opinion), and so long as I don't criticize the committee. But that's fine too, because you should absolutely not take anything I say here as a criticism of the committee. I am confident that the committee will do the best it possibly can, given the parameters that it has to work within.

** I didn't even get past the 2xxxx's.   

     

What's sustainable development? Says who?

Last week I learned that there is a proposal afoot for a brand new ISO management system standard, specifically to support organizations who are trying to address one or more of the United Nations' 17 Sustainable Development Goals. Monday I had a chance to sit in on a webinar that gave some information about this proposal. Here's what I learned. 

Basics

What exactly has been proposed?

The proposal is to create an "International Standard [which] specifies requirements for a Sustainable Development Goals Management System."

What do all those big words mean?

An "International Standard ... for a ... Management System" is any standard like ISO 9001, ISO 14001, or ISO 45001. 

More basically, a management system is the collection of policies, processes, and procedures, plus the corresponding assignment of roles and responsibilities that makes your organization run. I give a brief description of what management systems are in this post here. 

A management system standard is a generic standard that tells you how to set up your management system. It doesn't tell you exactly what words to write or exactly whom to assign to do what; but it says that you have to make sure to cover these topics and those activities, somehow or other. Then it leaves the details to you, because the operational processes for an aircraft manufacturer will be different from the ones for a laundromat.

The phrase "Sustainable Development Goals" refers to a set of 17 goals adopted by the United Nations back in 2015 as part of the 2030 Agenda for Sustainable Development, which the UN website describes as "a shared blueprint for peace and prosperity for people and the planet, now and into the future." These goals represent "an urgent call for action by all countries - developed and developing - in a global partnership," and the list of all 17 is as follows:

• No poverty
• Zero hunger
• Good health and well-being
• Quality education
• Gender equality
• Clean water and sanitation
• Affordable and clean energy
• Decent work and economic growth
• Industry, innovation, and infrastructure
• Reduced inequalities
• Sustainable cities and communities
• Responsible consumption and production
• Climate action
• Life below water
• Life on land
• Peace, justice, and strong institutions
• Partnership for the goals

Therefore a management system standard to support the UN's sustainable development goals is a generic standard to tell you how to organize your business (or other group) in order to help you make progress towards one or more of the goals on this list.

Who proposed it?

The Danish Standards Foundation, one of the member bodies of the ISO.

Who wants it?

Companies are asking for guidance. Their stakeholders are asking them to work more sustainably, and then to prove it.

What good will it do? (Or, what needs will it satisfy?)

Some companies are being asked to prove that they work sustainably. Other companies have recognized that if they can offer proof of sustainable operations proactively, that will give them a competitive advantage. But how do you prove something like that? By comparing to a standard.

Then there are companies that don't (yet) feel forced to prove anything to someone else, but they care about the SDG's and want to help them forward. But they don't know where to start, and are asking for some kind of systematic guidance. 

Since there is no established standard right now, multiple private sources are issuing their own. But of course this means there is no consistency in requirements or reporting, so nobody can tell what this or that certification really means without reading all the fine print on each one. ISO is recognized as an international authority. So if ISO issues a standard, that common framework will clear up a lot of confusion. 

What will this involve?

Will organizations be able to certify to it?

Yes.

Will organizations be required to certify to it?

No. It will be a voluntary standard, like ISO 9001.

Let me say that a little more precisely. Some organizations find themselves required to certify to ISO 9001 because their customers insist. But there is no legal requirement anywhere to certify to ISO 9001. In the same way, if your customers ask you to certify to this new standard that's between you and them. But there is no intention that your government will require it.

How will this standard be structured?

Just like all the other modern ISO management system standards.

If we already have an established management system, will we have to scrap it and create a new one to comply with this standard?

Of course not. You should never do that anyway. Set up your management system in whatever way works for you. Just make sure it covers the things that the standard asks it to cover.

Since this one will be structured exactly like ISO 9001, ISO 14001, and the rest of them, it should be very easy for you to plug a few extra requirements into your existing management system and scarcely notice the difference. 

What will this standard actually require an organization to do?

We haven't written it yet, so it's hard to be sure of the details. 😀 But our proposal is that you don't have to address all 17 SDG's to get certified. Pick the ones that are relevant to your business. 

On the other hand this means you have to have a defined process for selecting which SDG's are relevant, not just that you pulled numbers out of a hat. You should have a systematic way to define a sustainable strategy for your business, and then be able to deliver to that strategy.

How will progress be measured?

Already today, each SDG has several "targets and indicators" defined to measure the status of the goal. (Go to the SDG website, and click on each goal in turn for more information, including the complete list of targets and indicators defined for that goal.) These targets and indicators will have to be built into the KPIs for this standard, to keep the measurements consistent and objective, and to avoid the risk of "SDG-washing."

How does this relate to any other standards or committees?

We already have ISO 37101, which is a management system standard for sustainable communities. How does this relate to that?

There will be overlap, to be sure. But sustainable communities are only one of the 17 SDG's. Certainly the committee writing this standard will appreciate all the help we can get from other existing sources.

Will this standard end up replacing ISO 9001?

It shouldn't. They are about different things.

ISO 9001 is still about the quality of goods and services. Yes, it has some very valuable requirements that help your organization run in a successful way: identifying key stakeholders, defining a strategy, settling KPIs, and so on. And ISO 9004 is a great standard for assessing your organizational maturity. But neither of those is really focused on the content of the SDG's, the way this standard would be.

Or did you mean "Will this standard end up becoming the most popular management system standard, the ISO flagship standard, the way ISO 9001 is today?" Well of course we don't know. We do know that the UN SDG's are coming ever more clearly into focus in markets clear across the global economy. We know that people understand how important they are. But I don't think the committee that writes ISO 9001 has anything to worry about.  

Is there already an existing ISO committee who will be responsible for this?

No. If the proposal is accepted, a new committee will have to be created.

Is there already an existing national standard that covers the same subject, so the committee can just copy it and be done?

No.

What is the timeline?

How does the process look from here? What is the timeline?

From now until December 8, 2022, the national standards bodies that comprise ISO will collect input and vote on the proposal. (ANSI's deadline for comments is October 28!)

December 8, 2022, ISO counts the votes. If a majority vote "No," that's the end of it. If a majority vote "Yes," then ISO will establish a committee.

Early 2023, the committee holds meetings on scope, title, and content.

September 1, 2023, the committee circulates the first working draft to experts for comments.

November 1, 2024, the committee submits a Draft International Standard.

November 15, 2025, ISO publishes the completed International Standard.

Wait, ... you don't expect to publish until 2025, and the UN's SDG's are supposed to be due in 2030? That's just five years. How do you expect that timeline to do any good at all?

None of the proposers believes that the SDG's will expire in 2030. They might be updated or reissued or renamed. But if anything, they are likely to become even more important after 2030. So there should be plenty of time for this standard to offer support.

Final questions

How do I join the committee?

Talk to your national standards body and tell them you are interested in helping. Work with them to meet whatever requirements they have in order to make that happen. Or if you already belong to some other entity that will need to establish a liaison with tis committee, approach that entity and this committee directly.

Where can I get more information?

The Danish Standards Foundation has set up a website for the proposal here. That website contains a lot of information, including a flyer, plus recordings and presentations from the information webinars. It also contains links to other information sources.

There will be another informational webinar on November 2, 2022, from 8:00-9:00am UTC. That's the middle of the night here in the United States, but in other parts of the world it is a friendlier hour. You can join it by clicking this link.

ANSI's announcement about the proposal is located here.

A complete copy of the proposal can be found here.

I hope this helps.       

      

Can ISO 9001 stop climate change?

By itself? No, of course not. But can it support the work of others? I'm still dubious, but on that point opinions differ.*

Image by Gerd Altmann from Pixabay

Last year the ISO published the London Declaration. According to the ISO website, "the London Declaration to combat climate change through standards defines ISO’s commitment to achieve the climate agenda by 2050." Among other things, the London Declaration states formally and unequivocally that the ISO will "Foster the active consideration of climate science and associated transitions in the development of all new and revised International Standards and publications." [Emphasis added.] This means that whenever ISO 9001 is next revised, the relevant committees will have to consider climate science and "associated transitions" when writing it.

What will this look like? I've emailed people who know more than I do, to get some idea of what the current thinking is. I haven't heard back from them yet. One person suggested in casual conversation** that there might be no more than a line added to clause 4.1 that the organization "shall consider the implications of climate change" when identifying the "issues ... relevant to its purpose" that make up its Context. But somebody else answered back that, "Some aspects affecting climate change should be addressed in design and development of products and services. Otherwise it's too late." So I have no idea where this will end up. 

My own opinion—and I emphasize, for reasons spelled out below, that this is a personal opinion—is that ISO 9001 should stay in its lane. In the first place ISO 9001 is a Quality management system standard. It's directly focused on the satisfaction of customers and other interested parties. But a company can satisfy its customers without taking any action on climate change, ... unless the customers themselves demand such action, in which case presumably the company is already working on it. In this sense, adding requirements to consider climate change is a distraction from the standard's true job. 

In the second place, ISO 9001 is a generic Quality management system standard, equally applicable to a global manufacturing concern or to a neighborhood five-and-dime. If a local hamburger restaurant wanted to implement ISO 9001, they should be able to do so. But small enterprises like that are unlikely to spend much time or effort considering the implications of climate change. So depending on what new requirements are finally added to the standard, I can see a couple of possibilities.

The requirements might be deep and substantive. In this case, we should expect small and medium-sized enterprises to opt out, because meeting the requirements will be too difficult. If we follow this route, the number of companies who seek new certifications—or maintain their existing ones—will drop significantly. A result like that won't be good for the ISO brand.

The requirements might be superficial. In this case—if the requirements can be satisfied by adding a few words to your Quality Policy and then taking literally no other action—companies probably won't opt out. Quality Policies are easy to edit. But in this case, we should expect the customers of ISO 9001 to get pretty cynical about the exercise. They'll get the idea that they can take credit for fighting climate change just by updating a document that hangs on the wall; they'll know how ineffective that action is; and then how seriously will they take anyone else's statements about climate change? How seriously will they take the ISO brand? This result won't be any better than the last one.

Maybe there's a sweet spot between these two bad outcomes. I sure hope so. But it seems like the easiest way to avoid this dilemma is to stay out of the arena. If ISO 9001 never had to say anything about climate change in the first place—if ISO 9001 left consideration of climate change to other standards that are directly focused on the topic—then it could continue to focus on the areas where it really does some good: on the quality of processes, products, and services; and on the satisfaction of customers and interested parties.

Just an opinion.  

__________

* In the interests of strict compliance with all applicable regulations, it is my duty to inform you that I recently joined TAG 176: that's the American component of ISO/TC 176, who are responsible for writing the ISO 9001 family of standards. As a result, there are formal rules about what information I am allowed to discuss about the committee's work. In particular:

1. I'm not allowed to reveal the personal data of any other committee member. But that's fine, because I have no interest in talking about individuals. My topic is always the ideas and principles.
2. I'm not allowed to reveal how any particular individual or National Standards Body voted. But that's fine too. See above.
3. I'm not allowed to share any presentations or working documents. But I never planned to.
4. I am allowed to share my personal opinions, so long as I clearly identify them as such (and to be clear everything in the body of this post is hereby identified as a personal opinion), and so long as I don't criticize the committee. But that's fine too, because you should absolutely not take anything I say here as a criticism of the committee. I am confident that the committee will do the best it possibly can, given the parameters that have been mandated by the ISO central authorities.

** This discussion took place during the 2022 ISO/TC176 Plenary Meeting, which is going on this week.

      

"A gang with a logo ...."

Back in April I wrote about how the current Russo-Ukrainian war could lead to the unraveling of the system of global certification. Just recently I got the chance to discuss this very issue live, with Kyle Chambers of Texas Quality Assurance and Christopher Paris of Oxebridge International. It was a lot of fun. Kyle brings an infectious energy to any conversation he's a part of, and Chris has a wealth of knowledge about the international certification scheme; so the two of them together fleshed out my original thesis in ways I hadn't expected. (The fun quote in the title is an adaptation of something Chris says, but you have to listen to the podcast to find out who he's describing and what his actual words are!)

So please check us out, and leave a comment!

You can find the podcast version here: #QualityMatters episode 151.

Or there's a version on YouTube that also includes video, which you can find here:

I look forward to hearing your feedback!