A Standard for All Industries.

THIS ARTICLE DISCUSSES

* How records and information managers can participate in their organizations' quality management processes

* Why he revised standard is more accessible and applicable to RIMs beyond the manufacturing industry

* What changes have been incorporated in ISO 9001:2000

ISO 9001:2000 is an internationally recognized quality management system (QMS) standard affecting thousands of organizations around the world. A new version, which is scheduled for publication in late 2000, will replace ISO 9001:1994 and will have both a new look and a new scope as its image as a purely manufacturing standard is eclipsed and it becomes more acceptable to other sectors. Late 2000 will be the start of a busy period for anyone directly involved in an organization's ISO 9001 certification activities. One of the disciplines affected will be records and information management (RIM).

Provided they take a proactive role, information management professionals will find significant new opportunities to participate more fully than ever before in their organization's quality management processes. The focus of these opportunities lies in the area of documentation of an organization's processes and its related information and records systems.

This overview of the new standard should be a call to information managers in all sectors to look carefully at the standard to begin to understand its implications for them.

The final draft of ISO 9001: 2000, Quality Management Systems -- Requirements, was issued on February 22, 1999. Its adoption will continue to have a major influence on the manufacturing industry where it has long been accepted as the benchmark of quality management. The standard's most significant change is its potential applicability to industries other than manufacturing.

This article has a dual focus. First, it outlines the main elements of the agreement reached on a new version of ISO 9001. Second, it examines the new standard's impact on information management professionals.

While some service and software industries had already adopted ISO 9001, most organizations in these industries declined in the beginning to treat ISO 9001 seriously. They justified their lack of interest on the grounds that the standard was applicable only to manufacturing quality management systems.

The more generic and expanded character of ISO 9001:2000 clearly challenges this view. The strong manufacturing bias reflected in the content and structure of both the original 1987 standard and its 1994 revised version is now a thing of the past. Service and software organizations are likely to face increasing pressure to measure the quality of their organizations against the benchmarks outlined in ISO 9001:2000.

Background and Future of ISO 9001:2000

ISO 9001 serves as the basis for benchmarking an organization's quality management system. Quality management should not be confused with terms such as quality assurance" or quality control. Quality management measures the overall management function in determining the organization's quality policy, its objectives, and its responsibilities, as well as the quality policy implementation through means such as quality assurance and quality control. Quality assurance measures all planned and systematic activities implemented within the organization's quality system. Quality control is the operational techniques and activities used to fulfil quality requirements (e.g., meeting a customer's specifications or requirements for a given product or service).

Revision of the ISO 9000 standards has been under discussion for a number of years. Soon after the 1994 revisions, ISO Technical Committee 176 began the task of overcoming the standard's manufacturing bias while, at the same time, overcoming other persistent criticisms that the standard did not adequately cover all aspects of the QMS.

The development of ISO 9001:2000 has been a particularly interesting process to behold. It is an object lesson in consensus building. ISO Technical Committee 176, with the participation of various national standards bodies, has actually managed to overcome criticisms from apparently opposite directions and written a document that appears to be acceptable to the great majority of ISO's member bodies.

The manufacturing industry criticized the older versions of ISO 9001 for its failure to include a large range of quality management requirements in the standard. Some manufacturing industries considered ISO 9001 to be so inadequate that they developed their own expanded, industry-specific versions of the ISO 9001 standard. ISO was also criticized by non-manufacturing industries for catering to the manufacturing industries. Everything about the older versions of ISO 9001 seemed overwhelmingly rooted in a manufacturing environment.

The ISO technical committee found itself in a dilemma and then found a way out. ISO 9001:2000 appears to have actually reached a satisfactory compromise in which the language is generic enough to be applicable to industries other than manufacturing yet specific enough to satisfy the particular concerns of the manufacturing industry.

ISO Technical Committee 176's objective was to overcome the apparent conflict between the manufacturing industry's specific requirements and the demand to make the standard more accessible and more clearly applicable to other industries. This objective also led to changes in the structure and organization of what used to be a series of standards and guidelines. ISO 9001:2000 will replace all three 1994 standards (9001, 9002, and 9003). Once ISO 9001:2000 is published, ISO 9002 and ISO 9003 will become obsolete.

All organizations will have to fulfill all the requirements in ISO 9001:2000. A requirement is now inapplicable only if the function or activity it describes is not performed at all. In other words, organizations that may have certified under ISO 9002 to avoid including design and development activities in the scope of their certification can no longer do so. If they perform design and development activities, these activities must be included as part of the ISO 9001:2000 certification.

ISO 9001:2000 will have a structure that resembles ISO 14001:1996, an international standard that specifies the requirements for the certification of an organization's environmental management system (EMS). Titled Environmental Management Systems - Specification with Guidance for Use, ISO 14001 measures adherence to legislative requirements and information about significant environmental impacts. Like the EMS standard, the ISO 9001:2000 standard will be divided into five broad management principles. In part, this approach is intended to suggest that common subjects between ISO 9001:2000 and ISO 14001:1996 may be implemented in a shared manner to avoid duplication of effort.

As far as actual implementation of the new standard was concerned, ISO Technical Committee 176 recommended that implementation of ISO 9001:2000 could begin as early as the fourth quarter of 1999 -- one full year in advance of the standard's scheduled publication. The ISO technical committee made this recommendation because ISO works through a lengthy consultative process to achieve a consensus. Once a consensus was obtained (in early 1999), further changes became improbable.

New Elements and Emphases

What has actually changed in ISO 9001:2000 that makes it so new and improved? While ISO 9001:2000 retains most of the content of the 1987 and 1994 versions, it also contains substantive additions. Most of the specific changes fall under two broad categories: 1) customer satisfaction and 2) the quality management function. Some changes are quite broad in character.

In ISO 9001:1994 the scope declares the achievement of customer satisfaction as the standard's primary aim, but it was not then a requirement. In ISO 9001:2000, however, the achievement of customer satisfaction becomes an explicit requirement that finds expression in several sections of the standard. One requirement, for example, is that the organization must identify and review customer requirements. Another new paragraph focuses on management's responsibility to ensure that customer requirements are met. Yet a third requires the measuring and monitoring of customer satisfaction.

Customer satisfaction and conformity to customer requirements will also play a major role in determining where improvements can be made in an organization. Clearly, there are opportunities here for information managers to show the centrality of their work to the organization in areas of documentation.

ISO 9001:2000 also places a much stronger emphasis on the quality management function of the organization as distinct from its quality assurance activities. Although the 1987 and 1994 versions of the standard intended to measure the quality management function, large portions of the standard were focused solely on quality assurance.

Even the titles reflected the earlier emphasis on quality assurance almost at the expense of quality management. The title of ISO 9001:1994 was Quality Systems -- Model for Quality Assurance in Design, Development, Production, Installation and Servicing. In ISO 9001:2000, the title changes to Quality Management Systems -- Requirements. According to the foreword to the 2000 standard, the new title reflects the fact that the QMS requirements not only address quality assurance of products and services but also address the need for an organization to demonstrate its capability to achieve customer satisfaction.

Almost all the new elements in the 2000 standard (e.g., meeting customer and legal requirements, involving people and training, managing information, continuous improvement) address overall quality management issues as distinct from quality assurance activities.

ISO 9001:2000 is more strongly influenced by specific industry standards that were developed because the older versions were inadequate to a given industry's specific needs. Requirements for infrastructure, work environment, process monitoring, continuous improvement and customer satisfaction show the influence of these industry-specific standards, especially on the automobile, aerospace, and medical devices industries.

QMS Guidelines and Standards

A number of supplementary standards and guidelines have also been consolidated or restructured. ISO 9004 guidelines used to be published in four parts; one was generic and the other three addressed the concerns of specific industries. There will now be a single generic guideline: ISO 9004: 2000. Its structure will parallel ISO 9001:2000.

The purpose of the structural change to the guideline, titled Quality Management Systems -- Guidance for Performance Improvement, is to enhance its use as a supplement and aid to ISO 9001:2000. It parallels the standard not only in structure but also in content, including, for example, an even more explicit focus on customer satisfaction.

ISO 8402:1994, the standard that defines the terms and vocabulary used in the ISO 9000 series of QMS standards, and those parts of ISO 9000:1994 that pertain to definitions, will be consolidated into a single document (ISO 9000:2000) for defining terms and vocabulary. ISO 10011, ISO 10012, and the three EMS auditing standards are being revised and consolidated; they should be ready in the first quarter of 2001.

The Five Quality Management Principles

To facilitate a clearer understanding of the differences between ISO 9001:1994 and ISO 9001:2000, tables are used at various points in this article. In each table, the column on the left summarizes the requirement, by number and title, found in ISO 9001:2000. The column on the right lists the corresponding requirements, by number and title, in ISO 9001:1994.

Some comparisons, which are italicized, are derived from Technical Committee 176's (draft) Transition Planning Guidance, published in May 1999. The remaining comparisons between the 1994 and 2000 versions include those between ISO 9001:2000 and QS-9000. QS-9000 requirements are preceded by the letters "QS" and have been added to illustrate QS-9000's influence on ISO 9001-based industry standards.

(It is not the intention of this article to suggest that the automotive industry's QS-9000 is the only, or even the main, influence on the development of ISO 9001:2000. It happens to be the one with which the author is most familiar.)

In the standards, the scope, normative reference, terms, and definitions account for the first three numbered sections of the ISO 9001:2000 standard. The first quality management principle is numbered four. The remaining four principles are numbered sequentially.

Quality Management System Requirements

In ISO 9001:1994, this title was used to include all 20 main requirements against which the organization had to be evaluated. It had no independent content. In ISO 9001:2000, it is the title for the first of five quality management principles.

The QMS principle states that the organization shall implement, maintain, and improve a QMS and that it prepares QMS procedures describing the processes necessary to ensure that the organization meets the customer's requirements. It incorporates parts of the Quality System section of the 1994 standard (see Table 1).

TABLE 1: A Comparison

ISO 9001:2000                  ISO 9001:1994
4. Quality Management System   4.2.1 Quality system - General
Requirements                   4.2.2 Quality system procedures

This principle also highlights the understanding that a QMS has to be analyzed from two aspects: the processes that ensure customer requirements are met and their description in the form of documentation. In essence, this principle embodies the concept and practice that "you say what you do and you do what you say." This concept is not new to ISO 9001. The 2000 standard makes explicit what had been implicit in the previous versions.

Management Responsibility and Information Management

This ISO 9001:2000 principle (see Table 2) includes most of the following ISO 9001:1994 requirements: management responsibility, document and data control, and control of quality records. It also has several new clauses pertaining to customer requirements, legal requirements, the establishment of quality objectives, and the maintenance of internal communications. Portions of this principle, specifically those pertaining to control of documents and records, have special significance for RIM professionals.

TABLE 2: Management Responsibility and Information Management

ISO 9001:2000                        ISO 9001:1994

5.1 General Requirements
5.2 Customer requirements
5.3 Legal requirements
5.4 Policy                           4.1.1 Quality policy
5.5 Planning
5.5.1 Objectives                     4.1.1 Quality policy
5.5.2 Quality planning               4.2.3 Quality planning
5.6 Quality management system
5.6.1 General requirements
5.6.2 Responsibility and authority   4.1.2.1 Responsibility and
                                       authority
5.6.3 Management representative      4.1.2.3 Management
                                       representative
5.6.4 Internal communication
5.6.5 Quality manual                 4.2.1 Quality system- General
5.6.6 Control of documents           4.5 Document control
5.6.7 Control of records             4.16 Control of quality
                                       records
5.7 Management review                4.1.3 Management review

In ISO 9001:1994, both the document control and records control were, from a structural standpoint, treated as equals with the other 18 general requirements such as management responsibility. (Document and record have distinct meanings in the ISO 9001 standard. Documents are prescriptive and instructional, such as the quality manual, procedures, work instructions, and unused forms. Records are objective data recorded in a predetermined structured format, such as a form or a database.)

Now document control and records control are subsections of "Quality Management System," one of seven general requirements that constitute the principle of management responsibility. At first glance, their new position appears to have diminished their role in the ISO 9001 standard. This is not the case.

First, it should be noted that the requirements for the control of documents and records remained essentially the same between the 1994 and 2000 versions of the standard. Organizations will still have to maintain as rigorous control over documents and records as they have in the past. This is particularly significant for information managers in sectors where initially there was interest in certification to the standard.

Second, it has already been noted that documents constitute one side of the processes/documents dichotomy that lies at the core of the "Quality Management System Requirements" (not to be confused with the section entitled Quality Management System," which is part of the second principle, "Management Responsibility").

In the management responsibility principle, documents and records have been placed in a more appropriate and accurate context. If documents describe the QMS, then their control is essential to ensuring that this description accurately reflects the organization's processes. This explains why the control of documents (as distinct from the documents themselves) have been included under the QMS section of this principle. The description of processes through documents also requires the support of objective evidence in the form of records. Records control therefore enjoys equal status with document control.

Given that control of documents and records is so vitally important to the QMS, it is appropriate that management should take a direct interest in it. Indeed, making the control of documents and records -- through information managers -- a management responsibility has elevated information managers' status. It is another way of explicitly indicating management's active role in the documentation of the QMS.

This shift from apparent independence to subordination reflects 12 years of practical experience. The success or failure of a QMS (and its documentation) depends directly on the role played by management. In the corporate world, and in most other organizations, management has the power, means, and ultimate responsibility for the decisions an organization makes, including its document, information, and records management systems.

Resource Management

This principle pulls together parts of several requirements of the 1994 standard, most notably training (see Table 3). It also includes several new requirements on the management of information necessary to control processes, the provision for and maintenance of an infrastructure, and maintenance of an appropriate work environment.

TABLE 3: Training Requirements

ISO 9001:2000                   ISO 9001:1994

6.1 General requirements        4.1.2.2 Resources
6.2 Human resources
6.2.1 Assignment of personnel   4.1.2.2 Resources
6.2.2 Competence, training,     4.18 Training
  qualification and awareness
6.3 Information
6.4 Infrastructure              4.9 Process control
                                QS 4.6 Facilities and
                                  Tooling Management
6.5 Work environment            4.9 Process control
                                QS 4.9 4.9.b.1 Cleanliness
                                  of premises

Particularly significant for RIM professionals are the requirements affecting information management. A brief note disingenuously defines information as process, product and/or service knowledge and/or experience, and data from suppliers and customers. There is a requirement to develop system-level procedures for managing this information. This requirement opens the door to expanding the role and responsibilities of records managers and administrators in the QMS.

First, procedures must be put in place to ensure access to (and protection of) this knowledge and experience. The requirement has knowledge management overtones, and it strongly implies that the organization must document currently unrecorded information that may have an impact on the QMS. At the very least, it calls on the organization to include quality-related informal knowledge and experience into the corporate memory.

Second, there must be procedures to handle data from customers and suppliers. This requirement, an explicit recognition of the role of external data in evaluating the QMS, has the potential of putting organizational functions that had hitherto played only marginal roles in the QMS (e.g., the finance, information technology, and systems development departments) into the spotlight.

Only time will tell how the requirement for managing information will be interpreted when ISO 9001:2000 is implemented. If this analysis is correct, organizations may find it challenging to meet this requirement.

Product and Service Realization

This quality management principle (see Table 4) incorporates almost half (nine) of the 20 requirements that originally constituted the ISO 9001:1994 standard. The sequence of the first five sections parallels the processes involved in the realization of a product or service. It begins with the determination of the customer's requirements and ends with the customer's final acceptance of the product or service. The sixth section applies to measuring and controlling devices that are used in the other requirements covered by this management principle.

TABLE 4: Product & Service Realization

ISO 9001:2000                     ISO 9001:1994

7.1 General requirements          4.3.2 Contract review
                                  4.3.4 Records
                                  4.9 Process control
7.2 Customer-related processes
7.2.1 Identification of           4.3.1 Contract review - General
  customer requirements
7.2.2 Review of customer          4.3.2 Contract review
  requirements
7.2.3 Customer communication      4.3.3 Amendment to a
                                    contract
7.3 Design and development
7.3.1 General requirements        4.4.1 Design control - General
                                  4.4.2 Design and development
                                    planning
                                  4.4.3 Organizational and
                                    technical interfaces
7.3.2 Design and development      4.4.4 Design input
  inputs
7.3.3 Design and development      4.4.5 Design output
  outputs
7.3.4 Design and development      4.4.6 Design review
  review
7.3.5 Design and development      4.4.7 Design verification
  verification
7.3.6 Design and development      4.4.8 Design validation
  validation
7.3.7 Control of changes          4.4.9 Design changes
7.4 Purchasing
7.4.1 General requirements        4.6.1 Purchasing - General
                                  4.6.2 Evaluation of
                                    subcontractors
7.4.2 Purchasing information      4.6.3 Purchasing data
7.4.3 Verification of purchased   4.6.4 Verification of
  product and/or services           purchased product
7.5 Production and service
  operations
7.5.1 General requirements        4.9 Process control
7.5.2 Identification and          4.8 Product identification
  traceability                      and traceability
7.5.3 Customer property           4.7 Control of customer-supplied
                                    product
7.5.4 Handling, packaging,        4.15 Handling, packaging,
  storage, preservation and         storage, preservation and
  delivery                          delivery
7.5.5 Validation of processes     4.9 Process control
                                  4.19 Servicing
7.6 Control of measuring and      4.11 Control of inspection,
  monitoring devices                measuring and test
                                    equipment

Measurement, Analysis, and Improvement

This principle incorporates five of the 20 original ISO 9001:1994 requirements (see Table 5). These requirements pertained to quality assurance, internal auditing, and corrective and preventive action.

TABLE 5: Measurement, Analysis & Improvement

ISO 9001:2000                    ISO 9001:1994

8.1 General requirements         4.1.3 Management review
                                 4.10 Inspection and testing
                                 417 Internal quality audits
8.2 Measurement and monitoring
8.2.1 Measurement and            4.17 Internal quality audits
  monitoring of system           QS 4.9.1 Process monitoring and
  performance                      Operator Instructions
8.2.1.1 Measurement and          QS 4.1.6 Customer Satisfaction
  monitoring of customer
  satisfaction
8.2.1.2 Internal audit           4.17 Internal quality audits
8.2.2 Measurement and            4.9 Process control
  monitoring of processes
8.2.3 Measurement and            4.10 Inspection and test status
  monitoring of product
  and/or service
8.3.1 General requirements       4.13.1 Control of non-conforming
                                   product - General
8.3.2 Nonconformity review       4.13.2 Review and disposition of
  and disposition                  non-conforming product
8.4 Analysis of data for         4.20 Statistical techniques
  improvement
8.5 Improvement                  QS 4.2.5 Continuous improvement
8.5.1 General Requirements       4.14 Corrective and preventive
                                 action - General
8.5.2 Corrective action          4.14.2 Corrective action
8.5.3 Preventive action          4.14.3 Preventive action

Here ISO 9001:2000 substantially reduces the quality assurance requirements originally found in ISO 9001. However, it does have new requirements. The organization must show evidence that measuring and monitoring of the QMS processes, products, and services leads to an analysis of the data and to continual improvement. It must also measure, monitor, and analyze customer satisfaction. Corrective and preventive action constitutes the mechanism through which continual improvement can be made when non-conformities take place. Here, documentation and recordkeeping are of paramount importance.

Transitional Activities

According to ISO's Technical Committee 176, existing documents will remain valid for the purposes of ISO 9001:2000. During the organization's transition from the 1994 standard to the 2000 one, existing documents that make references to specific sections of ISO 9000:1994 will have to be changed to reflect the numbering scheme used in ISO 9001:2000.

In addition, organizations should perform a gap analysis to determine what areas of their QMS do not comply with the revised requirements. Depending on local conditions, they will have to revise the quality manual and some procedures, or write new documents, where appropriate, to conform to the new ISO 9001:2000 requirements.

Each organization should consult its ISO certification body before any of the steps above are taken and should establish, in conjunction with that certification body, when the organization begins and completes the transition from the 1994 requirements to the 2000 requirements. The certification bodies will define the transition period for each organization. Technical Committee 176 anticipates a transition period of one to two years.

What ISO 9001:2000 Means to RIM Professionals

In describing ISO 9001:2000, there are clear indicators that the standard may have a significant impact on information management professionals. As stated earlier, four requirements are particularly important:

* documented procedures

* control of documents

* control of records

* information management (e.g., external data, knowledge, and experience)

Because of the nature of their functions and expertise, information management professionals will be directly or indirectly affected by these requirements. How the requirements affect these professionals and the extent of the impact is contingent on the willingness of information professionals to face the challenge and seize the opportunities. Information managers could play a very important role in their organization's QMS. Sadly, however, it is equally possible for them to become marginalized in this area.

Information management professionals in the ISO-certified manufacturing sector have already had their opportunity. In some organizations, their role has been restricted to the control of records. In others, they play a much more significant role in the management and control of documents and information. This latter group is well placed to take advantage of the new information management requirements in the standard. As long as they are proactive, they should see an enhancement of their role in their organization's QMS.

The ISO 9001:2000's generic character will lead to its extension and application to industries other than manufacturing. It is a real possibility that manufacturing organizations will act as catalysts to this development by requiring their non-manufacturing suppliers to become ISO 9001 certified as a price for doing business with them.

ISO 9001 was and continues to be a customer-driven standard. In the future, service and software industries will not be able to so easily escape scrutiny of their quality management systems.

Information professionals in the service, software, and other non-manufacturing industries may be faced with the same essential choice faced by their colleagues in the manufacturing industry in the 1990s. They can allow others to make the decisions, or they can become proactive and show management that they have skills vital to the successful implementation of an internationally recognized QMS in their organizations.

Gerry van Houten, M.L.S., is the Web and documentation administrator for BASF Canada Inc. in Toronto. Benchmarking company documentation against various quality management systems in an integral pat of his job. He has eight years' experience in the information management field. He has participated in several successful ISO 9000 certifications and is a certified ISO 9001 auditor. He holds a master's degree from the Faculty of Information Studies, University of Toronto and is a member of ARMA International as well as the Special Libraries and the Canadian Library Association. He may be reached at [e-mail]. The author dedicated this manuscript to the memory of his very much loved son, Adrian, who died accidentally in December 1999. His parents miss him.