Frequently Asked Questions

Auditing

Can anyone in my organisation carry out audits of the QMS?

Yes, but they must have been trained in auditing before being allowed to carry out this activity.

Does Corrective Action have to be taken immediately?

It depends on the seriousness of the nonconformance. Any major nonconformance needs to be attended to immediately, but nonconformances of a minor nature can be addressed over a period of time.

Does the auditor have to be an expert on the area of the business being audited?

Not necessarily. Obviously it helps a great deal to know something about the processes being undertaken, but it can often be a distinct advantage not to be an 'expert' as one can then approach the audit process with no preconceived ideas of how the business should be run and perhaps be able to question and challenge what is happening in a way that someone steeped in the history of the processes would not do.

Does the notice of audit have to be written?

It is normal practice for an auditor to prepare an audit plan detailing what is to be audited and when. For the auditee to arrange for people, access or escorts to be available at the right times it is necessary to be advised of the plan and having a copy facilitates this. The Notice of Audit and Audit Plan then become part of the Audit Report.

How do we know if appropriate corrective action has been taken?

Major nonconformances will be re-audited within a defined timescale that will be detailed in the individual QMS documentation. Minor nonconformances are usually not re-audited until the next scheduled audit.

How much notice should be given of an audit?

This depends on what the requirements of individual systems are, but typically a minimum of seven days notice should be given.

If a re-audit is done does it cover the whole depth of the original audit?

No, a re-audit only covers the particular area where a non-conformance was identified.

Is there any limitation on what they can audit?

Yes. ISO 9001: 2000 requires that, 'auditors do not audit their own work.'

Should audits be carried out unannounced and as a surprise to the auditee?

Definitely not. The whole object of carrying out audits is to obtain accurate data to continually improve the sytem. You want the auditee to be co-operative, frank, open and helpful in identifying system failures, and not defensive, reticent and reluctant to share his/her knowledge of the system.

What happens if nonconformances are found?

Any nonconformance identified during an audit is noted and a Corrective Action (or similarly titled) Request is raised to initiate action to identify the root cause of the problem and to take action necessary to eliminate the cause of the nonconformance and prevent its recurrence.

Business Processes

Can Quality Associates help me to understand how to take a process-based approach?

Yes - we run training courses, provide consultancy advice and implementation assistance to organisations of all sizes and in both the public and private sectors.

Can you recommend software to help us implement a process-based system?

We maintain an independent position with regard to product recommendation, and do not promote any one software package, but we have considerable experience of a number of the products on the market and can give you an informed opinion as to their strengths (and weaknesses).

Do the main certifying bodies understand process-based systems?

In some cases, not as well as you would expect! Assessors need to take a different view of management systems and of auditing from the approach which many of them applied for ISO9000:1994. And many of them did not come from a background which lends itself to giving advice on business and process improvement. The days of the "finding fault" and checklist approach to assessment are in the past.

And - more worryingly - not all these organisations have demonstrated by their examples of "best practice" that they have succeeded in putting the emphasis on "best" rather than "practice" in process mapping and management systems development!

Is a production process different from a business process?

No. Production processes (or as ISO9001:2000 would - unfortunately - have it, 'product realisation processes') are just a subset of your business processes. When people describe the two as being separate, they are continuing the (now discredited) view that quality standards and management systems relate principally to a manufacturing environment and that supporting functions - and other sectors - are second class citizens.

Think of 'production' as "creation". If your organisation creates training courses or cleaning services, your production processes are how you generate a course or how you plan and deliver your service.

What is a business process?

A common description of a process is 'a sequence of related tasks and decisions which act on inputs to add value to create outputs'. It uses resources and is subject to controls and influences.

In business, this can be extended to mean a process which either creates value or supports a process which creates value. For example, "manufacturing to order" is the process of receiving a customer order, through manufacturing and packaging, to delivery of the goods. The process of "managing suppliers" supports the purchasing process.

What is the "correct" level of detail to use when defining a business process?

As little as you need! Be clear about why you are doing it and who will use the resultant definitions. But do it for yourself and your staff, a management system is not for your external auditor. Two pages of a flowchart should be sufficient for a process. Assume competence in the people allocated to work on the process, or train them!

What is the best way to define a business process?

There is more to a process than just the tasks and decisions which define the flow of information or material. You also need to define the resources required and the influences which affect the operation of the process. But even to describe the process flow clearly and in a format which staff can understand and use easily can be a challenge. The best way to show (or "map") a process flow is now widely accepted to be as a flowchart. A process flowchart shows "what has to be done", and a deployment flowchart, also shows the departments and job functions involved - "who should do it".

The deployment flowchart is a matrix, often presented with job functions along the x-axis and tasks or activities down the y-axis.

There are other types and formats of flowchart. Some are little more than a diagram with indeterminate "objects" linked by lines which suggest connections back and forward, up and down and occasionally round in a circle. Some would say that the attempt in ISO9001:2000 to illustrate the process-based approach promoted by the standard is a prime example of this!

Where should I start when designing a process-based management system?

Understand the concepts - such as processes/systems/flowcharting. Be clear about your objectives. Typically, people gain two principal benefits from this type of system: a better understanding of what is done now (this makes it easier to identify possible improvements) and a means of training new staff. Remember - most people will read flowcharts no more readily than they will read narrative procedures.

Then plan the structure. Always work from the top down - do not convert a collection of unrelated procedures and then try to fit them together.

Why are so many management systems built around the requirements of an external standard?

Because managers are often "happy" to manage by the seat of their pants and to sort out problems as they happen (it helps them to feel as though they have achieved something!) And they only document how they work when they are forced to adopt an external standard as a means of staying on tender lists, for example. Many then work around the system and find it an overhead rather than an asset.

And it has until now been difficult to find an approach to describing what the organisation does, and how it does it, which people can understand and are happy to use.

Why is it so difficult for many managers to understand business processes?

The 'traditional' way to define how a business operates is to define a set of 'procedures', narrative descriptions of related sequences of events within a department or work area (for example, in Stores or Purchasing). And the existing management structure often reflects and reinforces this.

Often, a company will generate one set of procedures for its quality system, another for how it deals with environmental matters, and another for how it addresses health and safety issues.

It can be difficult for those who are steeped in narrative procedures suddenly to change their thinking sufficiently radically to allow them to "see" their processes. Often they think of what their department does as a series of disjointed tasks, rather than identifying what initiates an action and how it is followed through to completion.

Excellence Model

A - What is the Excellence Model?

It is a widely respected model that can lead your organization towards excellence and vastly improved performance by helping you to compare your current situation against an accepted World-Class standard.

B -What types of organizations does the Excellence Model apply to?

All types, private and public corporations, large and small. Any organization that wishes to improve its overall excellence and be flexible in meeting customer needs, delivering improved products and services and best value, will benefit from using the Excellence Model criteria.

C - How does the Excellence Model help in my quest for excellence?

By assessing you organization and producing a numerical score against an agreed scale of excellence and, more importantly, a list of Strengths and Areas for Improvement (AFIs).

D - How does that help my organization improve?

The score shows where you stand on a scale of excellence, and the Strengths and AFIs give an indication of where you must apply your efforts to improve on that scale.

E - How is the assessment done?

It can be done internally, with the help of a facilitator, using the Excellence Model's well-established self-assessment techniques.

F - Why should my organization adopt the Excellence Model?

As stated above, self-assessment to the EFQM criteria produces a score on an agreed World-Class scale and, by identifying Strengths and Areas for Improvement it provides the basis for action to improve your performance versus your competitors and other World-Class organizations.

HAPPY@WORK

FAQ on the HAPPY@WORK programme

What "Goals" should be set?

The organisation may set a number of Goals. One goal, however, should be to increase Joy At Work since, if achieved, it will greatly help achieve the other goals. People will become more open, will assume more responsibility, be more creative, and be more productive.

What are 'permissions'?

The 'permissions' idea is both simple and powerful. Quite apart from formally stated policies and practices, organisations send very powerful messages to employees about what is and what is not acceptable behaviour.
The sources of these 'permissions' are organisation structure design decisions, process design decisions and the behaviour of top managers. To illustrate: The top manager who went overboard on Equal Opportunities, to the point where every manager and supervisor attended a 2 day EO course. Then the boss's staff officer moved on, and the boss immediately appointed a replacement without interview, advertising or any possibility of other employees expressing an interest in the vacancy. 3,700 employees instantly got the message that EO might be for other people, but not for the boss, confirmed when all the other top managers emulated the boss's behaviour. EO died an instant death.

What are staff levels?

Staff level begins with the most senior manager in the organisation, which is set at level zero.
Either the Chairman, if the organisation is a PLC, General Manager in a division of a PLC, or CEO or whatever is the appropriate job title. The key issue we are trying to understand relates to reporting distance from 'the boss'. All direct reports to level zero are level 1, and so on. Please note that this makes the boss's secretary level 1. The level is nothing to do with seniority or salary. It is about communications, hence the 'reporting distance' model.

What are the "Workshops"?

These involve sharing outputs with cross functional groups in order to flush out the issues and get them fixed. A senior manager should brief these groups at the start of each workshop to encourage them to be as challenging and innovative as they wish and not to disappoint by limiting their thinking. . If this is not done, with the type of messages as outlined, many employees will simply not believe that the exercise is anything but cosmetic.

What data is required from the client?

The data required includes: names, e-mail addresses, departments and levels.

1. Name - in the format the client wishes to see it at login. For example, it could be Initial + Surname, Given Name + Surname, Surname, Initial. Whatever the client provides we will use.
2. E-mail address as login name for our web site
3. Department with not too fine a gradation please
4. Level = reporting distance from the most senior manager, who by default is at level 0. Direct reports of the boss are level 1 and so on

What is HAPPY@WORK?

HAPPY@WORK® measures organisational resilience and identifies, quickly and cost effectively, the causes of organisational under performance. This is a web based data collection programme based on staff observations. It identifies performance-blocking issues. It measures organisational resentment and resilience in each of 15 outputs, the causes of which have been thoroughly researched to produce a superb diagnostic tool. Graphical reports (see below) are generated for the whole target population, by function, by level and level within function. Interpretation of differences, and identification of developmental actions needed is produced through dialogue with the people involved.

What is the "Client Team"?

We usually appoint a client team of two individuals, identified as internal change agents.
They would help with the design of the sample, briefing notes sent out, the initial review of the database and its interpretation, logistics around the workshops, running the workshops and setting up the final feedback. They can also help us understand the organisational culture and the commercial pressures under which it is operating. We also educate them on the philosophy of our system so that they can continue after we have gone.

What is the "Index of Resentment"?

This is a calculation using all the measured outputs to indicate the level of resentment in the whole organisation or the population being examined.

What is the "Index of Resilience"?

Management should set out to develop a 'Resilient Organisation' i.e. one that constantly re-invents itself in an unending dynamic process. A resilient company will be able to make sense of its environment, generate strategic options, and realign its resources faster than its rivals. Such a company will enjoy a decisive advantage. The 15 outputs are weighted according to the strength of their connections with the rsilience of the organisation, and that produces a new set of weighted scores that are then used to calculate the index for the whole company as a percentage of the 100% maximum score for a perfectly resilient company.

What is the Pre-project Meeting?

The Pre-project meeting is when we meet with the clients face to face to make sure they understand what we need in terms of sample etc. with a request for them to supply the data in an Excel spreadsheet. The client team may also be introduced at this meeting.

What is the Preliminary Meeting?

The preliminary meeting is after the initial analysis, and the purpose is to provide initial feedback to the client (sponsor) and agree how the workshops will run. It will, therefore, be after administering the questionnaire and after the initial analysis. The relevant graphical reports will be presented to highlight significant factors and a preliminary discussion of the implications for the business and what can be achieved by shifting the various scores in a positive direction.

What relationship exists between the questionnaire and the outputs?

There are no direct relationships between the inputs and outputs. There is a many-to-many inference engine that links the two sets of data. We use the outputs to frame conversations with respondents in groups to explore what the outputs are telling us and give them the opportunity to articulate other insights.

What size of sample is required?

From the point of view of the technology there are no limits to the size of the database that can be accommodated. Hence we would tend to err on the side of 'if in doubt, include them'. Our rule of thumb is 100% samples of senior people with the percentage reducing as we go farther down the hierarchy.

What type of questions appear in the Questionnaire?

We have worked on the basis of peoples' experiences of 'what it is like working here' recorded as observations and not judgements as being more useful than perceptions.
The latter always carries the risk of the cause of those perceptions being as much internal to the person as external, sourced in the (organisational) environment. This gets us away from the attitude survey type of questions, which generally end up producing lots of graphs but little action or change.

Who is the 'Project Sponsor'?

There is always a 'Project Sponsor' who will be a senior manager and who will brief the workshops to ensure that the employees believe that the exercise is anything but cosmetic.

Why are organisations non-responsive to change?

The new 2003 Best Practices in Change Management report has 6 key findings:

1. The contributor to project success is strong, visible and effective sponsorship.
2. The top obstacle to successful change is employee resistance at all levels: front-line, middle managers and senior managers.
3. Employees want to hear messages about change from two people: the CEO or their immediate supervisor (and the messages are not the same).
4. When asked what they would do differently next time, most teams would begin their change management activities earlier in their next project, instead of viewing it as an add-on or afterthought.
5. The top reasons for employee resistance are a lack of awareness about the change, comfort with the ways things are and fear of the unknown.
6. Middle managers resist change because of fear of losing control and overload of current tasks and responsibilities.

Quality Associates recommends Joy At Work to produce staff-proposed changes that will not only help alleviate the root causes of stress etc. but will help the workforce to become more enthusiastic about their work and to develop a higher personal commitment to the organisation. This in turn will make it much easier to introduce changes in the future and indeed many essential changes may be suggested by the workforce.

Health and Safety - Small Organisations

Am I obliged to have a risk assessment, and if so how do I get one?

Yes, if you employ 5 or more people, you must carry out a risk assessment, and record the findings. The assessment is carried out by touring the premises with a suitably skilled person, and recording, in the format prescribed by the HSE, the main risks, number of people exposed, control measures in place and actions intended. This usually takes no more than a day.

Am I obliged to have written H&S policy?

Yes, if a company has more than 5 employees it must have a written H&S policy, which must be shared with the employees and revised periodically. It must also have arrangements for implementing the policy i.e. there must be a person, usually the MD, who has responsibility for seeing that it is implemented.

Do I have to report all accidents, and to whom?

No. Only certain types of accident are reportable under RIDDOR (the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1985), but all accidents must be recorded and the record kept at the premises. Reporting under RIDDOR is to the HSE Inspector for your local area. For more see RIDDOR or attend a training course.

Do I need fire alarms?

Not necessarily. You are entitled to make the judgement on this, but if you have them they must be regularly tested.

How many sets of Regulations are there with which I must comply?

It depends a little on your industry, but not less than 30. Quality Associates run a 2 day training course which covers all these and can be tailored to your specific needs.

What am I obliged to display on my premises?

A current Employers' Liability Compulsory Insurance Certificate and the prescribed Health and safety Law Poster.

What am I obliged to do about fire precautions?

Your local fire authority will advise - you may need a fire certificate - you are obliged to provide enough exits with clearly marked, unobstructed exit routes and enough fire extinguishers of suitable type for the likely fires.

What are my obligations on noise?

The Noise at Work Regulations lay down the obligations; you must act if any noise level exceeds 85dB(A).

What are my obligations under first aid?

Someone must be appointed who can take charge in an emergency; you must have a first aid box whose whereabouts is known to employees. You are not obliged to have a trained first-aider unless your work involves special hazards, but you may choose to do so as a contribution to employee welfare.

What is COSHH, and what must I do?

COSHH is the Control of Substances Hazardous to Health Regulations 1994. It requires an orderly process for prevention, control, monitoring and recording of the exposure of employees to harmful substances. Get a copy or join a training course.

Integrated Management

How do I ensure effective design and implementation?

To ensure this is done effectively, the steps listed below should be followed:

• Define the Business Model and Primary Functions
• Analyse business processes using flow charts, standards and failure mode analysis techniques
• Formulate operational policies which will govern the processes and their inter-linkages
• Develop internal business procedures to control each business process which define who does what and where, when and how
• Implement the new and improved practices, if required
• Identify optimum documentation needs by linkage to the control procedures
• Document the system

How should systems be integrated?

There are several approaches, which can be taken, depending on an organisation's current position. However, all systems should eventually share the following processes:

• Management review
• Document development and control
• Monitoring, analysis and review
• Internal audit
• Training
• Continual improvement (Corrective and Preventive Actions)

What are Integrated Management Systems?

An integrated management system (IMS) is a management system, which integrates all relevant components of a business into one coherent system so as to enable the optimal achievement of its business objectives. The integrated approach requires combining all the internal business management practices into one system. For the different systems to be properly integrated, rather than simply being separate systems joined together, there have to be effective linkages so that the boundaries between processes are seamless. The fundamental components of the system include the organisation, resources and processes. Therefore, people, equipment and business culture are part of the system as well as the documented policies and practices.

What can be integrated?

Any system, which is required by the effective running of a business, can be integrated either totally or partially under a unified management structure. In essence any system, which has an impact on overall business performance should be part of the integrated management system.

What is required to ensure effective integrated management systems?

To ensure effective systems, the following functions must be performed:

• Risk Assessment- this should address customer perceptions, health & safety risks, environmental concerns & impacts and process failure modes. By having a common approach it will be easier to compare risks occurring in different parts of the business.
• Norms & Regulations Management - to capture norms and regulations with respect to product specifications, environment and health & safety and their impacts on the business.
• Continual Improvement Management - this should focus on specific improvement programmes related to quality, health & safety and environment.
• Stakeholders Awareness - this should address needs of both customers, staff and general public with respect to quality, health & safety and environment

What is the best approach to take?

Whether an organisation has an existing formal system or not, it is best to adopt the business process approach to management system development. The benefits are that one coherent system can be built which serves business needs and does not tie the organisation to a particular standard. The standards are used to assist identify tasks and processes. This approach starts by looking at the business as a whole and establishing its objectives, mission and core processes which deliver the objectives and achieve this mission.

What types of systems can be integrated?

All systems relevant to the business, whether certifiable or otherwise, can be included. These could include: Quality (ISO 9001); Environment (ISO 14001); Occupational Health & Safety (OHSAS 18001 & BS 8800); Food Safety & Hazard Analysis Critical Control Points (HACCP); Ethical Trading Practices (SA 8000); Social & Ethical Accounting, Auditing and Reporting (AA 1000); Investor in People (IIP); Law Society Practice Management Standard (LEXCEL), European Directives and CE Markings; Information Security (BS 7799); Quality System Requirements for Automotive Industry Suppliers (ISO/TS 16949 & QS 9000); Quality System Requirements for Telecommunications Industry Suppliers (TL 9000); and Business Excellence Model (BEM).

Why should management systems be integrated?

Integration is designed to:

• Ensure focus on business goals & objectives
• Harmonise and optimise practices
• Reduce risks to the business and increase profitability
• Balance conflicting objectives
• Eliminate conflicting responsibilities and relationships
• Create consistency
• Reduce duplication and therefore costs
• Improve communications
• Facilitate training and development

Training

Are courses for transition from the 1994 Standard to ISO 9001: 2000 available now?

Yes. A number of Organisations (including Quality Associates) are currently scheduling courses to update auditors to the new Standard.

Are there any courses for understanding the new Standard?

Yes. A number of Organisations (including Quality Associates) are currently scheduling courses to help people to understand the new Standard.

Are there different levels of training on QMS?

Yes, staff at different levels in the organisation performing different functions need different levels of training on the QMS.

Are there specific courses available for auditing?

Yes, a typical Auditor Training Course lasts two days, and a Lead Assessor Course lasts five days

Does Auditor Training need to be updated on a regular basis?

No. However, when changes are made to the ISO Standard relating to Auditing or major changes are made to the ISO Standard for QMSs (i.e. 9001:2000) then re-training of auditors becomes necessary.

How long do these courses last?

Two days.

How long does basic Awareness Training take?

Typically a general Awareness Training session will take about two hours.

How long does this course last?

Typically one day.

What is the basic requirement?

Everyone in an organisation should have a basic 'Awareness' of the QMS, why it is there and what the organisation's objectives are in having and operating such a system.

What training do auditors need?

There is no specified minimum training defined for auditors of QMSs. However, Third Party Assessment Bodies will be looking for evidence that anyone undertaking audits has received 'appropriate' training.