The Effect of the Changes

Software developers and service companies will need to make significant changes to their Quality Management Systems in order to comply with the latest revision of the ISO 9000 standard.

Organisations seeking certification for the first time will have to comply with the new standard. Those previously certified to the 1994 standards will be required to upgrade their Quality Management Systems over a period.

ISO 9000:2000 is a radical revision of the 1994 edition. It has relaxed some former requirements, introduced new requirements, and restructured and reworded the documents to make them easier to understand.

The impact of the changes on software companies may be less than for some other types of organisation. Many of the new requirements are for things that they would have been doing anyway. However, they will need to pay attention to:

Process Approach

The new standard requires a process approach to Quality Management. Your Quality Manual must define:

• the processes that make up your system,
• the sequence in which they take place, and
• the interactions between them (that is, the data and other information that flow from process to process).

See ISO 9001:2000 sections 0.2, 4.1 and 4.2.2 c).

Customer Requirements

You must now go and find out your customer's needs - not just rely on the customer to tell you. This includes implied needs and statutory and regulatory requirements, as well as those needs the customer actually states.

This will be especially important when, as is often the case, the customer lacks in-depth knowledge of software matters. The caveat emptor approach will no longer do.

There is also a need to communicate effectively with the customer on various matters. This will be particularly relevant to software projects, where the requirements tend to evolve throughout the life of the project.

See ISO 9001:2000 sections 7.2.1 and 7.2.3

Measurements or "Metrics" and Continual Improvement

Software companies often treated the measurement clauses of ISO 9000:1994 as optional, or paid lip service to them. Under the new standard, you must take measurement seriously and apply it as a tool for continual improvement.

Measurements to be taken include:

• Product quality - as evidence of fitness for release (approval of which has to be recorded).
• Process measurements - to be used for improving the processes.
• Customer satisfaction - how to measure this will need careful thought.
• Corrective actions taken to correct system, process or product faults - to be evaluated in order to ensure that the faults are prevented permanently.

Measurements not only have to be made, they also have to be analysed and applied for a variety of purposes stated in the standard.

See ISO 9001:2000 sections 8.1, 8.2.1, 8.2.3, 8.2.4, 8.5.1 and 8.5.2 c)

Top Management Responsibility.

Specific responsibility for certain aspects of the quality management system is assigned to "top management". Often, of course, the work will be delegated - but top management remains accountable; they cannot just point the finger if things go wrong.

This includes responsibility for determining and meeting requirements, for customer satisfaction, and for ensuring internal communication regarding the effectiveness of the Quality Management System.

See ISO 9001:2000 sections 5, 5.2, 5.5.3

Quality Management

The Quality Manager ("Management Representative" in ISO 9000-speak) now has to promote awareness of customer requirements throughout the organisation.

The periodic Management Reviews need to consider customer feedback, process performance and product conformity, corrective and preventive actions, and changes that could affect the Quality Management System.

See ISO 9001:2000 sections 5.5.2 c), 5.6.2

Quality Policy and Objectives

Under ISO 9000:1994, the Quality Policy was often treated as a platitude with little application to the company's actual activities. In the new standard, the requirements have been expanded and sharpened. You will need to review your existing Quality Policy, to make sure it complies.

Quality Objectives were referred to in the old standard, but little attention was paid to them. ISO 9000:2000 places a new emphasis on both overall company Quality Objectives and individual project Quality Objectives.

See ISO 9001:2000 sections 5.3 and 5.4.1

Configuration Management

At first sight, this may appear to have vanished from the standard. Not so!

It is covered by the requirement for "identification and traceability", which is now - confusingly - included under Production and Service Operations.

See ISO 9001:2000 section 7.5.3.

Other Changes

You must take immediate action to prevent defects when the need becomes apparent, not keep such action back to the next Management Review (ISO 9001:2000 sections 8.5.3 c) & d) ).

You must re-evaluate suppliers from time to time, not rely on a once-in-a-lifetime initial evaluation (ISO 9001:2000 section 7.4.1).

Further Information

The above is a brief general summary of the main requirements of the new standards that will affect most software organisations. For specific advice as to the effect of the changes on your organisation, please contact the author.