7.3 Inspection BCR Methodology

6.5 ISO 9001

ISO 9001 is a set of minimum requirements for quality management systems, as well as a set of criteria for certifying businesses within the European Union. It is also an international standard for quality and process improvement. ISO 9001 is composed of five broad categories of requirements for the design and certification of quality management systems. The five categories are quality management system, management responsibility, resource management, product realization, and measurement, analysis, and improvement. Quality management system consists of general requirements and documentation requirements. Management responsibility consists of management commitment, customer focus, quality policy, and planning. Responsibility, authority, communication, and management review round out management responsibility. Resource management consists of provision of resources, human resources, infrastructure, and work environment. Product realization consists of planning of product realization, customer- related processes, and design and development. Purchasing, production and services provision, and control of monitoring and measuring devices are also part of product realization. Measurement, analysis, and improvement consist of general requirements and monitoring and measurement. Control of nonconforming product, analysis of data, and improvement are also included. ISO 9001 requires about 546 hours to develop a quality policy, quality manual, and procedures for ISO 9001 registration. It also requires 560 hours to develop the necessary plans and records for each project. It is a simple equation expressed as the sum of 546 and the number of projects multiplied by 560. Figure 23 illustrates the cost model for ISO 9001.

Hours = 546 + 560 — Number of Projects

Figure 23: Cost Model for ISO 9001

The quality management system clause requires 21 policy statements at 3.4 hours and 21 quality manual paragraphs at 6.8 hours. This clause requires 5 procedures at 46.7 hours, 5 plans at 46.7 hours, and 21 records at 12.3 hours, for a total of 115.8 hours. The management responsibility clause requires 30 policy statements at 4.9 hours and 30 quality manual paragraphs at 9.7 hours. This clause requires 11 procedures at 102.7 hours, 11 plans at 102.7 hours, and 30 records at 17.5 hours, for a total of 237.4 hours.

The resource management clause requires 12 policy statements at 1.9 hours and 12 quality manual paragraphs at 3.9 hours. This clause requires 5 procedures at 46.7 hours, 5 plans at 46.7 hours, and 12 records at 7 hours, for a total of 106.2 hours. The product realization clause requires 54 policy statements at 8.8 hours and 54 quality manual paragraphs at 17.5 hours. This clause requires 20 procedures at 186.7 hours, 20 plans at 186.7 hours, and 54 records at 31.5 hours, for a total of 431.1 hours.

Measurement and analysis and improvement requires 27 policy statements at 4.4 hours and 27 quality manual paragraphs at 8.8 hours. This clause requires 10 procedures at 93.3 hours, 10 plans at 93.3 hours, and 27 records at 15.8 hours, for a total of 215.5 hours.

ISO 9001 in its entirety requires 144 policy statements at 23.3 hours and 144 quality manual paragraphs at 46.7 hours. It requires 51 procedures at 476 hours, 51 plans at 476 hours, and 144 records at 84 hours, for a total of 1,106 hours. It is important to note that the 51 plans and 144 records which require 560 hours are only for one project.

The fixed part of the ISO 9001 cost model is 546 hours. The variable portion is 560 hours, which is multiplied by the number of ISO 9001-compliant projects to be audited . While Software Capability Maturity Model appraisals and ISO 9001 audits are not similar in this regard, the design of the Software Capability Maturity Model cost model was extended to the design of the ISO 9001 cost model for completeness and simplicity. The only question, then, is to determine the number of projects or project records to audit. How many projects need to spend a minimum of 560 hours to produce 51 plans and 144 records? Usually only four to seven projects are necessary for even the largest organization undergoing ISO 9001 registration. However, it is up to the discretion of the registrar. You could take the opposite tack and require hundreds of projects to be ISO 9001 compliant. No registrar would care to audit hundreds of projects. It is best not to undergo the expense for such marginal gains.