5.6. Section 5. Management Responsibility
Section 5 of the ISO 9001:2000 Standard describes management's responsibility in establishing and maintaining the organization's Quality Management System.
The requirements here are not extensive or demanding, but they are of special importance.
ISO 9001 places particular emphasis on the participation of management in the quality program. In some organizations (and we've probably all seen this), management may have the inclination to vouch audibly for process improvement and quality management, but when it's time for the rubber to hit the road, the work is delegated somewhere downstream, out of management's sight. But with ISO 9001, benign acquiescence is not the way.
Management is required to work as a key partner in the program's use, evolution, and ultimate success. In fact, this involvement is a big part of the 9001 audit process. Management must demonstrate its close involvement with the program.
To support this, Section 5 is organized into six requirements: management commitment, customer focus, Quality Policy, planning, accounting for responsibility and communications, and management review.
Next is a brief description of each.
5.6.1. 5.1. Management Commitment
The main requirement in this section is for management to demonstrate its commitment to the Quality Management System.
The term management here implies full management, from the executive level down to line management. And the word "commitment" means full and real commitment. Commitment with a capital C.
This breadth of commitment is essential to any quality program. In fact, it's essential to any program within a company. Employees tend to be a sharp, observant group of people. If they perceive that management lacks the interest to see an initiative through, they will quickly conclude that it's OK to skirt it themselves. Recognizing this, the 9001 Standard defines five requirements necessary to demonstrate and maintain quality-program commitment across the life of your program.
The first is to establish quality objectives. This was described in Section 4, but here the responsibility is laid at the feet of management. It is up to management to define what the QMS will be designed to accomplish, what its focus will be, how it will be directed. This is an important activity. From this, the full QMS will eventually emerge. This should not be a harried activity, nor rushed. It should be carefully thought out. And it should not be conducted in isolation. It may be management's responsibility to define QMS objectives, but management should do so with plenty of input from as many voices across as many levels of the organization as are practical. This will help ensure that the objectives address the true needs of the company.
The second requirement is to establish the Quality Policy. This policy, being a tangible document, represents the visible flag of management commitment. There are a few points to note about the Quality Policy. At its heart, the policy should reflect the quality objectives that management has established for the organization. These should be clearly but concisely described in the document. In fact, "concise" is a good word to apply to any policy. Policies are not programs or processes, which may require a great deal of description. Policies direct people to programs and processes. The best policies are precise. They are short and to the point. Your 9001 Quality Policy might be a couple of pages long. The best policies I have seen, and those that I have helped shape, have been a single page. Above all, the policy should be signedwith confidenceby management, the higher the positions the better. This is the cap on the visible flag of commitment.
The third requirement is for management to communicate the importance of the QMS to the organization. This is typically done through broad dissemination of the Quality Policy. The policy might be emailed to all employees. It might be tacked on bulletin boards around the company. It might be formally discussed at staff meetings. This communication can also take other forms: team meetings, newsletter communiqués, annual report statements, and so on. The central idea here is to let the whole organization know that the QMS is a core ingredient to the way business is conducted by the company, that this system is viewed as critical to corporate success, and that management wants this way to be commonly understood across the organization.
The fourth requirement is to ensure that adequate resources have been assigned to implement and run the QMS. Quality programs don't run themselves. It takes people to make a program work, and one of the chief reasons quality programs fall short is because the right people are not in place to take care of them. With the 9001 Standard, management is required to fortify the program by adequately staffing for its use.
The fifth requirement is to conduct management reviews of the program on a periodic basis. A guiding philosophy behind ISO 9001:2000 is that adoption of the program represents a strategic move on the part of senior management, a move that shifts the culture of the organization to one with a distinct process focus. That being the case, management should not leave the success of the program solely in the hands of those down-line of the executive chain. Management must monitor and review the effectiveness of the QMS on a regular basis. This can be done several ways: through group discussions, through project reports, through off-site meetings. The regularity of such evaluations is up to management. It might be quarterly, it might be at the close of each major project, it might be linked to other management evaluations. However conducted, the point is the same: management takes an active and ongoing role in evaluating the effectiveness of the QMS and guiding its evolution.
Figure 5-3 illustrates the five domains of management responsibility.
Figure 5-3. Management responsibility under ISO 9001 falls into five domains. The first is to establish quality objectives for the organization. Second is to establish the organizational Quality Policy. Third is to communicate the importance of the policy and the program. Fourth is to provide adequate resources. And fifth is to conduct periodic management reviews of the program.
5.6.2. 5.2. Customer Focus
You'll see later in the discussion of Six Sigma that one of its major directives is to find and listen to the "voice of the customer." With the 9001:2000 revision of the ISO Standard, the place of the customer has taken on a similar and heightened prominence. Section 5.2 requires that the QMS be shaped specifically to help meet customer requirements, thus better ensuring customer satisfaction.[*]
This is a relatively new emphasis in the realm of process improvement. Many organizations shape their process programs from a strictly internal view. How can we streamline X to reduce waste? How can we improve Y to speed up delivery? How can we manage Z to add more features?
All of those may be good ideas, but they may have little to do with customer satisfaction. Your customers may not care about waste reduction, faster delivery, or added features.
The point of Section 5.2 is that you should shape your program, first of all, to help fulfill the requirements of your customer.
If the requirements are fulfilled, your customer should be content, and that contentment should translate (in their minds at least) to quality. That should then contribute to business success for your enterprise.
5.6.3. 5.3. Quality Policy
A key component of management's commitment to its QMS is to produce the Quality Policy. I discussed some of the characteristics of a Quality Policy in Section 5.1. In Section 5.3, the Standard sets forth four requirements that the ISO expects to see in a sound policy.
The first requirement is that the policy reflect the mission of the organization. This mission statement is important. It helps ensure that management is able to articulate its mission precisely. Surprisingly, many management teams find this difficult to do. They may have a feeling about it. They may think it's obvious enough. But when it comes to putting the mission into words, they struggle. This requirement also links the quality program to the mission and encourages management to articulate that in real terms.
The second requirement is for the policy to reflect the organization's defined quality objectives. Defining these objectives is a crucial management activity. The objectives shape the form and tenor of the quality program. They point it in the direction it will set sail. The Quality Policy is a natural home for these objectives, as evidenced by the next requirement.
The third requirement is to communicate the policy to the organization. Since the policy holds the quality vision of the organization, this document needs to be shared throughout the organization. This communication helps saturate the vision. It will also aid in its consistent implementation throughout the organization. You'll find that the idea of communication is one broadly implemented throughout the 9001 Standard. Effective communicationsharing, evaluating, and using informationis a key to effective teamwork. Since the Quality Policy gives the team its charter, this first-tier document should be shared with everyone.
The fourth requirement is that the Quality Policy be maintained and reviewed for relevance. You'll find that your quality program will grow and evolve over time. Your business will undoubtedly grow and evolve over time. For these reasons, your Quality Policy must be kept up-to-date with the mission of the company. From time to time, your management team should review the policy, make sure it reflects current quality objectives, and (if needed) revise the policy and then redisseminate it within the organization.
5.6.4. 5.4. Planning
Planning under ISO 9001 is another key management responsibility. In fact, in all quality programs or process management systems, planning is always an important consideration. In Section 5, management is required to assume planning responsibility in two areas: planning (defining) the organization's quality objectives and planning the overall Quality Management System. Let's take a quick look at each of these requirements.
188.8.131.52. 5.4.1. Quality objectives
You've seen earlier that one of the first steps in creating a Quality Management System is to define the objectives of the systemthat is, what the system is designed to accomplish.
This requirement promotes management to establish relevant quality objectives.
The term quality objectives may seem a little broad. And it's admittedly easy to move down two obscure paths with this requirement. The first is for management to adopt broad-stroke objectives. Here are a couple of examples: "Become the nation's leading provider of Sales and Tax Management software" or "Produce products that are renowned for their quality performance." Those may be good objectives in and of themselves, but they are at such a high level that they beg for clarification. The second path is at the other end of the spectrum. The objectives are far too detailed or numerous, vivisected to the point where you can't see how they tie into a cohesive picture.
The word "relevant" helps with this requirement. Management is responsible for defining relevant quality objectives. These should be goals that the organization can use to devise plans of action, to establish routes that can move teams to their quality targets. As with all plans and policies, management should review the quality objectives from time to time to ensure they remain in sync with the organization's evolution.
184.108.40.206. 5.4.2. Plan the QMS
You've seen earlier, in Section 4, that ISO 9001 requires the development of a Quality Management System. Here, the Standard makes the creation, planning, and maintenance of the QMS a specific management responsibility. This requirement emphasizes the importance of the QMS. By assigning it to management, the implication is made that the QMS is an integral component of the organization's overall business strategy. It is not a side project, nor a low-level initiative.
This does not mean that the Quality Management System should be planned or executed without the input of your working teams. Just the opposite is true. As much as practical, the whole organization should become involved in the molding and shaping of the program. This will help ensure a secure cultural fit. But management should handle the production reins. It should not delegate QMS development ownership out of its domain. Management remains the party responsible for making sure the system is created, published, disseminated, used, and maintained within the organization.
5.6.5. 5.5. Responsibility, Authority, and Communication
This section of the standard establishes accountability for the QMS. In other words, management is required to create the right infrastructure to support the implementation of the system.
Many organizations have created quality programs without accounting for this infrastructure. As a result, many fine programs are today sitting on shelves somewhere collecting dust. The concept of responsibility, authority, and communication is crucial to the successful rollout and implementation of any quality program. To support this, the ISO Standard specifies three requirements:
Let's briefly look at these three.
220.127.116.11. 5.5.1. Identify stakeholders
All Quality Management Systems have stakeholders.
A stakeholder is usually defined as a person who will take an active role in the execution of the quality system or who is significantly impacted by its use. This may be a person who owns a process, whose activities influence a process, or who must interact with a process or collection of processes.
Identifying these stakeholders is important for two reasons. First, it lets the relevant people know their roles in using and managing the QMS. Second, it helps establish the basis for defining the resources needed to adequately run the system.
18.104.22.168. 5.5.2. Appoint management representatives
The stakeholders identified in the previous section will typically use the QMS on a day-to-day basis. But the stakeholders need the presence of management to maximize the productive use of the system. Should issues arise, or questions concerning system use surface, the stakeholders need to know who they can turn to for resolutions. And so management needs to appoint representatives who areperhaps as part of their other dutiesresponsible for the operation of the system within the organization.
The management representatives and identified stakeholders should work as a team to propagate the QMS throughout the organization in a coordinated manner.
22.214.171.124. 5.5.3. Establish communication channels
In the two previous sections, the ISO Standard defines the two parties that will manage the Quality Management System: stakeholders and management representatives. Here in Section 5.5.3, the Standard requires that management establish channels of communication between these parties.
These communication channels are defined to allow stakeholders to bring to management's attention ideas and issues related to the use of the QMS. They are also defined to describe how management can communicate changes, revisions, or addenda concerning the QMS to the stakeholders. As with any effective communications plan, rigidity is best avoided. The more effective path is to set into place a two-way street, with open access and encouraged participation.
5.6.6. 5.6. Management Review
The core idea behind Section 5 of ISO 9001 is that management take ultimate responsibility for the system's use, maintenance, and effectiveness.
Section 5.6 describes requirements for ensuring that management's relation to the system remains active. This is done by management periodically reviewing the effectiveness of the QMS within the organization.
Three requirements are set into place for this:
These are described next.
126.96.36.199. 5.6.1. General
The first requirement is for management to review the QMS at regular intervals.
The spacing of those intervals depends on a few things. The size of your QMS, its reach within the organization, and its current level of maturity can all dictate how often management meets to review it. Perhaps with new and unfolding programs, management might meet quarterly. With large, well-established programs, it might be necessary to meet only annually. You will find that you are the best judge of this when it comes to your own program.
188.8.131.52. 5.6.2. Review input
Management's responsibility to meet and review the effectiveness of the Quality Management System is defined in Sections 5.6.2 and 5.6.3. In 5.6.2, the Standard requires that management's review of the QMS be based on actual data, not merely on an internal agenda from the group. This data is termed input, and as ISO 9001 is used over time, plenty of input should accumulate. There are many sources of this input.
One source could be the results of audits conducted for the program. As a project moves through the quality management process, there are preset milestones at which audits are conducted to make sure compliance is being honored.
Another source could be customer feedback. I mentioned earlier that ISO 9001 places particular emphasis on customer satisfaction. In line with this, the Standard promotes seeking feedback from the customer as often as possible. This feedback can be a valuable source for improving the QMS.
Another source might be process performance measures. ISO 9001 specifies in Section 8 of the Standard that the organization regularly monitor and measure the performance of its processes. The results of these measures can provide insight into improving the QMS. The status of corrective actions is another good source of review data, as are follow-up actions on any current issues.
Reviews of all these sources of dataall this inputcan provide objective and tangible information that can be used to improve the QMS.
184.108.40.206. 5.6.3. Review output
By reviewing the input described in the previous section, management should be able to take concrete action to better shape the QMS to the needs of the organization. These actions should be set into place, and the results of these actionsthe outputshould also be reviewed by management as part of its ownership of the system.
In this regard, management should look at two areas. The first is to look at improvement measures that have been taken. If the program is in any way reshaped or the processes re-engineered, it's a good practice to review how well the changes are working for the organization. Another view is just as useful: to look at the improvement of your products. That's the ultimate objective of any quality program: produce an improved product. By looking at the quality trends of your products (or their components), you can acquire a good gauge of the effectiveness of your quality system.
5.6.7. Required Records
Section 5 of ISO 9000 requires that the organization retain records of its management reviews. These records can be evidenced in many ways. One common form is to keep them as meeting minutes of review meetings. (Another record that usually comes from the requirements of Section 5 is the Quality Policy, but that is usually accounted for in the Quality Manual, which is the record requirement of Section 4.)