ISO 9001 for a REALLY small business

[AndyN]

The very first thing I would do is take a course on ISO 9001:2008. Get a copy of the standard and read it before taking the class. Taking a course first will help you to see where your company is and where it needs to go.

Any recommendations for a specific course, Jim? Overview (1/2 day)? Implementing and Understanding ISO (2 days)? Documenting an ISO QMS (2 days)? Internal Auditing (2-3 days) Skills for the Management Rep (3 days)?

Judith could sign up for a 40 hour Lead auditor course (everyone says that's the best course, they have fun on that one) and it will tell her nothing about implementation in a small company!

 

[Big Jim]

Exposure to the standard is what I'm suggesting. A two or three day internal auditor training class would be about right.

You are certainly correct in that the class itself will not tell her how to implement the standard, but it is a start, and one that would greatly benefit her.

 

[JaneB]

I would do a 1 day overview of ISO 9001 with a good certifier.

You are looking to get a quick 'high level' view of the Standard and what it entails.

Personally, I think a 2-3 day course on internal auditing is overkill, particularly at this point.

 

[JaneB]

The 1994 version was a bit of a nightmare for a small business - the updated version is much, much better, so be reassured on that point.

I've done it for very small businesses (smallest = 1). Yes there are some challenges (eg, 'management review' and audit).

1. Keep it simple.
2. Keep it small.
3. Don't make it complicated (see #1)
4. When you do get around to writing some stuff (I wouldn't start there!), have the absolute bare minimum.

Many (if not most) people are more accustomed to doing it in a larger business, so keep reminding yourself of that, and treat much advice offered with caution and a big grain of salt. eg, Many small businesses often don't need procedures and work instructions.

 

[Sidney Vianna]

At the risk of being accused of blasphemy and heresy, I will say that, in my opinion, ISO 9001 implementation in micro-businesses (1-5 employees) is, for the most part, a wasted effort.

When you have a 1-man shop, internal audits, by necessity have to be outsourced. A 1-man shop management review might resemble a esquizofrenic attack.

Micro businesses, for the most part, need to be so fluid that any resemblance of structured system, as implied by ISO 9001, turn into an artificial effort.

Don't get me wrong. For a micro business to grow, they will need structure. And ISO 9001 might provide a good framework. But the reality is different. If I had to draw a line somewhere, I would say that organizations with less than 10 employees should not be eligible to certification, what would impact the implementation.

Running for cover.

 

[Big Jim]

One of the one man shops I call on is a guy that owns a plastic molding machine and his biggest customer is Boeing. Boeing says he needs to be certified if he wants to continue as their supplier. Not a lot of choice there.

At least two of the one man shops I call on are doing it for the structure, with the intention of growth, so that they don't learn bad habbits they need to overcome later.

And, yes, they do need to outsource internal audits. One of them does management review by himself (and he finds it useful). The other one does management review with the same consultant that does his internal auditing.

So from your plan, the first guy that needs certification to do business with Boeing, would need to hire nine people?

 

[Sidney Vianna]

So from your plan, the first guy that needs certification to do business with Boeing, would need to hire nine people?

Not a plan. Just an opinion of someone who has been involved with this for 20 years.

Many certification mandates are thrown down the supply chain without careful consideration. Just because AS9100 is a good standard model for many suppliers in the aerospace supply chain, it does not mean that it should be flown down to ALL suppliers.

Many procurement organizations of large OEM's flow down such policies and the buyers have no idea of the impact of the mandate over some of the suppliers.

Just like, in my opinion, it makes no sense to require AS9100 certification of a supplier that is not involved with flight hardware production. If, for example, I am a supplier of production equipment maintenance services, most of the AS9100 additional requirements (compared to ISO 9001) will make no sense to me.

But mandates are normally painted with a broad brush, instead of careful evaluation and laser targetting the intended recipients of the requirement.

Further, sometimes, an OEM will require a micro-supplier to attain certification as an exercise to raise the hoops for the supplier to jump. At the end of the day, certification will not save the supplier relationship with the customer, if their performance is unacceptable, in the long term.

With the upcoming changes to the ICOP Scheme, the cost of certification will certainly go up and some small suppliers might decide they should not be playing that game anymore.

Rest assured that, with Boeing's recent announced re-organization, partially due to the concerns over the 787 program, Boeing's relationship with non-performing suppliers will change.

 

[AndyN]

I also believe that too many major purchasing organizations make registration to a standard a (thoughtless) contractual boilerplate requirement. A few years ago, I was involved in implementation with two GM suppliers about as far removed from product quality as you could get!:mg:

One, comprising 24 people, clean and stocked the photocopier 'fleet' at the Warren Tech Center. The other, processed papers for legal purposes! The first negotiated to stop implementation when it came to pricing pressures and, although I lost a job, didn't blame them for doing it!

I also agree that certification is often pursued by these micro businesses unnecessarily, which points to another divergence of implementation vs certification........

 

[Big Jim]

Not a plan. Just an opinion of someone who has been involved with this for 20 years.

Many certification mandates are thrown down the supply chain without careful consideration. Just because AS9100 is a good standard model for many suppliers in the aerospace supply chain, it does not mean that it should be flown down to ALL suppliers.

Many procurement organizations of large OEM's flow down such policies and the buyers have no idea of the impact of the mandate over some of the suppliers.

Just like, in my opinion, it makes no sense to require AS9100 certification of a supplier that is not involved with flight hardware production. If, for example, I am a supplier of production equipment maintenance services, most of the AS9100 additional requirements (compared to ISO 9001) will make no sense to me.

But mandates are normally painted with a broad brush, instead of careful evaluation and laser targetting the intended recipients of the requirement.

Further, sometimes, an OEM will require a micro-supplier to attain certification as an exercise to raise the hoops for the supplier to jump. At the end of the day, certification will not save the supplier relationship with the customer, if their performance is unacceptable, in the long term.

With the upcoming changes to the ICOP Scheme, the cost of certification will certainly go up and some small suppliers might decide they should not be playing that game anymore.

Rest assured that, with Boeing's recent announced re-organization, partially due to the concerns over the 787 program, Boeing's relationship with non-performing suppliers will change.

Actually, I agree with you. Now if only Boeing did.

Boeing wants suppliers that make tools for ground support to be AS9100. Ford wants suppliers that ship their cars to be ISO 9001. Ford wants suppliers that refurbish car radios to be TS16949. All of those are very questionable.

 

[JaneB]

Sidney, Andy, Big Jim, I agree with you all.

The extremely small ones I've done have almost invariably done so because it was forced upon them by a large customer and they don't want to lose the business. (eg, for one firm, 90% of their business was one customer, who said 'you will get it').

IN general for tiny,tiny companies, certification is hard to justify the cost of - I've dissuaded some potential customers from doing it because of that. OK, I lose the business, but better that than give poor advice.

But some other companies have done it (meaning got certified) because although they're small now, they are fast growing and are smart enough to plan for the future.

I cannot think of a situation where I would advise even a small organisation against using ISO 9001 as a model for their qms. It's a good model. But I can think of a number of situations where going for certification is hard to justify in cost/benefit terms.

But contrary to Sidney's point of view, my organisations have found the management review part useful. They usually think they do it 'all the time' and 'everyday' and for some aspects of it, yes they do. But often what's missing is the 'helicopter view' aspect of it, standing back & looking at their objectives (presuming they have them!) and how well they did against them. Perhaps because of being so hands on.