NIST IR 4721QUESTIONS AND ANSWERS ON QUALITY, THE ISO 9000 STANDARD SERIES, QUALITY SYSTEM REGISTRATION, AND RELATED ISSUES Revised July 1992 Maureen Breitenberg
Standards Code and Information Program
Office of Standards Services
National Institute of Standards and Technology
Gaithersburg, MD 20899
The Standards Code and Information Program periodically publishes information on various aspects of conformity assessment for use by those who operate or benefit from such systems. Recently there has been considerable interest in the content and application of international standards related to quality management, i.e., the so-called ISO 9000 series. This report provides answers to some of the most often asked questions on this topic. This material is intended for those who are concerned about the ISO 9000 standards and should help foster a wider interest in the use of quality systems in general. This document also references other publications and services provided by this office which readers may find useful. The reader is also invited to share any comments on the material presented in this document. The attainment of quality is a dynamic and evolving process, and its continued maturation depends on feedback from those involved in the process. Return to CONTENTS
I would like to thank Mary Saunders, International Trade Administration's Office of European Community Affairs; Mr. Charles Hyer, the Marley Organization; Mr. Donald Mackay, Air- Conditioning and Refrigeration Institute; Dr. Curt Reimann and Dr. Robert Chapman, NIST's Office of Quality Programs; Patricia Kopp, American Society for Quality Control; and NIST's Standards Code and Information staff for their careful review of and comments on this document. Maureen A. Breitenberg
Standards Code and Information Return to CONTENTS
This report provides information on the development, content and application of the ISO 9000 standards to readers who are unfamiliar with these aspects of the standards. It attempts to answer some of the most commonly asked questions on quality; quality systems; the content, application and revision of the ISO 9000 standards; quality system approval/registration; European Community requirements for quality system approval/registration; and sources for additional help. Key Words: conformity assessment; EN 29000; ISO 9000; quality assurance; quality control; quality system; quality system registration Return to CONTENTS
This report was designed to answer the most commonly asked questions on quality; quality systems; the content, application and revision of the ISO 9000 standards; quality system approval/registration; European Community requirements for quality system approval/registration; and related topics. The Standards Code and Information Program at the National Institute of Standards and Technology (NIST) has received an increasing number of inquiries on these topics, which is indicative of the expanding interest in quality by many sectors of the economy. This report has been prepared to provide basic information in this area. Return to CONTENTS
Quality improvement has now become both the corporate and international business strategy of the 1990's. Cadillac and Milliken and Company each advertise winning the Malcolm Baldrige Award for quality. Ford Motor Company publicizes a "Quality is Job 1" slogan, and many other companies are following suit. At the international level, interest has mushroomed in quality systems as a means of assuring the consistent conformity of products or services to a given set of standards or expectations. There has, however, been little agreement among either corporate management or professionals in the field regarding the meaning of "quality." The International Organization for Standardization (ISO) Standard 8402 defines quality as: "the totality of features and characteristics of a product or service that bear on its ability to satisfy stated or implied needs." However, there are problems with this definition. Whose needs does the service or product address? Who are its customers? In the testing services field, for example, totally erroneous test results may satisfy a client's needs quite well if the faulty test report can be used to allow him to sell his product, especially if an accurate test report would not. Nevertheless, such results are unlikely to satisfy the needs of the potential buyers of the product or of the agency responsible for regulating the product. Customers for a product or service produced by a company can be located within or outside the company or both, depending on the product or service. A product or service may be provided by one company unit to another solely for the latter's use, or for subsequent delivery to a customer outside the organization. It has been said that most product or service defects (no matter where they occur in the service or manufacturing process) usually find their way to the point of interface between a company and its outside customers. In an attempt to address this problem, ISO has added seven footnotes to its definition, including that: "in a contractual environment, needs are specified, whereas in other environments, implied needs should be identified and defined" and that "needs can change with time." Needs can be defined in terms of safety; usability; availability; versatility; compatibility with other products; reliability; maintainability; overall cost (including purchase price, maintenance costs, and product life); environmental impact; or other desired characteristics. Even if all "needs" can be identified and adequately defined (often no easy task), what about the issue of an "acceptable quality level (AQL)" -- the maximum percentage of nonconforming products or service units that should be considered satisfactory as a process average? Stated in other words, how many (if any) mistakes can you make and still produce a "quality" product or service? A manufacturer's production system may be considered by his customers to produce a "quality" product if the AQL is 0.1%, that is only one in 1,000 products contains defects. Yet a 1 in 1,000 error rate for nurses whose job it is to hold babies (they only drop one out of a thousand) or for containers which hold highly toxic or hazardous materials (only one serious leak gets by for every 1,000 containers produced) are obviously not acceptable. There is a belief among many quality experts and their disciples that the only acceptable quality level for any manufactured product or service is 100% ("zero defects"), and that any failure to "do it right" the first time is not tolerable. This is not a universally held opinion. Return to CONTENTS
Product quality depends on many variables, such as the caliber of the components or materials used; type of equipment used in design, production, handling, installation, testing and shipping; the equipment calibration and maintenance procedures employed; the training and experience of production and supervisory personnel; the level of "workmanship;" and sometimes the environmental conditions (temperature, humidity, level of dust particles) in the area where the product is produced. The process, organizational structure, procedures, and resources that manufacturers and suppliers use to control these variables to produce a product of consistent quality which meets defined specifications is called a quality system. (1) The standards that are being adopted globally for quality systems are the ISO 9000 standards. Return to CONTENTS
ISO is the International Organization for Standardization, founded in 1946 to promote the development of international standards and related activities, including conformity assessment, (2) to facilitate the exchange of goods and services worldwide. ISO is composed of member bodies from over 90 countries, the U.S. member body being the American National Standards Institute (ANSI). ISO's work covers all areas except those related to electrical and electronic engineering, which are covered by the International Electrotechnical Commission (IEC). The results of ISO's technical work are published as International Standards or Guides. Return to CONTENTS
In 1987, the ISO published a series of five international standards (ISO 9000, 9001, 9002, 9003, and 9004), developed by ISO Technical Committee (TC) 176 on quality systems. This series, together with the terminology and definitions contained in ISO Standard 8402, provides guidance on the selection of an appropriate quality management program (system) for a supplier's operations. The ISO 9000 standards were intended to be advisory in nature and were developed primarily for use in two-party contractual situations or for internal auditing. However, the standards are currently being applied under a much broader range of conditions and circumstances. In some cases, compliance with one of the ISO 9000 standards (or their equivalent) has been or will be mandated by a U.S., foreign national, or regional government body. Conformance to ISO 9000 standards is also being required in purchasing specifications with increasing frequency. The ISO 9000 Standard Series has been adopted in the United States as the ANSI/American Society for Quality Control (ASQC) Q 90 Series (soon to be changed to the ANSI/ASQC Q 9000 series). In Europe, it has been adopted by the European Committee for Standardization (CEN) and the European Committee for Electrotechnical Standardization (CENELEC) as the European Norm (EN) 29000 Series. According to a recent survey by ISO, forty- eight (48) countries have national standards that are identical or equivalent to the ISO 9000 Standard Series. Additional countries are considering their adoption. Return to CONTENTS
The ISO 9000 Standard Series is generic in scope. Each standard addresses a different aspect of quality assurance, depending on the needs of the user. ISO 9001, 9002 and 9003 describe three distinct quality system models of varying stringency for use in different applications. Common elements in ISO 9001, 9002, and 9003 include the need for: an effective quality system; ensuring that measurements are valid, that measuring and testing equipment is calibrated regularly; the use of appropriate statistical techniques; having a product identification and traceability system; maintaining an adequate record keeping system; having an adequate product handling, storage, packaging and delivery system; having an adequate inspection and testing system as well as a process for dealing with nonconforming items; and ensuring adequate personnel training and experience. ISO 9000 (ANSI/ASQC Q 90), Quality Management and Quality Assurance Standards - Guidelines for Selection and Use, explains fundamental quality concepts; defines key terms; and provides guidance on selecting, using, and tailoring ISO 9001, 9002, and 9003. ISO 9001 (ANSI/ASQC Q 91), Quality Systems - Model for Quality Assurance in Design/Development, Production, Installation and Servicing, is the most comprehensive standard in the series. ISO 9001 covers all elements listed in ISO 9002 and 9003. In addition, it addresses design, development, and servicing capabilities. ISO 9002 (ANSI/ASQC Q 92), Quality Systems - Model for Quality Assurance in Production and Installation, addresses the prevention, detection, and correction of problems during production and installation. It is more extensive and more sophisticated than ISO 9003. ISO 9003 (ANSI/ASQC Q 93), Quality Systems - Model for Quality Assurance in Final Inspection and Test, is the least comprehensive standard. It addresses requirements for the detection and control of problems during final inspection and testing. ISO 9004 (ANSI/ASQC Q 94), Quality Management and Quality System Elements - Guidelines, provides guidance for a supplier to use in developing and implementing a quality system and in determining the extent to which each quality system element is applicable. ISO 9004 examines each of the quality system elements (cross- referenced in the other ISO 9000 standards) in greater detail and can be used for internal and external auditing purposes. Return to CONTENTS
WHERE CAN COPIES OF THESE STANDARDS BE OBTAINED?Copies of ISO draft/final standards and European standards (ENs) can be purchased from: The American National Standards Institute,
11 West 42nd Street, 13th Floor,
New York, NY 10036 Phone: (212) 642-4900,
Fax: (212) 302-1286. Return to CONTENTS
According to ISO procedures, all ISO standards, including those in the ISO 9000 series, must be reviewed and revised or reaffirmed at least once every five years. ISO has already begun to revise and supplement the ISO 9000 series. Some of these standards/guidelines will supplement ISO 9000 and ISO 9004, while others will be included in the new ISO 10000 series. Both series have been reserved for use by ISO TC 176. Recently released ISO standards and guidelines in the quality area include: ISO 9000-3, Guidelines for the Application of ISO 9001 to the Development, Supply and Maintenance of Software; ISO 9004-2, Quality Management and Quality System Elements - Part 2: Guidelines for Services; ISO 10011 Part 1, Guidelines for Auditing Quality Systems - Auditing; ISO 10011 Part 2, Guidelines for Auditing Quality Systems - Qualification Criteria for Auditors; ISO 10011 Part 3, Guidelines for Auditing Quality Systems - Managing Audit Programs; and ISO 10012-1, Quality Assurance Requirements for Measuring Equipment - Part 1: Management of Measuring Equipment. In addition, ISO/DIS (Draft International Standard) 8402-1 Quality Systems Terminology; and DIS 9000-2 Addendum to 9000 on Guidelines for Implementing 9001-2-3; DIS 9004-3 Addendum to 9004 on Processed Materials are under review by ISO TC 176. ISO TC 176 is also considering committee draft (CD) 9004-4 Addendum to 90004 on Quality Improvement; guidance documents on project management, quality plans, quality manuals, the economics of quality, and configuration management; documents covering revisions to ISO 9000, 9001-2-3; and 9004; and a working draft (WD) 10012-2: Quality Assurance Requirements for Measuring Equipment - Part 2: Measuring Equipment. (3) Some national and regional standards bodies are developing supplemental guidance for the application of the ISO 9000 series to specific industries. CEN and CENELEC, for example, are developing more specific requirements for the application of the ISO 9001 to the medical device industry. (4) The U.S. Food and Drug Administration (FDA) is planning to revise its Good Manufacturing Practice (GMP) regulations for medical devices to follow ISO 9001 with appropriate additional requirements. Draft GMP regulations are expected to be issued by the end of 1992. The International Organization for Legal Metrology (OIML) is developing a document entitled: "Quality Assurance as Applied for Initial Verification of Measuring Instruments," which provides guidance on the applicability and use of the ISO 9000 Standard Series in the manufacture of measuring instruments. Return to CONTENTS
Vision 2000 - A Strategy for International Standards' Implementation in the Quality Arena During the 1990s is a long range plan through the year 2000 developed by an Ad Hoc Task Force of ISO TC 176. The plan includes providing additional guidance on how to apply the ISO 9000 series standards to four generic product categories (hardware, software, processed materials, and services), as well as providing guidance on related issues, such as quality system auditing. As noted above, these documents are in various stages of development. Minor modifications in the original ISO 9000 series are expected in 1993, with major revisions in 1997. The long range goal, according to Vision 2000, is to have a single Total Quality Management Standard by the year 2000. Return to CONTENTS
ISO has established a forum to serve the needs of ISO 9000 users by: providing information (including a newsletter); facilitating international discussions on new developments and issues affecting the application of the ISO 9000 standards; promoting the exchange of experience in such areas as training, promotion and operation of relevant schemes; harmonizing practices in the application and interpretation of the ISO 9000 standards; providing advice to ISO TC 176 or the relevant ISO decision making body. Return to CONTENTS
The Malcolm Baldrige National Quality Award process is designed to recognize and award those firms with outstanding records of quality performance. The purpose of the program is therefore very different from the purpose behind the development of the ISO 9000 criteria. While the use of the ISO 9000 standards may be a good starting point in establishing a quality system, the criteria used in evaluating candidates for the Baldrige Award are much more detailed and extend beyond those areas covered by the ISO 9000 series. The Baldrige Award criteria are results oriented and cover all operations, processes, and work units of a company. The evaluation procedures emphasize the dynamics involved in the integration of all aspects of a firm's quality system and the firm's continuous improvements in quality. Return to CONTENTS
Quality system registration or approval (sometimes misnamed "quality system certification" (5)) involves the assessment and periodic audit of the adequacy of a supplier's quality system by a third party, known as a quality system registrar. When a supplier's system conforms to the registrar's interpretation of an ISO 9000 standard, the registrar issues the supplier a "certificate of registration." Interpretations of an ISO 9000 standard may not be consistent from one registrar to another. Note that the supplier's quality system is registered, not an individual product. Consequently, quality system registration does not imply product conformity to any given set of requirements. Registration programs can be conducted in conjunction with or independently from a certification (6) program. Registrars may or may not concurrently operate a product certification program. Return to CONTENTS
A manufacturer may choose to evaluate his own quality system. Such self-audits are usually major components of the quality system itself. Such self-audits can increase the confidence of management in its production system and demonstrate to its personnel that the firm is committed to quality management. "Second party" evaluations are also common. In these cases, it is usually the buyer who requires and conducts quality system evaluations of his suppliers. These evaluations are mandatory only for companies wishing to become suppliers to that buyer. "Third party" quality system evaluations and registrations may be voluntary or mandatory and are conducted by persons or organizations independent of both the supplier and the buyer. According to a recent ISO survey, 31 countries reported the existence of one or more third party registration schemes in their countries. Return to CONTENTS
The Government of the European Community (EC) has established a conformity assessment scheme for EC-regulated (7) products. The EC has specified conformity assessment methods in terms of eight "modules," such as self-certification (also called "manufacturer's declaration"), type testing, quality system approval, or final product verification by a third party. Each "new approach" directive specifies the alternative means (set of modules) which suppliers must use to certify their products as being in conformance with the "essential requirements" spelled out in each directive. When EC directives require the use of a third party in the conformity assessment process, each member country government must provide the EC government with a list of such bodies. Each member country government must determine that the bodies it notifies, referred to as a "notified bodies," are competent to declare that a regulated product is in conformity to the "essential requirements" spelled out in a particular directive. Member states notify bodies by both conformity assessment method (module) and by directive to the EC, which is then responsible for compiling a list of all such bodies. Each EC country must accept the results of conformity assessments by notified bodies in all other EC countries unless there is cause to believe that the product was improperly tested. Each EC country is responsible for assuring that the bodies it designates as notified bodies comply with the criteria for competence of testing laboratories, certification and laboratory accreditation bodies, and quality system registrars spelled out in the European EN 45000 series of standards. Return to CONTENTS
Having an approved quality system will not be a blanket requirement for all products. However, for suppliers of construction products, certain classes of medical devices and personal protective equipment, telecommunications terminal equipment, gas appliances, commercial scales, and possibly other products (such as pressure equipment, recreational craft, cable ways, and lifting equipment for people), approval of a supplier's quality system will be a key component of the EC's legal requirements for certification. For most of these regulated products, ISO 9000 registration is one alternative to proving compliance, not an absolute requirement. In other directives, such as the Council Directive dated June 14, 1989 on machinery (89/392/EEC), manufacturers of some products will be permitted to self declare that their product conforms to the requirements of the directive and to place the European Community (CE) mark on the product. However, such machinery manufacturers must maintain a file on the manufacture of those products, including information on "the internal measures that will be implemented to ensure that the machinery remains in conformity with the provisions of the Directive" -- in other words, on the manufacturer's quality system. It is possible that the ISO 9000 (EN 29000) Series Standards could be used within the European Community to evaluate the adequacy of such quality systems. Manufacturers need to review all relevant EC directives for specific requirements applicable to their products. Return to CONTENTS
At the present time, notified bodies must be physically located within the geographical boundaries of the European Community. In November 1991, the EC developed a document entitled, Working Document on Negotiations with Third Countries Concerning the Mutual Recognition of Conformity Assessment, which provides guidance for the establishment of mutual recognition agreements with third countries. A less detailed directive on this topic is expected sometime in June 1992. Until the directive is issued and one or more mutual recognition agreements are subsequently established between the United States and the European Community, there can be no notified bodies in the United States. A mutual recognition agreement would allow U.S. entities to perform all required conformity assessment procedures included within the scope of the agreement. There remains the possibility that some conformity assessment tasks may be subcontracted by notified bodies to bodies outside the EC, including organizations in the United States. Such subcontracting would be done at the discretion of the notified body, which would continue to be responsible for the final assessment of product conformity. Subcontractors must comply with all requirements of the EN 45000 series. Guidance on subcontracting can be found in Guiding Principles for Subcontracting by "Notified Bodies" pursuant to the Council Resolution of 13 December 1990 Concerning the Modules for the Various Phases of the Conformity Assessment Procedures. Return to CONTENTS
In the nonregulated product area, producers desiring to do business in the European Community (EC) and elsewhere may be required by procurement authorities or buyers to be audited and registered as being in compliance with an ISO 9000 standard. This is especially likely in industries such as aerospace, autos, electronic components, measuring and testing equipment, or in industries where safety and liability are concerns. Such requirements will result from marketplace demands, as opposed to regulatory requirements. It should be noted that in the United States, the U.S. Department of Defense is considering adopting the ISO 9000 standards in place of some of its military quality standards (MIL-Q-9858A and MIL-I-45208A). Other foreign government procurement authorities have already or are likely to follow suit. Return to CONTENTS
The European Organization for Testing and Certification (EOTC) was created by the EC in April 1990 under a memorandum of understanding with the European Committee for Standardization (CEN), the European Committee for Electrotechnical Standardization (CENELEC), and the European Free Trade Association (EFTA) countries. The EOTC was formed to promote the mutual recognition of test results, certification procedures, and quality system assessments and registrations in nonregulated product areas throughout the EC and EFTA. The EOTC will also be responsible for providing technical assistance to the EC Commission in the implementation of some EC legislation, especially in the preparation of mutual recognition agreements with non-EC countries. It is anticipated that there will be a Specialized Committee of the EOTC in the area of Quality Assurance. However, this committee will not be established until after December 31, 1992. Nevertheless the need for expert advice in this area was recognized by the EOTC in July 1991. The European Organization for Quality (EOQ) and the European Committee for Quality System Assessment and Certification (EQS) have been offered observership status in EOTC to fill this need. The EOTC is expected to be fully operational by the end of 1992. For further information on the EOTC, contact: EOTC, Rue Stassart 33, 2nd Floor, B-1050 Brussels, Belgium, Phone: 32 2 519 6969, Fax: 32 2 519 69 17/19. Return to CONTENTS
Until recently, U.S. companies relied on quality system registration firms in Europe and Canada to register their quality systems, but this is no longer the case. Today, the number of U.S.-based organizations offering consulting services, assessment and/or quality system registration is growing rapidly. Return to CONTENTS
In 1989, the Registrar Accreditation Board (RAB) was established as an affiliate of the American Society of Quality Control (ASQC) to develop a program to evaluate the quality of services offered by registrars. RAB issued its first approval in March 1991, and several more firms have been approved since then. The RAB and ANSI agreed to form a joint U.S. program in December 1991. In February 1992, RAB announced the establishment of an ISO 9000 auditor certification program. Information on the RAB program is available from: the RAB, 611 East Wisconsin Ave., Milwaukee, WI 53202, Phone 414-272-8575. Programs similar to that of the RAB have been underway in Canada, in a number of European countries, and elsewhere in the world for some time. Return to CONTENTS
Additional information is available from: National Center for Standards and Certification
Information (NCSCI)
National Institute of Standards and Technology (NIST)
NIST North Bldg.(820) Room 164; MS2150
Gaithersburg, MD 20899-2150
Phone: (301) 975-4040 Fax: (301) 926-1559 and from Office of EC Affairs
International Trade Administration, Room 3036
14th and Constitution Ave., SW
Washington, DC 20230
Phone: (202) 482-5276 Fax: (202) 482-2155 Both agencies are located in the Department of Commerce and can refer interested parties to other sources of information within and outside the federal government. Return to CONTENTS
INFORMATION AND PUBLICATIONS AVAILABLE FROMOffice of Standards Services
National Center for Standards and Certification Information
Return to CONTENTS
SOURCES FOR ORDERING STANDARDS Return to CONTENTS
(1) Note this definition is somewhat different from the ISO definitions. ISO Standard 9000-1987 defines quality system as: "the organization, structure, responsibilities, procedures, processes and resources for implementing quality management." (2) Conformity assessment includes testing, inspection, laboratory accreditation, certification, quality system assessment, and other activities intended to assure the conformity of products to a set of standards and/or technical specifications. (3) Information on drafts or proposed standards work was provided by Patricia Kopp, Standards Administrator at the American Society for Quality Control (ASQC) in Milwaukee, WI, Phone: 414-272-8575. (4) CEN and CENELEC have issued a draft European standard, EN 46001 - Specific Requirements for the application of EN 29001 to Medical Devices. Medical device manufacturers doing business in the EC will have to comply with the quality system requirements of EN 46001. (5) ISO/IEC Guide 48 uses the term "register," though many Europeans continue to use the term "certify." (6) Certification is defined in ISO Guide 2-1991 as the: "procedure by which a third party gives written assurance that a product, process or service conforms to specified requirements." (7) Regulated products are those for which the EC Commission has developed or is developing an EC-wide technical harmonization directive which provides manufacturers with a single set of requirements that must be met to place their products on the EC market. Return to CONTENTS | 