Understanding the Process Approach of ISO 9000:2000

Originally Published MDDI October 2002

COVER STORY

The newest version of the ISO quality standard shifts the focus from the product to the processes behind it.

Curt Flemming

Even when change is good, most of us would rather run the other way when we see it coming. This is simply human nature, especially when a system seems to be working satisfactorily. But the reality is that consistent improvement in quality demands change.

So it is with ISO standards, which are reviewed every five years to make sure they meet the current standards and needs of the global community. Revisions inevitably affect each of our corporate quality systems, and adapting to change and coming up to speed quickly can determine success or failure in a highly competitive environment.

The 1994 edition of the ISO 9001 standard included 20 elements, among them contract review, design control, and statistical techniques. But with the release of ISO 9001:2000, those 20 elements have been incorporated into a process approach. The intent of this change is to move users toward process-based methods of quality management. Consequently, ISO 9001:2000 and the upcoming release of ISO 13485 (specific to medical devices) are causing companies to reevaluate their quality systems.

Is this new emphasis on process a matter of semantics, or is there something more substantial behind it? Although the process approach may be unsettling at first glance for some, those familiar with quality management will see in it such familiar concepts as the quality management system, management responsibility, resource management, product realization, measurement, analysis, and improvement.

Defining metrics and methods of assessment specific to an organization is critical to the development of a successful product. This ISO revision will cause companies to think through the life cycle of a device in terms of smaller, interrelated processes that contain the 20 elements of ISO 9001. But more importantly, this change will keep the focus on how the quality of one process affects the quality of the next.

DEFINING PROCESS AND PROCESS APPROACH

ISO 9001:2000, clause 3.4.1, defines a process as "a set of interrelated or interacting activities that transform inputs into outputs." The process approach is built on the belief that a desired result is achieved more efficiently when activities and related resources are managed as a process. This approach is built on four concepts: inputs, outputs, verification, and validation. These four ideas form a cohesive structure to ensure that the desired outcome results from the process applied.

If effectiveness and efficiency are not achieved, the process has failed and needs attention. This becomes apparent quickly in a development and manufacturing environment because the outputs of one process usually become the inputs for the next one. High-quality input at the start of a process will more than likely result in high-quality output at the end.

In a process-driven environment, staff members are trained to think in terms of how their work affects the quality of the processes that follow. This results in an ongoing push for high-quality input and output each time processes intersect, and benefits both internal and external customer needs.

To use the process approach, you need a clear understanding of what is needed to meet the requirements and the value of meeting them for both the company and the customer. You also must have a verification method that proves the process is indeed successful. Success is determined not only by achieving a predetermined result in a product or conforming to regulatory guidelines, but also by implementing a full quality management system that adds ongoing value.

The four concepts behind the process approach, combined with the key idea of review, are similar to those of design controls. Under design controls, we apply these principles to the product produced. But the process approach takes it one step further, applying the principles to the process used to create the product. Table I shows the similarities between a process approach and design controls and the types of activities and documents associated with each principle.

FDA mandated design controls in large part to reduce the number of medical device recalls caused by design-related errors. The design control regulations have required careful documentation of the products we produce, and include many checks and balances when making design changes. We must continually evaluate the impact of each change on the product as a whole. For example, an apparently straightforward hardware change can inadvertantly affect other hardware and software and require personnel to redo testing previously completed. In the same way, the concept of a process approach requires a systemic view of a quality system.

PROCESSES AFFECT EACH OTHER

The major point of the process approach is that the output of one process almost always affects another. If one creates a set of quality procedures using a limited point of view, it can result in an incomplete quality system that does not adequately control the interactions across an entire organization. This in turn results in unnecessary hurdles for staff members to cope with before they can complete their work.

Yet the most destructive consequence is the perception by staff members that the quality system works against them and does not support the efficient completion of their project leading to a high-quality device. Accurate perception and acceptance of your quality system is vital to the quality of work your organization produces.

WHAT PROCESSES WILL WORK BEST?

Think about the process approach in terms of added value to your organization. Added value may take the form of knowing that methodologies and conditions in which a product or service is rendered are controlled and consistent. Therefore the result will be predictable and consistent. Added value may mean doing the work right the first time or doing it more efficiently, thus resulting in cost savings. Added value may also come from documenting the appropriate information and collecting only the data that will affect your organization. A measurement without an understanding of what you might do when that measurement changes is probably not very meaningful.

Justifications of quality systems based on such statements as "the auditor likes it that way" or "ISO/FDA says to do it this way" are strong clues that the added value is not recognized. Furthermore, if team members do not understand the reasoning behind a requirement, they may apply it inappropriately or not at all. Communicating the reasons why quality processes add value to development and manufacturing is essential to the daily practice of such processes.

IMPLEMENTING CHANGE SUCCESSFULLY

Understanding the effects of a process on the entire organization, and not just one specific area, is a key to successful implementation. Often a new quality process will be conceived as a direct result of another process being put in place. Allowing processes to interact within a quality management system is crucial to smooth implementation. This is why the design of quality system processes must be specific to each company's goals. For this reason, generic systems are usually inadequate. Just as design controls require cross-functional groups to come together to discuss the development of a product, so can the creation and modification of your quality processes by cross-functional groups lead to a better quality system.

WHAT DOES THIS REALLY MEAN?

To better understand the impact of the process approach, it helps to consider how it might apply to a specific business process. Let's look at the process of handling customer feedback and complaints. This process is common to all companies in the medical device industry, yet, depending on the business, type of customer, and product, it may be handled in very different ways.

The first step in developing this process is to answer the question, "What regulatory, quality, or business requirements are involved in this process?" There are several regulatory requirements and voluntary quality standard requirements that directly affect complaint handling. At a minimum, a medical device company must consider title 21, part 820.198 of the Code of Federal Regulations (CFR), "Complaint Files," and 21 CFR 803 or 804, "Medical Device Reporting."

If the company is distributing products in the European Union, it must also consider the vigilance reporting requirements under the Medical Devices Directive. Additional requirements may also be placed on this process when the distribution expands to other countries such as Canada or Japan. From a quality-requirements standpoint, both ISO 9001 and ISO 13485 address this process. All of these requirements help to define the basic framework of the customer feedback process.

IDENTIFYING PROCESSES AND STAKEHOLDERS

To create an effective quality process, one must apply this framework to the company's particular business environment. Begin by asking the question, "What other processes interact with this process?" In other words, what processes provide input to or receive output from this process? Who are the stakeholders in this process?

In this example, there may be a large number of interactions. Figure 1 shows potential sources of input for a customer feedback process. The number of inputs for an individual company will depend on the size of the organization, the type of product or service, the customer using the product, and the distribution of the product. Although several processes may submit input to the process, the type of input is most likely the same—a customer complaint.

Defining input sources will identify one of the three groups of stakeholders—in this case, customers—who should be involved in creating the process. For the process to be effective, this group needs to believe it will work. If they feel the method for submitting complaints is cumbersome, complicated, or inefficient, or that it somehow doesn't meet their needs, they won't participate in the process. The price a company pays is high: it will not capture all of its customer complaints and will thereby miss golden opportunities to improve its reputation.

The second group of stakeholders needed for the creation of this process are those who receive outputs from the customer feedback process. Figure 2 shows some potential interacting processes that receive these outputs. As shown in Figures 1 and 2, some processes may both submit inputs and receive outputs from the same process.

The outputs from a customer feedback process may differ greatly, depending on which process receives them. Outputs could include the results of a complaint investigation, copies of all communication with the customer concerning the situation, a design change request, changes to customer training, trend analyses, or a letter of response from the company to the customer.

If the information received from the process does not meet the needs of this second group of stakeholders, one of two things may happen. They will either ignore the information, or they will repeat work that was already completed. In this example, this means the handling of the complaint is ineffective. It will most likely result in additional complaints in the future, repeated investigations conducted by each department that hears about a complaint, and an inefficient use of company resources.

The final group of stakeholders involved in creating a process should be the individuals that actually execute the process. For them to do their job effectively, they need to make sure the inputs they receive are adequate. And for their outputs to be valuable, they must also understand the needs of those who will use the information.

Stakeholders from all three areas are needed to create or modify effective methods for executing the process. In the customer feedback process, there are many methods from which to choose. Should the system be paper-based or electronic? Should a special committee be established to review all complaints? Who decides whether a complaint should be investigated? The answers that result will depend on the individual needs of the company.

PROCESS EVALUATION

After looking at inputs and outputs from the process, the next question is, "What measurements will be used to evaluate whether this process is functioning properly?" The key is providing information to management so they can provide appropriate resources to the process to maintain its effectiveness and to improve it. In this example, two measurements that may be useful include the number of days required to complete the investigation of a complaint and the percentage of complaints received with insufficient information.

It should be noted that these metrics are different from the outputs created by the process. They are meant to evaluate how the process is working, not the data received by the process (e.g., the number of complaints received for an individual product line). From these metrics, management can determine whether additional staff are needed to process complaints, what type of personnel are needed, whether additional tools are needed, or whether a change in the process is required.

One pitfall many companies encounter is the creation of metrics for the sake of metrics, i.e., recording data that will not lead to change, regardless of what they show. These types of metrics are time-consuming to create and review, and generally lead to frustration and disillusionment of the staff . Ultimately, such metrics are a waste of company resources. An example could be the number of complaints received per day.

Once the process has been defined and metrics put in place, the final question to ask is, "What do the stakeholders think of the process?" This is a question that needs to be asked on a periodic basis. It ultimately indicates whether the right process was created. As a company changes, whether by adding new product lines or services, expanding distribution, or acquiring new assets, asking this question helps ensure that the system is still effective. When a product does not meet user needs, consumers do not buy it or use it; in the same way, when a process does not meet user needs, it will be unsuccessful and unused.

CONCLUSION

The concept of a process approach is not another hurdle that is meant to impede a company's progress. Rather, it is a change in emphasis that, if applied appropriately, can lead to added value within an organization.

Every company must create a system that meets its needs. The processes of one company may or may not match the processes of another. As your firm competes in a tough marketplace, ISO's new process approach to quality management can help integrate your business systems and procedures to work toward a common goal—ensuring business growth and maintaining an effective quality system.

Curt Flemming is quality system manager for the Battelle Healthcare Product Development Group (Columbus, OH).

Copyright ©2002 Medical Device & Diagnostic Industry