Checking the procedure is a form of procedure verification.  You run a test before implementing the procedure to verify that the procedure works and meets all the design requirements.  But how do you know if the procedure will work outside of the design space ?  Will it work in the real world, with real users?  At this point, we are beyond procedure verification — we need to validate the procedure to ensure the process and procedure are working.

You are not done with your procedure until it has been validated.  After all, you wrote the procedure to close some gap in compliance, quality, or performance — how do you know your procedure is actually closing the gap?  Procedure validation consists of performing procedure training, process auditing, and completing a process procedure management review that will allow us to confirm that the gap is closed, the process is working, and the procedure works.

Process Procedures Implementaton and Training

Procedure validation starts with process implementation and procedures training.  Procedure training will be your first feedback from the actual users.  Gather the procedure users together and brief everyone on the main procedure tasks, changes, and process objectives.  Use your process maps to visually explain the process.  Highlight individual responsibilities for key performance metrics.  Ask questions and obtain feedback.  Remember: your procedure goal is “a working process”.

If you have a lot of users from multiple work cells or geographic locations, you need to prototype the new procedure — test it in one area before implementing it across the whole business.  Your procedure validation should occur before a widespread implementation.  In a small organization with limited scope, this is often not practical.  In that case, process auditing is critical to ensure that the procedure works.

Process Procedures Audit

Once employees are trained, how do you know if the procedure works or is being used correctly?  To find out, you need to audit the procedure at some point after procedure training. Process auditing is an internal audit of the process and procedure.  At some interval after training, you need to follow-up on your new procedure and see how it’s being used.  Is the procedure followed?  Is the procedure effective?  Is the process working?  Is the procedure working?  Is the procedure integrated into the process?  Simple questions, but they all must be asked.

If the process or procedure is critical to quality, compliance, or performance, you should perform a process procedure audit sooner and more frequently (perhaps 7, 30, and 90 days apart).  You are still in procedure validation and you need feedback to determine if your procedure is working.  Once validation is complete, you may be able to back off the process audit (e.g., cut back from monthly to annually): it all depends on how well the process is working and how critical it is to your firm’s success.

Process Procedures Review and Change Management

Once audited, how will you know if the procedure is performing as expected?  To find out you will need to analyze the audit data and process performance and hold a process procedures management review.  If you started your process procedure journey with a project charter, you have your original quality, compliance, and performance objectives.

Compare your audit data with the project charter to determine if your procedures work, if the process is working as expected, if you’re ready to close out procedure validation, or you need to make changes to improve your process procedures effectiveness.  Change Management can be tricky here.  Process optimization comes later, after you close out the original design, the process is going for a while, and you’re ready to improve once again.  For now, focus on important procedure changes to achieve the original objectives, in order to prevent scope creep.

Conclusion

We started the process procedure journey with a procedure implementation plan.  Your process procedures project continued with a process map, documenting your process procedure design.  If a procedure was required, you had to write a procedure.

The process procedures journey ended with procedure validation, where you ensured the process was working and the written procedure worked.  Once validation is complete, you’re ready to start your next process procedures journey.

St. Louis, MO (April 24, 2009) - Bizmanualz, Inc., a business strategy consulting and quality publishing company based in Clayton, Missouri, today announced the successful certification to ISO 9001:2008 for the design, development, realization, and delivery of its policy and procedure publications, training courses, and consulting services.  The certification demonstrates the Bizmanualz commitment to continually improve its ability to assist business owners achieve the growth they envision. 

“We developed a Lean visual management approach to implementing our Quality Management System (QMS) to dispel the notion that an ISO system requires a lot of paperwork,” explained Chris Anderson, Bizmanualz, Inc., Managing Director. “Now we can show clients the benefits of a working ISO-compliant quality system using Lean visual techniques to streamline the operations, focus employees on the objectives, and reduce wasted efforts.”

Bizmanualz ISO 9001:2008 Registration

Bizmanualz received its ISO 9001:2008 certification on April 10,2009, from Platinum Registration.  Auditor Colin Gray noted particular areas of excellence, including Bizmanualz customer feedback, corrective action, and internal communication methods, which involve morning staff meetings around the company’s “scoreboard” — a bulletin board listing the company’s main processes, projects, action items, and metrics.  Mr. Gray also praised the Bizmanualz Internal Audit process, saying in his report that the company’s internal audits are “thorough, effective, and meaningful.”

Kaizens/Corrective Actions are posted on the Bizmanualz "Kaizen Wall"

With the new lean implementation, Dan Davison, Vice President of Sales and Marketing has noticed a difference, saying, “clients are seeing tighter project definition, project management, status reports, and budget forecasts by job for the coming weeks. Tracking tasks posted on the wall increase our communication’s effectiveness.”

ISO 9001:2008 is an internationally recognized QMS standard, which ISO Secretary General Rob Steele said has “an estimated one million users worldwide.”  Certification is obtained through independent registrars that audit every aspect of a company’s QMS.  Lean is a quality system approach that seeks improvement through the elimination of waste, a focus on the customer, and systems of visual management.

Bizmanualz has been at the forefront of deploying business best practices since 1995, delivering Policies and Procedures publications, Lean ISO Quality Management Systems, and strategic marketing implementation services to help business owners achieve growth and expansion.

Bizmanualz Policies and Procedures publications are available through Amazon.com, calling Bizmanualz at 800-466-9953 (outside the USA, 314-863-5079), faxing your request to 314-863-6571, e-mailing sales@Bizmanualz.com, or by logging onto store.bizmanualz.com.  Bizmanualz® is a registered trademark of Bizmanualz, Inc.

Get a Handle on Your ISO 9001 Required Records

Clause 7 “Product Realization” (recall that we can substitute “service” anywhere the word “product” occurs) covers the spectrum from product development (literally from the moment an order is taken or a product conceived) until the product is shipped to the customer.

Besides understanding and complying with the “shall statements” in Clause 7 (as we discussed for Clause 5 and Clause 6), a key element to complying with ISO 9001 Clause 7 is getting a handle on the required records.  A lion’s share of the ISO 9001 required records (14 of 21) come from Clause 7.  These include

• Clause 7.1 Planning of Product Realization – 1 record
• Clause 7.2 Customer Related Processes – 1 record
• Clause 7.3 Design and Development – 5 records
• Clause 7.4 Purchasing – 1 record
• Clause 7.5 Production and Service Provision – 3 records
• Clause 7.6 Control of Monitoring and Measuring Equipment – 3 records

Some organizations seem to struggle with all the required realization records.  For example, I recently worked with a company that took great effort and pride in their meticulous record keeping.  The problem was, however, that they did not understand how the records they kept met the record requirements of the ISO 9001 QMS.

As you create a QMS to comply with Clause 7, there are two things to always keep in mind:

1)  What do I need to do to comply with the requirements?
2)  How can keeping these records help my organization?

In order to comply, particularly in terms of records, an organization has to reflect on the specific requirements listed, as well as on how this record fits in with the unique ways each organization fulfills product realization.  Ensuring you comply with the spirit and letter of the ISO 9001 Standard will require taking some time to understand the requirements and to reflect on your realization processes.

Understand Specific ISO 9001 Requirements for Records

As we know, the ISO 9001 QMS requirements are not very detailed or specific when it comes to record keeping.  It is this generic approach that gives ISO 9001 the flexibility to be applied to disparate organizations.  So each organization can define exactly what form the records will take, and what kind of information will be collected.

But there are some specifics associated with each record that one must be aware of in order to comply with ISO 9001 requirements.  For example, Clause 7.3.4 states specifically that the design and development review records shall contain the results of the reviews and any necessary actions.  So, early in the effort to create records to comply with Clause 7, an organization must have a clear picture of what records are needed and what specifically must be included in the record.

Using ISO 9001 Records for Continual Improvement

While compliance is important, the whole goal of implementing ISO 9001 is to improve as an organization.  So how you use the records to help the organization improve is equally important.  The point of keeping records is not because ISO says we need to, or even because auditors want to see them (though it does, and they will…).   In several places of the ISO 9001 QMS requirements (i.e. Clause 4.1e) the standard requires organizations to monitor, measure, and analyze processes.  Records play an important role in that they are used to capture data and information about processes that are used for monitoring, measuring, and analyzing.

This is what record keeping is really about.  Using them to understand your processes and learn ways to improve.  Are we capturing the customer requirements properly and avoiding rework, scrap, and other waste?  Are design reviews generating actions that improve the product and meet requirements?  Are design projects on schedule and budget or do they consistently suffer from scope creep or delays?  Are process objectives being met?

Employ the ISO 9001 Process Approach

One useful way to get a handle on realization records is to consider product realization as a set of processes, and then identify where, as part of the process, a record is generated and what record requirement is fulfilled.  Ideally, realization processes, like all processes, should have key objectives established that measure effectiveness.  The goal should be to collect information in the records that relates to process effectiveness.

Your ISO records should tell you a lot about how effective your processes are operating.  If they don’t, then perhaps you are meeting bare minimum ISO requirements by generating the record, but you’re not meeting the spirit of the ISO standard by using the QMS for continual improvement.  And the continual improvement philosophy applies to the records themselves.  If you find that you are not getting useful information from your records, then change what you are doing.

Try to Simplify ISO Compliance

With so many required records from Clause 7, it also important to look for ways to streamline and simplify the record keeping.  Do you need 14 different forms?  For example, perhaps a general form can be used for all the design and development records.  For the calibrations records, it may be easier to track the calibration of monitoring and measuring equipment electronically in a database or spreadsheet instead of on paper.

As always, the best approach is to start simple and build on it as you identify needs and areas for improvement.  It is easier to build on a basic, simple system than it is to strip unnecessary elements from an overly complex system.

Using and Auditing ISO 9001 QMS

Now we have covered all the clauses of the ISO 9001 QMS that have requirements.  If you build your ISO compliant QMS in phases over a period of time it becomes less daunting.  Obviously, we could not cover all the elements of compliance, but hopefully we have delineated a path to compliance in manageable steps.

If you recall, earlier we only created drafts of some system procedures.  As you use and review your system, you should get the procedures in finalized forms and release them into document control.  To verify and improve the QMS you should regularly audit it (including records, documents, and improvement activity).  But the most important thing you can do with you ISO 9001 QMS is use it.  Communicate the QMS to the staff; involve them with reviewing procedures, keeping records, and conducting process reviews.  Develop an internal auditing staff who understands the requirements and the organizational goals in employing ISO 9901.

Once you feel comfortable that your ISO Quality Management System is operating and functional, you are ready to contact an ISO 9001 Registrar and set up an audit for certification.  If you need help building your ISO 9001 QMS, we have products and consulting services that can help.  We also offer public and on-site ISO 9001 Internal Auditing classes that can help get the most out of your continual improvement efforts.

Management Commitment is Vital to ISO 9001 Success

Now we are starting phase three: implementing the requirements of Clause 5 – Management Responsibility and Clause 6 – Resource Management. While there are a number of required documents we created to meet requirements from Clauses 4 and 8, Clauses 5 and 6 are long on stated requirements (“Top Management shall … ,” “The organization shall … “), but they have few required documents and records.

In Clause 5, the responsibilities of meeting the requirements of the ISO 9001 QMS are put squarely on the shoulders of top management. Those who are familiar with how organizations tend to function know that the success or failure of any organizational endeavor depends on the commitment of top management. If top management does not see it as important or a priority, then it becomes starved for resources and eventually dies. Whatever top management focuses on, however, becomes a priority for the whole organization. This is certainly true for implementing, maintaining, and improving the ISO QMS.

There are specific requirements relating to Management Review in Clause 5, including a management review meeting record. Otherwise, there are no specific requirements to create particular records showing management’s commitment and responsibility. The requirement is a general one of providing evidence of commitment.

ISO 9001 Is Generic Application Depends on the Organization

It is this type of general requirement that many organizations struggle with. In contrast with specific requirements that are straightforward (for example, an Internal Audit procedure that includes responsibilities and requirements for planning and conducting internal audits, establishing records and reporting results), these more general “shall statements” require organizations to come up with their own method of compliance.

One way to deal with these less specific requirements is to convert “shall statements” into questions. For example, top management has to answer the question, “How do we ensure appropriate communication processes are established and that communication takes place regarding the effectiveness of the QMS?” The formal language in the standard seems intimidating and adds to the difficulty. Appropriate communication processes? But most organizations have communication processes; it is just a matter of recognizing them and being aware that those activities meet a requirement of the ISO 9001 standard. For example, perhaps you have monthly department head meetings, and departments have weekly staff meetings. Perhaps you have an on-line or printed quality newsletter. These are all communication processes.

Focus on ISO Compliance Not Unnecessary ISO Documentation

So in a sense, phase three is about reviewing and considering requirements in Clause 5 and Clause 6, and then recognizing how your organization meets them. You don’t have to have procedures or even records in order to comply, unless you feel they are important for the needs of your organization. Obviously, as you work through this, when you recognize a weakness or an area of non-compliance it is time to implement new or altered methods. But as in our communication example, frequently organizations are doing things that comply with the requirements. It is just a matter of being cognizant of them, plus knowing what evidence exists that verifies your compliance.

Clause 6, Resource Management, requires a similar approach. Phrase the “shall statements” as questions and then give reflective responses. For Clause 5 and 6 you may want to capture these responses in notes for your own purposes or for training, but there is no requirement to do so. In terms of compliance, just be sure you can answer the question appropriately when the internal or external auditor asks, and that others give answers that are consistent with your compliance methods. Be aware, however, that after you give an auditor the answer, he or she will then seek objective evidence that you do, indeed, do things that way (such as meeting agendas, minutes, or collaboration from the earlier communication example).

Training Records Are Required in ISO 9001

Let’s emphasize, however, the training record requirement for Clause 6 of the ISO 9001 QMS Requirements. Many auditors agree that this is a common area of weakness among ISO 9001 certified organizations. So one focus for phase three of ISO 9001 QMS implementation should be creating a training record system where education, training, skills, and experience are captured. In larger organizations this probably has to be handled at the department level, but there should still be consistency throughout the organization. This will require a systematic approach that is communicated through training, examples, etc., to department leaders.

So there is no simple advice or direct methods for complying with the requirements found in Clause 5 and Clause 6. Phase three is as much about understanding and awareness as it is about creating new processes and documentation. Each and every organization has to decide how they currently fulfill them or how they will fulfill them. It is this flexibility, however, that makes ISO 9001 flexible enough to be applied to any type of organization.

Our next and final piece in the series will cover phase 4, implementing ISO 9001 Clause 7 – Product Realization, also known as design, development and fulfillment. Here the ISO 9001 Requirements are heavy on records that many organizations have difficulty with in terms of compliance. We will discuss ways to simplify and streamline Clause 7 compliance.

• Become familiar with the ISO 9001 QMS Requirements
• Identify key QMS processes and their interaction
• Create drafts of the Quality Manual, Quality Policy, and Policy Objectives
• Write a draft of Document and Record Control Procedures

After completing these tasks (delineated in Clause 4 of the ISO 9001 Standard), the next crucial step in implementing an ISO 9001 QMS is to create the continual improvement processes as described in Clause 8 of the standard. In terms of Clause 8 continual improvement primarily consists of Customer Satisfaction, Internal Auditing, and Corrective Action, and Preventive Action.

Sketch Out the Continual Improvement ISO Processes

After putting the basic components of the general QMS requirements in place during phase 1, in phase 2 the focus is on continual improvement because it is the continual improvement processes of the ISO QMS that provides value and benefit to your organization. So, in order to gain these benefits as soon as possible, start putting these processes in place and practicing them.

Much as was described for the critical QMS processes in phase one, sketch out your continual improvement processes. Ask questions such as: How will using Corrective Actions and Preventive Actions (CAPA) most benefit the organization? Who are the process owners? What are inputs and outputs? Are certain departments integral to CAPA or should everyone get into the act? Of course, when resolving such questions, it is a good idea to involve the ISO Strategy Team. They can provide perspectives from various departments or segments of the organization.

Drafting the ISO 9001 Procedures

Once you have a continual improvement process sketched out, write a draft procedure. Remember, it is better to document a process in the way you are capable of doing it, not how you think it should be done in a perfect world. After you have a draft procedure, train the involved staff and start executing the process. You don’t have to wait until the procedure is finalized or the ISO QMS is fully implemented to start executing Corrective Actions, for example. This is a great opportunity to learn and implement practices that are effective while ditching things that don’t work and while you can easily update your draft documentation.

One important note: I mentioned writing procedures. Corrective Action, Preventive Action, Non-Conforming Material, and Internal Audit are required procedures for an ISO 9001 QMS. You don’t have to write a procedure to describe every process. In fact, the most common mistake organizations make when implementing an ISO 9001 QMS is over-documenting: writing too many procedures that end up not followed, not used, not updated, and not correct. So it is important to note that I list writing procedures as an important step for these continual improvement processes because the ISO Standard requires them. (Note the emphasis on continual improvement in the ISO 9001 requirements it involves four of the six required procedures. There are also key required records associated with these processes.)

Focusing on the Continual Improvement Processes

Corrective Action is the process you use to fix the root causes of problems. They could be internal process problems (office or production), product problems, or even problems with the QMS. There are some basic steps that have to be included: fix any current problems, investigate root causes and solutions, make necessary corrections/improvements, and then verify they are effective and the problem doesn’t reoccur.

Preventive Action is the process of making improvements before a problem occurs. Frequently organizations struggle with Preventive Actions; perhaps because they envision preventive action as being something big or major. That doesn’t have to be the case. Small improvements prevent problems as well. So the real goal for the preventive action process is to create a system that documents all improvements – big and small.

Nonconforming Product is where you log defects found either in receiving inspection, manufacturing, or customer returns. Each defect needs to be logged, isolated from good product, and a disposition determined, which could lead to a corrective action.

Internal Audits are used like instruments to measure the effectiveness of the ISO 9001 QMS. Of course, your internal audit team will need training and to understand the ISO 9001 QMS Requirements, so an Internal Auditor Class may be helpful.

With an internal audit procedure and audit training you can start auditing the ISO 9001 QMS even though the system isn’t fully implemented. But it provides ISO 9001 auditing practice and generates required audit records. The audit findings are also entered into the corrective action process so we can practice doing corrective actions.

Since the ISO 9001 QMS is still being implemented, some records and documents may not be available for audits. Auditors can start, however, by auditing processes put in place implementing Clauses 4.1 and 4.2 in phase one. We can use the internal audit program to continually improve our growing ISO 9001 QMS.

Additional ISO System Components of Continual Improvement

Other pieces of continual improvement include customer satisfaction and analysis of data. While there are no required procedures or records associated with them, you still need to have defined processes for capturing data about customer satisfaction, and for regularly collecting and analyzing data from the critical processes identified in the Quality Manual. After all, improvement is the whole point of implementing the ISO 9001 QMS, and one key to improvement is to set objectives for your processes and then regularly compare actual results to the objectives, and then taking action to correct deficiencies.

Now you have completed phase two of implementation by putting in place your continual improvement processes. Next week we will cover phase three: implementing Clause 5-Management Responsibility and Clause 6- Resource Management.

St. Louis, MO – February 27, 2009 – Bizmanualz, Inc., a business publications, training and consulting company based in St. Louis, MO, today announced the launch of a completely redesigned version of its ISO 9001 QMS Internal Auditor Training course.  This ISO training course demonstrates requisite auditing skills to beginning auditors, and is also valuable to experienced auditors and quality managers looking for a refresher course or the opportunity to discuss innovative approaches.

The redesigned two-day ISO auditor class focuses on helping participants understand the criteria, the skills, and the activities required to be an effective internal auditor as part of an ISO 9001 Quality Management System.  The class is offered regularly at the Bizmanualz Learning Center in St. Louis. It can also be conducted privately on-site for organizations that would like to hold group internal auditor or quality auditor training sessions in-house.

“We had been using the previous design for several years now, and we have continually improved and updated it,” said Don Reed, Technical Writing Director at Bizmanualz and the primary designer/instructor for the class. “We have learned so much, however, through our experience teaching the course and through carefully listening to student feedback, that we felt it was time to start from scratch and use everything we have learned to completely rework the course.” 

The ISO 9001 Internal Auditing course is currently the most popular training class offered by Bizmanualz.  The totally redesigned Internal Auditor class was conducted for the first time on February 9 & 10 at the Bizmanualz to a great success. The participants responded very positively to the new approach and the reworked materials.

“The newly redesigned ISO 9001 Internal Audit Class focuses on giving the participants exactly what they want and need from an ISO 9001 Internal Auditor class: an interactive, seminar-style discussion along with real world examples and exercises,”  said Chris Anderson, Managing Director of Bizmanualz. “For example, we no longer use PowerPoint because we just don’t feel it creates the interactive environment that participants expect and deserve.”

Mr. Reed agrees. “Professionals prefer to learn in smaller classes with an atmosphere that encourages discussions and questions; where participants share their experiences and challenges. This produces a better learning experience for everyone.”

In this auditor training course, students will learn the basics of an ISO Quality Management System, as well as how it can drive organizational improvement.  Students will become familiar with using the ISO 9001 Standard as criteria for auditing, the importance of an audit program, along with basic auditing principles.  Most importantly, however, students will learn the step by step methods of conducting an audit, and participate in an audit of a QMS process. ISO 19011 – Guidelines for Quality and Environmental Auditing is used for fundamental guidance on auditing principles and methods. Plus, all participants receive a free copy of the ISO 9001:2008 Quality Management System Requirements.

Bizmanualz schedules the Internal Auditor Training Course at least once every  three months.  Please visit the Bizmanualz website at Bizmanualz.com to register for the class or to see a detailed course description and a upcoming training schedule

Bizmanualz also offers strategic process improvement services for growing businesses as well as a range of quality training classes. In addition, standard operating procedures manuals from Bizmanualz have helped thousands of companies develop policies and procedures to standardize their core business processes and implement best practices.

Cash Security Is About Prevention

The same idea applies to your cash process; you want to use best cash practices and follow proper cash procedures.  In business you can reduce cash risk with good cash controls through removing opportunity and temptation.  While your employees may be honest, sloppy cash control is like leaving your car windows down at the mall… you are just begging for something bad to happen.

Proper cash security precautions in cash controls involve several basic tenets, but the most important is clear and accurate recording of all cash that is received and of all cash disbursements.  Make sure all cash transactions are documented and recorded immediately.  A delay in recording cash transactions not only introduces an opportunity for errors, but also creates the opportunity for temptation that could lead to cash fraud.  The recording element of the cash process doesn’t have to be difficult or complex.  In fact, simple basic cash records can improve the likelihood they will be done immediately and with less error, and thus reduce risks to cash.

Proper Cash Controls Need Proper Cash Records for Reconciliation

With the proper records created during all cash transactions, then regular reconciliation can take place.  Depending on your organization, there may be reconciliations that need to occur at several levels. These can include cash drawer reconciliations at the end of a shift or the business day, reconciliation prior to a bank deposit, and regular bank statement reconciliations.  As explained in the last week’s discussion on cash control procedures, management or owner involvement in reconciliation and regular internal audits sends a signal to all members of the organization who handle cash that internal cash control is a priority.

Separation of Duties Is a Key Facet of Internal Cash Control

Proper separation of duties is also an important tool that discourages unethical cash practices.  The idea behind separation of duties is that it is much less likely for two employees to collude to commit fraud than it is for one employee to act alone.  This obviously applies to the reconciliation duties discussed above.  The person who does the daily cash deposit reconciliation should not be the one conducting the monthly bank statement reconciliation.
Frequently, cash procedures call for two people being present any time a large amount of cash is being handled or transported.  This helps prevent internal fraud as well as discourages threats of external theft or robbery.  A restriction on the number of people who have access to cash is also an important method to prevent cash fraud and abuse.  It creates a high level of accountability, which in turn reduces temptation and your cash risks.  If 20 people work in a business, but only three have access to the cash drawer or petty cash, then theoretically you have reduced the risk of abuse by 85%.

Use Proper Physical Control for Cash Management

Physical control over cash means how the cash is literally stored and handled.  The obvious rule of thumb is that the less cash on the premises then the less chance for theft or embezzlement.   Make bank deposits as often as necessary and you can even engage an armored car service that will regularly transport your cash safely.  Keep the cash you have on hand in a safe if possible; or at least securely locked.  Without good physical control it is difficult to restrict access as mentioned above.

Along with good physical control of cash, it is a good cash practice to keep cash records in a separate location from the cash itself.  That way if fraud or theft does occur, they cannot easily take, destroy or modify the cash records.  Separation of cash records and cash can discourage theft, or at least allow the theft to be discovered and clearly documented.

Define Cash Processes and Keep Cash Procedures Current

Proper cash controls can be documented in cash procedures as part of your cash management process.  Be sure to understand the cash process and document it clearly in an accounting procedure.  Keeping your cash procedures correct and up to date also sends an important message to your staff about the due diligence of owners and managers.  If the cash process changes then changing the documented cash procedures should be a high priority.

Cash security practices are vital for internal cash controls, and the goal should be to prevent fraud and theft before it happens.  The proper control involves all the elements we have discussed; proper cash records, separating duties, regular oversight and audits, physical handling, and understanding the cash management process including correct cash procedures.  Proper control reduces temptation and opportunity – the keys to prevention.

In recent weeks we have covered general Sarbanes-Oxley compliance as well as how using risk management techniques can provide a baseline for starting an internal control system required by SOX Section 404.  This week let’s continue the discussion by talking about writing accounting procedures.

Accounting Procedures Should Document Important Processes

The decision to write an accounting procedure to document a process should not be taken lightly.  Once your accounting processes are documented in an accounting procedure there is a commitment by the organization, the accounting department, and its members to execute the process in a consistent manner each and every time.

In many cases, however, this is exactly what the organization wants and needs – a high level of consistency in key financial processes, as well as a certain level of planning in how accounting processes should work.  When written and implemented correctly, your accounting procedures should provide this level of internal control.  While creating the accounting procedure each accounting process should be reviewed reflectively.  Decisions can be made by accounting managers and process-owners about how key financial activities should be carried out, and what goals, checks, and measures should be part of the accounting process.

When it comes to internal controls required for Sarbanes-Oxley compliance, accounting procedures that meet these criteria (documenting key process steps and checks/metrics) are an important part of your accounting internal control system.  Creating the accounting procedure, however, is only the beginning. 

The accounting process and its associated procedure must be communicated to all affected parties through training, meetings or other types of communication or events.  Then, regular internal audits are needed to ensure that personnel are aware of the accounting procedure and the process requirements that it documents. Writing accounting procedures without the necessary awareness and follow-up is counter productive.

This is why the decision to write an accounting procedure is an important one.  Hastily cranking out accounting procedures without properly defining and understanding your accounting processes or without the proper follow-up (training, audits) is actually a detriment to your accounting internal control system.  Using a casual approach to creating accounting  process documents increases the chance of not capturing key aspects of the process, associated financial risks, or needed internal controls/metrics.  That is the opposite of the control that SOX intended to encourage.

Writing Accounting Internal Control Procedures for Compliance

There are several important keys to writing useful accounting internal control procedures for the Accounting Department or any department.  We have already talked about one: take time to do the necessary research and gather the appropriate information to ensure that your accounting procedure properly captures the goals and key attributes of the accounting process.  Other important elements to keep in mind include:

Keep It Simple – Accounting procedures should document the overall process being executed.  It is not necessary to document every single detail of every single action.  That information belongs in accounting work instructions or training materials.  Including minutia and too many details leads to an overly long and confusing accounting document, which ensures that your accounting procedure will be neither used nor followed.

Use More Than Text - Why create accounting procedures that rely solely on text?  Graphics can illustrate accounting process flow, inputs/outputs, and important relationships or risks.  We all know that a picture can be worth a thousand words; using graphics can improve simplicity and usability, which can lead to better internal control.  Take advantage of how easy it is to integrate graphics (including photos) into your accounting procedures.

Be Consistent – accounting procedures should be consistent in format and design, and in the use of language and terms.  They should be highly recognizable and familiar in an organization.  To a degree, they should even be similar in length.  That is to say there is a consistency problem if one accounting procedure is four pages long and another procedure is 25 pages. (Refer to “Keep It Simple” above.)

Maintain Them – Keeping accounting procedures up to date means you are properly maintaining the internal control system.  A change in the process means a change in the accounting procedure.  This aligns with the first point as well.  The more basic and simple you keep an accounting  procedure then the easier it is to maintain.  Checks and metrics should also be evaluated regularly and modified if they do not truly monitor the effectiveness of the accounting process or provide the needed internal controls.

Which Accounting Policies and Procedures to Develop for SOX Compliance?

As discussed last week, developing accounting procedures to document processes as part of an internal control system that meets the Sarbanes-Oxley Section 404 requirement should be done in iterations according to the risks that your accounting operations face.  For the purpose of SOX compliance, the mission is financial statements without material errors.  What are the most important accounting processes that need to execute properly to complete the mission, and what business processes contain the most financial risks to the mission?

For each iteration, focus only on the number of accounting processes (selected by priority of importance and risk) that your organization has the resources to develop, deploy and maintain properly.  Don’t try to develop/integrate accounting procedures for 15 processes if your organization can only handle five at a time.  Over reaching is a sure path to failure.  Generally, a system with five functioning, well-controlled processes provides more accounting internal control than a system with 15 poorly controlled accounting processes.  Once the organization has defined and created accounting documentation for five processes, then identify the next five accounting process.

Remember, useful accounting procedures should be simple and clear, as well as known and maintained.  Otherwise, they are a detriment to the required SOX internal controls.

We would like to hear from you about accounting policies and procedures required by SOX.  Our mission is to help companies improve through improved accounting processes and training and developing accounting policies and procedures in a way that enhances that goal.  One way to be successful in that mission is to know what you think.

To learn more about Bizmanualz Accounting Procedures go to http://www.bizmanualz.com/accounting/ and check out the Accounting Policies and Procedures Manual or sign up for the Bizmanualz Newsletter and download a free sample accounting procedure right now.

Determining Needed Documents

What are some of these potentially needed documents? Here is a table that lists documents you may want to consider making part of your QMS. (Referring to the ISO 9001 Standard might make some of the descriptions more clear.) Frequently particular documents may not be required by the ISO 9001 Standard, however, creating a document may be the easiest way to comply with the intent of the standard.

What a list! It doesn’t seem very “lean,” does it?

Lean Means Value – Not Small

Some of the listed documents are required, so there is no choice. The goal it to keep the required document simple, thus ensuring that it provides value. (As I attempted to convey in the two previous articles in this series.)

For the documents listed as “Strongly Implied” in the table above, there may not be an actual document requirement in ISO 9001:2000, but it may be the easiest way to meet the requirements in the standard, as opposed to verbal explanations. In addition, the items listed as “Strongly Implied” there is also value in having a document that is actually useful for the organization. An example would be the Approved Supplier List.

For the documents categorized as “Implied” or “Optional,” an organization needs to focus on the rationale for these items to see the value. For example, ISO 9001 clause 5.5.1 states, “Top Management shall ensure that responsibilities and authorities and defined and communicated within the organization.” An Organizational Chart goes a long way to effectively communicate the responsibilities and authorities. Try substituting a few paragraphs of text for an Organizational Chart and one can see the value of a simple graphic. In some organizations, this is all that is needed to meet the 5.5.1 “shall” statement.

Overall, if an organization maintained all or most of these documents in a simple value-added format, then their Registrar Compliance Audits will go much smoother. As anyone who has been through the audit process knows, anything that will help the auditor facilitate a swift completion of the audit is a big plus.

Creating Your Lean System

I hope this series will assist those who with a Quality Management System, whether it is to comply with ISO 9001, AS 9100, TS 16949, or other standards. The time savings in using a Lean approach to QMS documentation can be dramatic, as well as the value of saving paper. The greatest value, however, lies in having a document that is actually used and aids the organization by providing value, rather than a wasted document that never really used and only exists to be brought out at audit time.

For those who are just starting their journey to ISO registration to a Quality Standard, I hope that I have at least put a few holes in the “documentation nightmare” myth. As you go through your journey, first examine if the document is required. If it is, then ensure that when complete it is adding value to your organization. If the document is not required, but desired, absolutely ensure there is value and not added bureaucracy to your QMS.

A simple matrix listing required documents and non-required documents, and the value non-required documents add may help you decide which documents are needed to meet the needs of your organization and QMS.

Best of luck to all of you changing your paradigm and instituting a Lean ISO 9001 Quality Management System

Understand the Requirements

The ISO 9001 Quality standard requires six procedures: Document Control, Record Control, Control of Nonconforming Product, Corrective Action, Internal Audit, and Preventive Action. That is the minimum requirement, but even the leanest of Quality Management Systems will probably need a few additional procedures.

My personal opinion is that a company should always have a procedure for Competence, Awareness and Training to outline their training and skills program. I have found the contribution to the QMS by this procedure to be very valuable. After 25 years of auditing, I have come to the conclusion that the number one weakness of the various Quality Management Systems in North America is Competence, Awareness, and Training.

As I outlined in Part I of this series, other QMS procedures may be needed to bring emphasis to a company’s core business and processes. So for a very Lean QMS there should be six to ten system procedures. Before we discuss how to make the individual procedures more Lean; how about a story?

QMS Out of Control: A Case Study

In 2005 I audited a small manufacturing company in central Illinois who was a supplier for a large defense contractor (which I represented). It was a privately owned company of about 80 employees with the owner as President. This company had been ISO 9001 registered for about six years, initially to ISO9001:1994 and then to ISO9001:2000. After the Audit Opening Meeting and facility tour, I started the audit by checking system procedures.

The Quality Manager indicated that there were two sets of procedures, one set in administration and one set on the shop floor. “Well, let’s go check the set on the shop floor,” I told him. We arrived at a table that had a “procedure manual” that was about six feet long. It had a heavy, solid support on each end with three rods running between the supports where standard holes were punched in 8 ½ x 11 sheets of paper. Pages were placed back to back, and then inserted into a plastic page protector. The page protector was then inserted into the “procedure manual.” The Quality Manager proudly explained that as they added more procedures they could just add additional sections of the three rods to expand, thereby moving the support ends farther apart. Get the picture?

I quickly noticed that Procedures, Work Instructions, Part Drawings, as well as all kinds of other documents were included into this “procedure manual.” I asked the Quality Manager to show me the Document Control procedure. After some searching he could not find it! He told me he was sure it was there;somewhere. Next I asked him for the Internal Audit Procedure. He could not find that! Corrective Action? You guessed it. I asked him if there was any specific procedure that he cared to show me. His response was, “Well, if there was I probably could not find it either.” I did ask him if he understood that the procedures I had requested were required procedures. He said that he did.

We moved to the “procedure manual” in the administration area and I asked if there was someone else who might be able to find these required procedures. He returned with his assistant and informed me that she had been with the company for several years more than his two with the company. (It was Hail Mary time!). After some searching, the assistant could not find the requested procedures in the administration area “procedure manual” either. It wasn’t looking very good for this auditee, and it was only 10:00 in the morning.

Follow-up discussions revealed that they constructed their “procedure manual” under the premise that ISO 9001 requires everything to be documented. They thought their “procedure manual” was what the ISO 9001 Registration Auditor was looking for. Since they had not received any non-conformances to their QMS in six years, they assumed that they were doing the right thing. The fact was, however, that I could not find a single person in the company that used these “procedure manuals.” The belief of the company was that they had to have all those “useless” procedures because that is what ISO required, and they had to do ISO because it was what their customer’s required.

This company had some serious issues with their QMS. Not only did they have specific compliance issues to the ISO 9001 Standard, they had a system that did not provide any real value. They did not know how to use their Quality System, and they did not understand ISO 9001. Their most consistent response to me was, “Well, our ISO Auditor did not have a problem with that.”

Where is your Big Honkin’ Binder?

That was definitely one of the largest “Big Honkin’ Binders” that I’ve ever seen. Imagine, though, if the company had understood that ISO 9001 excellence does not come from lots and lots of procedures. What if they had grasped the concept of focusing on processes and had only six to ten QMS procedures? What if they had thought about providing value to the employees by issuing Work Instructions at the point of use? One thing is for sure; I would not have written nearly as many non-conformances to their QMS.

This story is a great illustration of how “less is more.” Fewer QMS procedures can actually provide more value to the QMS. The same concept also applies to the length of each procedure. The starting point should be to address the minimum requirements for the six required procedures in ISO 9001, and then build on the system as needed for benefit of your organization.

The ISO 9001 Standard does not specify the format of any procedure, nor does it specify a length. All an organization has to do is to meet the requirements given in the standard. Since no one wants to read a procedure “book” or page after page of procedure text, why write them? Why not write one, two or three page procedures? Why not use flow charts or process diagrams? Eliminate lengthy text in paragraph format – no one wants to read it anyway. Using flow charts, process maps, numbered lists, etc;, the information is brief and easy to understand.

A Document Control procedure for ISO 9001 can be done in two or three pages using a flow chart, a document list, an approval block, and allow for revision history. The Records Control procedure can be in completed in three pages, including a Master Records List. The Internal Audit, Control of Nonconforming Product, Corrective and Preventive Action Procedures can all be two page documents

Try it! Change your paradigm and your organizational approach to Lean Procedures. This will reduce cost and you will see for yourself how easy it can be to follow and use System Procedures. You may be surprised that people will actually use the procedures.

Next, in Part III of this series we, will discuss other QMS documentation from a Lean perspective.