Applying
ISO 9001 and ISO 9004
As noted in the article, no one likes to
be surprised, least of all senior management. Senior management will expect to
review the plan as it evolves. The following points are critical:
· Companywide planning objectives must be
established.
· A mission statement must be issued by
senior management before the disaster planning
process begins.
·
The scope of the review, planning
milestones and timelines must be established.
· Personnel must be assigned to tasks and schedules established.
Questions
to Ask
Managing
Systems and Processes
·
What
are the needs of the organization?
·
What
organizational and management structure is used to accomplish these objectives?
·
What
is the legal structure of the organization?
·
Who
are the stakeholders?
·
What
is the overall planning structure of the organization?
·
What
plans are in place at present?
·
How
many corporate divisions and sites are managed by the organization, and what is
their
function (for example, corporate management, R&D, production or
service delivery)?
·
What
is the financial structure of the organization?
·
What
type of security systems are employed in the divisions and at different sites?
·
What
type of information & communications systems (hardware and software) are
used to operate the business and manage production and services?
·
Do
any fail-safe backup systems exist?
·
How
is proprietary information and intellectual property handled?
·
What
contingency plans exist for shifting production and service delivery to
alternative
locations?
·
How
much and what type of insurance is carried by the organization?
·
What
are the processes used to manage the organization?
·
What
are the sequence of these processes and their interaction?
·
What
criteria and methods are used to ensure that the operation and control of these
processes are effective?
· How are these processes monitored, measured and analyzed?
·
If
so, how are these processes monitored within the quality system?
The February 2002 Quality Progress article developed additional ISO 9001 & ISO
9004 questions to illustrate the approach for Documentation; Statutory and Regulatory Requirements; Quality Policy;
Responsibility; Authority and Communication; Production and Service Operations;
Control of Nonconformity; Corrective Action; Resource Management; Human Resources; Infrastructure; Work Environment; Information; Financial Resources;
Design and Development Planning.
Again, the demonstration of the approach did not use all of the elements of ISO 9001 & ISO 9004 and did not develop the full complement of possible questions for each element. The objective was to demonstrate how this type of approach would work.
Timing is critical. Catastrophic events
happen quickly and, in most cases, without warning. It is necessary to develop
an emergency response procedure and create a crisis management team to deal
with the public and press.
·
Backup
computer operations (hardware and software) should exist in duplicate form so
that they can be accessed whenever necessary. Quality records and documents
such as design documents, production records, financial records and supplier
records also should be stored in duplicate off-site so that operations can
begin again as quickly as possible.
·
Companies
that manufacture one-of-a-kind products should have duplicate design records.
Companies that CE Mark products should have their Technical Files (Parts
A&B) stored electronically off-site as well.
·
Depending
on the nature of the disaster (for example, flood, mudslide, explosion, terror
attack, sabotage, etc.), personal liability lawsuits could ensue. Operational
data will become critical in defending the company.
·
Product
liability and criminal liability lawsuits also could be initiated after a plant
or facility is destroyed by disaster. Such lawsuits often occur several years after
a product is first manufactured. Without data to prove that products were
designed to be safe, production was under control and complaints were dealt
with in a timely fashion, an organization could be at the mercy of juries that
must determine the facts of a case. The truth is that if you can’t prove it
doesn’t exist.
The shopworn
American aphorism, “If it ain’t broke, don’t fix it” is meaningless in disaster
planning. If you don’t plan for all possibilities, your company likely will be
out of business.
When writing the February 2002 article, I remembered three events in my life that made vivid impressions concerning disaster planning. First, when I was in Law School a fire broke out in some commercial buildings that had been acquired by the University of Wisconsin for graduate student offices and laboratories. The newspaper accounts said that the work and records for over 40 doctoral dissertations were destroyed. Second, when I was a doctoral candidate at the University of Kansas, I made duplicate copies of my dissertation and as soon as a chapter was finished, I stored three separate copies at three separate locations in the city. Finally, when I was vice president of a university, I discovered that student records and transcripts have always been created in duplicate and stored in different locations to avoid any possibility of a records disaster.
Comments