ISO 9000-3 Digest Thursday, 15 February 1996 Volume 01 : Number 010
In this issue:
Q:ISO-9000-3 Gap assesment
Re: GUI Testing Methods
RE: ISO 9000-3 Digest V1 #9
Process - Requirements for evolving product
Re: Q:ISO-9000-3 Gap assesment
RE: ISO-9000-3 Gap assesment
QUESTION: Audit Reports
Re[2]: ISO-9000-3 Gap assesment
RE: Re[2]: ISO-9000-3 Gap assesment
----------------------------------------------------------------------
From:
Date: Wed, 14 Feb 96 11:39:07 PST
Subject: Q:ISO-9000-3 Gap assesment
Hello All,
I have the opportunity to use two students from a local technical
college for an ISO-9000-3 "gap assessment". These students will come
into the company I work for and asses what would have to be done in
order for this company to register to ISO 9001.
The question I have is that there is concern (by upper management)
that the students may consume allot of our employees time in the
execution of their study.
Does any one have some ideas on how to either scope the project to
lessen the impact or another way in which we might approach this
opportunity with as little disruption as possible.
James Ingham SQA
jcingham@ccgate.hac.com
------------------------------
From: Don Delauder
Date: Wed, 14 Feb 1996 14:59:59 -0500 (EST)
Subject: Re: GUI Testing Methods
Lee, with respect to your question about testing GUI interfaces, you may
want to take a look at Centerline's Quality Center family of products if
you're planning to develop in an X/Motif environment. Their testing
products include:
QC/Replay: GUI capture/playback
QC/Recall: Post-deployment automatic fault reporting
QC/Coverage: Code coverage and analysis for test planning
QC/Sim: Add-on to QC/Coverage for simulating difficult to
test conditions, such as disk or network failures
TestCenter: General testing environment (run-time errors,
memory leaks, and so on.)
We don't use these tools ourselves, though we have extensive experience
with CodeCenter (a really nice debugging environment). We've been happy
with the quality of the product and have found the Centerline support to
be exceptionally good.
To reach Centerline:
617-498-3373 (Cambridge, MA)
http://www.centerline.com
- ----------------------------------------------------------------------------
Don DeLauder
Director of Engineering Email: delauder@cdi.com
Computational Diagnostics, Inc. Voice: (412) 681-9990
5001 Baum Blvd. FAX: (412) 681-9994
Pittsburgh, PA 15213
------------------------------
From: "Jones, Alan MV"
Date: Wed, 14 Feb 96 14:14:00 PST
Subject: RE: ISO 9000-3 Digest V1 #9
To reply to Dirk ( his message follows),
Since the certification is actually to the ISO 9001 standard
and NOT to the ISO 9000-3 guidelines, we chose to do
it in the reverse order. We developed our Quality Manual
based on the ISO 9001 standard. As a matter of fact we
have section numbers that coorespond to the ISO 9001
standard's clauses to make it easy to locate where we
address each clause. We ONLY reference ISO 9001
in our Quality Manual.
Alan Jones
Unisys Corporation
Quality System Coordinator
California, USA
alan.jones@mv.unisys.com
>From: Dirk VERSCHOORE
>Date: Mon, 5 Feb 1996 12:15:20 +-100
>Subject: Question: Xrefs to ISO9001
>
>I am currently writing a Quality Manual (including procedures, ...) )for a
>Software development company.
>It is inspired by ISO 9000-3. I have cross-references to ISO 9000-3. Do I
>also need to have explicit cross-references to ISO 9001?
>
>Dirk Verschoore
>Quality Assurance Manager
>AmbraSoft s.a.
>Luxembourg
----------------------------------------------------------------------------
--------------------------------------
In response to James ( his message follows),
Our organization works on both ISO 9001 certification and SEI CMM
maturity level growth. The reasons for each are completely different.
We established ISO 9001 certification to facilitate the marketing
of our products in Europe and elsewhere that the standard is required
or wanted. We began evaluating our organization against the
SEI CMM levels (and the subsequent improvements ) to both be
able to market to the DOD and more importantly to improve our
organization. Even at CMM Level 2, there are differences from ISO 9001.
For example, ISO wants your process to be documented but it not
necessary that it remain the same from one cycle to the next, where
the CMM wants you to be able to demonstrate that you can be
repeatable from one cycle to the next. I have made presentations
comparing the CMM and ISO, but the important point it that they serve
different purposes. You may want one or the other or both, but it is
NOT because there are deficienices in either one.
Alan Jones
Unisys Corporation
Quality System Coordinator
California, USA
alan.jones@mv.unisys.com
>From:
>Date: Mon, 05 Feb 96 09:34:58 PST
>Subject: Q: CMM and ISO 9001/ Ingham
>
> Hello all,
> I have a question about ISO 9001 and the SEIs CMM. I am wondering
> what advantages CMM (level 3) certification has over ISO 9001, if any,
> and what are the major deficiencies of the CMM (level 3) compared to
> ISO 9001?
> Any insight would be greatly appreciated.
>
> James Ingham
> SQE (604) 279-5962
> jcingham@ccgate.hac.com
----------------------------------------------------------------------------
------------------------------------
In Response to Henry ( his message follows),
In our facility we have both manufacturing, hardware design,
and software R&D. the "calibration" of clause 4.11 has never
impacted software. It has only been used to assure that the
machines that the software is tested on have been "tuned up".
Alan Jones
Unisys Corporation
Quality System Coordinator
California, USA
alan.jones@mv.unisys.com
>From: "Schneider, Henry"
>Date: Wed, 7 Feb 1996 13:45:00 -0600
>Subject: Calibration of Sofware
>Just thought that I would through this question to see what everyone
>thinks.
>What does calibration of software and software test tools mean (element
>4.11)?
>Henry Schneider
----------------------------------------------------------------------------
-------------------------------
------------------------------
From: Peter Martiniello
Date: Thu, 15 Feb 1996 13:17:02 +0900 (JST)
Subject: Process - Requirements for evolving product
Hello,
I post a similar question to ISO9001 before I knew of this list, so
sorry to anyone who may have already read/responded.
The situation is that an existing product which was developed not using
the types of process implied by ISO9001-3 is still evolving (new
development work ) and being provided to customer. Since we are moving
to a more formal SW development method we would like to use the process
we have defined in evolving the product. However we are finding
difficulties with this since the process assumes that many of the basic
documents exist for the product.
Questions
- - since it will not be practical to retrofit all the
missing documents, what will be an auditor's that a product is
being delivered that has key documents and records
missing ?
- is it sufficient to consider that all new changes to
the product are being performed according to our
procedures.
- if the product did have a full set of require documents, and
it was evolving what technique/process could be used
to show the changes from one release to the next.
Thanks for any comment/advice
Peter
------------------------------
From: winters@agc.bio.ns.ca (Gary Winters)
Date: Thu, 15 Feb 1996 10:14:08 -0400
Subject: Re: Q:ISO-9000-3 Gap assesment
> Hello All,
>
> I have the opportunity to use two students from a local technical
> college for an ISO-9000-3 "gap assessment". These students will come
> into the company I work for and asses what would have to be done in
> order for this company to register to ISO 9001.
>
> The question I have is that there is concern (by upper management)
> that the students may consume allot of our employees time in the
> execution of their study.
>
> Does any one have some ideas on how to either scope the project to
> lessen the impact or another way in which we might approach this
> opportunity with as little disruption as possible.
>
> James Ingham SQA
> jcingham@ccgate.hac.com
>
>
>
You should reconsider using students for this task. You will be conducting
more than a "gap assessment" and the students will be doing more than
"consume allot of our employees time in the execution of their study".
The students will be conducting an "audit" of the company. If the employees
at your company are not familiar with the ISO program, the impressions that
they get from your students may be different than you are planning. If you
need to conduct a "gap assessment", you should do it properly - you get what
you pay for. The exercise should be lead by a trained ISO 9000 lead
assessor. The potential disruptions caused by using students for this task
can cost you much more than you may realize. You may do better to spend
your efforts on training and begin implementing a formal quality management
program using the ISO 9000 model.
Gary Winters
*****************************************************************
Gary Winters, ASQC-CQE Industrial Process Mapping and Evaluation:
20 Fort Sackville Rd. Quality Planning, SPC and DOE.
Bedford, Nova Scotia Environmental Process Mapping:
Canada B4A 2G5 Principle Components (Factor),
Voice: (902)835-2212 Cluster and Regression Analyses.
e-mail: ad388@ccn.cs.dal.ca
------------------------------
From: "Schneider, Henry"
Date: Thu, 15 Feb 1996 10:09:00 -0600
Subject: RE: ISO-9000-3 Gap assesment
Hi James,
I think you are buying a lot of risk by having a couple of college
students perform your gap analysis. If you want a value added assessment
you would be much better served by using a software consultant or
software auditor.
My concerns with your approach are:
1. What do you mean by a technical college? Is it a junior college?
From my experience these types of schools only teach language courses
and not software development. Therefore it is highly likely that the
students would have no understanding of the software development life
cycle and testing which is the bulk of ISO 9000-3. So how could they
give you an objective review of your quality system?
2. Are the students that you are considering computer science students?
I would hope so. Assuming that they have some background in software
development, again it is highly likely that they have no business
experience. Therefore they would not be able to judge if your business
practices are adequate. Again you would not have an objective review of
your quality system.
3. Is this technical college teaching ISO 9000 and the software
guidelines ISO 9000-3? If not it is highly likely that the students will
give you a literal review of your quality system and misidentify
non-conformances.
4. Most important to the success of this exercise and to your whole ISO
9000 effort is the credibility of the auditors. Your workforce will
rapidly discover whether or not the auditor knows anything about software
development and its unique business issues. People will certainly have a
difficult time accepting criticism and non-conformities from college
students.
5. Finally to answer your question. Any auditor that comes into your
workplace that has no prior audit or ISO 9000 experience will spend, and
waste, a LOT of your time.
6. It sounds to me that your company is not fully committed to ISO 9000.
If they are looking for a cheap solution they are setting you up for
failure. Look at element 4.1 of the standard. Don't alienate your
workforce to ISO 9000 by bringing in people that have no credibility.
Hire an ISO 9000 software consultant. You won't need to use them that
much. They may be expensive on a per diem basis but in the long run you
will save a lot of money. I know from personal experience. The first
consultant we hired gave us an inexpensive quote and had no software
background. He blew his credibility within 5 minutes of talking to our
workforce. I then forced him to bring a software consultant in at no
additional cost and repeat the job. I was still learning ISO 9000 myself
at the time but it did cause a delay in our process of a couple of
months.
Henry Schneider
----------
From: jcingham[SMTP:jcingham@CCGATE.HAC.COM]
Sent: Wednesday, February 14, 1996 2:35 PM
To: ISO9000-3
Subject: Q:ISO-9000-3 Gap assesment
Hello All,
I have the opportunity to use two students from a local technical
college for an ISO-9000-3 "gap assessment". These students will
come
into the company I work for and asses what would have to be done in
order for this company to register to ISO 9001.
The question I have is that there is concern (by upper management)
that the students may consume allot of our employees time in the
execution of their study.
Does any one have some ideas on how to either scope the project to
lessen the impact or another way in which we might approach this
opportunity with as little disruption as possible.
James Ingham SQA
jcingham@ccgate.hac.com
------------------------------
From: "Schneider, Henry"
Date: Thu, 15 Feb 1996 10:21:00 -0600
Subject: QUESTION: Audit Reports
I have a question that I am posting to both ISO groups.
We had our pre-assessment audit last month from our ISO registrar. At
the end of the audit we received a hand written audit report. Rather
than distribute the handwritten report to our management team I typed it
so they wouldn't have to decypher the handwriting.
Several of my managers felt that the auditor should have also delivered a
typed report, especially for the price we are paying.
It is my understanding that hand written audit reports are the norm.
That is what I learned when I took the TickIT Lead Assessor class.
For those of you who have had ISO audits of your company, do you normally
receive a handwritten or a type written report?
For those of you who are auditors, do you normally deliver handwritten or
typed audit reports?
Should I request a typed audit report from the registrar?
Thanks,
Henry Schneider
FutureSoft
------------------------------
From:
Date: Thu, 15 Feb 96 12:42:17 PST
Subject: Re[2]: ISO-9000-3 Gap assesment
Thanks Henry,
I agree with your concerns. I was thinking if the study was performed
at a "surface level", in other words, "scoped" to minimise impact on
the company. Just to give us an idea of what we are up against, then
we would approach a consultant if and when the commitment to ISO 9001
is firm.
What do you think of the students looking at the organizational
training needs if we seek registration? I see an opourtunity to use
some fresh eyes, that are able to focus on one issue for a while.
They could bring something to our company and get some hands on
experience. There must be something??????
These students (at a Polytechnical University) are operations
management majors, specializing in quality. They have completed some
(4) comp sci. courses. Heavy emphasis on business systems and process
engineering as well as quality management systems and the usual
commerce curriculum.
James
______________________________ Reply Separator _________________________________
Subject: RE: ISO-9000-3 Gap assesment
Author: "Schneider, Henry" at CCGATE
Date: 2/15/96 8:59 AM
Hi James,
I think you are buying a lot of risk by having a couple of college
students perform your gap analysis. If you want a value added assessment
you would be much better served by using a software consultant or
software auditor.
My concerns with your approach are:
1. What do you mean by a technical college? Is it a junior college?
From my experience these types of schools only teach language courses
and not software development. Therefore it is highly likely that the
students would have no understanding of the software development life
cycle and testing which is the bulk of ISO 9000-3. So how could they
give you an objective review of your quality system?
2. Are the students that you are considering computer science students?
I would hope so. Assuming that they have some background in software
development, again it is highly likely that they have no business
experience. Therefore they would not be able to judge if your business
practices are adequate. Again you would not have an objective review of
your quality system.
3. Is this technical college teaching ISO 9000 and the software guidelines
ISO 9000-3? If not it is highly likely that the students will give you a
literal review of your quality system and misidentify non-conformances.
4. Most important to the success of this exercise and to your whole ISO
9000 effort is the credibility of the auditors. Your workforce will
rapidly discover whether or not the auditor knows anything about software
development and its unique business issues. People will certainly have a
difficult time accepting criticism and non-conformities from college
students.
5. Finally to answer your question. Any auditor that comes into your
workplace that has no prior audit or ISO 9000 experience will spend, and
waste, a LOT of your time.
6. It sounds to me that your company is not fully committed to ISO 9000.
If they are looking for a cheap solution they are setting you up for
failure. Look at element 4.1 of the standard. Don't alienate your
workforce to ISO 9000 by bringing in people that have no credibility.
Hire an ISO 9000 software consultant. You won't need to use them that
much. They may be expensive on a per diem basis but in the long run you
will save a lot of money. I know from personal experience. The first
consultant we hired gave us an inexpensive quote and had no software
background. He blew his credibility within 5 minutes of talking to our
workforce. I then forced him to bring a software consultant in at no
additional cost and repeat the job. I was still learning ISO 9000 myself
at the time but it did cause a delay in our process of a couple of
months.
Henry Schneider
----------
From: jcingham[SMTP:jcingham@CCGATE.HAC.COM]
Sent: Wednesday, February 14, 1996 2:35 PM
To: ISO9000-3
Subject: Q:ISO-9000-3 Gap assesment
Hello All,
I have the opportunity to use two students from a local technical
college for an ISO-9000-3 "gap assessment". These students will
come
into the company I work for and asses what would have to be done in
order for this company to register to ISO 9001.
The question I have is that there is concern (by upper management)
that the students may consume allot of our employees time in the
execution of their study.
Does any one have some ideas on how to either scope the project to
lessen the impact or another way in which we might approach this
opportunity with as little disruption as possible.
James Ingham SQA
jcingham@ccgate.hac.com
------------------------------
From: "Schneider, Henry"
Date: Thu, 15 Feb 1996 15:05:00 -0600
Subject: RE: Re[2]: ISO-9000-3 Gap assesment
Hi James,
Now that you've qualified the type of students you are considering I feel
a bit more comfortable. However, without any practical business
experience you will only get an academic approach to the problem. I
think that you will benefit in the long run from someone with software
development and business experience.
I think that you could use these students to look at areas such as
purchasing, training, and production. The design and development areas
need an experienced eye.
However, if you are using these students to "scope" the registration
effort for your company it again may not be an effective use of their
time and your money. A lot of articles have already been published on
this subject, this topic is routinely discussed at conferences, and there
are several off-the-shelf computer programs that will help you answer
your questions. Probably the best place for you to get an answer to your
problem is to contact the ASQC.
Henry
----------
From: jcingham[SMTP:jcingham@CCGATE.HAC.COM]
Sent: Thursday, February 15, 1996 2:40 PM
To: ISO9000-3; Schneider, Henry
Subject: Re[2]: ISO-9000-3 Gap assesment
Thanks Henry,
I agree with your concerns. I was thinking if the study was
performed
at a "surface level", in other words, "scoped" to minimise impact on
the company. Just to give us an idea of what we are up against,
then
we would approach a consultant if and when the commitment to ISO
9001
is firm.
What do you think of the students looking at the organizational
training needs if we seek registration? I see an opourtunity to use
some fresh eyes, that are able to focus on one issue for a while.
They could bring something to our company and get some hands on
experience. There must be something??????
These students (at a Polytechnical University) are operations
management majors, specializing in quality. They have completed
some
(4) comp sci. courses. Heavy emphasis on business systems and
process
engineering as well as quality management systems and the usual
commerce curriculum.
------------------------------
End of ISO 9000-3 Digest V1 #10
*******************************