Lifehacking ISO in a small, medical business (...and some free documents)
We are a 10-person team at Hawksley & Sons, with only a couple of staff in the office. However, the nature of medical manufacturing makes it nearly a necessity to be accredited to both ISO 9001 (general quality management) & ISO 13485 (medical devices quality management). Considering that our small team are all rushed off their feet with a million jobs at one time, these accreditations can at first seem like death by bureaucracy and will take a quarter of little Timmy’s yearly hours.
With Hawksley’s veteran ISO delegate retiring, I was designated little Timmy, although I had little experience at directly dealing with Quality Management. Trying to get my head round the thousands of documents, standard operating procedures, internal audits and quality checks was more than daunting. But, to cut a long (and incredibly boring) story short, I can boast that we passed with flying colours and I, therefore, wanted to share some of the tips, tricks and cheats I picked up along the way;
1. A Map: When faced with such a monumental challenge, my immediate reaction is to build a system that helps me make sense of everything – like drawing a picture of the jigsaw you’re about to put together. I found stuff online that listed every clause of both ISO 9001 & ISO 13485, which you can find by clicking here for 9001 or here for 13485.
I laid this out on an excel spreadsheet and created another 3 columns that I populated myself, these were; a. Hawksley’s response to the clause, b. Existing documents that evidence our compliance, & c. additional required documents that we would need.
I’ve created a couple of download links to those files here. The files include example evidence that are required for each clause.
This became the most central document in the entire process for me, as it helped fit everything together. It gave me the confidence to know that I hadn’t missed anything important and, if there was something missing, I could see easily what was needed.
2. Quality Objectives: In many different ways of phrasing the same thing, ISO asks for your strategy and quality objectives. I realised that all this means is they want to know if you have a plan. In a small business like ours, we all know the plan. As a salesman, I’m trying to sell the stuff, the engineer is trying to build the stuff, and the production manager is trying to stop the building from falling down. It is just a matter of turning that into a document. From a previous job in a large Children’s Charity, I was used to an objectives template we regularly used, so I recreated it.
I put in some fancy formulas to work out how far through various business projects we were, had a section for information that supported each objective and voila – what was already in our mind was on paper. I’ve attached that document, for your perusal or use here (with formula’s included)
3. The 5 Why’s: this little trick is something that I learnt during our actual audit. ISO focuses quite heavily on customer complaints and customer feedback, as a way of improving your products/services/whatever else you do. Like most businesses considering ISO, we keep a record of customer complaints and feedback and ISO 9001 wants you to collate information about the nature of the problem, how it was resolved, and very importantly, what the root cause of that problem is.
But surprise, surprise, a root cause isn’t solved by me writing down ‘it was this’, when it could actually be that. I could say that the root cause of our forklift breaking was that water fountain was out of order that day, but it doesn’t make it true. If you can show (on an excel or in your paperwork) that for every complaint received, you show 5 questions about why the thing happened, building from the previous why, you’ll get the ISO tick. Let me show you an example.
“I would like to complain that the car you sold me is broken after two weeks”
Why did it break? Because it was not checked before we sold it.
Why was it not checked: Because Ed was off on holiday that day and nobody could test it.
Why could nobody else test it? Because it was listed as Ed’s car to Test.
Why was it listed as Ed’s car to test? Because we don’t have a way to cover testing when somebody is on holiday?
Why do we not do holiday cover for testing? Because mechanics do not do a holiday sign off procedure, where they handover urgent tests for the next day.
OK, so that example is a little detailed and doesn’t have to always be that way, for most things we settle for 3 why’s, but the point is that you went through the process. And as always, I’ve attached a template spreadsheet for you to use as you wish.
4. Work with it, not against it: Perhaps the biggest complaint about ISO 9001 or 13485, is that they make you complete loads of non-important documents that are never used and weigh over you like a burden to revise before every audit. Whilst I understand this difficulty, it is also true that (most) auditors want to see working quality management over an obviously fabricated or dusty online document (or worse, an actual folder!). However, there are some tools that I already use to help me every day at work. My proudest achievement is my homemade CRM, that has all of our customers included, including their comments, feedback and recent buying habits. This is evidence for so many clauses within ISO 9001 & 13485, but with a couple of tweaks was relevant to even more clauses.
My advice is to use the existing tools you’ve got in Sales or in the factory and treat ISO like a helping hand to improve those tools.
5. “The Showroom”: A NSFW tip and ignoring my last point, ISO do occasionally ask for unreasonable things. For example, we use very precise pieces of metal to calibrate our measuring equipment. In reality, these are hardy pieces of metal that will not wear down, are carefully stored and rarely used. However, at the ISO 9001 audit, the auditor insisted that we had records of calibrating each piece of these indestructible bits of metal against a master. A nifty trick that my predecessor employed, was to nicely display each of these on a shelf, with its calibration note beside it. Despite not exactly being up to the pointlessly rigorous standards of the certification, it was not even mentioned as an area of improvement.
6. Recording Management Meetings: recording and minuting important meetings is useful in so many ways. It helps you improve your strategy, get access to what was agreed upon, keep records of various areas and changes going on in the business and why that decision was made. These benefits are before I even have to bring up ISO. But nevertheless, recording minutes of important conversations gives you a wealth of resource to prepare for your audit – you can find the right documents, evidence decision making, and (dare I say it) create ISO approved documents.
7. Suppliers: There is no easy way around this, you should be doing due diligence on the people that supply to you. You should be checking that they have effective quality management systems too, as well as looking at their accounts and so on. It helps you to test new suppliers, as well as vet potentially fraudulent customers and scammers. Also, the auditors will look at how you verify your supplier’s reliability and quality; due diligence is the most effective way of demonstrating this.
Again, I have attached a template Due Diligence form that we use in Hawksley.
8. Consistency: My final point is about consistency. A lot of standard operating procedures will be reviewed and checked in the audit, to ensure that they have a responsible author and a rereview date. To make it easy for you and them, having a template to include basic information on each standard operating procedure is a massive help – and I’ve added ours as an example. But the same applies to everything, if you have 4 departments, save files into one of those department file areas and get used to calling things the same name.
I do hope you find this useful. As a small business, we are happy to help support other small businesses to succeed, against our corporate overlords. If you have any questions or would like to see more content like this, please email Harvey.email@example.com