Centauri Business Group (QPRC)

Three concepts that outline the future of auditing

2012-01-30T16:52:00.000-08:00

Auditing Remotely

Modern technologies have changed the way we communicate and collaborate with each other over the last five years (2007 - 2012) much more than it had done so over the previous twenty years (1987-2007) and even more than the previous 110 years (1877-1987). New ways to collaborate that became available over the last several years include: social networking, tele-presence, virtual group meetings, instant sharing of text, video and audio, as well as virtual content creation. New information technologies pushed the boundaries of what seemed to be impossible in the last century allowing real-time collaboration of people from remote locations. Companies that offer certification, registration, and consulting services increasingly prefer virtual sessions over in-person visits. These technologies open a world of new possibilities for organizations but also introduce a number of challenges.

Risk-based Auditing

Risk-based audits have been established in different areas including accounting and finance for quite a long time. The concept of risk-based audits was introduced to the area of management system auditing by the standard ISO 19011:2011 Guidelines for Auditing Management Systems. The standard recognizes that organizations need to focus auditing efforts on matters of significance to the management system. Risk management process, as defined by the International Standard ISO 31000:2009 Risk management Risk management - Principles and Guidelines, includes such elements as risk evaluation and analysis. These principles can be incorporated into the auditing process and help prioritize conclusions and results based on strategic goals. The ISO 19011:2011 standard also suggests how the risk management approach can be adapted to the auditing process to evaluate the risk of the process not achieving its objectives and the risk to the potential of interfering with the audited activities and processes.

Handling Confidentiality

The complexity of maintaining confidentiality is constantly increasing with the development of new information technologies. What information should and should not be shared via emails and messages? What levels of information security are provided by different types of software applications for screen sharing and virtual sessions? How to ensure the security of information when large files are shared over the internet? What information security risks are assessed and controlled prior to the beginning of an audit or a consulting engagement? Every new technology that becomes available raises a new set of security questions that should be addressed by both parties, auditors or consultants and their clients. ISO 19011:2011 states that “auditors should exercise discretion in the use and protection of information acquired in the course of their duties”. Since the information from the client is mostly acquired in an electronic form through the use of information technologies, it prompts auditors and consultants to become technically savvy with proper handling this information.

Please share your experiences and thoughts on the topics discussed.

Natalia Scriabina is Centauri Business Group, Inc. Vice President responsible for overseeing the portfolio of training courses and strategic partnerships.

ISO Standards on Management Systems published in August - December 2011

2011-12-16T15:33:00.000-08:00

Framework for managing sustainable development in business districts: IWA 9:2011
Document available as of: 2011-08-29
Guidelines for auditing management systems: ISO 19011:2011
Document available as of: 2011-11-11
Environmental management -- Material flow cost accounting -- General framework: ISO 14051:2011
Document available as of: 2011-09-12

Energy Management and ISO 50001:2011 - Questions and Answers

2011-11-21T16:17:00.001-08:00

Edwin Pinero, chair of ISO TC 242, answers your questions:

Question:
Does the Energy Management System ISO 50001 cover on Energy conservation and supporting for the supply of energy by preserving the environment?
Answer:
THE STANDARD IS A TYPICAL ISO-TYPE MANAGEMENT SYSTEM STANDARD FOCUSED ON HOW AN ORGANIZATION MANAGES ITS ENERGY USE. THIS INCLUDES BOTH CONSERVATION AND EFFICIENCY. BUT IT ALSO INCLUDES THE MANAGEMENT OF THE TYPE OF ENERGY THE ORGANIZATION DOES HAVE TO USE, FOR EXAMPLE SELECTING RENEWABLE OVER FOSSIL FUELS MANAGEMENT DECISIONS REGARDING ENERGY CAN TAKE INTO CONSIDERATION CRITERIA SUCH AS ENVIRONMENT, ENERGY RELIABILITY, ENERGY SECURITY, CLIMATE CHANGE CONCERNS AND MANY OTHERS.

Question:
Secondly, is the scope of this standard covering the nuclear energy and all sorts of energies?
Answer:
YES, ANY TYPE OF ENERGY THE ORGANIZATION WISHES TO INCLUDE CAN BE ADDRESSED IN THE ENERGY MANAGEMENT SYSTEM.

Question:
Is this procedure covers Safety as well?
Answer:
NO, THE ENERGY MANAGEMENT SYSTEM STANDARD IS FOCUSED ON ENERGY. IT IS HOWEVER MODELED AFTER OTHER TYPES OF MANAGEMENT SYSTEM STANDARDS, SUCH AS THOSE FOR SAFETY, ENVIRONMENT, AND QUALITY. AN ORGANIZATION CAN OPT TO INTEGRATE THEIR SYSTEMS.

Question:
Are there any spots open on committees to draft energy management system auditing documents?
Answer:
TC 242 WILL BE UNDERTAKING SEVERAL NEW PROJECTS, INCLUDING DEVELOPING GUIDANCE ON AUDITING AN ENERGY MANAGEMENT SYSTEM.

Energy Management and ISO 50001:2011

2011-10-11T14:37:00.000-07:00

ISO (International Organization for Standardization) issued a new standard ISO 50001 - Energy management systems – Requirements with guidance for use in June 2011. This standard defines requirements for energy management systems including energy efficiency, energy performance, energy supply, measurement and continual improvement of energy usage.
ISO 50001 was created by a TC 242 (Technical Committee) that was established in 2008.
Centauri Business Group (formerly QPRC) invited Edwin Pinero, chair of ISO TC 242, to answer our questions:

CBG: Please tell us about your professional background and your current role as a chair of ISO TC 242 Energy Management.

Edwin Pinero: I am currently the Chief Sustainability Officer for Veolia Water North America, a global water services provider. With over 30 years of experience, I have worked in the sustainability, environmental, and energy field both in the private and public sector. I am a geologist by education. In 2008, I became the chair of the newly created ISO 50001 Energy Management System committee (Technical Committee 242). That role involves facilitating and shepherding the work of approximately 50 nations in developing the energy management system standard and related documents.

CBG: What factors initiated the creation of ISO TC 242 back in 2008 and the development of the first international standard on Energy Management ISO 50001:2011?

Edwin Pinero: The main factor was the realization that energy management is a key component of addressing the energy global energy issues. Sound energy management would lead to improved efficiency, smarter energy-related decisions by organizations regarding process and capital improvements, and mo use of renewable energy. Related to this point was the fact that organizations realized that holistic management system approach, using the plan, do, check, act model, would make robust energy management more feasible. With these beliefs in mind, it was clear that ISO should play a leadership role and develop a management system standard in the spirit of ISO 9000 and ISO 14000.

CBG: ISO 50001:2011 includes references to a number of national or industry standards on Energy Management. Which of these standards most influenced the development of ISO 50001:2011?

Edwin Pinero: As with other ISO standards, several reference documents were consulted. For ISO 50001, I would contend that the US ANSI standard, Management System for Energy (MSE 2000) and the EU standard (PrEn 16001), were the main documents.

CBG: Please let us know about upcoming projects and activities of ISO TC 242.

Edwin Pinero: Now that ISO 50001 is published, the TC will embark on work on a series of documents that deal with energy auditing, energy management system auditing, energy measurement, among other topics. Work will begin in earnest at the 2011 plenary meeting in Washington, DC in early November.

CBG: In addition to being a chair of ISO TC 242 Energy management you also hold a position of an Executive Vice President and Chief Sustainability Officer at Veolia Water Corporation. Please tell us about the relationship between Energy Management and Corporate Sustainability.

Edwin Pinero: Energy management is a key element of sustainability. Considering the many implications of using energy, such as: cost, resource consumption, greenhouse gas emissions, and pollution.

ISO Standards on Management Systems Published in July 2011

2011-08-08T14:30:00.000-07:00

Environmental management systems (EMS)

ISO 14006:2011 Environmental management systems -- Guidelines for incorporating eco design

Contains: guidelines on management of eco design as part of an environmental management system (EMS)

Issued on: 2011-07-08

Environmental Management Systems: Understanding Organizational Drivers and Barriers

Environmental Management: Systems, Sustainability and Current Issues

Security management systems for the supply chain

ISO 28002:2011 Security management systems for the supply chain -- Development of resilience in the supply chain -- Requirements with guidance for use

Contains: requirements that help an organization to develop and implement policies, objectives, and programs for a resilience management system in the supply chain

Replaces: ISO/PAS 28002:2010

Issued on: 2011-07-21

Specification for Security Management Systems for the Supply Chain

ISO Standards on Quality & Management Systems Published in Jan-July 2011

2011-07-08T13:10:00.000-07:00

January 2011

Certification of management systems

ISO/IEC 17021:2011 Conformity assessment -- Requirements for bodies providing audit and certification of management systems

Contains: contains principles and requirements for the competence, consistency and impartiality of the audit, certification of management systems, and for bodies providing these activities

Issued on 2011-01-31

April 2011

Service management systems (SMS)

ISO/IEC 20000-1:2011 Information technology -- Service management -- Part 1: Service management system requirements

Contains: requirements for the service provider to plan, establish, implement, operate, monitor, review, maintain and improve a service management system (SMS)

Replaces: ISO/IEC 20000-1:2005

Issued on 2011-04-12

May 2011

Information security management systems (ISMS)

ISO/IEC 27005:2011 Information technology -- Security techniques -- Information security risk management

Contains: guidelines for the implementation of information security based on a risk management approach

Replaces: ISO/IEC 27005:2008

Issued on: 2011-05-19

June 2011

Electronic document management system (EDMS)

ISO/TR 14105:2011 Document management -- Change management for successful electronic document management system (EDMS) implementation

Contains: criteria for electronic document management systems (EDMS) development, selection and implementation

Replaces: ISO/TR 14105:2001

Issued on 2011-06-07

Energy management systems

ISO 50001:2011 Energy management systems -- Requirements with guidance for use

Contains: requirements for establishing, implementing, maintaining and improving an energy management system

Issued on 2011-06-09

Statistical quality control

ISO 7870-4:2011 Control charts -- Part 4: Cumulative sum char

Contains: descriptions of cumulative sum techniques for monitoring, control and retrospective analysis

Replaces: ISO 7870-1:2007

Issued on 2011-06-29

Innovation Gap Analysis

2011-06-09T15:44:00.000-07:00

Innovation, invention, improvement, and execution – these four words determine successes and failures in business. It is commonly accepted that the best way to manage execution and improvement is through process definition, planning, measurement, and control.

Application of a process approach to manage innovations and inventions is still not very clear for many businesses. Companies that believe that innovation occurs by chance and rely on “invent-it-ourselves” can find their businesses on a path to diminishing returns. Real innovation leaders look at both internal and external sources for innovation. They also use technology and networks to seek out new ideas, measure innovation processes and link them to revenue growth, resource allocation, people development, performance evaluation and rewards.
Find out more about best practices in managing innovation as a process in our new online course Innovation Best Practices.

Register before July 1st 2011 and receive the 20% off the registration fee.

Innovate More Effectively

2011-06-03T14:30:00.000-07:00

• Innovation is not an art, but a process that receives inputs from monitoring and analyzing an organization’s environment.
• ISO 9004:2009 provides a systematic, processbased approach to innovation within a quality management system.
• This approach can help organizations innovate more effectively.

Natalia Scriabina's article Organize How to Innovate was published as a cover story in the June 2011 issue of Quality Progress.

A link to an audio interview with Natalia on innovation topic is posted on ASQ web-site at media.asq.org

Evaluate Innovation Activities in a Company

2011-06-01T16:40:00.000-07:00

"Innovation distinguishes between a leader and a follower". Steve Jobs

It is hard to underestimate the role of innovation in the success of an organization in the modern rapidly changing world.
Is your Company a Leader or a Follower?

Check out our ten-question tool that evaluates innovation activities in a company and identifies the most important areas to improve.

New Developments in Sustainability from the World Economic Forum in Davos

2011-03-01T18:45:00.000-08:00

The theme of the World Economic Forum (WEF) in Davos this year was “Shared Norms for the New Reality.” Several speakers communicated that the business world must come together in furtherance of sustainability goals because cooperation through government has been slow to progress. The conference celebrated the 10th anniversary of one such cooperative effort, the Global Compact. This initiative was introduced to encourage companies toward greater ambitions in the area of sustainability. This year, a new platform for corporate sustainability leadership, Global Compact LEAD, was introduced to challenge the member companies to implement the Blueprint for Corporate Sustainability Leadership, a list of approximately 50 action steps that companies can take to achieve improved sustainability.
At this year’s conference, the renowned Harvard Business School strategy professor, Michael Porter, put forth his latest strategic concept: Shared Value. He suggested that the existing model for value creation that most companies use is outdated and is based on optimizing short-term profitability at the expense of long-term success. Porter proposed that companies need to create economic value in a way that also addresses the problems and challenges facing society.
The “Shared Norms” theme also manifested itself in new reporting practices in various industries. Since the transport industry is a key component of the value chain of most industries, companies that seek to achieve sustainability are impeded in their efforts if their transport partners are not also assessing their own sustainability. To address this issue, the conference introduced the Guidelines on Consignment-Level Carbon Reporting, a set of principles to ensure consistency across the logistics and transport industry in reporting carbon emissions at the consignment or customer level.
The United Nations and the Global Reporting Initiative (GRI) launched a reporting criteria for the financial services sector to promote global corporate environmental, social and governance (ESG) disclosure standards. The specialist financial services sector guide includes clear social and environmental indicators for fund managers, insurance companies and retail and corporate banks that fit with the GRI’s G3 standards, the latest version of its recommended corporate ESG reporting criteria.
Strides were also made in the area of sustainability labeling with the formation of “Windmade”, which allows consumers to identify products made with wind energy. Today wind accounts for 2% of energy worldwide and its contribution is finding its way into more products and services.
The overarching message of this year’s conference in Davos appears to be that sustainability objectives can only be reached by working together. Government and NGO initiatives are insufficient and the participation of businesses is essential for real success. All contributors to the value chain must also cooperate to achieve effective results. The development of standards, labels, strategic frameworks and organizations are all crucial in creating a more robust network that can lead its members toward greater sustainability.
Steve Rubens is a Director of Centauri Business Group (QPRC). He holds an MBA and a JD and has fifteen years of business strategic planning and consulting experience. He is also an instructor on sustainability business strategy at UCLA Extension.

Risk management

2010-12-15T18:54:00.000-08:00

At the end of 2009, the International Organization for Standardization (ISO) issued a new set of principles and guidelines that should benefit all organizations confronting the always problematic challenges of managing risk:

Title/Link	Date of Issue
ISO 31000:2009 Risk management - Principles and guidelines	Nov 13, 2009
ISO Guide 73:2009 Risk management - Vocabulary	Nov 13, 2009
ISO/IEC 31010:2009 Risk management - Risk assessment techniques	Dec 1, 2009

Standard ISO 31000 provides principles and generic guidelines on risk management and is not intended for the purpose of certification. ISO/IEC 31010:2009 describes more than thirty tools to use for risk assessment and explains their application. The ISO Guide 73:2009 contains risk management terminology and definitions. These three standards can be applied to any type of risk, whatever its nature, by organizations of any type or by individuals.

Risk, as defined by the ISO Guide 73:2009, is the impact of uncertainty on objectives. It is very important to emphasize that the impact of uncertainty can be positive as well as negative. "Not pursuing an opportunity" is also a risk.

John Shortreed **, PhD, who served on the ISO technical committees for Guide 73 (Risk Management—Vocabulary, 2002) and its revision (2009) as well as for ISO 31000 (2009), listed the following seven innovations introduced by ISO series 31000:

1. Formal principles for risk management and ERM (Enterprise Risk Management) that can be used for measuring the risk maturity of an organization.

2. Consideration of any risks or uncertainty that affects objectives of the organization, whether they have positive or negative consequences.

3. Organizational ability to tailor risk management to its own internal structure and governance processes.

4. Principle-based rather than performance-based.

5. Requires an organization to formalize and continuously improve a framework for ERM that integrates the management of risk into all processes in the organization.

6. Updates the risk management process used for assisting any decision through the five steps of context, risk assessment, risk treatment, communication, and consultation, followed by formal monitoring and review.

7. Requires accountability for any and all risks through the designation of a “risk owner” whose annual performance partly depends on how well risk is managed.

The next stages in the evolution of ISO 9001

2010-10-05T18:57:00.000-07:00

The latest version of ISO 9001 was released two years ago (2008) with very minor changes to the requirements. This is in contrast to the he previous version of the standard (released in 2000) which resulted in significant changes including the introduction of an entirely new concept of a process approach. At QPRC we wanted to know what to expect from the next stages in the evolution of the requirements of ISO 9001, and invited Dr. Gary Cort who currently chairs ISO Technical Committee 176 to answer our questions:
QPRC: When ISO 9001 will be updated again?
	Dr. Cort: If the past is any guide, then we should expect a six to eight year update cycle, which would have the next revision coming on line around 2015. While many of us in ISO Technical Committee 176 believe that we could reduce this time by half (at least), to do so will require fundamentally restructuring the standards writing process, which is completely serial today. Imagine separating the standards writing process into design (i.e. deciding what the content of a revision will be) and development (the iterative process implementing the design, i.e. creating the standards documents, circulating for comments, balloting, etc.). This would allow one team to complete the development of the current revision while another team simultaneously works on the design of the next revision.
QPRC: What are the major trends in the development of ISO 9001 quality management systems?
Dr. Cort: To date there have only been two substantive versions of ISO 9001 – the original 1994 standard and the year 2000 revision – so it is not really reasonable to talk about trends. But there are many proposals, each of which enjoys its own constituency within the Technical Committee and throughout the international community.
There are strong arguments for keeping ISO 9001 essentially unchanged as a minimal entry-level quality management system. Others believe it should be continually updated to reflect state of the art quality thinking. There are champions for specific additions, such as addressing risk management or resource management. Many think the architecture of the standard needs a fundamental overhaul, perhaps incorporating a maturity model or providing mechanisms for leveraging other standards from the ISO family or beyond.
We have also begun a campaign to create an ISO 9000 ecosystem—a dynamic, user-focused environment to sustain and invigorate the ISO 9000 family of standards, make our products more robust and easy to use, and propel them into new application domains, adapting as they go. We are populating the ecosystem with downloadable tools, templates, examples, case studies, decision trees, metrics, and reference material—practical information to help users apply our standards successfully in the real world.
If you would like more information on potential directions for ISO 9001, check out any of the following webinars that I have given over the past year or so:
https://csa.webex.com/csa/lsr.php?AT=pb&SP=EC&rID=620022&rKey=7B7CFF8DA57DDCDD
https://csa.webex.com/csa/lsr.php?AT=pb&SP=EC&rID=41372&rKey=733a4f1e04381d72
https://csa.webex.com/csa/lsr.php?AT=pb&SP=EC&rID=41837&rKey=5d9746a5acc8cbc3
QPRC: Can we anticipate that the sustainability notion reflected by ISO 9004:2009 guidelines will affect the next revision(s) of ISO 9001?
Dr. Cort: Sustainability is a bedrock concept across ISO today. Our mantra is “International Standards for a Sustainable World.” So we will certainly see the notions of sustainability included more explicitly in ISO 9001 and the other 16 standards that comprise the ISO 9000 family. It is my opinion, however, that the ISO 9000 family of standards is already innately compatible with the ideas of sustainability and sustained success. Using them as is can provide a powerful framework for sustainable operations.
QPRC: Do you envision possible connections between “to be released” ISO 26000 and the next revision(s) of ISO 9001?
Dr. Cort: While I don’t anticipate any direct references between the two standards, I firmly believe that the greatest opportunities for the ISO 9000 family of standards lie at the intersection of quality and society. I am immensely proud to report that ISO 9001 has already had some very important (and highly successful) forays into the world of social responsibility. Through International Workshop Agreements (IWAs), ISO 9001 has been used as the basis for international standards for Reliable Local Governments (IWA-4) and Secondary Education (IWA-2). It is also the basis for the landmark legislation in Colombia that requires registered quality management systems for public institutions. Furthermore, the Republic of Panama has become the first nation in the world to register its national Electoral Tribunal against ISO 9001, and there is a growing movement to develop an ISO-9001-based international standard for electoral bodies.
QPRC: Are there any specific actions that you would recommend for the users of ISO 9001 to take to be better prepared for the evolution of ISO 9001?
Dr. Cort: The best way to prepare for the evolution of the ISO 9000 family is to become part of it. More than ever we need to understand your concerns and needs. But even more than that we need your contributions to build a dynamic ISO 9000 ecosystem that delivers on the value proposition of our standards. If you have a useful tool or implementation system, we would love to make it available through our ecosystem. If you can share case studies, lessons learned, hints and tricks, example implementations, or anything else that can help unlock the potential of the ISO 9000 family – there is a world of users and potential users who hunger for this information. Get involved, showcase your knowledge and results, and help make the world a better place.
QPRC: .Can the user of ISO 9001 as an individual or as a company provide feedback and/or recommend some changes to the standard?
Dr. Cort: ISO standards are drafted (principally) by technical committees comprised of representatives of the international community of nations. ISO Technical Committee 176 is one such committee and is responsible for the 17 international standards that comprise the ISO 9000 family. The national standards bodies of the participating countries – more than 80 in our case – provide our membership. These are the people who actually write the standards.
In order to do this job effectively, however, we need lots of input from the public. We are able to gather some of this input through formal instruments like surveys, but these just scratch the surface. We desperately need comments, criticisms and suggestions from business and society in general.
In today’s fast-moving business world, communication is more important than ever for establishing expectations and setting priorities. Help us create a high bandwidth channel for collecting your crucial input.
QPRC: Thank you very much, Dr. Cort.

Business Process Documentation with ISO 10244:2010

2010-08-17T12:26:00.000-07:00

The new international standard ISO 10244:2010 “Document management - Business process baselining and analysis” was issued on July 16, 2010 by the International Organization for Standardization (ISO) headquartered in Geneva, Switzerland.

This standard reflects two major trends in document management. One trend is represented by the rapidly increasing amount of information that needs to be managed, both internal and external to the organization.

Another trend is represented by the increasing popularity and growing capabilities of electronic document management systems (EDMSs). A number of old issues related to paper based document management are gradually being taken off the agenda with the help of EDMSs, for example:

Providing unique identifiers for documents	Providing appropriate version control and archival
Recording time stamps for changes and revisions	Ensuring document retention over agreed time
Identifying individuals issuing and modifying documents	Providing easy location and tracking of documents

Most current EDMS systems are capable of supporting the functions listed above and prevent document management issues related to malfunctioning in these areas from happening.

As is mentioned by the ISO 10244:2010, some of the issues that many organizations need to handle with respect to document control and process management today are the following:

How much and what information needs to be gathered

The level of required details for each piece of information

The ISO 10244:2010 standard provides practical advice on the following aspects of process baselining and analysis:

defining the level of information required to be gathered,

selecting methods of documenting the processes,

establishing procedures for analysis of business processes.

The guidelines of ISO 10244:2010 standard include a number of examples and flowcharts. The guidelines are contained on 8 pages, not including bibliography.

See more ISO documents on document and record management @ QPRC Blog