1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice
You must be a registered member in order to post messages and view/download attached files in this forum.
Click here to register.

Clause 8.3 for software services

Discussion in 'ISO 9001:2015 - Quality Management Systems' started by Andrew Murray, Jan 28, 2023.

  1. Andrew Murray

    Andrew Murray Member

    Joined:
    Nov 22, 2022
    Messages:
    10
    Likes Received:
    6
    Trophy Points:
    2
    Hello,

    I'm struggling to interpret Clause 8.3 in the context of my software consultancy business, I'll provide some context...

    "The organization shall establish, implement and maintain a design and development process that is appropriate to ensure the subsequent provision of products and services."

    We don't offer products, we only offer a service where a customer pays for our time and we provide them with software engineers - with that time our engineers may work on writing and/or designing software as the customer requests, or from a scope of work agreed in the quotation.

    I consider that we have two services, a time and materials service and a fixed price service - these services are the same across all customers but they may evolve over time. The service we provide is embodied by the quotation and also various procedures (e.g. a software development process and related procedures, etc) that describe how we do this (operational activities).

    This clause appears to ask us to have a way of designing and developing new (consultancy) services (e.g. a maintenance or support service). With consideration for requirements, inputs, outputs and controls. With the view that when we design new services we meet the requirements set out etc. However these are very rare activities and feel more like they should arise from existing aspects of the QMS (e.g. risk register identifying need for a new service, corrective actions etc).

    Have I interpreted this correctly? Is this something we must do? Is there any guidance on how other similar service companies have implemented Clause 8.3?

    As a second point, as part of the work we do for our customers, we may assist them in designing software - however I don't consider this falls under the remit of this clause - instead this is something under the remit of processes we've identified in 4.4, i.e. our software development process - is that reasonable?

    Thanks,

    Andrew Murray
     
  2. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Andrew, good question! What’s your QMS scope?
    Typically, providing resources - people - is “managed services” and you may take exception to 8.3 and other requirements such as measurement resources.
     
  3. Andrew Murray

    Andrew Murray Member

    Joined:
    Nov 22, 2022
    Messages:
    10
    Likes Received:
    6
    Trophy Points:
    2
    Hi Andy,

    My scope is currently "The provision of software consultancy services worldwide". And indeed 7.1.5 hasn't seemed relevant to us.

    Thanks,

    Andrew Murray
     
    Andy Nichols likes this.
  4. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    It’s rare, in my 20 years of consulting, that the design requirements apply. Happy to help!
     
  5. Andrew Murray

    Andrew Murray Member

    Joined:
    Nov 22, 2022
    Messages:
    10
    Likes Received:
    6
    Trophy Points:
    2
    After further research I found this technical bulletin useful:

    https://www.ukas.com/resources/technical-bulletins/auditing-of-design-activities-in-iso-9001-scopes/

    And also this page which picks up on the use of the word 'appropriate'.

    https://www.quality.org/knowledge/understanding-design-and-development-of-products-and-services

    I think I need to recognise that from time to time we do design new services for our customers, and thus clause 8.3 should apply, at least within the spirit of the 2015 standard. I guess the point being what is stopping us from doing bad things to the business by bringing in new services without much consideration. I think it's reasonable to consider what is "...appropriate..." to implement 8.3 given our context (small business, rarely changing services, risk present in changing services).

    I've ended up with a very small procedure that describes how we approach this which involves the following high level activities:
    • Ensuring the need for new or updated service, considering risks and reviewing available sources of information (e.g. customer feedback)
    • Determining high level objectives for the new service.
    • Development of the service by process owners.
    • Validation of the new service against original objectives.
    I've also included who does the above activities. And to ensure that there is something written down (i.e. why was a new service needed, what were the objectives, how have they been achieved).

    For the size of my company, the above seems suitable and perhaps helpful. Is this likely to satisfy an auditor?
     
  6. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Who knows? Trying to predict that is worse than playing the lottery.

    Having been in consulting, I struggle fitting "design" into coming up with "new services". What is in the agreement wording which leads you to "design"? There's a huge difference between "planning" as in 8.1 and "design" in 8.3. I'd counsel you to look long and hard at them both before committing to meeting 8.3 every time you come up with what is, in essence a variation on a theme.
     
  7. Andrew Murray

    Andrew Murray Member

    Joined:
    Nov 22, 2022
    Messages:
    10
    Likes Received:
    6
    Trophy Points:
    2
    My biggest fear with ISO 9001:2015 is that I've completely misinterpreted some of the clauses - reading the standard on it's own leaves room for interpretation especially for a services company.

    As I currently see it, as a business we sense that we may want to offer a new service, this arises from general customer feedback or self-reflections. I.e. a customer hasn't asked us for this, but we see how the market is changing and want to respond. In order to roll that new service out, we have to design it - and that involves figuring out what the quote looks like, how we bill the customer (e.g. support contracts with use-it-or-lose-it budget), and how we design the processes that underpin all that. I.e. the design is of the new service. But there is no customer agreement (is that what you mean by "agreement wording"?) relating to this - no one has asked us to or has paid us to do so.

    Thanks for highlighting 8.1 and 8.3. I've seen 4.4 as describe processes, 8.1 as additional requirements for operational processes and 8.3 as further requirements for design. I'm struggling to find a concrete reason why 8.3 doesn't apply.

    I'd rather consider the requirement and show some limited consideration when designing new services, then dropping it all together - assuming auditors take into consideration the size and context of the business.
     
  8. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Think of the design "deliverable" as a package which is documented for the consultant. Is that really a different package than you currently offer - or a different market etc?

    You run the risk of a) creating a monster and then feeding it and b) paying for the privilege! Not including design can save on the costs of certification. Accredited CABs can reduce audit time (from the IAF MD-5 tables) by as much as 20%, with the attendant savings to your organization (subject to certain criteria).

    What you describe above seems to me (coming from your industry) as being an 8.1 type process and not a service design (8.3). My 35 years in QMS and certification tells me that organizations who really practice "design" are 20% of the population and those who design services even smaller - often logistics companies, for example.
     
  9. yodon

    yodon Well-Known Member

    Joined:
    Aug 3, 2015
    Messages:
    198
    Likes Received:
    115
    Trophy Points:
    42
    Jumping in a bit late...

    Is it really just strictly bodies you provide or do you have a defined software lifecycle that your folks follow? That might have a bearing on the discussion.
     
  10. Andrew Murray

    Andrew Murray Member

    Joined:
    Nov 22, 2022
    Messages:
    10
    Likes Received:
    6
    Trophy Points:
    2
    No - we speak to customers, they tell us their problem or what they need, we provide a quote with a scope of work for achieving that, we then go away and do what we need to in order to deliver. That work may be fixing a bug in their software, writing new software to achieve something, making something boot quicker, etc. Unlike recruiters that provide bodies to customers and let them manage them, we manage our engineers to get the result that's needed and generally provide more direction/oversight/control. As part of 4.4.1 and 8.1 we've documented our processes for doing software development, including how bugs are managed, how software is released to customers etc (i.e. we have a lifecycle).

    Part of the work we do for customers is sometimes design (i.e. designing software before writing it) - however this falls under our software development process (and the two services I previously described). I don't think 8.3.2 describes this activity and shouldn't be confused with it. 8.3.2 is the "design of products and services" but we don't offer products, so it's the "design of services". You could argue we design services (for ourselves - but it's not obviously what we do as a business) when we decide to offer new types of consultancy services (which we very rarely do) - but I don't think you could argue that the software design we do for customers as part of one of our services is within the scope of 8.3.2?

    But I'm completely new to this, so I may be missing some context here.
     
  11. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    This is not a design responsible scope in my experience. If you had a software product (a deliverable) then any fixes/features/bugs etc would fall under design and design changes - for that scope of a different QMS (Design of software applications etc…)
    Sounds like a combo of 8.1 and 8.2 to me. Not 8.3