Navigating the Way to ISO Certification

Throughout this year, MoldMaking Technology has published a monthly column titled “Keeping Up with ISO” to provide readers with an overview of the revisions put into place in ISO 9001:2015 by the International Organization for Standardization (ISO). Following is a birds-eye view of a mold manufacturing company’s experience with the oft-dreaded ISO certification process. PMI Industries, LLC in Rochester, New York, shares highlights of its journey to its expected certification in the updated standard and how this achievement factors into its plans for market growth and expansion. 

The Company
Founded in 1978, PMI specializes in designing, engineering and building both prototype and production molds, often with complex geometries and as heavy as 20,000 pounds. The company also offers precision machining and plastic injection molding on presses ranging in size from 110 to 1,100 tons. Industries served include automotive, construction, communications, electronics, aerospace and defense/military. Housed in a 50,000-square-foot facility, the shop currently employs 41, including four apprentices. 

In April 2015, PMI was acquired by Grand Island, New York-based BAM Enterprises, which invested $6 million to purchase five CNC five-axis machining centers (Hermle C42 and C60 VMCs, Mitsubishi DV1000 and DV1600 VMCs, and an Ingersoll Eagle V9 milling machine) and a Toshiba BTH 110 R18 boring mill. According to Greg Almeter, manager of new business development at PMI, these investments were made with an eye on company growth and expansion in aerospace and medical device markets. 

“PMI is putting a laser focus on current manufacturing trends, including five-axis machining, electrode manufacturing, hard milling cavity blocks, and enhancing customer satisfaction beyond stated requirements by reducing lead times while maintaining or exceeding customer quality expectations,” Almeter says. “We have taken major initiatives in business growth by investing in new (additional) equipment to expand our already advanced capabilities.”                                                                                                        
                          
Starting from Scratch
PMI is currently ISO 9001:2008-certified for quality, but the company is required to conform to the 2015 update to the standard no later than October 2018. Almeter says it made sense for PMI to begin the entire certification process as if from scratch because it also is pursuing ISO 13485 quality certification for medical device manufacturing and updating its AS9100D quality certification for aerospace, and each of these certifications is predicated on the ISO 9001 standard. The company contracted with George Mowry, of Mowry Consulting LLC, to update its current ISO 2008 certification and then infuse the relevant aspects of ISO 13485 and AS9100D quality standards into it.

According to ISO, the 9000 family of quality management standards “provide guidance and tools for companies and organizations who want to ensure that their products and services consistently meet customers’ requirements, and that quality is consistently improved.” ISO routinely updates its standards so they meet “modern needs,” Mowry explains, including those of a more complex, technology-driven global supply chain. Earlier versions of ISO 9000 were focused mainly on documentation of procedures and records. In 2000 and 2008 revisions, that focus became more process-management oriented, with emphasis on how someone does his or her job, he says. The 2015 standard is more focused on actual performance, with greater emphasis on risk-based thinking and implementation of the “plan-do-check-act” (PDCA) cycle on all levels of an organization. PDCA is four-step management method for the continuous improvement of processes and products.

Mowry says one of the most difficult components of working toward ISO certification is obtaining the commitment of senior management within an organization. “Here’s the caveat to the whole process: You can’t get anything accomplished unless you have management buy-in,” he says. “They have to step up and do what is required, whether it’s reviewing documents, attending meetings, allocating necessary resources–everything. If they don’t, the whole process will fall apart.”

Success also requires employee buy-in. One group depends on the other, Mowry says. For PMI, getting the buy-in from both management and employees was relatively easy, Almeter says, as management realized that moving forward required updating its operating systems. “One of the hardest things to wrap our heads around was how PMI would be able to accomplish this certification process for three separate and distinct ISO standards at once,” he says.

Another challenge was determining who from management would provide the best input. By the time the certification process was fully started, PMI’s ISO management team included a purchasing manager; toolroom manager; and managers of engineering, quality, sales and production. The team first began working with Mowry to review its existing quality management system (QMS), which Mowry says was necessary to uncover areas that did not meet the ISO 9001:2015 standard and then define the scope of implementation. 

Because PMI was looking to expand into the medical market, the shop also had to determine what category, or class, of medical devices it would provide, because there are different classes outlined in ISO 13485. It opted to pursue Class I certification, which pertains to medical devices that present minimal potential for harm, such as tongue depressors, bandages, examination gloves, handheld surgical equipment and the like. “Our goal is to walk before we run and get the actual certification in place,” Almeter says. “Class I allows us to get into the medical arena and covers probably more than 60 percent of the work we’re targeting at this time. Later, customers may come to us with work that requires us to evolve to Class II status, and if that is a good fit, we’ll pursue it.”

Next, Mowry initiated a baseline gap analysis of PMI’s QMS in order to compare its current ISO status with what is required for certification under 9001:2015. This gap analysis revealed how the company was currently managing its QMS, including documentation. He also reviewed its existing efficiencies according to 13485 to identify what steps were needed to earn that certification, as well as the necessary steps required by AS9100D certification for aerospace quality compliance. 

Working Toward Certification
Based on Mowry’s gap analysis findings, the ISO management team entered the most labor-intensive stage of ISO certification: identifying immediate issues to address and establishing specific, measurable objectives, and the corrective actions required to resolve them. Before it could begin, however, it had to first define the “context of the organization,” a major requirement in the 2015 revision that involves outlining the internal and external factors and conditions that can influence the company’s approach to its products, services, investments and more. PMI arrived at a statement that it was adding new equipment and focusing on transitioning the company into both a tooling and manufacturing operation with plans to build additional business in the aerospace and medical fields. 

Once this was accomplished, the team revamped its QMS to address the following major areas: leadership, continuous improvement, quality, human resources, customer service and satisfaction, tooling, shipping and receiving, production, contract review and design, engineering, and facilities and equipment maintenance. Objectives set forth included calibration of quality-related instruments, improving on-time delivery and lowering non-conforming product volumes, among others. 

An example of how PMI addressed these objectives is the purchase of GageTrak software from CyberMetrics Corp. to bring its calibration system into compliance. Other corrective actions for this objective included documenting all of the company’s measurement devices and requiring that personal measurement devices also go through the calibration process. Process maps, also known as “turtle diagrams,” were developed to visually display calibration process characteristics like inputs (measurement devices); outputs (deliverables); resources required (who and what); required method; and metrics, or performance indicators, to help determine the effectiveness and efficiencies of the calibration process. These maps were then published in a new quality manual. This same approach was employed by the team to address all the other objectives.

Risk Identification and Mitigation
Because the ISO 9001:2015 standard puts stronger emphasis on risk-based thinking, Mowry says PMI’s ISO team had to look long and hard at all of its processes on all corporate levels and determine what could go wrong. Examples of identified risks included nonconforming products (due to uncalibrated equipment or improper setup of a machine), employee safety (back injuries caused by stacking boxes of product or electrocution during lockout/tagout machine safeguarding procedures), environmental impacts (spills such as oils, lubricants and antifreeze, and disposal of waste) and inadequate training (not just of new hires, but for employees assigned to a new machine). 

Once these risks were identified, the team adopted basic principles from the automotive industry’s process failure mode and effects analysis (PFMEA) to identify each associated process and its sub-processes, determine what could go wrong in each case, and figure out the origin of the variations and how to control them or prevent them from happening. Take, for example, the purchasing process. One of its sub-processes is ordering of raw material, and risks include wrong information on the purchase order or receiving the wrong material. In either case, a baseline number, or rank, would be assigned that denotes the severity of that failure. Multiplying that number by the estimated frequency of this variation happening and how difficult it would be to detect produces what is called a risk priority number (RPN). A risk with a low RPN may not require action, but one deemed medium or high risk usually would, depending on the criteria established. Once criteria for and the severity of each risk were identified, PMI’s team initiated a mitigation plan for corrective actions, Mowry says.  

He says another hurdle for PMI was training employees to heighten their awareness of new risks that could arise in the production process, to alert management, and to incorporate mitigations for them. “It’s a new way of thinking, and not just for production employees, but personnel on all levels of the corporate structure had to be trained to do this,” he says. “It’s critical that every employee understands what is expected of him or her based on the 2015 standard as they perform their specific work functions.”

Audits and Advice
As this article was being written, PMI is completing the final stages of its ISO certification journey, which will include further training of employees by Mowry so that they can effectively schedule and perform internal ISO audits when he is no longer there to ensure continued compliance. Outside audits, usually performed by an accredited, third-party registrar or certifier who has experience in the industry specific to the company, will also take place before final registration audits are scheduled and certification can be awarded. After certification, the company can elect to be audited by a third-party registrar once a year or may opt to have semi-annual audits performed to break up the process into smaller workloads. 

Almeter offers reassurance for employees who might be intimidated by the auditing component. “Your employees need to know that they can relax about the auditing procedure,” he says. “It’s not difficult or intimidating, but the critical thing is to be sure they know the company’s mission, what their roles in the company are and how they impact the overall context of the company.” Having a trained, internal auditor like Mowry with the registrar during an outside audit is helpful, he adds, because that person “can jump in and help put folks at ease or steer them down the correct path for answering questions without giving the answer away.”

Mowry’s advice is to “say what you do, and do what you say.” Companies are required to implement their QMS systems and document them, because every auditor will look for objective evidence of that implementation. He also recommends hiring an ISO consultant or registrar who understands what the company does and is a good listener. These individuals should not dictate how to run the business or its processes, but should audit the company based on established procedures, regardless of what they have seen elsewhere, he says.

The entire certification process has not been without bumps in the road for PMI. “Objectives at times were not hit, which created stressful situations and discussions about getting back on track,” Almeter says. For example, a new material requirements planning (MRP) system for managing production planning, scheduling and inventory was introduced during this time, and that slowed the ISO certification process down. “This is the type of hurdle that every company will face, because there is always something that crops up that will interrupt or throw roadblocks into the ISO process,” he says. “The important thing is to pick back up, resolve the roadblocks and move forward.” PMI is moving forward and expects to earn its certification by the end of the year.