Collection of standards in electronic format (PDF)

1. Copyright

This standard is available to staff members of companies that have subscribed to the complete
collection of SANS standards in accordance with a formal copyright agreement. The document
may reside on a CENTRAL FILESERVER or INTRANET SYSTEM only. Unless specific
permission has been granted, this document MAY NOT be sent or given to staff members from
other companies. Doing so would constitute a VIOLATION of SABS copyright rules.

2. Indemnity

Standards South Africa accepts no liability for any damage whatsoever that may result from the
use of this material or the information contained therein, irrespective of the cause and quantum
thererof.

Click on one of the two boxes

I agree with the above I do not agree

 This standard may only be used and printed by approved subscription and freemailing clients of the SABS.

ICS 03.120.20
SANS 10055-2:2003
ISBN 0-626-14885-5 Edition 1

SOUTH AFRICAN NATIONAL STANDARD

ISO 9001:2000 Process auditing

Part 2: ISO 9001 Process capability model and

compliance indicators

Published by Standards South Africa

1 dr lategan road groenkloof private bag x191 pretoria 0001
tel: 012 428 7911 fax: 012 344 1568 international code + 27 12
www.stansa.co.za
Standards South Africa 2003
 This standard may only be used and printed by approved subscription and freemailing clients of the SABS.

SANS 10055-2:2003
Edition 1

Table of changes
Change No. Date Scope

Foreword
This South African standard was approved by National Committee STANSA SC 71C, ICT software
and systems engineering, in accordance with procedures of Standards South Africa, in compliance
with annex 3 of the WTO/TBT agreement.

SANS 10055 (all parts) cancels and replaces ARP 042:1997.

SANS 10055 consists of the following parts, under the general title ISO 9001:2000 Process
auditing:

Part 1: Concepts and application.

Part 2: ISO 9001 Process capability model and compliance indicators.

Part 3: Generic process performance model and work products.

Part 4: Process performance model and work products for information technology.

Annex B forms an integral part of this part of SANS 10055. Annex A is for information only.

Introduction
The need for SANS 10055 (all parts) emerged from discussions held early in 1995 by members of the
Software Quality Group of the South African Society for Quality. It was noted with concern that quality
managers and individuals engaged in external assessments and audits held widely differing
interpretations of the implications of various aspects of SANS 9001. In some instances it was
believed that these differences of interpretation were sufficiently severe to place at risk the
foundation of the quality management system on the one hand and, on the other, to cast doubt on the
effectiveness and value of external assessments and audits. As a result, ARP 042, ISO 9001 Audit
checklist for software, was released in 1997.

The need for a revision of ARP 042 was precipitated by the release of SANS 9001:2000. The
change in focus from function in the earlier version to process in the current version, has
necessitated a complete revision of ARP 042. As a result, and in order to accentuate the difference, the
revised standard has been renamed and renumbered.

The audit compliance indicators (i.e. questions) contained in this part of SANS 10055 are based
largely on SANS 9001:2000. The normative reference for the process capability model is
SANS 15504-2.

The process mappings based on SANS 15504-5 are intended to be indicative, and can be
expanded or shortened to suit individual situations. To facilitate this customizing activity, the
documents are also available in electronic format.
 This standard may only be used and printed by approved subscription and freemailing clients of the SABS.

SANS 10055-2:2003
Edition 1

Contents
Page

Foreword

Introduction

1 Scope ... .............................................................................................................................................. 3

1.1 Overview ... ................................................................................................................................ 3

1.2 Field of application ... ................................................................................................................. 3

2 Normative references... ...................................................................................................................... 4

3 Definitions ... ....................................................................................................................................... 4

4 The process capability model ... ........................................................................................................ 4

4.1 Concepts of process capability ... ............................................................................................. 4

4.2 SANS 9001 compliance indicators according to capability level
and process attributes ... ........................................................................................................... 8
4.3 Applying the capability model in process audits ... ................................................................. 12

5 SANS 9001 compliance indicators ... .............................................................................................. 13

5.1 Introduction ... ............................................................................................................................ 13

5.2 The SANS 9001 compliance indicator set ... ............................................................................ 14

Annex A (informative) List of elements of the process capability model ... ................................... 15

Annex B (normative) List of the SANS 9001:2000 compliance indicators... ............................... 26

Bibliography... ..................................................................................................................................... 54

Figure 1 - Levels of the process capability model ... ............................................................................. 5

Table 1 - Process capability levels and their characteristics ... ........................................................... 6

Table 2 - Process capability levels, process attributes and definitions ... ........................................... 7

Table 3 - Process attribute name, definition and characteristics, and SANS 9001
compliance indicators ... ...................................................................................................... 9

Table 4 - SANS 19011 implications for process auditing ... .............................................................. 12

Table 5 - Comparison between SANS 9001 text and compliance indicators ... ............................... 13

1
 This standard may only be used and printed by approved subscription and freemailing clients of the SABS.

SANS 10055-2:2003
Edition 1

This page is intentionally left blank

2
 This standard may only be used and printed by approved subscription and freemailing clients of the SABS.

SANS 10055-2:2003
Edition 1

ISO 9001:2000 Process auditing

Part 2:
ISO 9001 Process capability model and compliance indicators

1 Scope
1.1 Overview
This part of SANS 10055 defines a model for describing process capability from a SANS 9001
perspective. The model describes a framework for evaluating the capability of processes by
examining a series of process attributes structured into capability levels. This model for process
capability follows closely the model described in SANS 15504-2. The definitions of the process
attributes and outcomes have been aligned with compliance requirements that arise from
SANS 9001. The model provides a focused organizational growth path for process improvement,
defect prevention, and adopting innovative practices.

This part of SANS 10055 also describes a set of SANS 9001 "compliance indicators" which are a
set of questions based on the "shall" requirements from this part of SANS 10055. These compliance
indicators are intended to be used for preliminary assessment of the documented management
system before formal registration.

1.2 Field of application

The development of this family of documents has been motivated by the need to provide

a) guidance on the implications of establishing processes according to the mandate of 0.2 of

SANS 9001:2000,

b) a framework for auditing processes for compliance with SANS 9001 requirements in the context
of the process approach,

c) specific guidance on process content for different business application domains, and

d) a framework for process improvement using the concept of a tiered model of process capability.

3
 This standard may only be used and printed by approved subscription and freemailing clients of the SABS.

SANS 10055-2:2003
Edition 1

2 Normative references

The following standards contain provisions which, through reference in this text, constitute
provisions of this part of SANS 10055. All standards are subject to revision and, since any reference to
a standard is deemed to be a reference to the latest edition of that standard, parties to
agreements based on this part of SANS 10055 are encouraged to take steps to ensure the use of the
most recent editions of the standards indicated below. Information on currently valid national and
international standards can be obtained from Standards South Africa.

SANS 9001/ISO 9001 (SABS ISO 9001), Quality management systems - Requirements.

SANS 15504-2/ISO/IEC TR 15504-2 (SABS ISO/IEC TR 15504-2), Information technology -

Software process assessment - Part 2: A reference model for processes and process capability.

SANS 19011/ISO 19011, Guidelines for quality and/or environmental management systems
auditing.

NOTE The following revisions of the standards above were used as sources in the preparation of this part of SANS
10055:

ISO 19011 (DIS) (2001)

SANS 9001 (2000)

SANS 15504-2 (1998)

3 Definitions

For the purposes of this part of SANS 10055, the following definitions apply:

3.1
key process
process that makes a direct contribution to the customer value-creation chain, or a process that
exhibits a one-to-one relationship with financial income generation

3.2
work product
artefact associated with the performance of a process

4 The process capability model

4.1 Concepts of process capability

SANS 15504-2 defines a reference model for process performance and process capability. The
reference model comprises a two-dimensional approach to evaluating process capability. One
dimension identifies the processes to be assessed; the other describes a graded framework for
measurement of capability.

Figure 1 illustrates the relationship between process performance (Level 1), and four graded levels of
management intervention (Levels 2 to 5). The five levels taken together are referred to as the
process capability dimension. An increase in level implies a significant advance in achievement of
process capability.

4
 This standard may only be used and printed by approved subscription and freemailing clients of the SABS.

SANS 10055-2:2003
Edition 1

SANS 15504-2 provides the basis of the model that is applied in this part of SANS 10055 for
process capability. The distinctive SANS 9001:2000 implications for process capability arise from
current development thinking in ISO/IEC JTC 1/SC 7/WG 10, the international working group
responsible for transitioning ISO/IEC 15504-2:1998 to ISO/IEC 15504-2 (second edition).

A capability level is characterized by a set of attributes that work together to provide a significant
enhancement in the capability to perform a process. The levels constitute a rational way of
progressing through improvement of the capability of a process.

Level 5 -
Optimized
process

Level 4 -
Predictable
process

Level 3 - Established process

Level 2 - Managed process

Level 1 - Performed process

Figure 1 — Levels of the process capability model

There are six process capability levels in the reference model (see Table 1).

Evolving process capability is expressed in terms of capability levels supporting one or more
process attributes.

Process attributes are features of a process that can be evaluated on a scale of achievement,
providing a measure of the capability of the process.

Process attributes are applicable to all processes.

Each process attribute describes a facet of the overall capability of managing and improving the
effectiveness of a process in achieving its purpose and contributing to the business goals of the
organization.

5
 This standard may only be used and printed by approved subscription and freemailing clients of the SABS.

SANS 10055-2:2003
Edition 1

Table 1 — Process capability levels and their characteristics

Process
Description
capability level
Level 0: There is general failure to attain the purpose of the process. There are few or no easily
Incomplete identifiable work products or outputs of the process.
The purpose of the process is generally achieved. Individuals within the organization
Level 1: recognize that an action should be performed, and there is general agreement that this action
Performed is performed as and when required. There are identifiable work products for the process, and
these testify to the achievement of the purpose.
Level 2: The process performance is planned, tracked and monitored. Work products arising from the
Managed performance of the process comply with specified standards and requirements.
The process is performed and managed using a defined process based upon prevailing good
Level 3: professional practices. Individual implementations of the process use an approved, tailored
Established version of the standard documented process to achieve the process outcomes. The
resources necessary to establish the process definition are available.
The defined process performs consistently in practice within defined limits to achieve its
Level 4: process goals. Measures of performance are established, and process and product data are
Predictable collected and analysed, leading to a quantitative insight into process capability and product
quality.
Process performance is optimized to meet current and future business needs. Optimizing a
Level 5:
process involves piloting innovative ideas and technologies, and changing non-effective
Optimizing
processes to meet defined goals or objectives.

Table 2 lists the process attributes and their definitions for each level of process capability. A

careful reading of the attributes for the two models indicates that:

- The attributes for Levels 1 and 2 are, to all intents and purposes, identical for the two models.

- At Level 3, the SANS 9001:2000 model places less demands on the difference between the
concepts of a standard process and the defined process.

- At Level 4, both the SANS 9001:2000 model and the SANS 15504-2 model address process and
product measures. SANS 15504-2 looks for evidence of the process being under control.

- At Level 5, SANS 15504-2 places greater demands upon the need for evidence by management
of the impact of controlled change to processes. It is not sufficient merely to demonstrate that
changes to processes are being made (as in the SANS 9001:2000 model); it is also necessary to
show that the risks associated with changes are understood, that the impact of these changes is
controlled, and that the outcomes are predictable.

6
 This standard may only be used and printed by approved subscription and freemailing clients of the SABS.
Table 2 — Process capability levels, process attributes and definitions
SANS 9001 model
Level Attribute name Definition
0 Incomplete Process
1 Performed Process
1.1 Process Performance The extent to which the
process purpose is
accomplished.
2 Managed Process
2.1 Performance The extent to which the
Management performance of the
process is managed to
produce work products
that meet the process
purpose.
2.2 Work Product The extent to which the
Management performance of the
process is managed to
produce work products
that are appropriately
established, controlled
and maintained.
3 Established Process
3.1 Process Definition The extent to which the
enactment of the
process uses an
established and
maintained process for
application throughout
the organization to
achieve the process
purpose.
3.2 Process Resource The extent to which the
defined process draws
upon suitable
resources that are
appropriately allocated
to deploy the
established process.
SANS 10055-2:2003
Edition 1
SANS 15504-2 model
Attribute name Definition
Process Performance The extent to which the
process achieves the
process outcomes by
transforming
identifiable input work
products to produce
identifiable output work
products.
Performance The extent to which the
Management performance of the
process is managed to
produce work products
that meet the defined
objectives.
Work Product The extent to which the
Management performance of the
process is managed to
produce work products
that are appropriately
documented,
controlled and verified.
Process Definition The extent to which the
performance of the
process uses a
process definition
based upon a standard
process to achieve the
process outcomes.
Process Resource The extent to which the
process draws upon
suitable resources that
are appropriately
allocated to deploy the
defined process.
7
 This standard may only be used and printed by approved subscription and freemailing clients of the SABS.
SANS 10055-2:2003
Edition 1
Table 2 (concluded)
SANS 9001 model
Level Attribute name Definition
4 Predictable Process
4.1 Process Measurement The extent to which
process and product
measures are used to
demonstrate the ability
of the process to
achieve its purpose
and planned results.
4.2 Process Control The extent to which the
process is quanti-
tatively managed to
produce a process that
is stable and capable,
and predictable within
defined limits.
5 Optimizing Process
5.1 Continual Improvement The extent to which
appropriate data are
used to demonstrate
the suitability and
effectiveness of the
process and to
determine where
continual improvement
can be made.
5.2 Process Innovation The extent to which
effort is pro-actively
directed to identify
innovations and best
practices to achieve
superior performance
equal to, or exceeding,
best in class.
4.2 SANS 9001 compliance indicators according to capability level and
process attributes
For these process attributes to be useful in process auditing, each definition shall be supported by a
set of process management characteristics and, for completeness, the correlation of these
characteristics with SANS 9001 requirements. These process attributes, definitions and
characteristics, and SANS 9001 compliance indicators are listed in Table 3.
8
SANS 15504-2 model
Attribute name Definition
Measurement Attribute The extent to which
product and process
goals and measures
are used to ensure that
performance of the
process supports the
achievement of the
defined goals in
support of the relevant
business goals.
Process Control The extent to which the
process is controlled
through the collection,
analysis, and use of
product and process
measures to correct,
where necessary, the
performance of the
process to achieve the
defined product and
process goals.
Process Change The extent to which
changes to the
definition, manage-
ment and performance
of the process are
controlled to achieve
the relevant business
goals of the
organization.
Continuous The extent to which
Improvement changes to the process
are identified and
implemented to ensure
continual improvement
in the fulfilment of the
relevant business
goals of the
organization.
 This standard may only be used and printed by approved subscription and freemailing clients of the SABS.
Table 3 — Process attribute name, definition and characteristics,
and SANS 9001 compliance indicators
Attribute name Attribute definition
The extent to which
1.1 Process
the process purpose
Performance
is accomplished.
The extent to which
the performance of
the process is
managed to produce
work products that
meet the process
purpose.
2.1 Performance
Management
SANS 10055-2:2003
Edition 1
SANS 9001
Attribute characteristics compliance
indicators
As a result of full achievement of (Each process has its
this attribute, the process achieves own set of compliance
its defined outcomes. indicators)
As a result of full achievement of 0.2 Process approach
this attribute,
4.1 (d), (f) Quality
- the process is planned and management system -
managed and the performance General requirements
of the process is controlled,
5.5.1 Responsibility
- responsibilities and authorities and authority
for performing the process are
7.3.1 Design and
defined, assigned and
development planning
communicated,
8.2.3 Monitoring and
- resources and information
measurement of
necessary to support the
processes
operation and monitoring of the
process are made available,
allocated and used,
- interfaces between the different
groups involved are managed to
ensure effective communication
and clear assignment of
responsibility,
- appropriate review, verification
and validation are determined
(and planned),
- (in the performance of the
process) actions are imple-
mented to achieve planned
results, and
- correction and corrective action
are taken where planned results
are not achieved.
9
 This standard may only be used and printed by approved subscription and freemailing clients of the SABS.

SANS 10055-2:2003
Edition 1

Table 3 (continued)

SANS 9001
Attribute name Attribute definition Attribute characteristics compliance
indicators

The extent to which As a result of full achievement of 4.2.3 Control of

the performance of this attribute, documents
the process is
- the requirements of the work 4.2.4 (partial) Control of
managed to
products of the process are records
produce work
determined and defined,
products that are 7.3.2 Design and
appropriately - work products are appropriately development inputs
established, identified, documented and
7.3.3 Design and
controlled and controlled,
maintained. development outputs
- any dependencies among the 7.3.4 Design and
controlled work products are
2.2 Work Product development review
identified, and
Management
7.3.5 Design and
- work products are reviewed,
development
verified and validated and, if
verification
necessary, adjusted to meet the
defined requirements. 7.3.6 Design and
development validation
7.3.7 Control of design
and development
changes
7.5.3 Identification and
traceability

The extent to which As a result of full achievement of 0.2 Process approach

the enactment of the this attribute,
4.1 (a), (b) Quality
process uses an
- the process is established, management system -
established and
implemented (according to the General requirements
maintained process
established process) and
for application 4.2.1 Documentation
maintained,
throughout the requirements - General
organization to - the process is defined within a
5.5.2 (a) Management
3.1 Process achieve the process management system for
representative
Definition purpose. application throughout the
organization,
- the sequence and interaction of
the process with other processes
are determined, and
- the process is supported by
documented procedures as
needed.

The extent to which As a result of full achievement of 6.2.1 Human resources

the defined process this attribute, - General
draws upon suitable - the personnel performing work 6.3 Infrastructure
resources that are are competent on the basis of
appropriately 6.4 Work environment
appropriate education, training,
3.2 Process allocated to deploy skills and experience,
Resource the established
process. - the infrastructure needed is
determined, provided and
maintained, and
- the work environment is
determined and managed.

10