China Supplier Evaluation: Why an ISO 9001 certified supplier doesn't guarantee your product to be without defects

A few years ago I attended a training to become officially a certified ISO 9001 Lead Auditor in China. At that time I had already been performing supplier audit in China and Asia for several years based on this standard but I wanted to make sure I understood it very well and very deeply, so I took a formal training.

I eventually got the certification being passed but this was not the most important. The most interesting was actually what I learnt during the training about this ISO 9001 standard: its real weaknesses . Some things that many people simply ignored.

In the mindset of most of people, the words "ISO 9001" immediately trigger the synoym "quality" or "product with guaranteed quality". I heard in the pasts several clients telling me : " I need you to source me a manufacturer with ISO 9001 certification because I want to make sure the quality of their products is good". Yet, if you take the time to decipher the ISO 9001 standard documentation you actually find out that there is a general misunderstanding about what ISO 9001 standard is.

I was relatively shocked by what I learnt during the training session and by what I discovered. I then understood why ISO 9001 certification simply doesn't guarantee or even has no direct relationship with product quality.

Below are a few points I want to mention which will help you to understand why a supplier being certified against ISO 9001 standard doesn't guarantee you a product without quality issue.

ISO 9001 doesn't say the process is performing well

As I said earlier, one of the biggest misconception or misunderstanding of ISO 9001 is to assimilate the acquisition of standard certification by a company to the product quality standard that a company deliver. This is a mistake to think so because the standard doesn't have influence on product quality itself, it only look at the company internal behavior, process and its related organization. Indeed, what the ISO 9001 standard say is that :

- there is a process approach via an established documentation about processes. It doesn't say the established documentation is adapted to this process

For example, if a manufacturer got a production line being certified for the assembly or TV, the auditor will check if there is a documented process for assembling TV. However, the auditor will not take any opinion wether the assembling steps are performed in the right order to assembly the product. So the audit will focus on the establishment of a process but not if the process is adapted to make a product with high quality.

Another example given during this training: If a supplier decide to communicate 100% of the information and instruction to the staff voicely only instead of using documents, ERP and other system bringing reliability to the process, then it is considered there is a process being established for information transmission, and it can be accepted by the auditor as a proof of process establishment. I was shocked when I heard this.

- there is traceability being established on the documentation with versioning. It doesn't say this versioning is well adapted to avoid mistake

For example, if a company use a versioning writing on his documentation being 3-1-4-5-2 instead of a logical 1-2-3-4-5 (which would reduce risk of mistake) then the auditor would still validate this point as passed.

There are many other points where the standard doesn't involve product directly but relate to process. Why ? Well simply because ISO 9001 standard is a generalist framework which can be applied to a very wide range of business, not only to manufacturing.

In short, ISO 9001 certification means the supplier has established a controled organization among its business process. It doesn't mean those controlled process are appropriately controled and adapted to deliver a product without defects.

The certification may apply only to a restricted scope

Something that most people ignore is that when you apply for ISO 9001 certification, you have to mention which part of your process you want to certify. Some companies decide to certify their whole process and whole business units (procurement, finance, engineering and product development, manufacturing, sales, marketing etc...) whereas other companies will restrict their certification only to a small parts of their business process .

For example, a manufacturer A could decide to get only its packaging process being certified, whereas a manufacturer B could decide to get his whole engineering (design, prototyping, testing) and manufacturing business unit(including inspection, assembly and packaging) being certified. In both cases certification is issued but not the same processes have been awarded with ISO 9001 certification. Auditing a full engineering and manufacturing process take much more time to prepare and to audit than only a packaging process, hence the cost for the certification is also higher in the case of manufacturer B than in the case of manufacturer A.

So, next time a manufacturer tell you they are ISO 9001 certified, ask them on which business scope their certification apply.

You can see here on this article a few pictures of certification and I compare their scope.

For many supplier, getting an ISO 9001 certification is like an exam

Although one of the pilar of ISO 9001 standard is a the "continuous improvement" concept, there is actually no real quantification of this continuous improvement or simply of maintaining it after certification is acquired. What ever they perform a big change to improve or a very small one which have no significance influence, it is still continous improvement.

Of course, the most serious and the most structured company will really implement the standard, but many will just prepare to pass it. Like everywhere you have people who work to pass exam, and you have some who work to learn something they can really use later in their daily working life.

When a company get certified, his certification get validity for 3 years. After those 3 years they have to do a recertification. Normally, they get audited annualy by the certifier to make sure the quality management system is still implemented. Yet, within a year many things may happen in a chinese factory. Particularly, deviation in the processes or in the controls of the process. Audit are usually announced in advance so the supplier have time to make and put everything in order at D-1 before the audit if necessary and to forget everything after....

So, in short a supplier can pass the certificatin but it doesn't mean the skills or process are maintained over the time. Worse, the auditor is not supposed to take in consideration the real implementation or even the supplier understanding have of the framework. He is supposed to stay neutral.

Auditor corruption

In the audit and inspection industry, we all know some companies are specialized to get their auditors to deliver certifications against an "envelope". This is not only specific to ISO 9001 certification, I heard it apply to many different certification standard.

What I heard is that briberies particularly takes place when there is a potential big order which can be seized by the supplier if he pass the certification (I particularly think about some corporate retail audit). My personnal thinking about bribery issues is that westerners are much less inclined to accept them than asian auditors. Don't get me wrong, not all asian auditors are corrupted. However, it seems the envelope methodology is quite cultural and much more accepted as "normal" in Asia than in Europe or in the USA.

Yes, you are reading well, some certifications can be "bought". So, what to think about the value of those certification really ?

Certification doesn't equal proper implementation

We may think that because a supplier is certified, then he is in good shape. Yet, I have seen many supplier being certified against a Quality Management System but not really implementing it. For example, they will have a heavy pile of sheet of paper with template sleeping in a binder in a shelf, but those documents are actually never used, never even read. They have been printed and placed in a binder just to show to the auditor the day of the audit.

When I got my training done, I remember what the instructors said : "If they have a documentation, then they have it. As an auditor, you can not challenge the organization on the usage of this documentation". I was shocked, because when I audit, I usually attempt to verify if the suppliers really implement what they claim.

There is a real difference between implementation and certification.

In Asia, and particularly in China, many supplier see an ISO 9001 certification like a marketing and sales tool rather than like a way to really improve their organization by living and breathing the standard.

Conclusion

For all those reasons, you can understand now why a supplier being certified against ISO 9001 standard simply doesn't guarantee you a product with quality and without defect.

When I select and qualify a supplier, I would prefer to use a supplier who doesn't have an ISO 9001 certification but who have a real implementation of a Quality Management System (QMS) in place which I can see they really implement on a daily life, rather than a supplier who got a paper writen ISO 9001 issued from a company XYZ but not implementing really a QMS.

This article was writen by Christopher Oliva a Ms Electrical Engineering, Ms Business Administration, ISO9001 Lead Auditor, Six Sigma Green Belt, Certified Quality Engineer by ASQ based in China (Shenzhen), specialized in Product Development, Manufacturing Support & Quality Management.

Christopher provides consultancy support to help foreign buyers and importers to solve their quality related issue at their suppliers and manufacturers in China and Asia