ISO 9001 in the Time of COVID-19

COVID-19 has thoroughly disrupted lives, economies and industries. As with most crises, those who were prepared fared the best. While most companies probably weren’t preparing for a pandemic, following regulations and standards helps in every crisis. The International Organization for Standardization (ISO) has been providing some of the most universally accepted standards for 74 years. To see how ISO connects to COVID-19, we spoke to Debby Newslow of D.L. Newslow & Associates, who wrote the book on ISO 9001 — literally. It turns out that ISO 9001, the gold standard for quality management systems (QMS), has proved inadvertently helpful in adapting to the pandemic.

Q: How were ISO 9001 companies better prepared for COVID-19?

A: There are a couple of ways that ISO 9001 would’ve prepared a company for the pandemic. Some of them are a little more general, such as the structure and discipline inherent in ISO standards. If you already have that level of organization in your business, it’s easier to respond to change. And that applies to any kind of change or disaster, not just the pandemic. ISO forces you to not fly by the seat of your pants, which means you have standard operating procedures in place to help you with change management.

In a more specific way, quality management is even more important in a COVID-19 world. The bottom line for ISO 9001 is, do your products consistently meet regulatory requirements? Obviously, there’s a lot of minutiae that goes into that. With a crisis like the pandemic, effective change control is essential and if you can change quickly, that’s even better. Risk-based thinking is another specific component of ISO 9001 that helps when dealing with COVID-19. If you’re ISO compliant, your business should have preventive controls in place to help you deal with risk.

It’s also not just about risk to your product or your supply chain, it’s about risk to your employees. Part of ISO 9001 is that companies need to provide the proper environment for employees. A safe physical work environment is a component of section 7.1 in the standard. We don’t traditionally think of that as including masks and hand sanitizer in your facilities, but that’s what a safe work environment means during COVID-19.

Q: What are some other sections of ISO 9001 that you’d say are most beneficial during a crisis?

A: I think Section 5, the section on leadership, is a huge benefit. When we talk about the pandemic, we’re talking about something that’s going to affect your business on the organizational level. And really, quality should also be an organizational concept that’s important across departments. So, making it a priority for management and getting them directly involved is really important. Let’s say after everyone started working from home a quality manager needed to give employees remote access to the quality management system (QMS). Getting that done, especially considering the security involved, is a faster process when management is involved and recognizes the importance.

There are some parts of ISO 9001 that relate to customers that are important during a pandemic. Section 8.2.1 relates to customer communication. Whether you’re telling customers that certain products won’t be available right now, that there might be delays in shipping, or just sending out the obligatory “during these unprecedented times” email, customer communication is especially important right now. And keeping customers satisfied is a big part of the quality system.

I’d also say Section 7.2 relating to employee competence is important. Obviously, during a pandemic a lot of people get sick so you’re dealing with a reduced workforce. And a lot of companies have had to implement layoffs because of the economic downturn we’re experiencing. In both cases, you have to ensure that no role is left unattended in relation to your quality system. Employees that are taking on responsibilities they didn’t have before need to be trained and you need to maintain training documentation to show that it was done. In some cases, the training can be done quickly enough, and a record is automatically created, so there’s really no slowdown in your processes.

Q: What are some other standards that help companies in times of crisis?

A: Well, especially during a pandemic, the one that comes to mind is ISO 45001 which addresses occupational health and safety. Although that’s important in situations other than a pandemic, it’s just applicable in different ways now. Another standard that’s helpful is ISO 27001, which is about IT security. A big problem that companies have been having with so many employees working from home is security. Companies that already follow this standard would’ve been better prepared for the remote work.

But really, all ISO standards share the same high-level structure (HLS). And that’s meant to make it easier for companies to use multiple standards. If you had to start over from scratch with every standard, you wouldn’t be very motivated to follow them. This structure also puts you in a good place to add on to the standards. For example, crisis management is huge right now, but it’s not really part of ISO 9001. You could group it under risk, but there’s nothing specific to crisis management. If you already have the framework of ISO 9001 though, it’s relatively easy to add that to what you’re already doing.

Q: What advice would you give to companies that aren’t ISO certified in dealing with COVID-19?

A: You know, I think a lot of it comes back to things we’ve discussed already. Communication in particular is key. And that means internal and external communication. You need to ensure your employees know what’s expected of them during the pandemic. They need to be trained if they’re taking on new roles, but they also need to be trained on the new health and safety measures you’re putting in place. When you have good communication and implement risk-based standard operating procedures (SOPs), you’re putting yourself in a good spot. Even when dealing with a pandemic.