We wish all of you a merry christmas and a happy new year and hope that we can welcome some of you in June 2012 in Frankfurt!

Information security controls

An ISO/IEC technical report (TR) providing technical controls and compliance guidelines for auditors can improve the effectiveness of an organization’s information security system.

ISO/IEC TR 27008:2011, Information technology – Security techniques – Guidelines for auditors on information security controls, aims to instill confidence in the controls underpinning an organization’s information security management system. The review applies to all parts of the organization, including business processes and its information systems environment.

“The business environment is constantly changing – along with threats to a company’s survival. Organizations

need to be ahead of the game, and an excellent defence can be built around audit of the controls used to support the information security,” says Edward Humphreys, leader of the working group that developed the new document.



“ISO/IEC TR 27008:2011 supports a rigorous organizational security audit and review programme for information security controls, to enable the organization to have confidence that their controls have been appropriately implemented and operated and that their information security is ‘fit for purpose’.”

ISO/IEC 27008 provides guidance on reviewing the implementation and operation of controls, including technical compliance checking. The document is principally aimed at information security auditors who need to check the technical compliance of an organization’s information security controls against ISO/IEC 27002 and any other control standards used by the organization. ISO/IEC TR 27008 will help them to:

- Identify and understand the extent of potential problems and shortfalls of information security controls
- Identify and understand the potential organizational impacts of inadequately mitigated information security threats and vulnerabilities
– Prioritize information security risk mitigation activities
– Confirm that previously identified or emergent weaknesses or deficiencies have been adequately addressed
– Support budgetary decisions within the investment process and other management decisions relating to improvement of organization’s information security management.

Read more text http://www.iso.org

Toyota to Reduce Span of Control in Engineering

The Nikkei reported on June 11, 2010 that Toyota is bringing back front line supervisors, adding a layer of management to staff positions that has been missing since 1989. This is an admission by Toyota, the world’s greatest lean manufacturing company, that they got their span of control in engineering and possibly other staff areas, wrong.

This move is in quite stark contrast to the “de-layering” going on at many global companies in an effort mainly to cut costs. While it may not seem lean to add layers of supervision, it is in fact very lean when done to reduce span of control. Form follows function and in this case the supervisors function as team leaders, coaches and first responders to andon

cord pulls (calls for help). This in turn helps expose, catch and correct problems while they are still small, rather than letting them grow into bigger problems. These problems have apparently been escaping in recent years, based on the recalls and quality problems we are seeing at Toyota.



A few years ago we commented about an article citing concern among old-timers at Toyota that the rush increase volume and make large cost cuts in design was moving the company away from it’s principle of slow, steady growth through development of people. “When did Toyota get to be a company like this?” was the question asked in alarm at the way things were being changed. The person quoted in that article was Shoichiro Toyoda, the father of current Toyota CEO Akio Toyoda, who is leading this latest reorganization towards smaller span of control for engineers.

The Nikkei reports that this new team structure will be implemented first in the technology development sections. About 1,000 employees who have been with the company for about 10 years will move into supervisory positions. The span of control is a conservative five engineers per leader. Toyota has not given this position an official title yet, and plans to do so after a one-year pilot, according to Toyota.

For further reading on this important topic, here are three more articles on our blog about supervisor span of control:

Read more text http://www.gembapantarei.com

Three Challenges Facing Operational Excellence in Utilities

Within a regulated industry like utilities, operational excellence is a key tool in the balancing act between keeping prices for consumers down and providing value for shareholders. However, market forces are combining to place hurdles in the way of utilities’ continuous improvement efforts, which will ultimately be to the benefit of consumers. In the UK, for example, the “Big Six” energy suppliers are facing pressure from the public and regulators to keep retail prices down and for their influence on the market to be reduced. The energy infrastructure in the country is ageing and a quarter of the capacity will be decommissioned by 2020. Climate change legislation is placing an ever increasing burden on operations. These factors broadly align with the three major challenges facing operational excellence in utilities across the globe: new obligations, changes to the industry landscape and a growing, more demanding customer base.

Challenge 1: Market Reforms



Utilities have often found themselves faced with market reforms, due the essential service they provide and the inevitably costs this presents to the consumer.



The aforementioned changes taking place in the UK form part of the government’s wider Electricity Market Reforms, created to help the country meet its legally binding target of cutting CO2 emission by 80 percent by 2020.

Measures laid out to help achieve this include the introduction of a carbon floor price, new long-term contracts to offer investment incentives and an emissions performance standard. More than £110 billion will be required to make the infrastructure updates needed, and a proportion of this will need to come from suppliers.

Achieving operational excellence in the face of these changes presents a significant challenge.

Challenge 2: Changing Customer Expectations :

Read more text http://www.processexcellencenetwork.com

Future of Quality

Change is persistant, what an old but never outdated wisdom. But what does that mean to our organizational environment? What does that mean concerning the job outline of a Quality Systems Manager? We will give you to both questions some answers. Mr. Paul Borawski, Chief Executive Officer, American Society for Quality, will provide you with useful information about the future of quality. He will invite you to lead. To take action. To prepare yourself and your organizations to benefit by anticipating and preparing for the future.

Mr. Benedikt Sommerhoff, Senior Consultant, German Society for Quality, is going to outline the change of the

occupational image of a Quality Systems Manager and will invite you to look into the future.

Closing Ceremony and Announcement of the 56th EOQ Congress

The quality infrastructure

Introduction

UK businesses need to:

create and enter markets in a timely manner
meet customer requirements, including legislative requirements
manage risks, including risks to financial investment, product introductions, market exclusion, etc.

Underpinning these activities is the need to demonstrate conformance to standards (whether specified by

regulators, the market or the industry) in order to gain market access and gain market confidence in their products and services.



The ‘quality infrastructure’ supports these aims and comprises the physical facilities and the interrelated systems of organizations, structures and people that help organizations to implement quality practices and improve performance.

The principle parts of the infrastructure relate to:

regulation – government, regulators
standards – documentary, physical/ reference, other codified intellectual property
conformity assessment and accreditation
economic operators and their collective representatives
consumers

Overview

The UK quality infrastructure is concerned with the relationships between:

legal requirements contained in regulation and legislation
voluntary standards which define the quality of products and services and the methods of their production
industry practice and the actual solutions provided by business
the market, where the confidence and will to trade is promoted
the accreditation and conformity assessment regimes that provide the evidence and confidence

The UK quality infrastructure is principally made up of a number of separate bodies, each with separate remits but which impact the following:

Market access and international trade – facilitating the removal of technical barriers to trade, evolving common language and practices that promote trade and gaining access to overseas markets
Industrial policy – enabling the UK to take advantage of its strong science base and capacity for innovation to compete in global markets
Regulation – either supporting regulation where there are significant risks to health, safety or the environment, or through market self-regulation
Providing confidence, evidence, information and assurance to purchasers, suppliers and customers regarding the quality of products, services or their supply.
Promoting awareness of and providing training and assistance in quality tools, methods, practices and culture.

Read more text http://www.thecqi.org

Toyota

What do you get when you mix 1,000 engineers, four weeks of additional product development lead time and reduced reliance on outsourced engineering by 67%? In most product development departments this would get a decision maker quickly fired. Not so for Executive VP Takeshi Uchiyamada, a chief engineer at Toyota tasked with turning the tide on quality issues. Toyota is taking some expensive countermeasures to the root causes that their quality assurance process from the product design and testing standpoint seems to have been cut a bit too close to the bone over the past decade through cost reductions and development time reduction efforts.

According to the Wall Street Journal article Toyota Assigns 1,000 Engineers to Quality Drive :

Toyota Motor Corp. has assigned 1,000 engineers to help analyze quality problems and is extending time devoted



to testing new models by an average of four weeks in an effort to head off glitches before vehicles enter production

Toyota has so far spent about $4 billion to correct the problem of unintended acceleration in its vehicles, but this has been mostly containment and not root cause correction. The changes suggested in this article are aimed more at root causes, and will cost approximately $400 million if we take the cost of 1,000 engineers to be $150 million per year and estimate the cost of 4 weeks of lead time and the reduction in outsourcing to be another $250 million. Could this be a demonstration of the 10X rule of the cost of quality?

Toyota reportedly saved more than $11 billion in the early 2000s thanks to its CCC21 efforts, and some have linked these cost reductions in the design process as well as supply chain costs as contributors to today’s quality problems. Cost reduction should result from following and improving safe, high quality processes that deliver to customer’s expectations. When cost reduction programs put quality before the other KPIs there is a danger that the overall costs increase in the long-run.

Mr. Uchimayada said he would like to reduce the amount of outside engineers working on research and development, but the process will take time. The company must wait for contracts to expire before it can bring the work inside the company. A company executive said the target is 10% outside engineering contractors, down from 30% now.

Read more text http://www.gembapantarei.com

New ISO videos

ISO has just launched six new videos that communicate in less than a minute each the benefits that International Standards provide.
Each video addresses a specific area where ISO standards are helping business, government and society around the world, every day:

●  Developing countries

●  Energy management

●  Environment



●  Food safety

●  Healthcare

●  Social responsibility.

The videos (run time 38 to 54 sec), emphasize how ISO standards help to solve problems and achieve goals.

They conclude with a common message: “Confidence has a nickname that’s recognized worldwide. Now you know it too. It’s ISO.”

The videos, produced in English and in French, can be viewed on the ISO Website or on ISO’s YouTube channel and on iTunes. They can also be downloaded via links on the ISO Store as m4v files for viewing on iOS platforms (iPhone, iPad and iPod). In addition, they are available on an ISO DVD entitled, Videos 2. The ISO Videos 2 DVD is available free (except charge for handling and postage) from the ISO Central Secretariat through the ISO Store or by contacting the Marketing, Communication & Information department (see right-hand column). It can also be obtained from ISO national member institutes (see the complete list with contact details).

The new short videos follow two longer ones (run time 2 min 5 sec each) released by ISO in December 2010 – one for the general public and the other for business and government audiences – that communicate how standards help people in all aspects of daily life and provide tools to assist organizations in improving all aspects of their operations.

Read more text http://www.iso.org

Genius of Steve Jobs

After the news today Apple’s founder and visionary Steve Jobs had passed away aged 56, so much is being said rightly about the technical genius of the man. His profound impact on lives is clear from the global tributes from world leaders, industry luminaries and oft times competitive rivals.

But beyond his astute commercial insight lies a deeper truth, which is much more important to Process Professionals and all us involved in building and developing Process Excellence.



We cannot easily quantify the impact on all of us. To live a life and touch so many people in such a significant way is incredible. What a truly amazing person. I don’t know where I would personally be without my iPhone, iPad and iTunes.

To briefly reflect on his impact in our process world I would like to share three of his key business insights that inspire me. Where did this notion come from? What imperative created this different way of looking at business? How does Apple consistently deliver exceptional performance for their shareholders, customers and employees? Here are some of the insights that I believe Steve Jobs brought to Apple to make it the world-beater it is today:

Insight Number 1: Discern the real need

“You can’t just ask customers what they want and then try to give that to them. By the time you get it built, they’ll want something new.”

How do you discern the real customer need and not just the want when so often the customer doesn’t know it themselves? Part of this genius is to transcend the customer surveys, research and legions of marketing agencies telling you about customer desires. You need to go beyond that and Steve Jobs did and described a way of thinking through the successful customer outcome and then, only then, align everything you do, through your processes, people and technology to achieving that objective. A collaborator (and sometimes Apple competitor) Jeff Bezos from Amazon describes the process as “working backwards”. He encapsulates the essence of this outside-in view of business “Hey, rather than ask what are we good at, ask who our customers are and what they need. We will figure out how to give it to them.”

Read more text http://www.processexcellencenetwork.com