IATF 16949:2016 Essentials – A Practical Guide to Automotive QMS Compliance

Okay, well, good morning everyone and welcome to Mnemonics Quality webinar series. Very happy and safe Halloween to all of you. This webinar this morning is going to discuss the new automotive quality management standard 16949:2016, which is heavily based on 9001:2015, and we're trying to bring together experts in the automotive industry and a collaborator of ours, Michael Wolf, from the McDay Group to discuss how the standard can be implemented and some of the challenges that we've seen across the industry. So just a very brief introduction about Mnemonic. Mnemonic offers software solutions to help companies audit out in the field. And really what we try to also provide is a lot of industry information analysis, audit protocols, checklists, and insights from experts around the world such as Michael. We're gonna be providing some PDFs, which are mostly blog posts and articles that Michael has written about the standard. You can download those in the handout section on the right-hand side of the GoToMeeting. There's also a case study in there from a project we did with GKN Driveline, a tier 1 auto supplier that provides drivelines around the world. So feel free to download those handouts. Right now or throughout the presentation. They're yours to keep and to distribute within your organizations. And over the last few months, we have been publishing videos, shorter videos with Michael, on different parts of this management standard. And those are all available on our website on the blog, and you can certainly go and take a look at those. They're usually 2 to 3 minutes long, and you can share those as well within your organization. So every 3 months we conduct a webinar on a hot topic, an industry topic, and this month, or this, this quarter I should say, we're doing it on the IETF 16949 standard. So feel free to ask questions throughout the presentation. To ask a question, you'll want to go into the chat window on the right-hand side of your GoToMeeting, and you can just type a question in. Michael will see those questions throughout the presentation, and depending on the question, he might address it during the presentation or keep it for the end. We'll have a Q&A period where we can ask questions and, uh, and, uh, dive into details on specific topics. So some other webinars that we've done, just so you know, uh, include EHS trends in China, where we look— we work with a lot of automotive companies in China who are struggling to keep up with the regulatory changes over there. So if ever things in China introduce you into— sorry, if things in China, uh, interest you, um, feel free to reach out to us at Mnemonic. We have a team over there in China. So for today's webinar on automotive quality management standards, we're working with the McDay Group. The McDay Group specializes in implementing quality management standards in a variety of industries, but especially the automotive industry, and Michael will dive into that in a little bit more detail. And again, Mnemonic, at a very high level, what we offer is a software and a database of regulatory information as well as industry standards such as IETF. And we help companies comply to regulations as well as to industry standards. And we work with a lot of the companies in the automotive industry. My name is, uh, Jonathan. I'm the president and founder of Mnemonic, and I'm a newbie to the automotive industry. I've been driving in cars for many years, but I am only now learning the inner workings of the automotive industry through some really interesting projects we've done with automotive suppliers, Tier 1, Tier 2, as well as the OEMs. And I've come to appreciate the complexity of the automotive industry at a whole other level than what I, what I knew just a few years ago. So, but Michael here is, is the real expert. He's our presenter today, and he is a standards implementation consultant with the McDay Group. He helps organizations in a variety of industries, but especially the automotive industry, implement quality management systems that are both audit and user-friendly. So that's all I have for introductions. We have attendees from all over the world today, so good morning to some of you, good afternoon to others, good evening. And we'll be sharing this presentation online afterwards so you can distribute it within your, your networks on LinkedIn or within your organizations. I am, um, uh, I have a question here that says if our security blocked GoToWebinar, uh, the attachments. Yeah, we can, uh, we'll be able to email those attachments out. So we'll send an email out after the webinar with the handouts, uh, that we're providing, as well as with the video of the presentation and the slides. You'll get all that in email later today or tomorrow. So we're going to have a few polls throughout the presentation. We have, I believe, 5 polls, and these polls are just designed to get a bit of a sense of who's on the call, what some of your challenges are, and that way we can frame some of the presentation in that light. So I'm going to let Michael introduce himself in just a moment, but I'll just read out the first 2 polls, and that way you can start to think about them. The first poll is, uh, have you read in, in the entirety the new IATF standard? And the second question that will come just after that one is, uh, is your company that you work for or represent currently certified to the old version of the standard, the new version, the 2016 version, or are you not certified at all? So those two polls just get a sense of how familiar you are with the standard, and I'm going to launch the first one. And hand it over to Michael here for his presentation and an introduction about himself.

Okay, thank you, Jonathan. Uh, again, I agree. Good morning, good afternoon, good evening to wherever you are. And, uh, I appreciate everybody being willing to take a little bit of their valuable time, uh, to attend this webinar. I know your time's extremely valuable, and we respect that. So I am going to move through the presentation slightly quickly because I would prefer to give as much possible information as I can in the time frame I have been given. As Jonathan said, I am an implementation consultant with the McDay Group, and there's going to be a slide near the end of the presentation about us, so I'll save my introduction until that slide. I've been in the building creating and implementing quality management systems for about 15 years now. Probably well over 300 to 400 quality management systems that I've, that I've created and implemented. So you're in good hands. We're going to have a good time. I'm going to try and keep it interesting. I'm going to try and keep it enjoyable. So as Jonathan said, there's some polls going on the right side if you want to just jump on those. It gives us a chance to see who our audience is, and it helps me guide, guide the information a little bit more closely in line with what people need. Okay, so Jonathan, the second one, I see that. Got it. Okay, so here we go. Just a little bit first about the webinar objectives quickly. This, this webinar is going to provide a simple high-level overview of the standard Obviously, given 40 minutes to do a webinar on IATF would be impossible to give specific details of the standard, what's in the standard, and how to apply it to your organization. But I am going to give you a high overview. It's going to briefly explain the foundation for an effective quality management system for IATF. Obviously, we can't give implementation advice in 40 minutes, so, so what I've at least tried to do is categorize the foundations and give a little bit of tips and tricks and advice on the foundation of a quality management system. And I want to give you some tips for implementing and improving the effectiveness of the system. I've been on both sides of the industry. I have built systems and run systems in my own companies that have been audited, and I have been an auditor. So I understand the delicate balance of making sure your company is profitable and productive, but also, you know, satisfying what auditors are looking for. So I'm going to give some tips on how to do that throughout the presentation. First, let's, let's take a 10-minute tour through the standard. The first 2 slides are going to have a lot of words. I'm not going to read them to you, and I'm going to give you a chance to kind of peruse them as I talk through them. But the first 2 slides are just the idea of what is IATF, where did it come from. The first is the International Automotive Task Force is the organization that has created this IATF standard as the organization that manages the IATF standard, and it includes members of a lot of the largest OEM and vehicle manufacturers in the world. The reason I like to at least put this slide here is to show you that if you go to iatfglobaloversight.org, there is a lot of free information on the IATF standard. So you can kind of see that iatfglobaloversight.org. The next thing is IATF, like Jonathan already referred to, has been built off of the new ISO 9001:2015 standard. In my professional opinion and experience, I think that was an excellent move. I think it was the right thing to do, and we are seeing the benefits of that. So again, if you'd like some more free information about the foundation of the IATF system, you can go to www.iso.org. But I think it was a good move. We're very excited that they collaborated, and there's some free information available for you there as well. Okay, so let's actually look at the philosophy of the IATF standard. The philosophy is based upon ISO 9001, and basically if you think of IATF as a book with 10 chapters, only chapters 4 through 10 include requirements and are auditable. So we're only going to focus on those chapters, but in a sense, chapter 4, the organization and its context, is the input to your quality management system. Okay, in the old standard, customer requirements was the only input. If you knew what your customers wanted and you gave them what they wanted, you were in conformance into IATF. That's what IATF cared about. Do you know what your customers want, and are you giving them what they want, and are they satisfied? So now with the collaboration with ISO 9001:2015, now we have this whole idea of issues and interested parties and strategic business direction, business risks, things of that nature. So that's been added to the standard. Another really huge change from TS to IATF is the leadership section. Under TS 16949, the leadership section was one of the exterior circles. And so they had one little piece of the quality management system. If you notice now, leadership is in the middle of the system. They are— top management is now expected to participate in every aspect of the quality management system and to be engaged. There are a lot of things that they were allowed to delegate in the old standard that they are no longer allowed to delegate. Chapter 6 is the planning or the risk management chapter, and that's what we're talking about— quality objectives, quality, talking about your actions to address risks and opportunities with your interested parties and your issues. And so there's a lot of risk-based thinking involved with Chapter 6. Chapter 7 and 8 is the resource section and the doing section, the operational section. This is your production your inspection. This is all, all of the things that are involved in product realization and, you know, RFQ review, order review, design and development, manufacturing feasibility, production, inspection, all of those things needed for everything from understanding what your customers need and delivering the final product. Chapter 9 is the performance evaluation. Chapter 9, this is talking about things like monitoring and measuring more KPIs than we used to have to monitor and measure in the TS standard. This is the, this is the section with internal auditing, management review, which has been really made more robust. And I'm going to talk some specifics about these later on in the slides. This is just again the high-level philosophy of the standard. And then Chapter 10 is the improvement chapter, corrective action, problem-solving, error-proofing, things of that nature. And the basic concept is this, based off a Deming cycle, and this isn't new to anybody, but the basic concept is you understand your issues, your interested parties, and your customers' needs, wants, and requirements. You make a plan, you resource the plan, you execute the plan, you evaluate the plan. If it worked, you pat yourself on the back and do it again. If it didn't work, you make changes and try it again. And if you consistently follow that cycle, the natural outcome will be satisfied customers, great products and services, and a healthy quality management system. So let's talk about how this works in, in the real world, in everyday life. That first chart is what ISO and IATF present. This is more of a real-world view. For a philosophy of an effective quality management system for IATF, it starts with an organization, an organization identifying relevant issues, issues that could help or hurt your business. Not product-related issues, not on-time delivery-related issues, not, you know, not product health and safety issues with employees. These are issues that could help or hurt the business They could— there are issues related to the strategic direction of a company and interested parties as well. So an organization identifies these issues that could help or hurt their company. They identify the interested parties and the requirements that those parties have that can help or hurt their company, and they create quality management system processes that umbrella the entire IATF standard and the entire company. Then we assign key performance indicators to those processes with goals and targets, and that's the way we're going to make sure that our processes are working effectively. That's going to be the, the mechanism that we use to understand how effective our processes are operating and where our processes are breaking down and what we need to do about them. Employees follow procedures and work instructions that support the operations of the processes, and they generate records. Employee engagement and employee awareness has been put on steroids in the new standard, and employee engagement and employee awareness is one of the most critical aspects of an effective quality management system. And we're going to talk a lot about that farther in the webinar. The next is the internal auditing is used to gather evidence. There's a lot of criteria for internal auditing. We have a slide on that later in the webinar. This is just a high overview. But internal auditing is extremely important, hence the reason we have Mnemonic here with us. You know, we're going to talk a little bit about Mnemonic's system a little bit later, but just as an FYI, I use Mnemonic's auditing app for all of the audits that I do for internal auditing and supplier audits that I do. And then the last one is top management makes decisions based upon all of the data and at management reviews. So that's the way it works. Very high-level, 50,000-foot view of how, how a philosophy of a system fleshes itself out in an organization. Let's look at the overall content for a little bit. IATF 16949, it has 10 chapters. If you think of it as a book with chapters, it makes a little bit more sense. It has 160 auditable elements Okay, so if you're going to do a full internal audit one shot, you're going to have to look at 160 elements. It has 351 specific requirements. Where we get that from is the word "shall" when it appears in the IATF standard is translated into "must." So if it says the organization shall do this or that, it's really saying the organization must, which means that is a specific requirement. There's also 42 required documents that are needed for an IATF 16949 system, and there's 43 required records. It's a high-level overview. Again, I'm not going to read all of these in the bulleted list, and obviously you can see there's not 42 bullets there, but as I'm talking about these documents and records that are required, you can feel free to peruse the list with your eyes. And just kind of pick out a couple that you see there. So the biggest ones obviously are the quality manual, processes, procedures, and work instructions. That's obviously the biggest piece of the, you know, of the quality management system to IATF. But a couple specifics, you know, the anti-bribery employee code of conduct, ethics escalation policies, those are required to be documented somewhere. Internal, external lab scopes. So a lot of these were already in the TS standard, but again, there's been a few added here and there to the new IATF standard. The records that are required, some examples, again, your eyes can peruse this list. Obviously, you can see there's not 43 bullets there, but risk management activities are, are some new records that are required. So this is not necessarily the PFEMAs and the DFEMAs, This is the actions to address risks and opportunities to the business, the issues, the interested parties, some of the more business risks that a company faces, not necessarily the product design and production risks. Employee competence and training, there's a lot more robustness that's around employee awareness. Changes to production methods, there's some new records that are required there. So again, feel free to peruse the list with your eyes. Obviously, it's not the exhaustive list of all the requirements, all the records that are required, but basically in the end of the day, there is 43 records required for an IATF 16949 quality management system. Some examples of some key performance indicators. Again, KPIs were a large part of the TS standard, so KPIs in and of themselves are not new. But one of the differences is they, they want to see KPIs now for all of the processes, not just production, quality, and product-related things. They would like to see some KPIs on business processes as well as production, quality, and product-related processes. Okay, so again, feel free to, to peruse that list with your eyes. There's not a specific number of KPIs required by the IATF standard, so, you know, the sky's the limit. Typically, you know, I would recommend at least 25 to 30 KPIs, but I've seen some, some companies go up to 40 and 50 KPIs. So that's the 10-minute overview of the standard, the philosophy of the standard. I believe we have a poll question for the next section.

Yep. So just, I'll share quickly the two polls that we did right at the beginning of the presentation, which was, have you read the new ITTF standard? We had 59% of people said yes, and 41% of the attendees said they had not yet read the entire standard. So that's an interesting number. I maybe would have thought that more of us would have read the standard. I've read it, but it's definitely worth, worth going through, getting into those details. The second question was, is your company currently certified to the standard? And 68% said yes and 32% said no. So it'd be curious to know for those who weren't, who are not certified, why you're not certified yet, if it's something that's in process or if it's something that your company doesn't feel it needs. So we can discuss that towards the end of the talk. The next poll that we have here is, uh, is your company's quality management— sorry, is your company's quality manual a copy-paste version of the standard, or the alternative would be something that was more customized and tailored and built for your organization, taking into context your reality? So kind of curious to see how many of you copy-pasted the thing and how many actually transformed it into something that's very closely tied to your operations. And the, the third option there is that you don't have a quality management manual, which is a little bit scary, but hopefully the people answering that maybe aren't running the big auto suppliers or the big organizations. So let me close this poll. The results, I'll share the results right away. So we have 74% are saying it's not a copy-paste, which is good news because we certainly hope that people don't just copy-paste. But 21% do have a more or less copy-pasted version of the standard, and then 5% do not have a quality management. And then I think we have one more question— oh, sorry, no, I think that's the question we had for this portion of the talk, and I'll kick it back over to Michael.

Great. So just, yeah, I'm glad we did that poll question. Actually, that's very encouraging to me, the 74% of companies that have a customized quality manual. When I, when I get involved in a lot of companies with my clients, I see that it is just a copy and pasted version. So that was very, that was a very encouraging poll number. So for you, 74%, great, great decision. For the 21%, I'm gonna talk through the pros and cons and and what I, what I would encourage you to think about. So creating an effective quality management system starts basically with the quality manual. That is the foundation of a company. It's, it's your first impression to a customer because a lot of customers say, hey, send us your quality manual before we want to do business with you. So it's a first impression of your company. Your auditors are always looking at your quality manual. So it's an opportunity to put your best foot forward. In my professional experience, I believe at a minimum these bulleted items should be in the quality manual. What, what I see a lot when I audit companies and when I go to help improve companies' quality management systems, I see this idea of a copy and pasted standard where they take the standard, they copy and paste it, and everywhere it says the organization shall, it says our company must, or our company does, or they even put their company's name in it. So for example, McDay does XYZ, and, and basically they just say, well, this is what we do, but they don't give any information, any quantifiable information on the whys, the hows, the whos, the whats, the wheres. And so it's, it's, it adds a lot of burden to a company because the other problem is when you hire a new employee, and you, you bring them in for orientation and you hand them a 65-page quality manual, usually when I do polls and I interview employees at those types of companies, basically 90% of them admit to me they stop at page 5. They go to the last page, they sign that they read it, and they turn it back in. So it's not adding a lot of value. So the context of the organization, I believe, is important to have in the quality manual— who you are as a company, what value you add to the supply chain, you know, where your company's going, what direction you're going, what, what, you know, what makes you valuable, what makes you who you are, and why customers should use you. Corporate responsibility is required to be documented, so I encourage my clients to put that in the quality manual simply because why manage two separate documents when you can put them in one? I encourage companies to put their quality policy and a quality objectives table in their manual. Here's what I mean by a table. Anytime the standard has a bulleted list of generic requirements, I encourage my clients to create a table that they can embed directly in their quality manual, and each bulleted item has its own column. And so what happens is, you know, let's just take communication for example. The organization shall decide what they communicate, when they communicate it, who communicates it, how it's communicated, and to whom it's communicated. I put a column of information for each one of those bullets, and what it does is it makes your system both user-friendly and audit-friendly. It avoids a 45-minute conversation with an auditor because an auditor can look at the quality manual, can see the table, and can see that you adequately gave him information on how you conform to each one of those items. In the bulleted list. So that's what I mean by quality objectives table, because there are 5 bulleted items that are now in the new quality objectives section in the IATF standard. A roles and responsibilities table, you know, that includes the personnel who have start/stop authority, that includes management representative, that includes, you know, all of the— there's a large amount of bulleted lists in Section 5 of the standard, 5.1, 5.3 of the standard, and I translate that information into a roles and responsibilities table. I think the most valuable piece of information that I encourage my clients to input into their quality manual is that QMS to IATF bridge table. What that means is it's a, it's a table with two columns. The far left side column has every element number in the standard. Some companies actually put the name of the element as well, but I, I just put the number. And then on the right side, it's your process or your procedure or whatever documented information you have that addresses that specific element. And the reason I like it is twofold. One, if you're missing information in the right column, then you have a gap in your system. So if the right column is completely filled with document some type of documented information, a process, a procedure, a form, a record, then you know you've adequately addressed the entire standard. The second thing it does is it's a quick reference point to— it's a quick reference point to an auditor, either an internal auditor or an external auditor. Hey, I need to audit Section 6.1.1. What should I look for? Well, they go to this table, look at 6.1.1, and they see actions to address risks and opportunities procedure. Now they know I can go right to the actions to address risks and opportunities procedure to audit 6.1.1. The other thing I like to do is the standard now requires that you document in your system where specifically in your system your company addresses customer-specific requirements. So I add a third column in that table. And so for example, if your customer XYZ Motor Company says you have to do something special with calibration, and that document is called XYZ Calibration 1, then in your bridge table you would put XYZ Calibration 1 in the 7.1.5.2 section of the bridge. So it's, it's a way to accomplish multiple— it's a way to accomplish multiple requirements, to address multiple requirements in one shot. What I try to recommend to my clients is if there is one tool that we can use to satisfy 4 requirements of the standard, let's use that one tool rather than managing 4 separate tools for those 4 separate requirements. And the QMS to IATF bridge table is a very effective way to satisfy 3 or 4 requirements in one tool.

Michael, and then, yes, sorry, one question. Sorry to cut you off there, but we're just asking, do Do you have a— would it— do you think you'll be able to send out afterwards an example of this bridge table?

I might possibly be able to. I'd have to get permission from the McDay group first to see if they'd be okay with that. But yeah, thanks for jumping in because just so you know, I don't see the chats or the questions. So yeah, Jonathan, and you know, by all means, feel free to jump in anytime like you just did. That was helpful.

Well, we'll try and let's see what we'll work with Michael, see if we can send at least a sample of this bridge table. Later to the attendees, because I think it would be something that would be quite helpful for them to, to see.

Yep. Okay, great. So then basically the communication analysis and evaluation table. So now you can put more in this. This isn't a requirement of, well, this is all you're allowed to have in your quality manual. This is just the foundation, in my opinion and professional experience, of what I think is an effective content of a quality manual. Typically speaking, a quality manual is about maybe 16, 17 pages long. You know, if your quality manual is getting to be 30, 40, 50 pages long, it's, it's going to be burdensome for the people who are reading it. Okay, so that's the quality manual. So let's go to the quality policy. Okay, effective quality policy. So quality policy is a hot-button topic for me. I actually picked a fight on LinkedIn last night, two nights ago about it because people tend to think the quality policy is a waste of resources and is a burden, and they wish that IATF wouldn't require a quality policy. And so my defense to that, because I think the quality policy is one of the most important parts of the system, that's why it's second to the quality manual. A lot of times what I see in my clients is the quality policy is a fluffy, feel-good, slickly worded poster that gets hung up somewhere in the building when you originally get certified, and it's never to be looked at or discussed or talked about again. And when the auditor comes in and says, does your company have a quality policy? Everybody has been mindlessly trained to just point to the poster and say, it's up there, go look at it if you'd like to. In my opinion, that's very sad. An effective quality policy is— it should be wrapped up with the strategic direction of the organization. You know, this is who we are. This is what value we add. This is where we're going. This is what it's all about. It's a driving force of an organization. It can be used as a filter when making business decisions and critical decisions. It should be a rallying point for employee engagement. It's an elevator pitch for new business. You know, it's a picture of the organization's culture. And so it's very important to take a look at your organization's quality policy and ask yourself this question: is this just a slickly worded phrase that is posted somewhere so an auditor can get off our back, or is this quality policy driving the culture of our company? Who we are, where we're going, and what it takes to get there is the quality objectives. So I really encourage my clients to, to really think about their quality policy Interesting tidbit about IATF. This is the first time that any standard has actually done this. They've actually encouraged the annual review and revision of a quality policy, not just, oh, let's look at it for 10 seconds in management review. Yep, we read quality policy, we're all happy, because the quality policy should be evolving with the organization. As the organization grows and changes and morphs, as the market conditions change, as the client base changes and the customers change, your quality policy should be reflecting that changing in the evolution of the organization. A great quality policy must include the ability to set quality objectives. And a lot of times when I come into a company they have a very weak quality policy that's just satisfying the requirements for an auditor, and they have these 4 generic quality objectives. Yeah, we want to maintain 90% on-time delivery, 90% product quality, 90% customer satisfaction, and they've actually never changed their quality objectives in years. But effective quality objectives are company-wide, not department-specific, and they're also business-related. Not just product related. You have to have some product related objectives. I get that. And you have to have on-time delivery objectives. I get that as well. But it would be such more, so much more valuable to an organization to have business quality objectives, not just product and on-time delivery and customer satisfaction quality objectives. They need to be timestamped, okay, because now IATF is requiring these to be reevaluated every year. And they need to be measurable with specific goals. Typically speaking, I encourage somewhere between 8 and 10 quality objectives. I've seen 6 and I've seen them well done. So, you know, maybe I could say between 6 and 8, maybe between 8 and 10, but somewhere in that range. And these are also not your process KPIs. That's being managed separately. Under 4.4.1 and 9.1.3. So this is, this is quality objectives, not process KPIs. Process KPIs obviously need to be measured and evaluated, but they're separate from quality objectives. Processes. One of my— I think one of the best things that IATF and ISO got right. ISO 9001 technically was the one who got it right. This is the first standard where they finally, finally, finally separated processes and procedures. And we're going to talk about this for a little bit because this is extremely important. In the past, all the standards said processes and procedures are basically the same thing. They're interchangeable. Process, procedure, tomato, tomato, you know, potato, potato. Water, water. It's the same thing. It's just a different word, or it's just phrased differently. For example, I've seen companies who have a calibration procedure, and then a half an inch below the title calibration procedure, it says process owner. So is it a procedure or process? What didn't matter in the old standard if it was a procedure or process, they were interchangeable. ISO 9001:2015 has finally nailed it and got it right. A process and a procedure are two completely different things. And here's why it's critical that we get this right. In the new standard in 4.4.1, there are 8 specific rules that must be applied to everything that your company calls a process. So if you tell me you have 36 processes, I need to see how you applied all 8 rules to all 36 of those processes, and it will overwhelm you. It will be bloated. It will be, it will be very, very overwhelming. So it's very important that we get it right, that we limit the amount of processes we have, and we make sure that those rules can be adequately and effectively applied to them. So an effective process describes what the company does, not how it does, but what it does. They transform planned inputs into outputs. They have KPIs with goals to monitor their effectiveness. They have to adequately address all the applicable IATF requirements. They have to adequately address all the company's activities, departments. They have to, in my opinion, they don't have to be documented on a turtle diagram, But in my opinion, a turtle diagram is the most effective way to address and document processes, and they have to point to the procedures that support them. So 4.4.1 in the new standard says you have to pick the processes and you have to apply all 8 of these rules to every process. In 4.4.2, it says the organization shall maintain documented information that supports the operation of its processes. That is where the procedures come into play. So this is a cultural shift for many companies. The old standard had Level 1 was your quality manual, Level 2 was your processes procedures, Level 3 was your forms and work instructions, Level 4 was your records. That has now been shifted. Level 1 is now your processes, Level 2 are your procedures. Level 3 are your forms and work instructions. And Level 4s are the records. So let's talk about procedures.

So Michael, just before we jump to that, I think we have a poll on the processes just to get a sense of what people are doing right now.

Oh, excellent.

So let me launch that one. And the poll is, are your company's processes current? I'm changing the, the way I'm saying the question. Are the company's processes documented using turtle diagrams, right? Are your company's processes documented using turtle diagrams? Michael said you don't have to use turtle diagrams, you don't have to use turtle diagrams, but they can be quite helpful. So we're curious to know how many of you are using those. Um, so let me just give it 3 more seconds. I'm going to close the poll and I will share that result, uh, just so folks can see. So about half, uh, that's interesting. Half of the attendees are using turtle diagrams, and then some are anonymously admitting that they don't have any processes yet, so we won't hold them to that. All right, let me kick it back over to, uh, to Michael, and then we'll have one more poll, uh, once we're finished with the procedure section.

Excellent. Okay, so here are some examples of suggested processes. You do not have to word them this way. You do not have to combine some of them. You do not have to You know, this is just some examples to get you thinking. I'm not going to read the list to you, so you can kind of peruse that list on your own. But there are, there are a few places where the standard says the organization shall, so in other words, your company must have a documented process in this area. Every one of those phrases is represented in one of these examples. Okay, so if you use these examples as your processes, you would adequately address the few areas where the standard says the organization shall document a process on XYZ. So again, you can peruse that list there a little bit. This is where I get the idea from that a, a good strong IATF system, a healthy IATF system, should have somewhere around 10 processes. If you have 4 or 5, it's not going to be quite strong and robust enough. If you have 15 to 20, you're beginning to add burden to your system and beginning to bloat your system. Okay, so let's talk about— so here's an example of a turtle. And if you, if you look at this particular turtle that I've created, it's different than the ones that you would see on Google if you would Google turtle diagram or turtle tool. Typically speaking, in the turtle diagrams or turtle tools you'll see on the internet, The top left box says what, the top right box says who, the top bottom box says how, and the bottom right box says something else. But what I've done is I've created a Turtle Tool that adequately addresses 6 of the 8 requirements. I'm sorry, 5, 5 of the 8 requirements in 4.4.1. So for example, 4.4.1 says you have to determine the risks and opportunities associated with the process. That's in the top right box. You have to identify the responsibility and authority for the process. That's in the top right box. You have to determine the KPIs needed. That's in the bottom right box, etc., etc. The inputs and outputs are on the left and right. The middle box adequately addresses the requirement in 4.4.2. The organization must maintain documented information supporting the operation of its processes. So in that middle box are the level to procedures that support the operation of this specific process. The name of the process and all of the revision history is cut off on the picture. I apologize for that, but this is an outsourced control process, and that's why you have supplier selection and approval procedure, purchasing procedure, receiving verification procedure, etc., etc., etc. Okay. All right, so let's talk procedures. Effective procedures describe who does what and when it's done. If there is how-to, specific how-to information, it does not belong in the procedure. That belongs in a work instruction. One of the biggest weaknesses I see in a lot of the clients that I get involved with is their procedures are 10-page paragraph-based documents. Like, I was at a company 2 weeks ago helping them upgrade to the new IATF standard. Their calibration procedure was 16 pages long. And it was filled with contradictions. It was filled with— it was just, it was a mess because it had the whys, it had the whos, and it had the hows. It had everything all wrapped up in one, and the company was, was not doing well in the area of calibration. So an effective procedure describes who does what and when it's done, not how it's done, and it identifies a series of actions taken, you know, to complete something. It supports the operation of a specific process, and it highlights, you know, these things. So my opinion and professional experience, flowcharts are the best way to document a procedure. So Jonathan, if you want to throw that second one up, I believe we're going to ask that question as well. Yep.

So are your company's procedures in the format of a flowchart, some paragraphs, text basically, or do you not have procedures implemented yet. So kind of curious. I agree with Michael that flowcharts, uh, can be a lot easier to communicate, especially to new staff and staff who haven't been working in the industry or on a specific portion of the operation for many years. So flowcharts being visual often helps communication. All right, let me close this poll and share the results. So we have about half again, so 46% are using flowcharts. 54% have text or paragraphs, and then some do not— sorry, nobody doesn't have procedures yet. So that's a good sign, but only half are using flowcharts, which is an interesting result.

Yep. So a couple things that I would encourage the 50% not using them yet. Some of the purpose— one of the biggest purposes of procedures is not actually for your company, ironically, and it's sometimes it's counterintuitive, and I raise a lot of eyebrows sometimes when I say this. Procedures are actually more of a tool for an external auditor, a registrar auditor, a customer auditor, an internal auditor, to understand quickly and easily what your company does. You know, who does what and when it's done. And there, there, a lot of times I'll ask it, I'll ask an employee during an interview during an audit, I'll say, when's the last time you looked at your procedure? And they say, well, about 3 and a half years ago when I got hired. And the reason for that is the procedure doesn't have any how-to information in it. So once you understand that a procedure is more fit for an auditor, it's more of a tool for an auditor to come in and quickly and easily identify what your company's doing. It gives them a direction to go for auditing, what to look for, who to ask. It's it makes more sense to bring it over to a flowchart. Paragraph-based procedures are risky because usually if you read them from start to finish, there's contradictions in there. And usually there's a lot of pointing to other things in there. When you go look at those other things, it doesn't quite jive together. And when you have paragraph-based flowcharts and you hire new employees and say, hey, read this, you know, 8-page document because this is your procedure, It's very, very hard. It's not very user-friendly. So paragraph-based flowcharts add a little bit of risk and bloat to a system. Flowchart-based procedures make it more user-friendly and more audit-friendly. So as I've been talking, hopefully your eyes have been perusing that screen. You know, again, these aren't all an all-encompassing list. They don't have to be named this. Obviously there's not enough room on the screen to have them all listed. Typically speaking, a healthy IATF quality management system has somewhere around 30 procedures. In my professional opinion and my professional experience, I've seen somewhere around 30 procedures be a healthy point for procedures. Work instructions, that's a different story. You could, you could have hundreds, but procedures, Level 2 procedures, typically somewhere between, you know, 25 and 35 is a healthy level. Okay, here's again just an example. This is an example that I got permission from, from a company to share. Configuration management procedure and internal audit procedure, and you can basically see what the flowchart looks like. I'm not going to, you know, read the content of it, and I apologize that it's a little fuzzy and hard to read because the content isn't what I was hoping to show you. It was the concept to see how easy and how quickly it is to see who does what and when it's done when you pull out a 1 or 2 page flowchart. Okay. All right. So now let's move to implementing and improving the quality management system. Employee engagement. Employee engagement, in my opinion, is the third most important part of a system. The most effective quality management systems have a strong internal audit program, a robust management review, and engaged employees. So again, this comes from experience of both owning and running certified companies and implementing on behalf of clients and auditing. So getting employee input in determining the issues and interested parties in 4.1 and 4.2 is a very helpful way, because if you want to know if the company's got issues, I can tell you right now, you ask the employees, they're going to be able to tell you very quickly, oh yeah, we got issues and here they are. So top management shouldn't get into a room in a bubble and in a vacuum decide what the company's issues are. They should allow the employees to have some input in that because it will, it will give employee engagement and employee buy-in. Centering the culture around the quality policy I've already shared enough about that and the quality objectives. Having a strong internal audit training program— training is a weakness of a lot of companies that I go into for help. I see quarterly quality management staff meetings, things of that nature. Communication is extremely important for a strong, healthy system, and a lot of companies struggle with communication. Management mentoring program, professional development program, public performance dashboards, posting all of your KPIs in a public place for people to be able to see on a consistent basis, things of that nature. Semi-annual QMS staff meetings. I have one client that has an annual QMS awards luncheon. It is one of the strongest quality management systems I have ever seen in 15 years of auditing. And when I went around the company to find out why it was so strong, it was— they had an annual QMS Awards luncheon that all the employees always looked forward to and they had the ability to participate in. So again, whatever it takes for your organization, find creative ways to get the employees to buy in. The more employees engage in the system, the stronger the system. The more valued the employees feel, the more they're going to buy in. The more they're going to buy in, the more value they're going to add. The more value they're going to add, the more valuable they're going to be. It's a cyclical reciprocal process. Show the employees that the organization cares, bring them into the fold of the system, make them aware, help them know what's going on, encourage them to know what's going on, and your system will become stronger. Okay, internal audits. Implementing an effective internal audit program. First, you would either need to have comprehensive internal auditor training or you would need to outsource your internal audits. And the internal auditor competence is a new part of the standard that has been causing a lot of stress in the industry. And it's— that's probably the area where I've gotten the most questions from. Your internal auditors do not have to be certified auditors by an SAI or by some type of an accredited agency You do not have to have the same credentials as a registrar auditor. I just want to put that out there. I want to put that to death. That rumor is not true. Do they have to be trained? Absolutely, they have to be trained. Are there records needed for that training? Absolutely, there's records needed for that training. And is the training going to be looked at, and is the competency going to be looked at for the trainer and the trainee by the auditor? Yes, it will. But you do not have to have certified auditors in your company. Okay, the audit plan should be discussed and approved at management review. That is not a requirement of the IATF standard, but that is one thing that I encourage all of my clients to do for two reasons. One, top management is involved in creating the audit plan if it's discussed at management review. And two, they can't ever say, well, you know, if we'd have known we weren't auditing this much, you know, if the quality management system starts breaking down, they can't pass the buck. And they can't blame it on, well, we didn't know you were only auditing 3 times a year. If you'd have been auditing more, our system wouldn't break down. So they can't pass the buck and they can't blame something else if they're a part of approving and discussing the audit plans, the annual audit plans. You have to identify our objectives, scopes, criteria, progressively scheduled QMS, you know, full QMS. You know, the standard requirement is your full system has to be audited every 3 years. In my opinion, I think that's absolutely insane, and I encourage all of my clients to audit their entire quality management system every year. You're not required to, but I think it would be insane not to. That's just my opinion though. It's just opinion on seeing all the systems that I've seen over the years. Customer-specific requirement audits— some, some customers may say, hey, you know, we need you to audit this and we need you to audit this frequently. You must follow that. If your customer has more rules on auditing than the standard, you are required to follow your customer's rules. You have to do product audits and manufacturing process audits. Same thing, manufacturing processes have to be audited. Every manufacturing process has to be audited on a 3-year cycle. Okay, so those are some tidbits about internal audits, and we'll talk a little bit more about how you can audit in a little bit. Management review— conducting an effective management review. I recommend one annual management review. Now I get myself into some hot water every once in a while with some people who don't— or struggle with that. Here's what I recommend doing. If you tell me your company has a management review, I am required to audit it. I'm required to see that you address the inputs, the outputs, the discussions. I gotta look at everything. I, I gotta dig through the records, okay? So that's why I don't recommend having monthly or quarterly management reviews. What I do recommend is having monthly or quarterly QMS staff meetings, and you can talk about everything that's required to talk about management reviews. You can talk about the inputs, the outputs, but I can't audit you to it, and I can't look for the records of it because you didn't call it a management review. And we're going to talk about what the management review includes in a little bit. An effective management review is, is more of a presentation, discussion, decision-based meeting that doesn't chase rabbit trails. It's basically someone presents information to top management on all of the inputs, top management discusses the information that was presented to them, and collectively makes decisions based upon upon the discussion. One of the biggest differences between TS and the IATF version of management reviews is in TS you were allowed to look at snapshots. You were allowed to look at information from one period of time. Now you're required to look at trends over a longer period of time. For example, if our customer satisfaction is at 95% in 2014, we could pat ourselves on the back because our goal was 90%. But in 2015, we were at 92%. In 2016, we were at 91%. In the old standard, we were only required to look at the fact that, hey, in 2016 we were at 91%, we did a great job. But now we're required to look at the overall long trend period, and we're required to say, yeah, that's great, we're meeting our goal, but this is our third year of decline. What's going on? And so the trends analysis has really become more valuable of a requirement than just looking at snapshots of information. There are 23 specific topics that are required to be included in management review, and there's 3 categories that are required to generate actions. Okay, Jonathan, do we have any questions for this section?

Well, we have a lot of questions for a number of the sections. And I know we're already at 11 AM and we, we said we would end around now. So I, I just want to say what we're going to do is go through these questions. We want to make sure we address everybody's questions. It's a very complicated subject that's affecting a lot of important companies. So Michael and I will stay here as long as necessary to answer all the questions. Many people probably have to leave for meetings. What we're going to do is we're going to compile the questions and send out the responses by email along with the slides, the video, and some additional resources. Um, but just before some of you leave, just as a quick summary, uh, mnemonic, we're going to be doing a demonstration tomorrow of the internal auditing tool to do your internal audits, uh, around 16949. And certainly if you have questions, uh, and concerns about your management system and would like help, uh, Michael and everybody at the McDay Group can offer a whole, a whole suite of services. They have years of industry experience, and they can really help you get ready for certification or for an audit or for implementing it for the first time. So as a summary, that's where we're at. Michael, feel free to add anything about your group and, and the services that you offer, and then we can dive into some of these questions.

Yeah, that's a great— it was a great time frame because technically we only had 2 slides left Pneumonic slide, which, you know, everybody's kind of heard already about that Pneumonic offers auditing software, which I personally use and love it. And yeah, our, the McDay Group is here for you, www.mcday.com. Shoot me an email, you know, go to the website. Yeah, but instead of kind of doing a sales pitch here, I'd rather start shooting some of these questions out, Jonathan.

Great. So we have, we have a lot of questions. We might be here for a little while, Michael. Let's see what we can get through. I'm going to address these questions purely in order so that there's no— and they were coming in throughout the presentation. So, so some of the questions will address earlier parts of the presentation. The first question, and I'll let you address this, Michael, is ISO 9001 does not address preventative and is replaced by risk-based thinking. As per 6.1.2.2, the standard requires preventative action to be addressed There appears to be an anomaly. Please explain. So this question's coming from Kazi Rao, and, um, I, I believe that, uh, he's looking for, uh, he or, or she, I apologize, is looking for clarification on preventative action and risk-based thinking. I'm not sure if you think about that, Michael.

Yeah. Yeah, sure. So, uh, yeah, a couple things. Uh, ISO 9001 did take out a few things that some of the other industries like the aerospace, the medical, and the automotive industries didn't like that they took out. So ISO 9001 did take out the requirement for preventive action, and IATF said, whoa, whoa, whoa, you know, we're not okay with that, you know, let's, let's put it back in. But they did put it back in slightly differently than it was in the old ISO standard. So in the old ISO standard, corrective action was responding to a nonconformance, preventive action was preventing the potential of a non-conformance. Now what they've done is they've kind of said, okay, let's, let's pull it back in. ISO took it out, IATF, let's pull it back in, but let's morph it a little bit. What they're looking for is they're looking for companies to not necessarily predict non-conformances, but to predict issues that could hurt the company, to predict what interested parties have, what requirements they have that could hurt the company, and to take action to prevent those things. So for example, okay, since automotive is one of the largest industries with, with unions, I want to use that as a tangible example because sometimes I don't like to answer questions with information. I like to answer them with examples because it connects better with people. Okay, let's say that we know we have a union and we know the union contract is up in January. A preventive action to, to, to help mitigate the potential issues and bad things that could happen from a union strike would be to ramp up production 6 months before the contract is over and to hold safety stock of parts and for a, you know, maybe hold 2 months worth of safety stock for parts. That way, if the unfortunate situation happens where there's a strike, your company can continue to ship product to a customer and it does not negatively impact the customer. So you've identified a potential issue, a union strike, and you've addressed it with a preventive action to do that. So that's just one of 500 examples I could share, but that's what they're looking for is you are looking to identify things that could hurt your company, things that could hurt your customers, and you're saying now that we know this particular issue could hurt us or hurt our customers, what are we going to do to prevent it from happening?

Great. Yeah, I think that example really illustrates what the standard is trying to get at. All right, the next question is from Deepak Dave. And his question is, can the interested parties be better understood by key stakeholders' interests and expectations? So let me know what you think about that, Michael. I think he's asking if the interested parties could be better understood as stakeholders' interests and expectations.

Yeah, stakeholders is a common word that I'm hearing. People translate interested parties into stakeholders. I'm not quite sure how to specifically answer the question, so what I'll do is I'll share a couple examples of some that a lot of people have not thought of yet, but I've thought of them for them. So for example, interested parties— what most companies are doing is they're just kind of checking the box by saying our customers are interested parties, our employees are interested parties, and our suppliers are interested parties, and they're checking the box and they're moving on. They're technically passing their audit by doing that, but it's not adding value to the company. I know a small machine shop that unfortunately actually went out of business recently because they didn't own their building. They've been in the building for 20 years. They renew their lease every 5 years. Came up to renew their lease again, and they said, hey, Mr. Landlord, it's time. We want to do another 5 years. And the landlord said, You know what, I got bad news for you. I'm actually gonna be using the building for my son. He wants to start a business. He just graduated college, get out. Company went out of business. They went under, 23 people lost their jobs because they didn't recognize that their landlord is an interested party. They didn't recognize the requirements of the lease. They didn't recognize the risk of the landlord saying no. They've been, you know, they've been in this building 20 years. There's no way that they the landlord would say no to renewing. They never predicted that particular risk with that interested party. I've seen companies struggle where, you know, a regulatory agency changes a rule, and now, you know, a regulatory agency says if you want to have 55-gallon drums of this particular chemical in your building, you have to have 4 new fire escapes. And now they have to spend $65,000 renovating their building but they never thought of that because they didn't look at that interested party. So interested parties are— this is how I would define it— any entity that could knock on your company's front door and say, if you want to stay in business, you have to do this, and you would be forced to say, okay, we're gonna do it. That's an interested party. Mm-hmm.

That's, that's, that's a very good point. Um, all right, we've got a lot of questions. We're going to try and move through these. Um, the next one is coming from Theodora Pedias, and the question is, are all identified— excuse me— are all identified processes key, or can we determine which are key after we have identified all the processes? What is key in quotation marks? So how, I guess, how do you define which processes are key and which ones aren't? And can you determine that after you've identified all the processes?

Yeah, so, um, 4.4.1 is the section in the standard that says the organization shall, you know, determine the processes needed for their quality management system. Unfortunately, IATF did force a few processes, uh, that you must have. And it's in those areas it says the organization shall document a process for this, you know, like design and development, for example. So what, what you do first is go through the standard, and everywhere that the standard says, sorry, you must have a process for this, right there we already automatically know, okay, those are some key processes we have to have them, unfortunately. Sorry. Then after you get those, you have to look at your your company. How large is your company? Is it multi-site? Is it single site? 3 shifts, 1 shift, 100 people, 500 people? How many departments do we have? And you have to identify, to successfully, effectively run this company and adequately address all the requirements of the standard, we feel that we need this process, this process, this process, and this process. The beauty of it is you get to pick. An auditor cannot come in and say, well, I think you should have that process and you don't, that's a nonconformance. And I don't think you should have this process because it doesn't make sense to me, that's a nonconformance. So as long as you've addressed all of the requirements that say you must have a documented process for this, above and beyond that, it is completely your company's decision, right?

That makes a lot of sense. So the next question I have here is also from Theodora, and the question is, we require risk management activities. Do we need a documented process for how we assess risk, or do we only need to show the results of the risk assessment?

That is a fantastic question. Excellent question. In my professional opinion and experience, I recommend companies to document risk management activities. Not all of them are required to be documented. So first, the answer is no, not all of your, not all of your risk management activities are required to be processes or to be documented, but they all are required to be audited, and they're all required to be discussed at management review. The effectiveness of actions taken to address address risks and opportunities is a required discussion point at management review. So if you're not documenting them, then you're, you're at risk because your auditor is going to have to have a lot of conversations with you. And anytime you got to talk to an auditor a lot, it gets ugly. And you're not— you're going to have trouble with your management reviews because people are going to have to rely on their memory to evaluate what the company's done with risks. So what I personally recommend is an actions to address risks and opportunities procedure, a level 2 flowchart that addresses the requirements of 6.1.1 and 6.1.2, and it points to the use of a risk matrix to identify the risk and categorize the complexity, you know, the level of the risk, and only take action on risks over a certain threshold. That's what I recommend.

Perfect. Makes a lot of sense as well, um, and allows people to focus on the high-risk activities and the things that really can impact their business. Um, so there's two questions that are quite similar. I'm going to merge them. They're questions from Patricia Phillips and Mitch Brinkham, and basically they're both asking, is there a complete list of all of the auditable elements, the specific requirements, the 42 documents, and 43 required records. So do you, or do you know of somewhere where there's a comprehensive list of all of those things that they can, that people can easily access and use?

Yeah, typically, uh, if, if you would Google, uh, you know, if you would Google it, there's a lot of people who have taken the time, uh, you know, to actually like, you know, make an Excel spreadsheet, uh, for example, so to speak. I have personally not done that, you know, mostly because I've been working with these standards for so many years. It just becomes second nature to me. But yeah, I bet you if you Google it, you would probably find the, you know, a document like that. The only hesitancy I would have with that is you're trusting somebody else's research, and there are a couple fuzzy gray areas in the standard that could be misinterpreted unintentionally. And so to take that document and then run with it and implement around it is a little dangerous and risky. One of the reasons I don't provide that for my clients is a risk of allowing them— a consultant to be a part of your system is organizational knowledge. The consultant is the expert in the system, and then the consultant leaves because he or she doesn't work for the company, the auditor comes in and can discern that the company doesn't really know the standard well or their system well. And so I don't create those specifically because I force my clients to actually dig into the standard, read it for themselves, and pull that information out for themselves because their system will be much more effective because of their level of knowledge, not, not because I'm knowledgeable.

Yeah, I think definitely working your way through anything, whether it's this quality management system or something else, may help you read— sorry, helps you learn and really internalize the intent of the different requirements and the different parts of the standard.

Now, I would— let me follow that up real quick though with one more thought. If you do buy the electronic version, you can type in the find search box the word shall and you can scroll through and see everywhere that the word shall shows up, and that's where they get the 351 requirements from. And you can type in the word process and, you know, do the same thing. So, so it's not like you have to read it and hopefully you retain every— you can use the search feature if you buy the electronic version of the standard. So, so that's a way you can kind of meet in the middle. Don't read everything word for word and try to write it all down or memorize it, but at the same time, don't rely on somebody somebody else's research.

Right. All right. The next question, also from Theodora, and it's about roles and responsibilities. So her question is, how are people documenting the roles and responsibilities? Are they using an organizational chart, a list of responsibilities, using the job descriptions? What, what have you seen in the industry, and what would you maybe recommend in terms of identifying those roles and responsibilities?

Okay. So what I've seen in the industry is org charts. Which I'm not a big fan of. I've seen job descriptions used, which I'm a fan of job descriptions for a different reason, but I don't like to use them for roles, responsibilities, and authorities in 5.1 and 5.3. I use job descriptions for 7.2 and 7.3. And, and I've seen, I've seen people post things, you know, through workplace signage. But the one that I like the most and what I recommend and what I employ implement with my clients is that table in the quality manual. And on the left side of the table is the position. I don't put names, you know, I put positions, you know, because they're, you know, employee turnover. And then the next column is the bulleted list of what they're responsible for and authority. And I take that bulleted list right from the standard. That way there's no misinterpretation of it. That way there's no— I take requirement of the organization shall define somebody to do XYZ. I put XYZ on the right side of the column— the table. I put the position on the left side. So I recommend a table in the quality manual.

Perfect. So we have— so there was a request here for the showing example, that bridge table. We're going to try and send a sample out about after the talk. And— but there was a question just to kind of briefly mention the columns again that were in that bridge table. I think that was quite an interesting subject and sounds like a very interesting tool. So maybe, Michael, if you could just go through quickly, what were those columns in the bridge table that you were proposing that companies use?

Okay. So the left side column, the far left column is every element in the IETF standard, you know, 6.1.2, 7.3. So, you know, every element in the standard is down the left side, the left column. The middle column is the customer-specific requirements that— where and where they fall into the system. And then the right side is your documented information that addresses it. So it's either your process, your procedure, or a form, work instruction, or a record. Is on the right side.

Perfect, great. Yeah, that's quite helpful. So another question here from Thomas Bérivaud, uh, is for a multinational project or a large corporation, can the quality manual, quality policy, and quality objectives be developed at the corporate level and be common to all sites? So, so if you're a big, big company with lots of sites in multiple countries, can you one quality manual, quality policy, and quality objectives developed at the corporate level?

Yes, the answer to that question is yes. One of the other things that I specialize in is what's— what we call on my side of the industry global quality management systems. Not global as a sense that they're in different countries, although they can be, but global as in there's multi— there's multi-sites, there's multiple sites in different locations under one IATF certification and under one quality management system. And so the answer is yes, corporate-wide you can have one quality manual cover all your sites, you can have one quality policy cover all your sites, and you can have quality objectives cover all your sites. Now the quality objectives, the way that each site generates their data might be different as long as the end result supports the quality objectives. So one site might generate data on a Pareto chart, the other site site might generate data in an ERP system, the other site might generate the data through an SPC, as long as the end result of the data supports the overall quality objective. But yes, you can have one policy, one set of objectives, one quality manual that covers all of the sites. I actually encourage that. And then if you want site-specific goals and targets, they would be covered under 9.1.1 9.1.3 in the standard, they wouldn't be covered under quality objectives. Perfect.

So another question here from George Hardy, which is, what about showing risks within the turtle diagram? So let me know if that question is clear enough for you, Michael.

Yeah, so, so what, what I do is the top left box of the turtle diagram is, is the risks that are associated with that process. So you identify, you know, some high-level and make it value-adding. I mean, technically speaking, you could identify 100 risks. I mean, there's risks everywhere. Every time you breathe, there's a risk. So make it value-adding, you know, 3 or 4 major items that could be a, you know, legitimate risk to the process. And then what I would do is follow whatever procedure you use to address those risks. So in my example, what I try to do is is I have a client doing actions to address risks and opportunities procedure. And so that procedure points to the use of a risk matrix. So you take the risk from the process turtle, you put it into the risk matrix, and that risk is, is evaluated against 6 or 7 categories of impact, and a priority color is determined. Green, no action required. Yellow, monitor the risk for a specified period of time. Red, take action to mitigate the risk and document what action you took. And so yeah, I put the risks on the top left box of the turtle and then I flow them through a risk matrix.

Perfect. And so while we're on the subject of turtle diagrams, another question from Theodora here. And, and the question is, so we cannot use a flowchart in the middle box of the turtle diagram? So I suppose Theodora's question is, is can you insert a flowchart within your turtle diagram when you're dealing with the processes and procedures?

No, I mean, what's the— so the technical answer is yes. There's no requirement in the IATF standard of how a process needs to be documented or should be documented. My opinion though is I wouldn't put a flowchart in the middle box of the turtle. I would just point to the level 2 flowcharts. But by all means, you, you have all the freedom in the world world. If you find a different way to document, to point to the procedures, or to document the middle of that turtle diagram, the sky's the limit. Whatever your creativity can imagine up is acceptable, as long as at the end of the day the process addresses 4.4.1 and 4.4.2 in the standard.

Perfect. So I have another question that's a bit similar to what we discussed earlier on about identifying the risks and the process. So, but maybe we'll just repeat the question and answer it quickly to make sure that we don't miss anybody's question. The question is, do we have to have a process and show the activity that led to the final list of risks, or is just having that final list of risks acceptable under the standard?

Yeah, correct. You don't have to have a process that you're— that you're a documented process that you're showing to follow to find the risks. And technically speaking, depending on how you interpret standard, you're not even required to document your final list of risks. But it would be very unwise not to, and it would add a lot of burden to your system not to. So the way you identify risks is, is totally up to you, and the sky's the limit. Use your creativity, use your imagination. You don't have to tell me as an auditor how you identified the risks, but once you do identify them, it is really in your company's best interest to throw them through some type of a risk matrix, and then that risk matrix becomes the documented information about the risks.

Perfect. So another question here from Gulnaz Mardanova, and the question is, what's the difference between a process description and a procedure? Could you please provide an example? So I think they're just looking to get a little bit more clarity on what's the difference between process description.

So, okay, so a process is what your company does. So for example, let's say we have a product realization process. The turtle diagram tells us what the risks are with product realization. The inputs are a customer or orders a part. The output is the delivery of that completed part to the customer in conformance to the requirements. So the input is a customer order. The output is a delivered part. The middle box, the procedures that you need to take the customer's order and deliver the part is you need an order review procedure so you can review the order correctly. You need a purchasing procedure so you can buy the raw materials. You need a receiving inspection procedure so you can inspect the raw materials when they come in. You need a machining procedure so you can machine the product with the raw material. You need an inspection procedure so you can inspect the product after it's been machined. And you need a shipping procedure to ship the product to the customer. So the product realization process takes the input of a customer's order and output is the delivery of the part to the customer. But there's no possible way that one process could adequately tell us who does what and when they do it to get from order to delivery. And so in the middle of that process, we have all those procedures: order review, purchasing, receiving, production, inspection, shipping, etc. And so the procedures tell us how we actually accomplish taking the order and delivering a part. Who does what and when they do it is in the procedure.

Great. And so while we're on the, on the subject of processes, one question here from, coming from Kazi Rao is, What, in your opinion, is the best documentation method for a process?

So the turtle tool, in my, in my opinion, my professional experience shows that a turtle tool is the most effective way to document a process. Some people use, some people use SIPOCs, but, but the SIPOCs only address 2 or 3 of the, of the rules, where a turtle addresses 5 of the rules. So, but some people use a SIPOC, but I prefer a turtle.

Great. So I have a question for Patricia. I think we answered it, but, but the question was, Do you have an example of a flowchart procedure that you can share with us? I believe you put a couple of those up on the slides earlier.

Yeah, let me just go back and— yeah, there you go.

So those— and we'll be sending out these slides after the presentation, so you'll be able to take a closer look at this procedure, which is admittedly a little bit difficult to read on the screen. But that would be an example of a flowchart procedure.

Yep, correct.

Alright, great. We have a question here from Aaron Ham who's asking, internal auditor training must show technical competency of the area they are auditing. How do you show this? How do you show that an internal auditor has the technical competency for the area that they're auditing?

Okay, so let's, let's unpack that a little bit first. What I, what I recommend first is some, some type of internal auditor training from, from a company that actually audits. A lot of times you'll get internal auditor training if you go to like the big names in the industry, because, you know, people tend to think brand, brand name means something. And so they go to these large organizations that provide these trainings at hotels all across, you know, the world. But a lot of times those organizations haven't— they don't really audit. They're not auditing organizations. They're, they're informational training organizations. So my first recommendation is to get auditor training from people who actually audit, and, you know, since we're here, as a plug, McDay offers internal auditor training and we audit. Secondly, what you would want to do is make sure that there's a training provider who also provides an aptitude quiz or an aptitude test along with that, because that The answers to that aptitude test is going to be part of the record that shows you have, you know, you have the competence to do auditing. For the actual technical knowledge needed for— with a specific question, I like to use a resume. If you are going to select internal auditors for your company and have those auditors trained, A, if they already have a resume, That needs to become a part of the audit, the training record. If they do not have a resume or if their resume was not written well enough to show technical competence in their area, help them write a new resume. And the point of that resume would be a record of competence in that technical area. So the external training record along with the resume of competence would be together what you would use to show a registrar auditor this person has the ability to be an internal auditor for this area.

Perfect, that makes a lot of sense. Again, documentation, documentation, documentation is key here. So a question coming from Randy Paul, and the question is, uh, process efficiency concept is not new to the automotive standards. But is now a separate item in management review. Could you provide some examples of efficiency metrics for items such as sales, HR, information systems?

Okay, it's a great, great question. So I'll do a couple. I recommend a management commitment and planning process. It's not a required process in the ITF standard, and it covers Section 5 and Section 9 of the standard. And so how do you know this management commitment planning process is effective? Well, first what you would need to do is you need to identify what procedures are involved. So in the management commitment planning process, I involve management review procedure, actions to address risks and opportunities procedure, I have a managing the company's context procedure. And so what, what do those procedures do? Well, first let's take management review. Let's say the company says 'Cause this, this happens to me a lot. Let's say the company says we're gonna have management review in January and July, and the actual management review happened in March, and the next management review happened one day before the registrar audit because they forgot to do the management review in July. Is that process working effectively? No, it's not. Well, how would you be able to capture that? Well, one way you would be able to capture it is on-time completion of management reviews. So that would be a new indicator that you would be tracking. You, you have a management review scheduled. Did you have it on time? Another thing that I commonly see with management review is top management will get together. They'll have a 3-hour management review. It's really awesome. It's great. It's documented. The records are amazing. They did— they made 7 decisions. We're gonna do these 7 things. 7 things based upon this management review, and we want all 7 of these things done by the third quarter. Well, the fourth quarter comes around and only 3 of the 7 things have been done and the other 4 have been forgotten about. Is that process working effectively? No, the management commitment process is not working effectively. So how would we see that? Well, we would see that by tracking the completion, the on-time completion of management review action items. Okay, so that's some example from Azure Review. So sales, for example, you know, if you have, if you have some type of a sales process, your company is probably already tracking the data for the sales personnel to determine: A, do we want to keep them employed? B, do they deserve a bonus? You know, do they have a quota? So if you are, if your company already has sales quotas in place, you could just roll them up to the effectiveness of the sales process. If all of our sales guys and gals are meeting their quotas, our process is working effectively. Some people do a quote win-loss ratio. You know, we want to win 70% of all our quotes, and if we're winning 40% of our quotes, our sales process is not working very well because we're not winning enough jobs. If we're winning 90% of our quotes and the industry baseline is 70%, our salespeople might be giving inaccurate information to just win sales jobs. You know, where they're telling them 2-week lead time when it really takes 8 weeks. So you can use quotas, sales quotas, you can use quote win-loss ratios, things of that nature.

Perfect. So just to come back to a question you recently answered about the technical competency of the auditors, one question or a clarification maybe from George Hardy is, can we not use 19011 as a guide to auditor competency?

Yes, for the ISO 9001 version you can. Unfortunately, the, that particular standard doesn't address product audits and manufacturing process audits, and because the standard, the IATF standard goes above and beyond the ISO 9001 standard, your ISO 19011 is only a guide to help get you moving in the right direction. The IATF auditors will be expecting more than just 19,011.

Good. Yeah, that's definitely good to know, um, that you have to go above and beyond that. Um, so we have about 4 or 5 questions left, uh, and again, we're going to send out the slides. So everything you've seen on the screen, you'll get a copy of. We're going to send out the video and a transcript of this presentation, the Q&A. So you'll get all that later and and you're welcome to share it internally at your organization and share it frankly with anybody you like. If you want to post on LinkedIn, that is always appreciated by, uh, Michael and by myself. Um, one question here coming from Rizwa Khan Patan, um, it's a question that we've dealt with at Mnemonica a fair bit is, uh, can you explain how to comply with requirements for product safety?

Yeah, that, that would probably be a webinar all in of itself. That's, that's a tough one because that is such a specific and customizable issue that from one organization to another is so drastically different, it would really be hard for me to add any value or even, even be able to address it necessarily. See, that now, that would be an example where that, that would be an example where somebody should reach out to the McDay Group through the website, and there's an email on the website to get some customizable and to get some specific tangible support in that particular area because It's, there's probably 600 different discussion points we could have over that. You know, because you've got everything from airbags and we look at the, you know, the Takata recalls and you know, you've got electronic counterfeit products in the electronic industry. There's so many issues that it would be hard for me to add anything valuable in this environment.

For sure, I agree there. I mean, it's a very complicated subject and it varies not only by subject, whether it's airbags or electronics, but also by jurisdiction that you're producing it, that you're selling it. We worked with a client who told us about, they had built a minivan or a sort of small minibus that they were selling into the Brazilian market. And between the time that they had finished all the design work, they'd finalized all this, specifications and the time it went to production, there was about an 8-month gap there. And when they went actually into production, the regulations around seat belt safety for Brazil had changed and they didn't pick up on it. And so they went into production, they started producing these minibuses, and then they were starting to hit the market, like hit the dealers, and they realized that all the seat belts were out of compliance. And so they had to stop the production line, go back, retrofit the things that had already been built, modify the production process. I think the cost estimate in terms of how much it cost them was, you know, was in the tens of millions of dollars.

Oh yeah. Yeah.

And that was something that was due to a lack of monitoring of the safety requirements, which are regulations in his—

which is an interested party.

Yeah. And so that's, that's something that Mnemonic works a lot on is, is just monitoring regulatory change. Around the world. We have teams in a number of different countries because it is such a moving target, and especially in the emerging economies, uh, places like Brazil, South Africa, China, the regulations are moving very quickly, trying to catch up with the more developed countries. Uh, so that's— it's a full-time job, and, uh, and mistakes can be very expensive. So you definitely want to invest in a system there.

What I would— what I would say, just to at least get— because I, I would like to at least give some type of of an answer. I would say that when you do identify these safety issues, the best place to address them is in your control plan. So, so my answer would be address them through your control plans. Jonathan's answer would be, hey, call Mnemonic, we're here to help.

Well, no, I mean, they have to be in your control plans as well, but, uh, the, the, the changing product safety requirements is probably where we can assist.

Right.

That's kind of what we do. But you're right. I mean, they have to be in your control plans, documented and explained and controlled for. All right. A couple more questions. This one from Thomas Matthew. Yeah, I'm just trying to— sorry, I'm trying to decipher the question. The only problem— sorry, Thomas Matthew, if you're still on the call, you asked a question I think that was referencing a comment that Michael made, but I'm not sure which comment you are referencing. So if you're still on the call, feel free to jump back in and just give me a little bit more information about— you're talking about a problem about when organization changes force you to change the quality manual, but I'm a little bit lost as to what it's referring to. So if you're still on the call, if you just drop a message into the chat window, we can go back to your clarification. Um, so a question here from Sherry Brewster, uh, What are the 8 rules that must apply to a process?

Okay, so I believe, I believe I do have them memorized. I'm working very hard on memorizing the standard. I had the 9001:2008 memorized. Okay, so the first one is you have to identify and address the risks and opportunities with the process. Now these may be not in the order that they're bulleted in the, in the standard, but you have to address, identify and address the risks associated with the process. You have to identify the inputs and the outputs expected from the process. You have to determine the criteria and effectiveness method measurements, the KPIs. You have to evaluate the processes. That's done at management review. You have to improve the process. That's just done over time from management review evaluating the KPIs. You have to identify the resources needed and ensure their availability. And you have to identify the responsibility and authorities with the process. And they are found in a bulleted list in 4.4.1 of the standard.

Perfect. So question here from— I'm sorry, Iones. Iones, I won't try and pronounce your last name. I'm not very good with Greek last names. But so the question here is, hello, in my company we are using Pestle tool to address risks and opportunities to satisfy the 9001:2015 requirement. We've only addressed known risks for which we have already planned actions to eliminate them and control. Do we have to do it again for all IATF processes, but this time get more deep, or, uh, will this put us on a possible risk of getting a non-conformance if we haven't planned any actions to resolve those risks?

So, okay, a couple things. One, if your company has— let me start again to say it a little bit of a different way. Some companies have already gone above and beyond the old TS 16949 requirements voluntarily because your company is allowed to do anything you want above and beyond the standard. So some companies have already already had a risk management system in place that addresses the risks with, you know, their processes, their issues, the interested parties. They just didn't know it was called issues and interested parties. They didn't know IATF was going to require it. They just did it on their own, and now they are inadvertently in conformance to the IATF requirements. So the only thing I would say is if you already have a risk management system in place. Either audit it yourself or have an external auditor like, like somebody like me, for example, audit your current system for a gap analysis. And so what I would recommend to that company is do a gap analysis on the risk management sections of the standard and look at what you're currently doing and what you've done in the past. And if it is already in compliance to the standard, you don't have to do a thing. But if it's not in compliance to the new IATF version of the risk management areas, then you have what we call a gap, and all you need to do is fill that gap. Filling that gap could just be checking off a couple new risk boxes, could be just changing the procedure slightly, or adding to the form, or whatever record you're using. But that's what I would do. Don't, don't reinvent the wheel just because IATF came along and said, hey, now you got to do all this. If you're already in conformance, don't change a thing, you're okay. And so that's another example where somebody could reach out to the McDay Group, you know, go to the website and shoot us an email, and we could even perform a remote gap analysis of that specific system in conformance to the new requirement, and we could give them a detailed report of, hey, this, this is, you know, this is what you've got, you're already in compliance, compliance, or here's a gap and here's what we recommend.

Perfect. Um, so I'm going to come back to this question from Thomas Matthew. He, he provided a bit of clarification, and he's saying he was referring to the responsibility matrix in the quality manual and was mentioning that the problem there is when the organization changes, you are forced to change the quality manual. So if you have your responsibility matrix right in that quality manual, and then there's a reorganization, which we know lots large companies love to do on a regular basis. They seem to think it's the solution to many of their problems. Then you have to go back and modify the quality manual. What are your thoughts on keeping that organizational matrix separate from the quality manual?

So it's, it's a cultural, it's a cultural question. One of the things I actually, I'm a little bit countercultural. If you haven't caught on to that by now, I'm a little different. I actually I like when companies put things in their quality manual that forces them to go back and make changes on a consistent basis. And here's one of the reasons why I like that. A lot of times when I go in to audit a company or when a company hires me to help them fix a problem or upgrade their system to another standard, the first thing I see is nobody has any clue what's in their quality manual. Nobody's read the quality manual in years. Sometimes people even have trouble finding the quality manual, and, and what— that's really sad to me because the quality manual, like I said, is the foundation of your company. It's the foundation of your system. So Thomas is correct that there's burden involved in the fact that if you put some types of information in, when the company makes a change, now you got to go back and revise it. So he is correct. It's an absolutely true statement. I just flip it on the other side, and, and I like that because I like when companies are forced to be in their quality manual consistently. But he's correct, you know, there are some information that changes a lot, and if it changes too much, then it should be a separately documented— it should be separate documented separately somehow.

Perfect.

And I would recommend not using names but using positions. You know, because names do change more frequently than positions do.

Yeah, for sure. That makes a lot of sense. Um, but I do, I do like the idea of having to go back and, and go into your documentation on a regular basis and not just do it 3 weeks before an internal or an external audit, which we see happen a lot of times.

Yeah.

Um, but, you know, forcing yourself to go in and work with it, um, kind of make sure you eat your own dog food. Um, So, uh, 2 more questions left. One from Karina Ramirez. Excellent webinar, she says. Thank you, Karina, and especially for Michael. Um, her question is, is it correct to implement layered process audit CQI 8 covering the clauses of IATF 9223 manufacturing process audit? So is it correct to use a layered process audit?

Sure, you can. When it comes to manufacturing process audits, the standard doesn't really have any, you know, you must do it this way or must do it this way or go this way or go that way. All they care about is that once every 3 years you audit all of the different manufacturing processes that are within your, your company. So some people, you know, some people use that format Some people just use a combination of their error-proofing and their product audit. Like, some people use a kind of a full— I've seen crazy approaches where somebody's used the error-proofing where they put their, they put their rabbits through and they're caught or they're not caught, and they use their product audits in the combination with an internal audit and a QA. And so it's really the sky's the limit on how you audit your manufacturing processes. But basically, I've seen companies take their control plans and they actually just watched the people on the line running the process, and they ask themselves, okay, if they do— yes, they do— yes, they're, you know, and then they, they interview particular people along the line. So some people do it through a control plan system where they, they look at the control plan and they make sure that everybody's doing everything according to the control plan. And so that's the beauty of it. You get to pick how you audit your process, your production processes. IATF kept their hands out of the hows in doing that.

Right. So the last question here, which touches on what you just discussed, but does IATF, does the IATF standard define the frequency of manufacturing process audits? Is there a definition?

Yeah, once every 3 years.

Right. And you mentioned No, I was gonna say that you mentioned earlier that doing audits in general, internal audits in general, every, every 3 years was a high-risk activity and certainly not recommended, but that is what the standard—

Yes, so all of your QMS processes have to be audited in their entirety, in, in their entirety, over a 3-year window. So I still think it's high risk, but that standard allows you to do it over a 3-year period.

Okay, perfect. And just on our end at Mnemonic, I mean, we've worked with a number of automotive companies implementing internal audit programs. And like Michael said, there's, there's a lot of different ways to do it. But what we've seen is, is the trick is to make the internal audits as helpful as possible and reduce the burden on your operations as well as if you're auditing your suppliers, for example, reduce the burden on the suppliers. We worked with one company where the suppliers were getting audited multiple times by different parts of their customer, which was the tier 1 supplier. So, they were auditing multiple times the tier 2 suppliers, driving them nuts and increasing their costs. So investing in, in a, in a tool, whether it's Mnemonic or another product, is, is really critical. I think there's far too many people still planning their internal audits with Excel and they're missing out on the ability to coordinate and to attach documents and evidence and just make it a lot clearer for the auditee, the people getting audited and the auditor, what is expected. Um, when's the audit going to happen? How much time is it going to take? So there's really a lot of opportunity out there to digitize a lot of this work and, and reduce the burden so you can get more audits done, target your high-risk areas, and make sure you're ready for those 3-year required audits. Um, all right, 2 more questions came in, and we did promise we'd address all the questions. Um, so from Patricia Lona, she's asking How should we document outsourced services in our quality management system, or how should we document outsourced services in our quality management? What have you seen on that front, Michael?

So I would agree that you should, and if you interpret the standard literally, it recommends it. Some people would say it requires it, some people say it recommends it, depending on your interpretation style. I would add that as another table in the quality management And that would be a good example of where earlier in the slide when I had those like 8 or 9 bullets of the quality manual, I had mentioned that your company could go above and beyond those and could do even more of those. So that would be a great fit for the quality manual actually for a table. Mm-hmm. Not, not necessarily to the depth of what particular vendors— you don't want to go that, that deep, but just an overall, hey, you know, we outsource plating, heat treating, you know, welding, or, you know, or whatever, whatever the services are.

Right. Um, so a couple points here from Thomas. Uh, he's saying that the, uh, the new standard really increased the amount of documentation that's required. I, I, I'll assume, Michael, that you agree with that, that the new standard has really increased the amount of documentation. Um, and then he's asking Should we have proof that we did a complete cycle of internal audits prior to the upgrade recertification audit?

Okay, yes. So that's a— that is a fantastic question. What you are expected to do is have a full quality management system audit, internal audit, to the entire IATF standard and a full management review prior to your upgrade audit by the registrar. That is extremely important. And we've seen companies go into— I've seen some of my clients have gone into their registrar audits without the entire audit, internal audit, and without the management review, and they are now struggling to get their certification. And that's why they hired me.

And so Thomas's point after that, and hopefully I interpret this properly, he's saying then we cannot have a 3-year cycle. So I guess he's saying that if we have to— if you have to do that full internal audit and the management review, then you can't necessarily stick to a 3-year cycle.

Well, yes. So what, what, what they would be— what they're looking for is there needs to be evidence in your internal audit that you have looked at your IATF 16949 system in its entirety and have audited to the elements of it. But then moving forward from there, you can start your 3-year cycle, right?

Perfect.

And that's something what I would do too, just to be safe, because there are like a hundred gazillion registrars out there and they're all drastically different, and a lot of them don't even follow the rules themselves. I would recommend, to be careful that I don't get myself in a tough spot, I would recommend everybody that's still on the webinar, or everybody who jumps on and listens to the recording of it to reach out to their registrar with that particular question, because so far the registrars that I've been dealing with have that requirement. But it wouldn't surprise me if some of the other registrar audit, audit companies do not. So it would be something that I would definitely tell you to contact your registrar as soon as possible and ask that question.

Yeah, and I think, you know, the point that we were discussing, Michael, before the call, which I think was quite interesting important is there's a lot of companies that get certified to ISO standards, whether it's IATF or another standard, and they really only do the bare minimum to get certified so that they can put that up on their website and provide it to their customers. And that's obviously— obviously we don't agree with that. It's really— the standard needs to be deeply embedded into your culture. It needs to be really respected. And there are certifiers out there who unfortunately will certify a lot of companies who don't— who shouldn't really be certified. Um, and we see that especially outside of some of the developed countries. And that's something that we've struggled with. Um, but just a point, you know, I think everybody on this call certainly believes that, or else they wouldn't be on the call today. Uh, but as, as we've seen in the industry, there's a lot of companies out there that really aren't necessarily, uh, certifiable. Even though they do get certified, unfortunately.

Right.

Um, and okay, well, Tom says that it's now, uh, clear, uh, thanks to your answer, Michael. So great. Um, and then, uh, the last point here Mike Swift made was that, uh, doing an internal audit every 3 years, uh, would be insane and ineffective for an organization, sort of like eliminating, uh, a quality manual. I think, I think you agree with that, Michael, that 3 years is, is way too long. Um, and the more frequent you do internal audits, definitely the better. And they don't necessarily have to do the whole standard at once. You can break it up, do different parts of your business, different parts of the standard, but keep everybody on their toes. I think, you know, that's the, that's the operating, uh, the, the, the, the thing that we recommend, certainly.

Great, great.

Well, I think that's, I think that's it. Uh, thank you to everybody who stuck around all the way till the end here. As you gone 2 hours instead of, instead of just an hour. We still have 60 people on the call from all over the world. So, um, we, uh, we really appreciate you taking the time to listen to Michael and ask all these great questions. And if you have any other questions for Michael, you can certainly be reached through the website at McDay Group. And anybody at Mnemonic can be reached through the website at Mnemonic. And tomorrow morning we're going to be doing a demonstration of the internal auditing software at 11 AM. So feel free to register for that. That one will— we will stick to 45 minutes. It won't go to 2 hours. It's a lot simpler than what Michael's been discussing today. But thank you to everybody. We'll send out the slides, the recording, and all the Q&A in the next couple days. And please don't hesitate to reach out to Michael or to myself.

All right. Thank you for allowing me to be a part of this, Jonathan.

All right. Have a great day, everybody.