ISO Quality Management Systems

Chapter 3
Process Approach, Systems Thinking and PDCA

Post Graduate Program in Total Quality Management
ISO Quality Management Systems   •   Post Graduate

Process Approach, Systems Thinking and PDCA

Introduction

ISO quality management systems are most effective when an organization is understood not as a collection of departments, but as an interacting system of processes. A process transforms inputs into outputs through activities, resources, controls and decisions. The process approach therefore shifts attention from isolated functional performance to the way work flows across organizational boundaries and creates value for customers and other interested parties.

Systems thinking complements this approach. It recognizes that processes are interdependent: changing procurement may affect production; changing inspection may affect delivery; changing sales incentives may affect customer complaints. The Plan–Do–Check–Act (PDCA) cycle provides the disciplined method by which these processes are planned, operated, evaluated and improved.

In ISO 9001, the process approach is closely connected with risk-based thinking, customer focus, leadership, documented information, performance evaluation and continual improvement. Together, these ideas provide a managerial architecture for achieving intended results rather than merely producing documents.

Learning objectives

By the end of this chapter, the learner should be able to:

  1. Explain the process approach and systems thinking in an ISO quality management system.
  2. Model processes using SIPOC, process maps and value-stream representations.
  3. Identify inputs, outputs, controls, responsibilities, resources, risks and performance indicators.
  4. Apply PDCA at operational, process, departmental and strategic levels.
  5. Critically evaluate process measures, interfaces and improvement actions.
  6. Design an integrated process-based response to a quality problem.

1. The process approach

A process is a set of interrelated or interacting activities that uses inputs to deliver an intended result. Inputs may include materials, information, specifications, people, energy, equipment or decisions. Outputs may be products, services, information, decisions, records or unintended consequences.

A process can be represented conceptually as:

Process approach showing inputs, transformation, controls, resources, outputs and feedback Inputsneeds, materials, data Processactivities and decisionsresources and controls Outputsproducts, services feedback, measurement and improvement criteria and controls
Process approach showing inputs, transformation, controls, resources, outputs and feedback
Figure: Process approach showing inputs, transformation, controls, resources, outputs and feedback

Figure: A process transforms inputs into outputs under specified controls and feedback.

The process approach requires managers to define processes, determine their sequence and interaction, establish criteria and methods, provide resources, assign responsibilities, address risks and opportunities, evaluate results and improve performance. It is not limited to production. Leadership, recruitment, purchasing, design, customer service, maintenance, auditing and strategic planning are all processes.

Process characteristics

A well-defined process normally includes:

  • a purpose and intended result;
  • a defined owner and responsible performers;
  • suppliers and inputs;
  • activities and their sequence;
  • resources and infrastructure;
  • controls, criteria and acceptance conditions;
  • outputs and recipients;
  • risks, opportunities and contingencies;
  • measures and records; and
  • interfaces with other processes.

A process owner is accountable for process effectiveness, but accountability does not mean that the owner personally performs every activity. Effective ownership includes authority to coordinate interfaces, establish measures and initiate corrective action.

2. SIPOC and process mapping

SIPOC is a high-level scoping tool whose name derives from Supplier, Input, Process, Output and Customer. It helps a team establish the boundaries of a process before detailed analysis. “Customer” includes the external customer and internal recipients of outputs.

SIPOC elementGuiding questionExample: order fulfilment
SupplierWho provides what the process needs?Sales, customer, warehouse
InputWhat enters the process?Approved order, stock data, address
ProcessWhat broad transformation occurs?Review, pick, pack, dispatch
OutputWhat is produced?Correct shipment and dispatch record
CustomerWho receives or uses the output?Customer, finance, carrier

SIPOC is deliberately not a detailed procedure. It is useful during process definition, improvement scoping, audit preparation and cross-functional workshops. Its limitation is that it can conceal variation, decision logic and delays. Those require a more detailed process map.

A process map displays activities, decisions, hand-offs, feedback loops and sometimes time or information flow. Common conventions include rectangles for activities, diamonds for decisions and arrows for sequence. The organization should use consistent symbols and provide a legend. A map should describe the actual process, not an idealized procedure; otherwise improvement decisions will be based on fiction.

When mapping, analysts should distinguish:

  • value-adding work, which changes the output in a way the recipient requires;
  • necessary but non-value-adding work, such as regulatory checks; and
  • avoidable waste, such as rework, searching, waiting, duplication and unnecessary movement.

A value-stream map extends process mapping by showing material and information flow, inventory or work queues, lead time, processing time and sources of delay. It is especially useful for end-to-end improvement, but it should not be treated as a complete representation of governance, risk or organizational learning.

3. Systems thinking and process interaction

Systems thinking examines relationships, patterns and feedback rather than isolated events. In a quality management system, the relevant system boundary may include suppliers, outsourced providers, regulators, customers, information systems and supporting functions.

Three principles are particularly important.

Interdependence. Processes share resources, information and constraints. Local optimization can damage overall performance. For example, purchasing the cheapest material may increase defects, inspection and warranty cost.

Emergence. System-level outcomes arise from interactions. Customer dissatisfaction may not be caused by one defective activity; it may emerge from sales promises, scheduling, transport variability and weak complaint handling.

Feedback. Measurement influences decisions, and decisions alter future performance. A target focused only on output volume may encourage overproduction or conceal defects. Balanced measures reduce this risk.

A useful distinction is between linear and systemic explanations. A linear explanation says, “The shipment was late because dispatch failed.” A systemic explanation asks why orders were released without confirmed capacity, why the system permitted incomplete addresses, whether the performance target rewarded speed over accuracy, and how customer information returned to planning.

Systems thinking does not eliminate the need for root-cause analysis. Rather, it broadens the analysis from immediate technical causes to contributing conditions, interfaces and governance choices. Tools such as causal diagrams, the five-whys method, failure mode and effects analysis, trend analysis and stakeholder mapping can support this work, provided they are based on evidence rather than speculation.

4. Process architecture and levels of control

A process architecture is a structured view of how processes combine to achieve organizational objectives. It may contain three levels:

  1. Strategic processes: direction-setting, policy, objectives, risk governance and management review.
  2. Core or value-creation processes: marketing, design, production, service delivery, distribution and customer support.
  3. Supporting processes: human resources, purchasing, information technology, maintenance, calibration, finance and document control.

The classification is contextual. Purchasing may be a support process in one organization and a core value-creation process in another. What matters is clear interaction and accountability.

For each process, a process profile should identify the following:

ElementPractical purpose
Purpose and scopeDefines why the process exists and where it begins and ends
Owner and rolesEstablishes accountability and authority
Inputs and suppliersSpecifies required conditions and sources
Activities and interfacesShows transformation and hand-offs
Outputs and customersDefines intended results and recipients
Criteria and controlsEstablishes conformity requirements
Risks and opportunitiesAnticipates failure and improvement potential
ResourcesIdentifies people, equipment, technology and knowledge
IndicatorsProvides evidence of effectiveness and efficiency
RecordsDemonstrates performance and supports learning

Controls should be placed as close as practical to the point where error can be prevented or detected. Prevention is generally stronger than relying exclusively on final inspection. Examples include validated software rules, supplier qualification, poka-yoke devices, competence authorization and controlled specifications.

5. Performance indicators and process effectiveness

A process indicator is useful only when it supports a decision. Indicators should have a clear operational definition, data source, frequency, owner, target or threshold and response when performance is unacceptable.

Typical categories include:

  • quality: defect rate, first-pass yield, complaint rate, conformity rate;
  • delivery: on-time delivery, cycle time, response time;
  • efficiency: resource consumption, productivity, queue time;
  • customer: satisfaction, retention, complaint resolution;
  • risk and resilience: overdue risk actions, supplier disruption, recovery time;
  • learning: competence completion, audit findings, implemented improvements.

A rate can be expressed as:

Rate = (Number of events of interest ÷ Total opportunities) × 100

The numerator and denominator must refer to the same period and population. The result is a percentage when multiplied by 100. For example, 18 late deliveries out of 240 deliveries gives (18 ÷ 240) × 100 = 7.5%. A lower late-delivery rate is preferable, but interpretation requires context such as product mix and agreed delivery dates.

Cycle time is elapsed time from a defined start event to a defined completion event. Processing time is the time during which work is actively performed. Confusing these measures hides waiting and queueing. A process may have 20 minutes of processing time but a two-day cycle time.

Measures should be balanced. A dashboard containing only productivity measures can encourage defects; a dashboard containing only compliance measures can suppress innovation. Leading indicators, such as preventive maintenance completion, should be considered alongside lagging indicators, such as equipment failure.

Measurement systems themselves require control. Definitions, sampling methods, data integrity, calibration and access permissions must be suitable for the decision being made. Automated dashboards do not guarantee valid information.

6. PDCA as a management and improvement cycle

PDCA is a recurring method for controlling and improving processes.

Plan. Define the intended result, understand requirements, assess risks and opportunities, establish measures, allocate resources and determine methods.

Do. Implement the plan under controlled conditions. Provide competence, information, infrastructure and operational controls. Manage changes and outsourced processes.

Check. Monitor and measure the process and its outputs. Compare results with criteria, analyze data, obtain customer feedback, conduct audits and review risks.

Act. Correct nonconformities, determine causes, implement corrective action, standardize successful changes and revise objectives or controls where necessary.

PDCA operates at multiple levels:

LevelPlanDoCheckAct
StrategicSet policy and objectivesDeploy strategyReview results and risksRevise priorities
ProcessDefine method and controlsOperate processMonitor indicatorsImprove or standardize
OperationalPrepare a taskPerform workVerify outputCorrect and learn
Improvement projectAnalyze problem and design changePilot solutionEvaluate evidenceAdopt, adapt or abandon

PDCA should not be reduced to a one-time project. The “Act” stage feeds the next “Plan” stage, creating organizational learning. Corrective action is stronger when it addresses systemic causes and verifies effectiveness rather than merely repairing an individual output.

Worked example: reducing order-release errors

An organization records 32 order-release errors in a month from 800 orders. The initial error rate is:

(32 ÷ 800) × 100 = 4.0%

The team maps the process and finds that incomplete customer addresses are accepted because sales and planning use different mandatory-field rules.

Plan: harmonize the data standard, add a system validation rule, train users and set a target below 1.5% for the next quarter.

Do: pilot the rule with one sales team for four weeks.

Check: during the pilot, 6 errors occur in 600 orders:

(6 ÷ 600) × 100 = 1.0%

The team verifies that the denominator includes all pilot orders and that no orders were excluded because they were difficult to process. It also checks whether the rule caused delays or workarounds.

Act: deploy the validated rule, revise the procedure, monitor the rate monthly and review whether errors recur in other fields. The improvement is not proven merely because the rate fell; effectiveness requires sustained results and examination of unintended effects.

7. Applied case: Northstar Medical Devices

The following is an illustrative case, not a report of a real organization.

Background

Northstar manufactures sterile components for hospitals. Its quality system contains separate procedures for purchasing, incoming inspection, production and complaints. Customer complaints have increased, although each department meets its local target.

Problem

The complaint rate rises from 1.8% to 3.1% over six months. Purchasing reports lower material cost, production reports improved output, and inspection reports that most lots pass final inspection. The organization initially proposes increasing final inspection.

Analysis

A cross-functional SIPOC identifies approved suppliers, material certificates, production specifications and customer requirements as inputs. The team then maps the end-to-end value stream. It finds that:

  • supplier changes are communicated late to production;
  • incoming inspection samples do not reflect the highest-risk characteristics;
  • production records a measurement in a local spreadsheet not visible to complaint investigators;
  • final inspection detects some failures but cannot prevent variation introduced earlier;
  • complaint data are coded by symptom, not by process or supplier.

A systems analysis shows that purchasing’s cost target and production’s output target unintentionally discourage supplier-development activity and additional setup verification.

Approach and solution

Northstar establishes a process owner for supplier-to-release performance and redesigns the process profile. Controls include risk-based supplier change notification, defined critical characteristics, verified measurement equipment, electronic traceability and a feedback loop from complaints to supplier review and process planning. Indicators are balanced: complaint rate, first-pass yield, supplier change compliance, critical-characteristic capability and time to close corrective actions.

The organization pilots the controls with one high-risk component. It uses PDCA: the pilot is planned from complaint evidence, implemented with trained personnel, checked through trend and audit data, and acted upon by standardizing successful controls and revising supplier agreements.

Outcome

After three months, complaints for the pilot component decline, but Northstar does not claim causality from the decline alone. It confirms that data definitions remained stable, no orders were diverted, and the improvement persisted across two subsequent months. The organization then expands the method gradually.

Learning points

The case demonstrates that final inspection cannot substitute for process control, local targets can create system-level dysfunction, process ownership must cross departmental boundaries, and improvement claims require reliable measures and verification of unintended consequences.

8. Governance, technology and contemporary practice

Process-based management creates governance responsibilities. Leaders must ensure that objectives do not conflict, delegated authority is clear, records are trustworthy and quality decisions are not overridden by inappropriate commercial pressure. Employees should be able to report risks and nonconformities without retaliation. Personal and customer data used in process measurement must be collected lawfully, protected and retained only as necessary.

Digital process mining can reconstruct actual event sequences from enterprise-system logs and reveal rework, bottlenecks and deviations from approved flows. Its results depend on event-log completeness, timestamp accuracy and correct case identification. Artificial intelligence may assist with anomaly detection, classification of complaints and prediction of process failures, but it does not replace process ownership or professional judgment. Organizations should address model bias, explainability, cybersecurity, access control, human oversight and validation before using AI for quality decisions.

Contemporary quality management increasingly emphasizes resilience, climate-related operational risk, supply-network visibility, remote work controls and sustainability. These themes strengthen, rather than replace, the process approach: each new concern must be translated into relevant processes, responsibilities, controls, measures and improvement cycles.

9. Challenges and limitations

Process models can become bureaucratic when they document every activity without clarifying purpose or risk. Excessive indicators create reporting workload and encourage gaming. Departmental ownership can remain nominal if owners lack authority over interfaces. SIPOC may oversimplify complexity; detailed maps may become obsolete; and PDCA can become ceremonial if checking is limited to confirming that a procedure exists.

Other limitations include unstable definitions, poor-quality data, hidden workarounds, excessive reliance on end-of-process inspection and failure to distinguish common-cause from special-cause variation. Managers should therefore validate models with the people who perform the work, observe actual practice, test data quality, review unintended effects and update controls when context changes.

Best practice is to begin with customer and stakeholder needs, define the end-to-end result, use the minimum documentation needed for reliable control, combine preventive and detective controls, balance indicators, assign real authority to process owners and treat audits as opportunities to test system effectiveness rather than document presence alone.

Chapter Summary

The process approach models an organization as a network of interacting processes that transform inputs into intended outputs. SIPOC establishes process scope, while detailed process maps and value-stream maps reveal activities, hand-offs, delays and feedback. Each process requires a purpose, owner, inputs, outputs, controls, resources, risks, measures and interfaces.

Systems thinking explains why local optimization can damage overall performance and why quality outcomes often emerge from interactions among processes. Balanced indicators, reliable data and end-to-end ownership are essential. PDCA provides a disciplined cycle for planning requirements and risks, operating under control, checking evidence and acting through correction, corrective action, standardization and learning. It applies from strategic management to individual tasks.

Effective implementation depends on governance, ethical data use, competent people, realistic process models and verification of sustained results. Digital tools and AI can strengthen visibility and prediction, but accountability, validation and human judgment remain indispensable.

Key Terms

Process: Interrelated activities that transform inputs into outputs.

Process approach: Management of activities as coherent processes and their interactions.

Systems thinking: Analysis of relationships, feedback and patterns within a whole system.

SIPOC: A high-level model of Suppliers, Inputs, Process, Outputs and Customers.

Process owner: Person accountable for process effectiveness and coordination.

Input: Material, information, resource or requirement entering a process.

Output: Product, service, decision, information or result produced by a process.

Process interface: Point where processes exchange inputs, outputs or information.

Value stream: End-to-end flow of activities and information that creates value.

Value-adding activity: Activity that changes an output in a way required by the recipient.

Control: Criterion, method or measure used to achieve intended results.

Risk-based thinking: Consideration of uncertainty, threats and opportunities in planning and operation.

Indicator: Defined measure used to evaluate process performance.

Leading indicator: Measure that signals conditions likely to influence future results.

Lagging indicator: Measure of an outcome that has already occurred.

PDCA: Plan–Do–Check–Act cycle for control and continual improvement.

Nonconformity: Failure to meet a requirement.

Corrective action: Action to eliminate the cause of a nonconformity and prevent recurrence.

Process architecture: Structured representation of an organization’s processes and interactions.

Process mining: Analysis of event logs to discover and evaluate actual process flows.

Review Questions

Short Answer Questions

  1. What is meant by the process approach in a quality management system?
  2. State the five elements represented by SIPOC.
  3. Distinguish processing time from cycle time.
  4. What is the role of a process owner?
  5. Why should process indicators have operational definitions?

Long Answer Questions

  1. Explain how systems thinking complements the process approach in ISO quality management.
  2. Describe how to construct and use a SIPOC and a detailed process map.
  3. Explain the four stages of PDCA and show how they operate at strategic and operational levels.
  4. Discuss why balanced performance indicators are preferable to a single productivity measure.
  5. Evaluate the limitations of relying on final inspection as the primary quality control.

Analytical / Application Questions

  1. A service process meets its response-time target but customer complaints are increasing. Develop a systems-based analysis using SIPOC, process interfaces and balanced indicators.
  2. Design a PDCA intervention for a process with a defect rate of 6% and identify evidence needed to verify sustained improvement.
  3. Construct a process profile for an outsourced activity, including inputs, outputs, controls, responsibilities, risks, measures and governance requirements.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the process approach?

A. Each department is evaluated independently without considering interfaces.

B. Activities are managed as interacting processes that transform inputs into intended outputs.

C. Quality is verified only through final inspection.

D. Documentation is treated as the primary measure of performance.

Correct Answer: B. Activities are managed as interacting processes that transform inputs into intended outputs.

Question 2

In SIPOC, which element identifies the recipient of a process output?

A. Supplier

B. Input

C. Output

D. Customer

Correct Answer: D. Customer

Question 3

What is the principal purpose of a process owner?

A. To perform every activity personally

B. To approve all organizational expenditure

C. To be accountable for process effectiveness and coordination

D. To replace the internal audit function

Correct Answer: C. To be accountable for process effectiveness and coordination

Question 4

Which PDCA stage includes comparing measured results with criteria?

A. Plan

B. Do

C. Check

D. Act

Correct Answer: C. Check

Question 5

An organization has 18 late deliveries among 240 deliveries. What is the late-delivery rate?

A. 5.5%

B. 7.5%

C. 13.3%

D. 75.0%

Correct Answer: B. 7.5%

Question 6

Which example is a systems-thinking question?

A. Who signed the final inspection form?

B. Which department should receive the blame?

C. How do purchasing targets and production capacity interact to affect delivery?

D. How can the procedure become longer?

Correct Answer: C. How do purchasing targets and production capacity interact to affect delivery?

Question 7

What is a major limitation of SIPOC?

A. It cannot identify suppliers.

B. It is too detailed for process scoping.

C. It may conceal variation, decision logic and delays.

D. It cannot identify customers.

Correct Answer: C. It may conceal variation, decision logic and delays.

Question 8

Which is generally a leading indicator?

A. Warranty complaints already received

B. Completed preventive-maintenance activities

C. Last quarter’s defect rate

D. Returned products

Correct Answer: B. Completed preventive-maintenance activities

Question 9

Why is final inspection not a complete substitute for process control?

A. Inspection always increases production speed.

B. Inspection can detect some failures but may not prevent variation or its causes.

C. Inspection eliminates the need for competent personnel.

D. Inspection measures only customer satisfaction.

Correct Answer: B. Inspection can detect some failures but may not prevent variation or its causes.

Question 10

During PDCA, an improvement should be standardized after the Check stage when:

A. the procedure has been written, regardless of results.

B. the pilot produces evidence of effectiveness and unintended effects have been considered.

C. the process owner requests it without data.

D. the original problem is no longer discussed.

Correct Answer: B. the pilot produces evidence of effectiveness and unintended effects have been considered.

ISO Quality Management Systems
Chapter 3 of 15