Quality Management and Industry Standards Guide

Transcription

1 Quality Management and Industry Standards Guide Author : Tom Fletcher Page 1 of 20 First Published : 01/10/2008

2 Index 1 Introduction to the Guide ISO14001 (Environmental Management System (EMS) ISO20000 (IT Service Management) ISO9001 : BS2599 : Business Continuity ISO27001 : (Information Security Management System) SAS TL SA Risk Management of Suppliers Health and Safety Climate Change How Can I get Regular Information on BT? Society and the Environment Report and Details Document Updates Tracking Author : Tom Fletcher Page 2 of 20 First Published : 01/10/2008

3 1 Introduction to the Guide We are often asked by customers about compliance to British or International Standards. BT is certified to some of theses standards and is audited on a regular basis to ensure compliance The standards that the BT Quality & Business Excellence team currently manage are: ISO14001 : (Environmental Management System (EMS) ISO20000 : (IT Service Management) ISO : (Quality Management) BS25999 : (Business Continuity) ISO27001 : (Information Security Management System) SAS70 : (Type 2 Auditing System) TL9000 : (Quality Management System) SA8000 : Social Accountability We are also often asked about how we measure quality, and how we do business with our suppliers to ensure they are doing a quality job whilst also helping to reduce the carbon footprint of our product line. Customer also enquire about our CSR (Corporate Social Responsibility) duties and what we do with the community Also included in this document is information on the following subject areas Risk Management Of Suppliers Health and Safety Climate Change How to get more information Return to Index Author : Tom Fletcher Page 3 of 20 First Published : 01/10/2008

4 2 ISO14001 (Environmental Management System (EMS) Our Environmental Management System (EMS) was certified to ISO14001 in 1999 and has covered all our UK based operations since March A phased implementation to cover non UK operations is now in progress with Italy, Belgium, Ireland and Spain currently certified with the Netherlands, Germany and USA in preparation. In addition BT has published a commitment to define a roadmap this year for establishing an Environmental Management (EMS) approach in eighteen of the countries in which we operate (representing over 95% of our direct employee base). Author : Tom Fletcher Page 4 of 20 First Published : 01/10/2008

5 3 ISO20000 (IT Service Management) Essentially - to comply with ISO20000 we ask that programmes comply with the Service Management Framework, and the high level processes that it gives reference to. Note the framework, and the associated processes, are at a high level, so it is usually necessary to create (or adapt) low level working procedures. Of course we don't just take their word for it. All programmes claiming ISO20000 certification are then subjected to regular auditing to ensure they meet, and continue to meet the standard. Key points of BT s Service Management policy are ICT services will be aligned to the business requirements rather than technical requirements. The standard processes and implementation rules provide the baseline for, and conform to, ISO requirements. Relevant ITIL content within the Process Management Framework (PMF) will represent ITIL Service Management best practice. ITIL processes will be governed by PMF process management policies. Contracts will use the standard set of processes and tools that have been developed. Variations from this must be agreed Typically other (as well as the afore mentioned key points) key points from a Service Management Policy that has been signed off could be : The overall service improvement and service delivery of services for this service desk must align to governance framework defined within this policy. This Service Desk adopts ITIL Service Management practices for the provision of its services to its clients The scope and definition of this clients Service Desk s service can be found in the associated Contract Schedules Also, for Senior Service Management responsibilities, the agreement (as a minimum) will be expected to include the following Communicate the importance of meeting the service management objectives and the need for continual improvement Ensure that the customer requirements are determined and are met with the aim of improving customer satisfaction Ensure onsite management are appointed to manage delivery of the service improvement plan. To ensure adequate number of and skilled resources to Implement, Monitor, Review and Improve Service Delivery and Management To ensure tools and documentation in place to support service management team Conduct reviews of service management, at planned intervals, to ensure continuing suitability, adequacy and effectiveness. Ensure that the client and account team has an input and sign off. Ensure documents and records provided ensure effective planning, operation and control of service management. Ensure ongoing maintenance of service support documentation. Author : Tom Fletcher Page 5 of 20 First Published : 01/10/2008

6 4 ISO9001 : 2000 BT s Quality Management System is fully paperless about one year ago we developed a Quality Manual document that summarizes the quality management within BT. We have identified several key building blocks to enable effective deployment of our Quality Policy. These are all interdependent and instil a systematic PLAN-DO-CHECK-ACT approach to continuous improvement. The four key steps are: Approach to Internal Audit: So as to ensure the management system is functioning to its most efficient Agree what we will do: To focus the energies of employees Manage Our Activities: To Manage, monitor and improve our processes Celebrate Our Success: Recognise, celebrate and promote role model behaviour BT is also certified in the Investors In People program BT first gained corporate IiP recognition on 13 October 1998, building on the earlier successes with IiP by a number of individual units. It has been since been successfully reaccredited in Dec 1999, January 2001 and January 2003 and 2005 and December Author : Tom Fletcher Page 6 of 20 First Published : 01/10/2008

7 5 BS2599 : Business Continuity Please read BT s Business Continuity Policy Directive. This document above talks about BT s Business Continuity Policy Directive. Section 1.3 within the document refers to the industry standard BS2599 for Business Continuity. In addition, BT also has an ERT (emergency response team) and a dedicated fleet of disaster recovery vehicles on hot standby at strategic locations. Author : Tom Fletcher Page 7 of 20 First Published : 01/10/2008

8 6 ISO27001 : (Information Security Management System) The BT Group Security ISMS (Information Security Management System) has been approved to ISO27001 : 2005 for "Activities including and associated with BT's security and resilience governance through development and maintenance of security policies, development and coordination of business continuity and resilience processes, provision of security communications, awareness and training, management of security investigations, control of liaison with HMG and co-ordination of activities for the physical protection of BT's estate". BT maintains around 420 mandatory security policies that are accessible online to all BT people via the BT intranet. These security policies are applicable throughout the BT Group, are mandatory and are applicable to all BT s operations and systems. These policies are designed to align with and discharge all the requirements of ISO27002:2007 the Code of Practice for Information Security Management. As part of our Information Security Management System we maintain a mapping of these security policies to ISO27002 to ensure there are no gaps. The development and maintenance of BT s security policies is certified to ISO27001:2005. Compliance to this is verified by an external organisation - LRQA (Lloyds Register Quality Assurance) an accredited member of UKAS (United Kingdom Accreditation Service) who have issued certificate number LRQ covering the activities including and associated with BT's security and resilience governance through development and maintenance of security policies, development and co-ordination of business continuity and resilience processes, provision of security communications, awareness and training, management of security investigations, control of liaison with UK Government and co-ordination of activities for the physical protection of BT's estate Author : Tom Fletcher Page 8 of 20 First Published : 01/10/2008

9 7 SAS70 BT believes an open dialogue with customers to assist them with their regulatory compliance, and there are a number of measures that can be adopted which have successfully avoided the need for customers to demand specific SAS 70 reports and audit rights unless there is a regulatory requirement for such. For example: Well drafted SLA s can define security and service standards and how service measures are reported to the customer BT has ISO certifications with regard to security standards BT has the nucleus of a "generic SAS 70" review for global IP services. Note that customer access to SAS70 audit reports is strictly controlled and can only be granted where there is a demonstrable need. Author : Tom Fletcher Page 9 of 20 First Published : 01/10/2008

10 8 TL9000 BT has been working with the QuEST Forum for some years now, whilst we are in a very strong position (i.e. our management systems are at the required TL9000 standard) work has been carried out as part of the 21C Customer Experience programme to bring GS (and other parts of BT) measurements up to TL 9000 standards Should the requirement become mandatory from a client perspective, BT are in a strong position again as teams of educated people are ready and prepared to have meetings and discuss in detail with the client their requirements Author : Tom Fletcher Page 10 of 20 First Published : 01/10/2008

11 9 SA8000 The gaining of this accreditation has been decided to not be pursued by BT. BT feels that the current conditions and controls in place via the GS18 labour standards documentation that all of our suppliers are asked to complete, complies fully with the guidelines and targets within the SA8000 set. BT does however make it mandatory that suppliers adhere to the following statements in the document provided To date, BT has not been involved in any employment tribunal cases concerning the conditions in the statement attached Author : Tom Fletcher Page 11 of 20 First Published : 01/10/2008

12 10 Risk Management of Suppliers We carry out detailed assessments of suppliers, which we identify as high or medium risk, through our CSR questionnaires. We also have an ongoing programme of on-site assessments for a number of high risk suppliers. Assessments help us to identify areas for improvement. We take a collaborative approach and work with suppliers to resolve issues identified during assessments. We recognise that the most effective way to bring lasting improvements is to empower our suppliers to manage risks in their own operations and supply chains. Assessments also raise awareness of our standards and emphasise the importance of CSR to BT. To date, we have carried out assessments in-house. However, during the past year we have engaged a third party so we can increase the number of on-site assessments we can complete, this also gives us greater resource flexibility. When we assess a subcontractor, we are accompanied by our tier one suppliers (the company that supplies us directly). This joint approach increases our influence with the subcontractor. Site assessments cover our Sourcing with Human Dignity standard and our environmental standards. A typical assessment includes: - a review of documentation, such as payslips and personal records interviews with managers - a walk around the premises, including canteen and accommodation facilities worker interviews. Where possible, worker interviews are conducted by NGOs or independent assessors. Interviewers always speak the worker s language and, where possible, are of the same gender. Findings are reported back to supplier management anonymously to protect the workers. We discuss assessment findings with suppliers and agree appropriate improvement plans. These are then followed up through reports, review meetings, or return visits to assess developments. Assessments in 2008 financial year We completed 25 site assessments in India, China, Taiwan, the Philippines and Romania, compared to a total of 20 in the 2007 financial year. Suppliers assessed included: - 20 existing or potential tier one suppliers - Two existing tier two suppliers - One potential tier three supplier We visited the potential tier three supplier jointly with the tier one and tier two supplier in Taiwan. We stopped any consideration of the use of this particular tier three supplier in our supply chain because of concerns on labour standards and environmental impact. The most common, significant issues found during assessments of medium and high CSR risk suppliers are around health and safety, and the welfare of employees. We sponsored an external review of how we implement our Sourcing with Human Dignity standard. In the 2008 financial year, in line with our external target, we have reviewed the findings and developed an action plan. We will work on the action plan during the coming year. Author : Tom Fletcher Page 12 of 20 First Published : 01/10/2008

13 Governance Our chief procurement officer, Neil Rogers, has overall responsibility for our CSR supply chain programmes and reports to a member of the Board. Our CSR strategy and policy manager for procurement oversees implementation of our strategy and provides advice and direction on CSR issues. Our buyers implement the programmes supported by our procurement CSR managers and a virtual CSR team. This team is made up from individuals representing different procurement areas, who each have a responsibility for CSR within their teams, such as communicating key messages. We have set up three procurement delivery centres outside the UK to help us manage our increasingly global supply chain: one in New Delhi, India, one in Shanghai in China and one in Budapest in Hungary. One person in Shanghai has joined the CSR team. Risk based approach We source from thousands of suppliers worldwide and it is not possible to engage in detail with all of these companies. We adopt a risk-based approach to help us focus our efforts. A supplier may present a higher risk to BT because of the product or service it provides or its location. In some countries labour and environmental regulations may be poorly enforced and suppliers may well operate to standards below UK norms. All new suppliers are required to complete our GS13 (environmental) and GS18 (Sourcing with human dignity, also known as labour standards) questionnaires via our online procurement portal. This helps us to establish whether there is a high, medium or low risk of a particular supplier not meeting our CSR standards. These questionnaires also ask for information on companies own suppliers which help us identify risks further down our supply chain. All suppliers of electrical and electronic equipment are required to fill in our GS19 questionnaire. This gives us vital information about the environmental impacts of products and helps us select environmentally preferable suppliers during the tender process. To view a copy of the GS13 Questionnaire click the following link To view a copy of the GS18 Questionnaire click the following link To view a copy of the GS19 Questionnaire click the following link We follow up with medium or high risk suppliers within three months. This ranges from a simple discussion with the supplier to clarify their responses to our questionnaires, to a full on-site assessment. Activity in 2008 In the past year we began requesting suppliers to fill in our questionnaires pre-contract to help us further integrate CSR into our procurement decisions. We also raised the minimum score required by our services suppliers, recognising that they can have a big environmental impact, for example distributors, recruitment specialists or consultants Author : Tom Fletcher Page 13 of 20 First Published : 01/10/2008

14 We used our climate change procurement principles, developed in 2007, during several tendering exercises; including BT own use corporate credit cards and electrical wholesalers. This gave us information on what these suppliers are doing to tackle climate change, from nothing to having fully embedded processes and measurable targets. To date 1,935 suppliers have completed our self assessment questionnaires and we are currently working with 244 suppliers on environmental standards, and 235 suppliers on labour standards. Author : Tom Fletcher Page 14 of 20 First Published : 01/10/2008

15 11 Health and Safety BT does not hold the OHSAS Certification. BT is of the opinion that generally the standard is aligned to overarching quality management principles and is more suited to a manufacturing or production environment. Our management systems are based on the HSE's HS(G)65 model entitled successful health and safety management. This is far more flexible and better matches our needs as a company. BT is however accredited to Contractor Health and Safety scheme (CHAS) see as proof of an acceptable standard and level of commitment to health and safety Author : Tom Fletcher Page 15 of 20 First Published : 01/10/2008

16 12 Climate Change Our approach to product stewardship We have a dedicated team to coordinate product stewardship work, and this year we established a forum to improve collaboration between our businesses. This forum meets quarterly. Our product stewardship efforts are part of our environmental management system which is certified to the international standard ISO We need to make continual improvements in this area to retain certification. The design stage offers the greatest opportunities to improve the lifecycle environmental impacts of a product. Good design helps manufacturers to reduce the use of hazardous substances and consumption of raw materials. The design stage also determines how much energy is consumed over the life of a product and whether it can be easily reused, recycled or safely disposed of at the end of its life. There are a number of ways we seek to influence the environmental impact of the products we sell: Providing advice to BT s technical designers and Product Managers on for example, choice of materials and reducing energy consumption Extending end of life take back beyond our legislative requirements, assuming WEEE producer responsibility and ensuring the equipment is reused and recycled where possible Helping our bid managers by providing potential customers with details of how we comply with legal obligations and environmental standards and advising current customers on the responsible disposal of products Engaging with suppliers BT does not manufacture anything, but we design products that are manufactured by a network of suppliers. In the 2008 financial year we bought 8.64 billion worth of products and services from suppliers. We engage with our manufacturing suppliers to promote good environmental practices and to ensure that they follow our standards for product stewardship. BT has a blacklist of banned materials and a grey list of materials giving cause for concern. All potential suppliers of electronic and electrical equipment must complete our product stewardship online questionnaire (GS19) when tendering for business. The responses are assessed by the product stewardship team. To view a copy of the GS19 Questionnaire click the following link Our focus areas In addition to our legal obligations, we are focusing our product stewardship efforts on two areas: Working to develop a methodology to understand how to assess the carbon footprint of our products Benchmarking the packaging of our own branded products against industry best practice in sustainability In the 2008 financial year we conducted a lifecycle assessment of the carbon footprint of the BT Vision set top box. This proved how difficult it can be to obtain energy and emissions data Author : Tom Fletcher Page 16 of 20 First Published : 01/10/2008

17 for complex electronic products from our suppliers. We may need to base future lifecycle assessments on data from reliable secondary sources, such as industry bodies and governments. Our approach to product stewardship Targets Start Date April 2008 April 2008 April 2008 April 2007 April 2007 End Date March 2010 March 2010 March 2009 March 2008 March 2008 Description BT will develop a group wide methodology for measuring the carbon footprint of its products and pilot the methodology on a product BT will develop a group wide methodology for measuring the carbon footprint of its services and pilot the methodology on a service BT will benchmark the packaging of its own brand products against industry best practice in sustainability We will research and produce a report on the data collection requirements which would enable the carbon footprint* of a BT branded product to be identified. (* Carbon footprint - the energy consumption associated with the product throughout its whole lifecycle.) We will assess the feasibility of using alternatives to bromine based flame retardants in BT branded telephones, modems and routers. Update A draft report is currently being finalised that identifies the necessary data collection requirement requirements. This has been completed and a report with recommendations has been produced. New New New Target Status Completed Completed Author : Tom Fletcher Page 17 of 20 First Published : 01/10/2008

18 13 How Can I get Regular Information on BT? Should you require further information on areas such as Company or Financial information, Innovation and Products, new releases or shareholder information, then please visit the site below and sign up. You will be able to choose to receive alerts on the subjects that are most appealing or of interest to you Author : Tom Fletcher Page 18 of 20 First Published : 01/10/2008

19 14 Society and the Environment Report and Details If you are interested in BT s impact on Society and the Environment, there is lots of information to be gained from the link below. The pages allows viewing of the Social and Environmental report (including a detailed search facility), also information on climate change, our employees and BT s CSR Strategy and Governance Return to Index Author : Tom Fletcher Page 19 of 20 First Published : 01/10/2008

20 15 Document Updates Tracking 1 st October 2008, initial document published. Future updates will be referenced below, with the actual updates appearing in the appropriate section above or new section dependant on the requirement Author : Tom Fletcher Page 20 of 20 First Published : 01/10/2008