Microsoft Visual SourceSafe for Document Control in ISO 9000 Registration

 

J. Mandell
Microsoft Corporation

October 1995

Introduction

The first thing you notice when you enter the main workspace in Microsoft's Canyon Park facility is a huge banner with white letters on a lilac background proudly proclaiming, "ISO 9002 Registered on October 21, 1994." The banner represents the culmination of a lengthy and complex process signifying that Canyon Park and other worldwide facilities have quality assurance and management programs that meet the stringent standards of the internationally accepted ISO 9000 series. Canyon Park is the largest software production facility of its kind. Within the 5.7 acres under one roof, more than 850 workers ship 2.7 million software packages of 5,500 finished products in 31 different languages per month.

As described in the "ISO 9000 Registered Company Directory," "Essentially, ISO 9000 requires a company to document what it does, and do what it documents. To illustrate the objective of ISO documentation: if a company suddenly replaced all personnel, their replacements—properly trained—could use the documentation to continue making the product or providing the service as before" (Irwin Professional Publications, Fairfax, Virginia).

Control of documentation is the critical element for International Standards Organization (ISO) registration. According to Brian Parnell, senior quality engineer and ISO project manager at the Canyon Park facility, the number one reason that companies fail their ISO audit—document control problems—causes twice the number failures as the second most common reason.

Microsoft® Visual SourceSafe™ is a project-oriented version control system with many features that make it ideal for use in the process of ISO registration. This document discusses the potential and uses of Visual SourceSafe as a document control system in companies seeking registration to one of the ISO 9000 series of quality control standards.

This paper contains the following sections:

• The Advantages of Obtaining ISO 9000 Registration
• Documentation Requirements for Registration
• How Visual SourceSafe Can Help with Registration
• An Example of Using Visual SourceSafe for Registration

The Advantages of Obtaining ISO 9000 Registration

The ISO registration process includes an audit of a company's quality systems by a third party. Once ISO registration has been achieved, the process does not end. Auditors return on a regular basis to verify that standards are being upheld. It is important to keep in mind that ISO registers the process that leads to a product or service, not the product or service itself.

The ISO 9000 series covers all companies of all sizes, whether service or manufacturing. The series comprises three standards:

• ISO 9001: Quality assurance in design, development, and production
• ISO 9002: Quality assurance in production and installation, everything in 9001. Canyon Park is registered to this standard because no design work is done there.
• ISO 9003: Quality assurance in final inspection and test.

Within a company, ISO registration benefits many functions, including production, manufacturing, contracting with suppliers, and legal requirements. Registering to an ISO standard focuses a company's energies on quality and consistency. Quality engineer Brian Parnell said of the Canyon Park facility, "We needed an impetus to get things together. ISO provided that focus."

For a company that deals with subcontractors, registration to an ISO standard is the closest thing to a guarantee that the product or service being purchased has been created under a quality-assured process, whether a supplier is in Indiana or India.

In a world economy, where most companies depend increasingly on other companies to provide some part of their product or service, quality standards have become essential. The ISO 9000 series is rapidly becoming the quality standard throughout the world. More than 80 countries as diverse as England, Colombia, Canada, Germany, Israel, and Turkey have adopted the ISO series.

The ISO standards ensure that the process used to produce a product or service, not the product or service itself, provides dependable quality. Increasingly, the companies that the Microsoft Canyon Park facility deals with are ISO registered to assure that their products or services are up to the standards that Microsoft expects and demands.

Perhaps the most cogent reason for seeking ISO registration is the marketplace itself: customers are beginning to demand registration.

Documentation Requirements for Registration

Documentation review is usually the second of six steps in the registration process (application, documentation review, pre-assessment, assessment, registration, and surveillance). If an applicant fails the documentation review, the registration process stops right there.

The American National Standard ANSI/ASQC Q9002-1994 corresponds to ISO 9002:1994. Differences between the two standards consist of "Americanization" of spelling and usage. This standard describes documentation needed for each phase in production of a product or service. The phases include quality-system requirements; contract review; documentation; data control; purchasing; inspection and testing; control of nonconforming product; corrective and preventative action; handling storage, packaging, preservation, and delivery; control of quality records; internal quality audits; training; servicing; and statistical techniques. Each section contains the words, "the supplier shall establish and maintain documented procedures."

ISO 9000 registration requires four levels of documentation:

• Level I consists of a quality manual that outlines what a company plans to achieve and outlines the policies it plans to implement to achieve its goal.
• Level II outlines procedures the company will follow, what workers will do, in what order, by whom, and with what results, structured to reflect the process flow of events.
• Level III consists of detailed work instructions—specific written information on how to do a particular task—available centrally and locally. Canyon Park has 25 local areas.
• Level IV consists of reference material and information not in other categories. In Canyon Park, this information includes quality records, forms, rates for carriers, and so forth.

Registration is achieved through an on-site audit and assessment of the company's quality system by independent auditors, including the quality policy, quality system documentation, and quality records. The complete process typically takes about two years and typically costs from $10,000 to $30,000 per facility. When performing the document review, auditors look at the following:

• Intent of ISO 9000 standard. How well does a documented system stand against the ISO standard?
• Implementation. Do people within the company follow the documentation? Is the documentation readily available?
• Effectiveness. How well does a documented system work?

How Visual SourceSafe Can Help with ISO 9000 Registration

In a wide-ranging discussion, quality engineer Brian Parnell described the process of achieving ISO registration, the scope of which he described as "humongous," and how the process could have been improved. He described the need for a good document control system as critical. "We need a good document control system to tie everything together." A good system must perform well in each of the following areas:

• Documentation must be controlled.
• Documentation must be available for auditors' perusal.
• Documentation must be easily accessible.
• Documentation versioning is necessary.
• Evidence of approval for each document must be available.
• A master list identifying revision status of documents must be readily available.

Visual SourceSafe provides all this required functionality and a great deal more. The top ten reasons for using Visual SourceSafe as a document control system:

1. It is available for multiple platforms, including the Windows® 95 operating system; Windows 3.1 and Windows NT® operating system for Intel, MIPS, and Alpha AXP and Macintosh®.
2. It stores any kind of file, whether text or binary.
3. It provides both a graphical user interface and a command line interface.
4. It uses a small set of commands that are intuitive and easily mastered.
5. It is designed to work in client-server environments. Typically, the Visual SourceSafe database resides on a server. Client installations contain the executables and auxiliary files necessary to gain access to the database.
6. It tracks the history of every change to every file and every project.
7. It contains a highly customizable, easy-to-use security system.
8. It is easy to view the contents of a file.
9. It is easy to generate reports containing the revision history of any file in its database.
10. It has an enormous capacity for files, holding over 8,000 files in a single project and as many files and projects in its database as your hard disk can hold.

The Visual SourceSafe version-control system features an easy-to-use interface that is similar in appearance and use to the Windows 95 Explorer, as shown in Figure 1.

Figure 1. The Visual SourceSafe Explorer interface

Visual SourceSafe is a version control system with a difference: rather than being file-oriented, like most version control systems, it is project-oriented. This means that in addition to performing actions on individual files, you can deal with files as a group—a much more efficient way to control documents. Instead of a separate operation for each file, you have just one operation for a group. If a particular project contains a dozen files, you can check out all twelve from storage with one command rather than with twelve separate commands.

All files are stored in the Visual SourceSafe database, but only the most recent version of a file is stored in its entirety. Only the changes to previous versions are stored in the reverse delta system. This system saves space on your hard disk. When an older version of a file is needed, Visual SourceSafe can easily recreate that version.

Visual SourceSafe contains a large number of tools to simplify the task of version control and document storage. These tools include a report generator, a history tool for showing history of projects or individual files, tools to identify differences between versions of files, a tool for finding strings in text files, and a tool for viewing files.

Documentation Must Be Controlled

One reason why companies don't have document control systems is that they can be hard to learn and hard to use. In a typical situation, a worker on a production floor needs to check the specifics of a certain step in a procedure. The worker must find the information quickly so as not to interrupt the work flow in his or her department. If the worker can't find the information quickly, the worker is likely to abandon the search.

When a worker needs to see a particular procedure, he needs only to open the project containing the procedure and double-click on the file containing the procedure. Visual SourceSafe automatically starts the application associated with the file and displays the contents of the file.

A major aspect of documentation control with regard to ISO registration is the ability to track changes to a document and produce change history. Each file in a Visual SourceSafe project has an associated comment. It is incumbent upon the people maintaining the files and projects to enter meaningful comments. Even the best system in the world won't work unless people use it properly. Each time an action is taken that affects the content of a file, you are presented with an opportunity to enter a comment. When you add a file, you can enter a comment of thousands of words should the need arise.

Visual SourceSafe controls documents by:

• Keeping the source files in the Visual SourceSafe database.
• Storing all changes to all versions so that any version can be easily reconstructed.
• Limiting access to the files by using a security system that can control access down to the file level.

Documentation for Auditor's Perusal

Section 4.5.2 of the ANSI/ASQC standard “ANSI/ASQC Q9002-1994” (ASQC, Milwaukee, Wisconsin) describes the standards for document and data control, posing the questions "What gets documented?" and "What documentation do you need to do your job successfully?" Section 4.5.2 specifies the following:

The documents and data shall be reviewed and approved for adequacy by authorized personnel prior to issue. A master list or equivalent document-control procedure identifying the current revision status of documents shall be established and be readily available to preclude the use of invalid and/or obsolete documents. This control shall ensure that:

a. The pertinent issues of appropriate documents are available at all locations where operations essential to the effective functioning of the quality system are performed.

b. Invalid and/or obsolete documents are promptly removed from all points of issue or use, or otherwise ensured against unintended use.

c. Any obsolete documents retained for legal and/or knowledge-preservation purposes are suitably identified.

Although registration is usually for three years, surveillance visits are exercised typically every six months, or in the words of Brian Parnell, "ongoing, forever."

Making documentation available for auditors involves a great deal of preparation. The large amount of documentation involved makes a document control system essential. If an applicant is not prepared for the auditors' inspection, the cost to the applicant can be substantial. Typically, a team of auditors will cost the applicant more than $1,500. If even one day of the auditors' time is wasted due to lack of preparation, the cost is unacceptable.

In addition the preparation for the auditors' visit can be expensive and time consuming. Brian Parnell reported that in the Canyon Park facility, a person delivering hard copies of a document to everyone who needs to see it walks five miles, all within the facility.

A good document control system can pay for itself in one day.

To prepare for the auditors' visit, Visual SourceSafe can help a company prepare as follows:

• View all necessary documents from any SourceSafe client to determine whether to include them in the review, without having to check the files out of the database.
• Generate reports to provide a change history of all comments associated with projects, as required for document review.
• Generate reports showing all changes to the contents of text files.
• Generate any version of any document in the Visual SourceSafe database. Even obsolete documents that have been deleted from projects can be retained in the database.

Documentation Must Be Easily Accessible to All Who Need It

Information must be readily accessible to anyone in the corporation, from managers to accountants, but particularly to workers on the production floor. The main reasons why companies fail their audits because of documentation problems include:

• Documentation isn't controlled, such as work scheduling, or a list of which component screens to use. Many companies still work with hard copies of documentation subject only to physical changes. If a page falls out of a binder, it can simply disappear.
• Documentation might be available, but the person doesn't know how to find it. Format of the documentation does not matter. It simply needs to be effective for users. The documentation can be hard copy or online, or online with hard copy backup.
• The most current version of the documentation is not available. Updates to documents are difficult to propagate, particularly with hard-copy-only documentation. Online systems that are not distributed across a network also face problems updating changes.
• Documentation must be usable. Users of the documentation complain that the system, whether hard copy or online, is hard to use; in fact, they find it so hard to use that they find it easier not to make necessary changes.

One of the key elements of the quality assurance system concerns procedures. All workers must have access to documentation that provides each step of the process for which they are responsible. Typically, work instructions are referenced often and must be available at all times.

In many companies, people work with a mix of different computers. Some people might still be using Intel 286 machines that lack the power to run a contemporary graphical user interface. For these users, Visual SourceSafe provides a command line interface to be run in an MS-DOS® shell. Users can work with the command line to create and use batch files that can perform such functions as daily updates of files and projects. Figure 2 shows a change history generated from the command line.

Figure 2. Change history generated from the command line

Currently, documentation in Canyon Park is online in Microsoft Word documents and consists mainly of high-level documents with embedded Visio diagrams and other embedded figures. However, according to Don Hirt, a systems analyst at Canyon Park, if response time of the online system is too slow, a worker is more likely to look for the hard copy and thumb through the pages in search of the information he or she needs.

Although much documentation is currently available in hard copy, online documentation would be acceptable if the response time for the delivery system were adequate.

Visual SourceSafe, designed for client-server systems, makes documentation available to any with access to a client machine. The graphical interface contains a listing of all projects and all files within a project. The same information is easily available with the command line interface. By giving files names that are meaningful, the file list provides easy access to the files. For someone to see a file, they need only to double-click on the filename in the file list. Response time for the display of the file is dependent on the application with which a file is associated.

Documentation Versioning Is Necessary

Brian Parnell held up a large ring binder overflowing with different hard copy printouts. "This," he explained, "is the archive system currently being used at Canyon Park." Other groups in other facilities use different types of archiving systems. Because of the need to provide older versions of documents, an online archive system is desirable to make the documents available not only to a central group, but also to any local groups that may require access to the documents.

Visual SourceSafe retains all versions of documents through its reverse-delta technology, saving only changes between versions, not the entire documents. Any version of any document can be retrieved by using the Visual SourceSafe history tool. Figure 3 shows the History of File dialog box, which is the place from which many tools are available from buttons in the dialog box.

Figure 3. The History of File dialog box

By working from this dialog box, you can:

• View any version of the file by selecting it in the file list and clicking View.
• View all comments on a file by clicking Details.
• Obtain a read-only copy of a file by clicking Get.
• View differences between any two versions of text files by selecting both and clicking Diff.
• Create a report by clicking Report.

Visual SourceSafe has a tool for displaying differences between versions of text files. The tool can identify whether or not a binary file has changed between versions, but due to the structure of binary files, the changes cannot be displayed. For some binary files, such as Microsoft Word documents, the application that created the file has a tool for displaying differences. Figure 4 shows a Visual SourceSafe difference screen in the Visual SourceSafe format. In this format, differences and insertions are identified by color. Differences can also be displayed in UNIX style.

Figure 4. Visual display of differences between versions of a text file

Evidence of Approval for Each Document Must Be Available

All changes to all documents and procedures must be signed to provide evidence of approval. Currently at Canyon Park, a physical signature is needed for all changes, but Brian Parnell feels that online approval would be acceptable. A document control system needs to provide evidence that the people who needed to approve the documentation actually did approve it.

All verified changes must be noted on the cover pages of the affected documents. A history of changes is also necessary, but it is only as good as the information given by the provider. One way to show approval of changes online is to edit the comments for a particular file by using the History Details dialog box, available from the History of File or History of Project dialog boxes.

Each person who must sign off on a change can edit the comment to show they approve or disapprove of a change and explain why. The comment field can accommodate lengthy comments. For facilities with scanners, a signature can be scanned into a file and then that file can be stored in the appropriate Visual SourceSafe project.

Figure 5 shows the History Details dialog box that has been edited to show how each person in the approval loop has granted their approval to the changes.

Figure 5. The History details dialog box showing approval of changes

Identifying Current Revision Status of Documents

Section 4.5.2 of the ANSI/ASQC states:

A master list or equivalent document-control procedure identifying the current revision status of documents shall be established and be readily available to preclude the use of invalid and/or obsolete documents.

This requirement of the standard seems to be aimed squarely at version control systems, and in particular at Visual SourceSafe. As a document management system, Visual SourceSafe provides tools to display the current revision status of all files in the Visual SourceSafe database, to display the comments associated with all changes to each of the files, and a tool to display the changes between versions of text files.

The history command is the means by which you use these tools. Access to these tools from the history command consists of selecting a file from the file list in the Visual SourceSafe Explorer, then clicking the history button. SourceSafe then displays the History of File dialog box. This dialog box displays a listing of all versions of a particular file.

To generate a listing of the details of each change, you need only click the Details button. To generate a listing of differences between versions of text files, such as procedure details or source files, you need only click the Diff button. To combine the two, click the Report button, which displays a dialog box, shown in Figure 6, offering the choice of how much information to include in the report and what format in which to generate the report.

Figure 6. The History Report dialog box

By default, the reports are generated as text files. You can, however, apply formatting by writing the report to the Clipboard and pasting the contents of the clipboard into Microsoft Word. The content of the report does not have to change because Visual SourceSafe provides all the information. Figure 7 shows the "raw" report.

Figure 7. A "raw" Visual SourceSafe report

Figure 8 shows a report that originated in the History dialog box; the report was formatted to add blank lines for readability and to change font size and bolding for making certain elements easy to find. Notice that the report contains comments entered by the person who last checked in the file to the Visual SourceSafe database and also contains differences between versions of the file. The ability to generate this type of information is crucial for a version control system in an environment that is to be ISO registered.

Figure 8. A Visual SourceSafe report formatted in an editor

An Example of Using Visual SourceSafe for Registration

To see how Visual SourceSafe functions as a document control system, consider the example of a hypothetical sewing company that manufactures backpacks, tote bags, briefcases, gym bags, and other outdoor equipment. As the designer, manufacturer, and distributor of its products, this company is seeking registration to the ISO 9001 standard.

To expedite the registration process, the sewing company has used Visual SourceSafe to control all documents. Each product line that the company produces is represented as a different project within Visual SourceSafe: Backpacks, Briefcases, Gym Bags, and Tote Bags. Each project contains subprojects. For example, the Backpacks project contains subprojects for Day Packs, External Frame Packs, and Internal Frame Packs. Likewise, the Day Packs subproject contains subprojects for each daypack, including Daypack 101, Daypack 202, and Daypack 303.

The company is set up with a local area network. The system has been set up so that certain departments have read and write access to the database. These are the departments with reasons to make changes to files, such as design and purchasing. Other departments, such as production and shipping, have only read access to certain projects.

The Visual SourceSafe database is installed on a server and each department has at least one client installation. From the client computers, people in each department can view or edit files to which they have appropriate access rights. Figure 9 represents portions of the Visual SourceSafe installation for the company. Each division of the company can access all projects, or only those projects that directly affect them. Access can be set up by project or by person.

Figure 9. Representation of a client-server installation for a sewing company

To be certain that the entire project stays on target, the company is using Microsoft Project, which contains built-in templates for ISO 9000 projects, to make scheduling and planning simple and intuitive. Like all files associated with the registration effort, the .MPP and associated Microsoft Project files have been placed under Visual SourceSafe control in a separate project for scheduling. Figure 10 shows the screen display for the master project.

Figure 10. Microsoft Project for ISO 9000 registration template

Because Visual SourceSafe is designed to work with projects and not just with individual files, anyone who needs to gather all the documentation for the production of a particular item can easily look at the documents, check them out of document control to make changes, compare newer and older versions of documents, and much more. Anyone needing to look at an individual file can perform any action that he or she has the access rights to do.

Testing has uncovered a problem with seams ripping in Daypack 202. Changes must be made to both the materials list and to the procedures. To do this, people must check out the files that they need and make the necessary changes. When they check in the file, they use the comment field to describe what happened, how testing found weaknesses, how they tested other possible ways to correct the problem, and their final solution, including what changes will go into effect and when.

While these changes are being discussed, specified, and then implemented, all documents associated with the Daypack 202 are under version control in Visual SourceSafe. This means that even under such stressful situations, all documents are available to everyone who needs to see them, including the ISO auditors.

Figure 11 shows the Visual SourceSafe Check In dialog box with a lengthy comment. Comments in this dialog box can be hundreds of lines long if necessary.

Figure 11. The Visual SourceSafe Check In dialog box

After checking in the file, it is available for perusal by all departments. Then, the head of each department who must approve the changes views the file. After they have studied the changes and decided whether or not to approve them, each department head then goes to the history of the file and edits the details in the comment field to show whether or not they have approved the changes. The approval or disapproval then becomes part of the history of the file and will show up in the reports of the file's history.

These reports provide a complete history of all changes to the file. Even if the person who changed a file did not add descriptive comments, a record of the activity on the file is part of the file history. Visual SourceSafe tracks all changes to individual files and to the projects that contain the files. Figure 12 shows the history of a project, showing all changes to each of the files within the project.

Figure 12. The History of Project dialog box

At this point, the company now has all the documents needed both for ISO registration and for producing each project.

Conclusions

Microsoft Visual SourceSafe is a version control system that provides control of all documents that a company produces. These documents are available in all versions since their creation. All changes to the documents are stored so that any version of any document can be viewed or retrieved at any time.

For a company seeking ISO 9000 registration, Visual SourceSafe provides all the tools needed in an easy-to-use graphical interface or in a command line interface for using batch files or for users who do not have access to graphical interfaces.

When combined with Microsoft Project, Visual SourceSafe becomes a powerful system for control of documents and schedules for any company producing a product or a service.