Microsoft Visual SourceSafe for Document Control in ISO 9000 Registration

7/29/2019 Microsoft Visual SourceSafe for Document Control in ISO 9000 Registration

1/16

Microsoft VisualSourceSafe for

Document Control inISO 9000 Registration

J. Mandell

Microsoft Corporation

October 1995

IntroductionThe first thing you notice when you enter the main workspace in

Microsoft's Canyon Park facility is a huge banner with white letters on a

lilac background proudly proclaiming, "ISO 9002 Registered on

October 21, 1994." The banner represents the culmination of a lengthy

and complex process signifying that Canyon Park and other worldwide

facilities have quality assurance and management programs that meet

the stringent standards of the internationally accepted ISO 9000 series.

Canyon Park is the largest software production facility of its kind.

Within the 5.7 acres under one roof, more than 850 workers ship 2.7million software packages of 5,500 finished products in 31 different

languages per month.

As described in the "ISO 9000 Registered Company Directory,"

"Essentially, ISO 9000 requires a company to document what it does,

and do what it documents. To illustrate the objective of ISO

documentation: if a company suddenly replaced all personnel, their

replacementsproperly trainedcould use the documentation to

continue making the product or providing the service as before" (Irwin

Professional Publications, Fairfax, Virginia).

Control of documentation is the critical element for International

Standards Organization (ISO) registration. According to Brian Parnell,

senior quality engineer and ISO project manager at the Canyon Park

facility, the number one reason that companies fail their ISO audit

document control problemscauses twice the number failures as the

second most common reason.

Microsoft Visual SourceSafe is a project-oriented version control

system with many features that make it ideal for use in the process of

ISO registration. This document discusses the potential and uses of

Visual SourceSafe as a document control system in companies seeking

registration to one of the ISO 9000 series of quality control standards.

This paper contains the following sections:

Visual Studio 2005 3 out of 8 rated this helpful

rosoft Visual SourceSafe for Document Control in ISO 9000 Registr... http://msdn.microsoft.com/en-us/library/bb509336(v=vs.80).aspx

16 3/4/2013 1:47 PM


2/16

The Advantages of Obtaining ISO 9000 Registration

Documentation Requirements for Registration

How Visual SourceSafe Can Help with Registration

An Example of Using Visual SourceSafe for Registration

The Advantages of Obtaining ISO

9000 RegistrationThe ISO registration process includes an audit of a company's quality

systems by a third party. Once ISO registration has been achieved, the

process does not end. Auditors return on a regular basis to verify that

standards are being upheld. It is important to keep in mind that ISO

registers the process that leads to a product or service, not the product

or service itself.

The ISO 9000 series covers all companies of all sizes, whether service or

manufacturing. The series comprises three standards:

ISO 9001: Quality assurance in design, development, and

production

ISO 9002: Quality assurance in production and installation,

everything in 9001. Canyon Park is registered to this standard

because no design work is done there.

ISO 9003: Quality assurance in final inspection and test.

Within a company, ISO registration benefits many functions, including

production, manufacturing, contracting with suppliers, and legal

requirements. Registering to an ISO standard focuses a company's

energies on quality and consistency. Quality engineer Brian Parnell said

of the Canyon Park facility, "We needed an impetus to get things

together. ISO provided that focus."

For a company that deals with subcontractors, registration to an ISO

standard is the closest thing to a guarantee that the product or service

being purchased has been created under a quality-assured process,

whether a supplier is in Indiana or India.

In a world economy, where most companies depend increasingly on

other companies to provide some part of their product or service,

quality standards have become essential. The ISO 9000 series is rapidly

becoming the quality standard throughout the world. More than 80

countries as diverse as England, Colombia, Canada, Germany, Israel,

and Turkey have adopted the ISO series.

The ISO standards ensure that the process used to produce a product

or service, not the product or service itself, provides dependable

quality. Increasingly, the companies that the Microsoft Canyon Park

facility deals with are ISO registered to assure that their products or

services are up to the standards that Microsoft expects and demands.

Perhaps the most cogent reason for seeking ISO registration is the

marketplace itself: customers are beginning to demand registration.

Documentation Requirements forRegistrationDocumentation review is usually the second of six steps in the


16 3/4/2013 1:47 PM


3/16

registration process (application, documentation review,

pre-assessment, assessment, registration, and surveillance). If an

applicant fails the documentation review, the registration process stops

right there.

The American National Standard ANSI/ASQC Q9002-1994 corresponds

to ISO 9002:1994. Differences between the two standards consist of

"Americanization" of spelling and usage. This standard describes

documentation needed for each phase in production of a product orservice. The phases include quality-system requirements; contract

review; documentation; data control; purchasing; inspection and

testing; control of nonconforming product; corrective and preventative

action; handling storage, packaging, preservation, and delivery; control

of quality records; internal quality audits; training; servicing; and

statistical techniques. Each section contains the words, "the supplier

shall establish and maintain documented procedures."

ISO 9000 registration requires four levels of documentation:

Level I consists of a quality manual that outlines what acompany plans to achieve and outlines the policies it plans to

implement to achieve its goal.

Level II outlines procedures the company will follow, what

workers will do, in what order, by whom, and with what results,

structured to reflect the process flow of events.

Level III consists of detailed work instructionsspecific written

information on how to do a particular taskavailable centrally

and locally. Canyon Park has 25 local areas.

Level IV consists of reference material and information not in

other categories. In Canyon Park, this information includes

quality records, forms, rates for carriers, and so forth.

Registration is achieved through an on-site audit and assessment of

the company's quality system by independent auditors, including the

quality policy, quality system documentation, and quality records. The

complete process typically takes about two years and typically costs

from $10,000 to $30,000 per facility. When performing the document

review, auditors look at the following:

Intent of ISO 9000 standard. How well does a documented

system stand against the ISO standard?

Implementation. Do people within the company follow the

documentation? Is the documentation readily available?Effectiveness. How well does a documented system work?

How Visual SourceSafe Can Help with

ISO 9000 RegistrationIn a wide-ranging discussion, quality engineer Brian Parnell described

the process of achieving ISO registration, the scope of which he

described as "humongous," and how the process could have been

improved. He described the need for a good document control system

as critical. "We need a good document control system to tie everything

together." A good system must perform well in each of the followingareas:

Documentation must be controlled.


16 3/4/2013 1:47 PM


4/16

Documentation must be available for auditors' perusal.

Documentation must be easily accessible.

Documentation versioning is necessary.

Evidence of approval for each document must be available.

A master list identifying revision status of documents must be

readily available.

Visual SourceSafe provides all this required functionality and a great

deal more. The top ten reasons for using Visual SourceSafe as a

document control system:

It is available for multiple platforms, including the Windows

95 operating system; Windows 3.1 and Windows NT

operating system for Intel, MIPS, and Alpha AXP and

Macintosh.

1.

It stores any kind of file, whether text or binary.2.

It provides both a graphical user interface and a command line

interface.

3.

It uses a small set of commands that are intuitive and easily

mastered.

4.

It is designed to work in client-server environments. Typically,the Visual SourceSafe database resides on a server. Client

installations contain the executables and auxiliary files necessary

to gain access to the database.

5.

It tracks the history of every change to every file and every

project.

6.

It contains a highly customizable, easy-to-use security system.7.

It is easy to view the contents of a file.8.

It is easy to generate reports containing the revision history of

any file in its database.

9.

It has an enormous capacity for f iles, holding over 8,000 files in

a single project and as many files and projects in its database

as your hard disk can hold.

10.

The Visual SourceSafe version-control system features an easy-to-use

interface that is similar in appearance and use to the Windows 95

Explorer, as shown in Figure 1.


16 3/4/2013 1:47 PM


5/16

Figure 1. The Visual SourceSafe Explorer interface

Visual SourceSafe is a version control system with a difference: rather

than being file-oriented, like most version control systems, it is project-

oriented. This means that in addition to performing actions on

individual files, you can deal with files as a groupa much more

efficient way to control documents. Instead of a separate operation foreach file, you have just one operation for a group. If a particular project

contains a dozen files, you can check out all twelve from storage with

one command rather than with twelve separate commands.

All files are stored in the Visual SourceSafe database, but only the most

recent version of a file is stored in its entirety. Only the changes to

previous versions are stored in the reverse delta system. This system

saves space on your hard disk. When an older version of a file is

needed, Visual SourceSafe can easily recreate that version.

Visual SourceSafe contains a large number of tools to simplify the taskof version control and document storage. These tools include a report

generator, a history tool for showing history of projects or individual

files, tools to identify differences between versions of files, a tool for

finding strings in text files, and a tool for viewing f iles.

Documentation Must Be Controlled

One reason why companies don't have document control systems is

that they can be hard to learn and hard to use. In a typical situation, a

worker on a production floor needs to check the specifics of a certain

step in a procedure. The worker must find the information quickly so as

not to interrupt the work flow in his or her department. If the worker

can't find the information quickly, the worker is likely to abandon the

search.


16 3/4/2013 1:47 PM


6/16

When a worker needs to see a particular procedure, he needs only to

open the project containing the procedure and double-click on the file

containing the procedure. Visual SourceSafe automatically starts the

application associated with the file and displays the contents of the file.

A major aspect of documentation control with regard to ISO

registration is the ability to track changes to a document and produce

change history. Each file in a Visual SourceSafe project has an

associated comment. It is incumbent upon the people maintaining thefiles and projects to enter meaningful comments. Even the best system

in the world won't work unless people use it properly. Each time an

action is taken that affects the content of a file, you are presented with

an opportunity to enter a comment. When you add a file, you can enter

a comment of thousands of words should the need arise.

Visual SourceSafe controls documents by:

Keeping the source files in the Visual SourceSafe database.

Storing all changes to all versions so that any version can be

easily reconstructed.Limiting access to the files by using a security system that can

control access down to the file level.

Documentation for Auditor's Perusal

Section 4.5.2 of the ANSI/ASQC standard ANSI/ASQC Q9002-1994

(ASQC, Milwaukee, Wisconsin) describes the standards for document

and data control, posing the questions "What gets documented?" and

"What documentation do you need to do your job successfully?"

Section 4.5.2 specifies the following:

The documents and data shall be reviewed and

approved for adequacy by authorized personnel prior

to issue. A master list or equivalent document-control

procedure identifying the current revision status of

documents shall be established and be readily available

to preclude the use of invalid and/or obsolete

documents. This control shall ensure that:

a. The pertinent issues of appropriate documents are

available at all locations where operations essential to

the effective functioning of the quality system are

performed.

b. Invalid and/or obsolete documents are promptly

removed from all points of issue or use, or otherwise

ensured against unintended use.

c. Any obsolete documents retained for legal and/or

knowledge-preservation purposes are suitably

identified.

Although registration is usually for three years, surveillance visits are

exercised typically every six months, or in the words of Brian Parnell,

"ongoing, forever."

Making documentation available for auditors involves a great deal of

preparation. The large amount of documentation involved makes a

document control system essential. If an applicant is not prepared for


16 3/4/2013 1:47 PM


7/16

the auditors' inspection, the cost to the applicant can be substantial.

Typically, a team of auditors will cost the applicant more than $1,500. If

even one day of the auditors' time is wasted due to lack of preparation,

the cost is unacceptable.

In addition the preparation for the auditors' visit can be expensive and

time consuming. Brian Parnell reported that in the Canyon Park facility,

a person delivering hard copies of a document to everyone who needs

to see it walks five miles, all within the facility.

A good document control system can pay for itself in one day.

To prepare for the auditors' visit, Visual SourceSafe can help a

company prepare as follows:

View all necessary documents from any SourceSafe client to

determine whether to include them in the review, without

having to check the files out of the database.

Generate reports to provide a change history of all comments

associated with projects, as required for document review.Generate reports showing all changes to the contents of text

files.

Generate any version of any document in the Visual SourceSafe

database. Even obsolete documents that have been deleted

from projects can be retained in the database.

Documentation Must Be Easily Accessible to All

Who Need It

Information must be readily accessible to anyone in the corporation,

from managers to accountants, but particularly to workers on the

production floor. The main reasons why companies fail their auditsbecause of documentation problems include:

Documentation isn't controlled, such as work scheduling, or a

list of which component screens to use. Many companies still

work with hard copies of documentation subject only to

physical changes. If a page falls out of a binder, it can simply

disappear.

Documentation might be available, but the person doesn't

know how to find it. Format of the documentation does not

matter. It simply needs to be effective for users. The

documentation can be hard copy or online, or online with hard

copy backup.

The most current version of the documentation is not available.

Updates to documents are difficult to propagate, particularly

with hard-copy-only documentation. Online systems that are

not distributed across a network also face problems updating

changes.

Documentation must be usable. Users of the documentation

complain that the system, whether hard copy or online, is hard

to use; in fact, they find it so hard to use that they find it easier

not to make necessary changes.

One of the key elements of the quality assurance system concerns

procedures. All workers must have access to documentation thatprovides each step of the process for which they are responsible.

Typically, work instructions are referenced often and must be available

at all times.


16 3/4/2013 1:47 PM


8/16

In many companies, people work with a mix of different computers.

Some people might still be using Intel 286 machines that lack the

power to run a contemporary graphical user interface. For these users,

Visual SourceSafe provides a command line interface to be run in an

MS-DOS shell. Users can work with the command line to create and

use batch files that can perform such functions as daily updates of files

and projects. Figure 2 shows a change history generated from the

command line.

Figure 2. Change history generated from the command line

Currently, documentation in Canyon Park is online in Microsoft Word

documents and consists mainly of high-level documents with

embedded Visio diagrams and other embedded figures. However,

according to Don Hirt, a systems analyst at Canyon Park, if response

time of the online system is too slow, a worker is more likely to look

for the hard copy and thumb through the pages in search of the

information he or she needs.

Although much documentation is currently available in hard copy,

online documentation would be acceptable if the response time for the

delivery system were adequate.

Visual SourceSafe, designed for client-server systems, makes

documentation available to any with access to a client machine. The

graphical interface contains a listing of all projects and all files within a

project. The same information is easily available with the command line

interface. By giving files names that are meaningful, the file list provides

easy access to the files. For someone to see a file, they need only to

double-click on the filename in the file list. Response time for the

display of the file is dependent on the application with which a file is

associated.

Documentation Versioning Is Necessary

Brian Parnell held up a large ring binder overflowing with different hard

copy printouts. "This," he explained, "is the archive system currently


16 3/4/2013 1:47 PM


9/16

being used at Canyon Park." Other groups in other facilities use

different types of archiving systems. Because of the need to provide

older versions of documents, an online archive system is desirable to

make the documents available not only to a central group, but also to

any local groups that may require access to the documents.

Visual SourceSafe retains all versions of documents through its

reverse-delta technology, saving only changes between versions, not

the entire documents. Any version of any document can be retrievedby using the Visual SourceSafe history tool. Figure 3 shows the History

of File dialog box, which is the place from which many tools are

available from buttons in the dialog box.

Figure 3. The History of File dialog box

By working from this dialog box, you can:

View any version of the file by selecting it in the file list and

clicking View.

View all comments on a file by clicking Details.

Obtain a read-only copy of a file by clicking Get.

View differences between any two versions of text files by

selecting both and clicking Diff.

Create a report by clicking Report.

Visual SourceSafe has a tool for displaying differences betweenversions of text files. The tool can identify whether or not a binary file

has changed between versions, but due to the structure of binary files,

the changes cannot be displayed. For some binary files, such as

Microsoft Word documents, the application that created the file has a

tool for displaying differences. Figure 4 shows a Visual SourceSafe

difference screen in the Visual SourceSafe format. In this format,

differences and insertions are identified by color. Differences can also

be displayed in UNIX style.


16 3/4/2013 1:47 PM


10/16

Figure 4. Visual display of differences between versions of a text

file

Evidence of Approval for Each Document Must

Be AvailableAll changes to all documents and procedures must be signed to

provide evidence of approval. Currently at Canyon Park, a physical

signature is needed for all changes, but Brian Parnell feels that online

approval would be acceptable. A document control system needs to

provide evidence that the people who needed to approve the

documentation actually did approve it.

All verified changes must be noted on the cover pages of the affected

documents. A history of changes is also necessary, but it is only as

good as the information given by the provider. One way to show

approval of changes online is to edit the comments for a particular fileby using the History Details dialog box, available from the History of

File or History of Project dialog boxes.

Each person who must sign off on a change can edit the comment to

show they approve or disapprove of a change and explain why. The

comment field can accommodate lengthy comments. For facilities with

scanners, a signature can be scanned into a file and then that file can be

stored in the appropriate Visual SourceSafe project.

Figure 5 shows the History Details dialog box that has been edited to

show how each person in the approval loop has granted their approval

to the changes.


f 16 3/4/2013 1:47 PM


11/16

Figure 5. The History details dialog box showing approval of

changes

Identifying Current Revision Status of

Documents

Section 4.5.2 of the ANSI/ASQC states:

A master list or equivalent document-control procedure

identifying the current revision status of documents

shall be established and be readily available to preclude

the use of invalid and/or obsolete documents.

This requirement of the standard seems to be aimed squarely at

version control systems, and in particular at Visual SourceSafe. As a

document management system, Visual SourceSafe provides tools to

display the current revision status of all files in the Visual SourceSafe

database, to display the comments associated with all changes to each

of the files, and a tool to display the changes between versions of textfiles.

The history command is the means by which you use these tools.

Access to these tools from the history command consists of selecting a

file from the file list in the Visual SourceSafe Explorer, then clicking the

history button. SourceSafe then displays the History of File dialog box.

This dialog box displays a listing of all versions of a particular file.

To generate a listing of the details of each change, you need only click

the Details button. To generate a listing of differences between

versions of text files, such as procedure details or source files, you need

only click the Diff button. To combine the two, click the Report button,

which displays a dialog box, shown in Figure 6, offering the choice of

how much information to include in the report and what format in

which to generate the report.


f 16 3/4/2013 1:47 PM


12/16

Figure 6. The History Report dialog box

By default, the reports are generated as text files. You can, however,

apply formatting by writing the report to the Clipboard and pasting

the contents of the clipboard into Microsoft Word. The content of the

report does not have to change because Visual SourceSafe provides all

the information. Figure 7 shows the "raw" report.

Figure 7. A "raw" Visual SourceSafe report

Figure 8 shows a report that originated in the History dialog box; the

report was formatted to add blank lines for readability and to change

font size and bolding for making certain elements easy to find. Notice

that the report contains comments entered by the person who last

checked in the file to the Visual SourceSafe database and also contains

differences between versions of the file. The ability to generate this

type of information is crucial for a version control system in an

environment that is to be ISO registered.


f 16 3/4/2013 1:47 PM


13/16

Figure 8. A Visual SourceSafe report formatted in an editor

An Example of Using Visual

SourceSafe for RegistrationTo see how Visual SourceSafe functions as a document control system,

consider the example of a hypothetical sewing company that

manufactures backpacks, tote bags, briefcases, gym bags, and other

outdoor equipment. As the designer, manufacturer, and distributor of

its products, this company is seeking registration to the ISO 9001

standard.

To expedite the registration process, the sewing company has used

Visual SourceSafe to control all documents. Each product line that the

company produces is represented as a different project within Visual

SourceSafe: Backpacks, Briefcases, Gym Bags, and Tote Bags. Each

project contains subprojects. For example, the Backpacks project

contains subprojects for Day Packs, External Frame Packs, and Internal

Frame Packs. Likewise, the Day Packs subproject contains subprojects

for each daypack, including Daypack 101, Daypack 202, and Daypack

303.

The company is set up with a local area network. The system has been

set up so that certain departments have read and write access to the

database. These are the departments with reasons to make changes to

files, such as design and purchasing. Other departments, such as

production and shipping, have only read access to certain projects.

The Visual SourceSafe database is installed on a server and each

department has at least one client installation. From the client

computers, people in each department can view or edit files to which


f 16 3/4/2013 1:47 PM


14/16

they have appropriate access rights. Figure 9 represents portions of the

Visual SourceSafe installation for the company. Each division of the

company can access all projects, or only those projects that directly

affect them. Access can be set up by project or by person.

Figure 9. Representation of a client-server installation for a

sewing company

To be certain that the entire project stays on target, the company is

using Microsoft Project, which contains built-in templates for ISO 9000

projects, to make scheduling and planning simple and intuitive. Like all

files associated with the registration effort, the .MPP and associated

Microsoft Project files have been placed under Visual SourceSafe

control in a separate project for scheduling. Figure 10 shows the screen

display for the master project.

Figure 10. Microsoft Project for ISO 9000 registration template

Because Visual SourceSafe is designed to work with projects and not

just with individual files, anyone who needs to gather all the


f 16 3/4/2013 1:47 PM


15/16

documentation for the production of a particular item can easily look

at the documents, check them out of document control to make

changes, compare newer and older versions of documents, and much

more. Anyone needing to look at an individual file can perform any

action that he or she has the access rights to do.

Testing has uncovered a problem with seams ripping in Daypack 202.

Changes must be made to both the materials list and to the

procedures. To do this, people must check out the files that they needand make the necessary changes. When they check in the file, they use

the comment field to describe what happened, how testing found

weaknesses, how they tested other possible ways to correct the

problem, and their final solution, including what changes will go into

effect and when.

While these changes are being discussed, specified, and then

implemented, all documents associated with the Daypack 202 are

under version control in Visual SourceSafe. This means that even under

such stressful situations, all documents are available to everyone who

needs to see them, including the ISO auditors.

Figure 11 shows the Visual SourceSafe Check In dialog box with a

lengthy comment. Comments in this dialog box can be hundreds of

lines long if necessary.

Figure 11. The Visual SourceSafe Check In dialog box

After checking in the file, it is available for perusal by all departments.

Then, the head of each department who must approve the changes

views the file. After they have studied the changes and decided whether

or not to approve them, each department head then goes to the

history of the file and edits the details in the comment field to show

whether or not they have approved the changes. The approval or

disapproval then becomes part of the history of the file and will show

up in the reports of the file's history.

These reports provide a complete history of all changes to the file. Even

if the person who changed a file did not add descriptive comments, arecord of the activity on the file is part of the file history. Visual

SourceSafe tracks all changes to individual files and to the projects that

contain the files. Figure 12 shows the history of a project, showing all


f 16 3/4/2013 1:47 PM


16/16

changes to each of the files within the project.

Figure 12. The History of Project dialog box

At this point, the company now has all the documents needed both forISO registration and for producing each project.

ConclusionsMicrosoft Visual SourceSafe is a version control system that provides

control of all documents that a company produces. These documents

are available in all versions since their creation. All changes to the

documents are stored so that any version of any document can be

viewed or retrieved at any time.

For a company seeking ISO 9000 registration, Visual SourceSafeprovides all the tools needed in an easy-to-use graphical interface or in

a command line interface for using batch files or for users who do not

have access to graphical interfaces.

When combined with Microsoft Project, Visual SourceSafe becomes a

powerful system for control of documents and schedules for any

company producing a product or a service.

2013 Microsoft. All rights reserved.
