ISO9000 CERTIFICATION IN BRAZILIAN SOFTWARE COMPANIES

96QL058/961112

Kival C. Weber
POLO de Software de Curitiba S.A.
kival@polo.com.br
www.polo.com.br

Roberto A. R. Almeida
International Center for Software Technology
ralmeida@cits.br
www.cits.br

Helio G. Amaral
QUALYSUL Consultoria e Treinamento Ltda.
qualysul@cits.br

Jorge H. F. Xavier
BVQI do Brasil Sociedade Certificadora Ltda.
jhxavier@br.homeshopping.com.br

Pedro S. Gunther
HOTSOFT Informatica Ltda.
pgunther@cits.br
www.labplus.com.br

Renato Loures
TES - Tecnologia em Engenharia de Sistemas
tes@avalon.sul.com.br

ABSTRACT
Software process improvement is a major goal for the Brazilian software
industry. It seeks to achieve a good quality reputation and competitive
advantages in the domestic and international markets.
This paper focus on the status of Brazilian software quality and Brazilian
software companies that are tracking ISO9000 certification. The authors also
look at the Brazilian Program on Quality and Productivity (PBQP) which
seeks to meet international standards and the Brazilian Program for Software
Export (SOFTEX) which is committed to software quality improvement.
This paper describes how the Brazilian software companies are moving
forward to ISO9000 certification. It details the cooperative initiative approach,
in a pilot project named Towards ISO9000-3, used to link 10 small to
medium-sized Brazilian software companies that plan to achieve ISO9000
certification. As a partial result, in only the first half of 1996, 3 of these
companies achieved ISO9001/TickIT certification and 1 achieved
ISO9002/TickIT certification. They were assessed by the accredited British
company BVQI (Bureau Veritas Quality International). This pilot project was
coordinated by the International Center for Software Technology (CITS), a
private not for profit making institution in Curitiba, Brazil.
The authors stress that the main result achieved with this pioneering project
was the ISO9000 certification of these companies, but this type of
cooperative work also showed the following advantages: cost reduction was
achieved through the sharing of resources; the exchange of experiences and
the synergy accelerated the implementation of the Quality Systems; the
Project developed and proved a methodology that can be applied to other
groups of software companies in Brazil.
INTRODUCTION
Capers Jones, in Global Software Quality in 1995, stated that: For many years, software
quality assurance lagged behind hardware quality assurance in terms of methods, metrics,
and successful results. New approaches such as Quality Function Deployment (QFD), the
ISO9000-9004 standards, the SEI maturity levels, and Total Quality Management (TQM) are
starting to bring software quality levels up to a parity with manufacturing quality levels. Since
software is on the critical path for many engineered products, and for internal business

Page 2/Erro! Argumento de opo desconhecido.

systems as well, the new approaches are starting to attract widespread international
interest. ... As many countries strive to compete in the international software market place,
quality is now a major topic for both software vendors and for outsource contractors. Any
country or company that wants to achieve a major place in the world software markets must
achieve and maintain high quality software levels. It can be hypothesized that success in
mastering software quality will be a key strategy for dominating global software markets in
the 21st century. [1]
Throughout the world, software companies are working hard to achieve international quality
standards and some of them are reporting their experiences.
One of these reports comes from Sybase, the seventh largest software company in the
world, and the only independent to be ISO9001/TickIT certified in 80%+ of its engineering in
the United States. As a contribution to other companies interested in the matter, the report
describes old mistakes and critical success factors found in Sybases experience. [2]
Another case, reported by Schlumberger, concerns continuous software quality
improvement using the Software Engineering Institutes Capability Maturity Model. ... Return
on investment for various process improvements is quantified, and twelve best practices
described, plus some failures. [3]
Brazilian software companies are also seeking for ISO9000 certification. This paper reports
one recent and successful project aiming at this goal.
SOFTWARE QUALITY IN BRAZIL
In 1990, the Brazilian Program on Quality and Productivity (PBQP) was created, comprising:
general subprograms covering quality and productivity processes: awareness and
motivation, management techniques, human resources, technological services and
institutional relationships;
sectorial subprograms aiming to achieve international standards on quality and
productivity in the main sectors of the Brazilian economy.
In 1993, the Brazilian Sectorial Subprogram on Software Quality and Productivity was
created. The objective is the achievement of international standards on quality and
productivity in the software sector. As in every PBQPs sectorial subprogram, there is a
reference book for software quality and productivity which includes: [4]
sectorial diagnosis;
trend analysis;
objective and strategies to reach it;
annual lists of projects;
set of software quality and productivity indicators, metrics and goals.
In the 90s, the leverage of a competitive Brazilian software industry is a topmost priority. [5]
In 1993, the Brazilian Program for Software Export (SOFTEX) was launched by the National
Council for Scientific and Technological Development (CNPq).
Between 1993 and 1996, SOFTEX provided infrastructure to 18 regional nuclei in the
country, offering software laboratories, technical libraries, and Internet connection, among
other resources. It also installed SOFTEX offices in the US, in Europe (Germany) and in
China, and promoted Brazilian Software Pavilions in the computer trade shows COMDEX
Fall (Las Vegas, US) from 1993 through 1996 and CeBIT (Hannover, Germany), in 1995
and 1996.

Page 3/Erro! Argumento de opo desconhecido.

Starting 1997, SOFTEX will be managed by a private, not for profit making institution, and
will rather focus on strengthening Brazilian software companies. Therefore, software quality
will be an even more important issue in this new phase of the program because
competitiveness depends on quality improvement.
SOFTWARE QUALITY IN CURITIBA, BRAZIL
In the early 90s, a movement proposed by the entrepreneurial sector, with the support of
the local and state governments and with the involvement of the academic community,
started in Curitiba, the capital of the Brazilian State of Paran, in the Southern part of the
country, aiming to transform the city into a center of excellence in software [6].
As result of this cooperative initiative, several entities were created in Curitiba, such as the
International Center for Software Technology (CITS), the Brazilian Subcommittee for
Software Standardization (ABNT/SC21:10), the Curitiba Nucleus of the SOFTEX Program
(managed by CITS), and the Curitiba Software Park (a technology condominium for
software companies) [7].
CITS is a private non-profit organization established in 1992 as result of a joint initiative of
the local government, private companies and universities of Paran. CITS major objective is
to promote the utilization of software technology as an instrument for business
competitiveness and to stimulate its development through cooperation with the local
universities. [8]
CITS mission is stated as:
To promote in the state of Paran and Brazil, through the qualification of human
resources, research and development, and partnerships, in the area of software
technology:
business competitiveness;
academic excellence;
utilization of software technology by the government aiming at the social
welfare.
CITS main contribution to the development of software technology in the Paran State, and
in a certain sense in Brazil, is in the software quality field. Thanks to the efforts of CITS and
its many local partners, Curitiba emerged in the last four years as one of the Brazilian
centers of excellence for software quality.
An important contribution of CITS is the annual International Conference on Software
Technology: Software Quality, created in 1992. Its organization is another example of CITS
commitment to cooperation: typically, its Technical Committee is formed by representatives
of the most active universities and R & D institutions in the IT field in Brazil. Besides putting
together the most relevant academic results in the field, the Conference promotes the
exchange of experiences with the industry.
CITS also coordinates nationally the Brazilian Sectorial Subprogram for Software Quality
and Productivity, promoted by the PBQP. This Subprogram has around 100 participants
from dozens of private companies, universities, R & D institutions, branches of the
government and other entities, and stimulates, proposes and conducts dozens of projects in
its field of activity.
The Brazilian Subcommittee for Software Standardization (ABNT/SC21:10) was established
in Curitiba in 1992, and is since then very active nationally and internationally, receiving
strong support from CITS. The mission of the Subcommittee, as part of the Brazilian
Association for Technical Standards (ABNT), is to propose and create the national
standards for software and to represent Brazil in the ISO/IEC international groups for
software standardization.

Page 4/Erro! Argumento de opo desconhecido.

CITS was the first institution in Brazil to offer courses on the Capability Maturity Model of the
Software Engineering Institute (Carnegie Mellon University). Introductory CMM courses
were offered twice in 1996 with attendees from several Brazilian states.
Besides this, CITS is implementing its own Quality System looking for ISO9000 certification.
THE TOWARDS ISO9000-3 PROJECT
Overview
As result of all these factors the Towards ISO9000-3 Project was established in 1994, by
the initiative of and under the coordination from CITS, having as a general objective the
improvement of quality for the Paran state software companies and as short term goals the
qualification and ISO9000 certification of a group from those companies. The companies
engaged in the Project develop and commercialize software, both standard and customized.
All these companies are of small size (5 to 50 employees), acting in several market niches,
such as business and finance, bank automation, hospital information systems, and office,
services and industrial automation.
The first phase of the Project, started November 1994 and concluded September 1995,
aimed at the development of ISO9000 skills, through training and consulting services for the
10 companies selected by CITS and ASSESPRO/PR (Brazilian Association of Software
Companies, Paran Branch) after a public invitation to all software companies in the state of
Paran. This first phase was made possible by funds from the SIDEE Program (a joint
program of the Parana State Technology Integration Center - CITPAR with the GTZ Deutsche Gesellschaft fur Technische Zusammenarbeit GMBH, a German government
agency for industrial cooperation), SEBRAE/PR (the Brazilian Agency for Support to Small
Companies, Paran Branch), CITS and the participating companies.
This phase comprised 15 activities summing up 626 hours of consulting and training,
provided by QUALYSUL, a Curitiba based consultant company which specializes in quality
management systems.
At the conclusion of the first phase it was clear that at least 4 companies were ready to start
the certification process, and that the others would require some additional time to fully
implement their quality management systems.
The second phase was launched in October, 1995, having as goal, the ISO9000 certification
of the companies. For this purpose, CITS coordinated the contracting of an accredited
certification body internationally recognized for its experience in the assessment of software
companies, and kept supporting the companies in their activities related to the certification.
To support this second phase, CITS gathered funds from the SOFTEX Program and FINEP
(a federal agency supporting technological and industrial development), in such a way that
the participating companies would be responsible for about 50% of the total cost. SOFTEX
contributed with traveling grants for the trips of the auditors from England and Rio de
Janeiro to Curitiba.
The 10 companies were divided into two groups with the companies of the first group
(AUSLAND, HOTSOFT, KERNEL and POLO) seeking certification in the first half of 1996.
The 6 month period needed for surveillance audits suggested a 6 month delay in the start of
the second group, for synchronization of activities and cost reduction.
The reason for the choice of BVQI - Bureau Veritas Quality International was its reputation
as one of the most experienced ISO9000 accredited certification bodies in the world and its
experience with software companies.
The optimistic predictions were surpassed by the results: three software companies (POLO,
HOTSOFT and AUSLAND) achieved ISO9001/TickIT certification and one (KERNEL)
achieved ISO9002/TickIT certification in the first half of 1996.

Page 5/Erro! Argumento de opo desconhecido.

Point of View of the Quality Consultant

QUALYSUL, located in Curitiba, is one of the two Latin America companies which have the
ISO9001 certificate in providing consulting in organizational management for implementation
of quality systems, having provided services all over the country since its foundation in May
1994. QUALYSUL participated in the Towards ISO9000-3 Project as the quality
management consultant.
The consulting method comprised three steps:
Generating a critical mass of knowledge
In this first step, activities were realized to provide specific knowledge within the companies
to begin the implementation of the formal quality system. The starting point was the initial
evaluation, which provided the consultant company a realistic picture of each the 10
companies with respect to quality requirements. Through several meetings and training
activities the personnel of each company was given the required motivation and awareness
level to proceed with the next steps.
Implementation of formal quality system
This step began with the identification and description of the processes within each software
company from the ISO9000-3 perspective. Each company prepared and then implemented
its own Quality Manual, its related procedures and work instructions.
Internal audit, corrective actions and pre-assessment
After completion, each quality system was evaluated by internal auditors, allowing the
correction of the detected non-conformities. At the end of this step, a pre-assessment of the
quality system of each company was performed by the consultant.
Point of View of the Quality Accredited Certification Body
BVQI Brasil, located in Rio de Janeiro, is a branch of Bureau Veritas Quality International of
England. It participated in the Project as the accredited ISO9000 certification body.
The certification process foresees, for each company, the following three phases: pre-audit,
formal audit and surveillance visits.
A pre-audit was carried out by BVQI three months before the formal audit, focusing on the
following clauses of the ISO9001 International Standard:
Design Control;
Management Responsibility;
Corrective and Preventive Actions;
Internal Quality Audit.
Design Control was chosen because the experience demonstrates that for software
companies involved in design and development activities, the majority of non-conformities
found during formal audits are related to this clause. The other clauses were chosen
considering that they are related to the feedback cycle; therefore, if they were well designed
and implemented, the companies would be able to close the PDCA cycle by themselves.
The approach used in the pre-audit proved to be successful because it was seen that
considering the clauses audited at that time, the companies showed an improvement in their
quality system, thus reducing the amount of non-conformities found during the formal audit
and the time needed for corrective action.
Six months after the formal audit, the companies received the first surveillance visit and it
was seen that the Quality System had helped some of them to overcome financial problems,
allowing one of them to obtain better financial results with the increase of productivity.

Page 6/Erro! Argumento de opo desconhecido.

The future challenge is to finalize the adequacy and conformity phases and move forward to
analyze the data made available by the Quality System records and take action to really
improve or change the actual processes, This challenge is even greater for small companies
that are investing all their resources in the struggle to survive in the market than for medium
and large companies that are receiving the return on the investments already made.
Point of View of the Certified Companies
POLO de Software de Curitiba S.A.
POLO is a software company located in Curitiba, Brazil, with a branch named POLO
International in Austin, Texas, US. POLO is engaged in the SOFTEX Program since 1993. It
is focused on application software for Business & Finance and has developed the software
product DOC-CONTROL, a document control system.
Since its creation in 1990, POLO made use of the Total Quality Management principles to
improve its software processes. In 1994 its management took the decision to establish a
formal Quality Management System and stimulated CITS to create the Towards ISO90003 Project.
From November 1994 through September 1995, POLO developed the following activities to
implement its Quality System, with assistance from QUALYSUL:
motivation of its personnel and definition of its quality policy, from November 1994
through February 1995;
writing of the required quality documents, from March through June, 1995;
putting its quality system into pilot operation, from July through September, 1995.
POLOs Quality Policy looks for the continuous quality improvement of its processes,
products and services, pursuing the following goals:
achieve the customer needs satisfaction;
improve quality live at work for its employees;
meet the shareholders expectations.
Because the top management of the company was strongly committed to the process
quality improvement, a significant part of the company also embraced the cause. Barriers to
the implementation were found (such as work pressure, superposition of tasks, insufficiency
of resources) and circumvented.
Therefore, in December, 1995 POLO was submitted to an ISO9000 pre-assessment by
BVQI and in March 1st, 1996, its ISO9001/TickIT certification was achieved. The scope of
POLOs certification is design, development, supply, maintenance and technical support of
applied software for business and finance, banking automation, document management,
marketing assistance and municipal administration (Transportation, Health and Education
Systems).
HOTSOFT Informtica Ltda.
HOTSOFT is also a software company located in Curitiba. It developed a LIS (Laboratory
Information System) named LABplus for Windows, which automates the tasks carried out in
a clinical laboratory facility, such as patient check-in, reporting of test results, billing and
statistics. The company has been dedicated to this sector since 1987 and has around 160
clients in Brazil. It joined the SOFTEX Program in 1994 and is currently working on an
English version of LABplus for Windows.
HOTSOFT decided to participate in the Towards ISO9000-3 Project understanding it would
be a unique opportunity. The cooperative approach and the raising of funds by CITS made it
possible to small firms like HOTSOFT to take the quality challenge. At first, the goal was to

Page 7/Erro! Argumento de opo desconhecido.

improve the software development process. As the training went on, it was understood that
ISO9000 offered the means to grab and control the company. It became clear, then, that
HOTSOFT should not go after the certification, but organize its business.
At the beginning, with the assistance of QUALYSUL, HOTSOFT formally indicated its
Technical Director as the Quality Manager. The company counted then with only five
persons. The most difficult task was then to spare the time needed to study and start writing
the quality procedures. This was really the hardest part: inserting another 8 hours of work
over a day already filled-up!
As the work advanced, the writing of the Quality Manual was so behind schedule that
HOTSOFT almost gave up. But then, the group of companies in the Project was split in two,
because some companies were clearly more advanced in the process, and HOTSOFT took
the challenge: in no more than 3 months, the writing of the procedures was completed and
their implementation started. Another external quality consultant (from TES - Tecnologia em
Engenharia de Sistemas) was added to the team, and became of vital importance. This
consultant showed HOTSOFT that if it had a disadvantage in being so small, on the other
hand, it could quickly train and implement the quality procedures in the whole company.
In December, 1995, HOTSOFT requested to BVQI a pre-assessment; this was very helpful
to show were efforts should be concentrated. The certification assessment happened in
February, 1996, and was successful.
AUSLAND Consultoria e Informtica
AUSLAND is another software company located in Curitiba, also engaged in the SOFTEX
Program in 1993. It is dedicated to design, develop, support and maintain application
software for industrial management. Its major software product is AUSBAUS, an integrated
industrial management system.
Quality management has been a major concern of the company, and the Towards
ISO9000-3 was the right opportunity to implement it. AUSLANDs strategic objective is to
become an international quality software-house.
The implementation of the quality management system at AUSLAND occurred in two
phases.
In the first one, 12 month long, the company worked together with the other software
companies in the implementation of the ISO9000-3 requirements. This collaborative effort,
with the assistance of QUALYSUL, provided AUSLAND the capability:
to define the quality policy including quality objectives and measures;
to train personnel to develop and implement an organization-wide quality system;
to develop a plan to implement the quality system;
to establish the standard for the quality documents;
to write the quality manual;
to train an internal quality audit team.
The second phase, with a duration of 6 months, was characterized by a firm effort in the
standardization of the processes in the company according to the ISO9001 and ISO9000-3
requirements. The Quality Group created to perform this task was cross-functional, including
one employee from each department and an external quality consultant (from TES Tecnologia em Engenharia de Sistemas), under the coordination of a Quality Manager.
The Quality Group organized the companys processes into five categories: Quality
Management; Marketing and Sales; Software Development; Training and Maintenance; and
Support.
The following steps were applied to each category:

Page 8/Erro! Argumento de opo desconhecido.

definition of the rules, practices and control tools for the processes;
implementation and testing;
elaboration of the documented procedures;
conduction of internal quality audit to check the effectiveness of the implemented quality
elements;
taking of corrective and preventive actions.
CONCLUSIONS
What was learnt?
CITS
From the standpoint of the promoters of the Project, the following advantages of the
cooperative work were noticed:
cost reduction was achieved through the sharing of resources both in the
implementation and certification phases;
the exchange of experiences and the synergy accelerated the implementation of the
Quality System in each company;
the establishment of a common framework for quality management within this group of
cooperating companies facilitates the interaction among them and between each of them
and CITS;
the Project developed and proved a methodology that can be applied to other groups of
software companies in Brazil.
QUALYSUL Consultoria e Treinamento Ltda.
From the standpoint of the quality consultant, the following lessons were learned:
a new and important experience - the implementation of ISO9000 based quality systems
in software companies - was added to the portfolio of the quality consultant company;
the participation of the top management of the software companies was the determining
factor of success;
the indication of one representative of each software company management (the quality
manager) to lead the process was also a key factor;
the exchange of experiences among the software companies was very important to
speed up the implementation process.
BVQI Brasil
From the standpoint of the ISO9000 accredited certification body, the pre-audit contributed
to reduce the amount of non-conformities found during the formal audit and the time needed
for corrective actions.
POLO de Software de Curitiba S.A.
From POLOs standpoint, the meanings of the ISO9000 quality system implementation and
certification were:
to show that it was possible to participate in cooperative initiatives with competitors,
sharing costs and activities, without loosing its own identity or privacy;

Page 9/Erro! Argumento de opo desconhecido.

to understand that the certification was both a victory of perseverance and an incentive
to the continuous quality improvement;
to understand that the certification was only a means to achieve the ultimate goals of
improving the customer satisfaction, the quality life at work, and the shareholders return on
investment;
to ratify the management of software processes as the main strength of the company;
to be able to use the certification as a passport to both domestic and international
marketplaces.
HOTSOFT Informtica Ltda
From HOTSOFTs standpoint, the following lessons were learned:
ISO9000 certification is a must: it does not replace business expertise but grants the
minimum organization every company should have;
it is easier to satisfy the customers if the company complies with the ISO9000 quality
requirements; therefore, increasing the business is a consequence;
the commitment of the top management is necessary;
the time invested in the process exceeds by far what was initially planned, but the
rewards will later be worthwhile.
AUSLAND Consultoria e Informtica
From AUSLANDs standpoint, the critical success factors in implementing the ISO9000
quality system were:
the commitment of the top management;
the use of quality methods on implementation of quality elements;
the training of the employees;
the involvement and the effective participation of the Quality Group members.
The following benefits were also pointed by AUSLAND:
the establishment of a software life-cycle model for incorporating software process tasks
and activities in consistent ways;
the improvement of testing procedures;
the increased control of support and maintenance processes;
the increased accuracy in the elicitation of customer requirements specifications;
the implementation of a systematic customer satisfaction survey and service level
agreement.
What next?
The Project gained a significant attention nationwide and is now seen as a model for other
groups of companies in Brazil and Mercosul (the South America Southern Cone trade
block).
New groups of software companies are being created, mainly in the 18 Brazilian cities
where SOFTEX nuclei are located, aiming at the Software Quality Management Systems
construction and certification using ISO9000 international standards.
References:

Page 10/Erro! Argumento de opo desconhecido.

[1] Jones, Capers, Global Software Quality in 1995, 5th International Conference on
Software Quality (5ICSQ), Austin, TX, USA, October 1995.
[2] Macfarlane, Malcolm L., Eating the Elephant one Bite at a Time - Effective
Implementation
of
ISO9001/TickIT,
Sybase,
Inc.,
November,
1996
(at
www.exit109.com/~leebee/case01.htm).
[3] Lloyd, Peter M., Return on Investment from Continuous Software Process
Improvements in an International Company, Schlumberger Austin Product Center, 5th
International Conference on Software Quality (5ICSQ), Austin, TX, USA, October 1995.
[4] Weber, Kival C. and De Luca, Jos C. M. and Rocha, Ana R. C., Qualidade e
Produtividade em Software - Termo de Referncia do Subprograma Setorial da Qualidade e
Produtividade em Software (SSQP/SW) do Programa Brasileiro da Qualidade e
Produtividade (PBQP), 2a. edio, Makron Books, So Paulo, Brasil, 1997 (in Portuguese).
[5] Weber, Kival C. and Pinheiro, M., Software Quality in Brazil, The Institute of Quality
Assurance, Quality World Magazine, London, UK, November, 1995, pp. 781-783.
[6] Weber, Kival C. and Almeida, Roberto A. R., Curitiba, Brazil: A Center of Excellence in
Software, International Conference on Cooperative Initiatives, CITS, Curitiba, Brazil,
December, 1994.
[7] Almeida, Roberto A. R. and Paciornik, M. E. F., The Contribution of the Curitiba
Software Park to the Development of Software Technology in Curitiba, The V World
Conference on Science Parks, IASP/AURRP/ANPROTEC, Rio de Janeiro, Brazil, October,
1996.
[8] Almeida, Roberto A. R., The International Center for Software Technology as a Model
for Cooperative Initiatives with Industrial Partners, Workshop on Information Technology:
Cooperative Research with Industrial Partners between Germany and Brazil, GMD/CNPq,
Berlin, Germany, July, 1993.

CT. POLO N# 268/96

December 2nd, 1996

Dear Mrs. Kit Stones,

I am sending you attached 10 pages formal paper ISO 9000 Certification in Brazilian
Software Companies to be submitted to the referees of the 5th Annual International
Conference on Software Quality Ma nagement (SQM 97), which will be held on 24-26
March 1997, in Bath, UK. I am sending you these same documents by mail.
If accepted, presentation will be made by myself or one of my co-authors.
In 05 September 1996 I sent you by fac-simile message the abstract for this formal paper.

Page 11/Erro! Argumento de opo desconhecido.

Best Regards

Kival Chaves Weber

President
POLO de Software de Curitiba S. A.