Quality standards require a description of the business applications used

Most popular management standards include such a requirement, although it is rarely referred to as an ‘application list’. Quality and security standards use terms such as resource management, infrastructure oversight, business continuity and information assets.

This requirement is set out in the most widely used ISO and industry standards in the following areas:

ISO 9001 (Quality Management)

The ISO 9001 standard does not require a software inventory to be drawn up as a separate document, but it does require a description of the resources necessary to carry out the processes:

  • Clause 7.1.3 (Infrastructure): The organisation must define, provide and maintain the infrastructure necessary to achieve conformity of products and services. Software and business applications (ERP, CRM, accounting systems) form part of the information and communications technology (ICT) infrastructure.
  • Clause 7.5 (Documented information): Processes critical to quality must be documented. If the implementation of a process depends on a specific application (e.g. quotations in CRM, production based on MES), the use of these tools must be described in procedures or workstation instructions.

ISO/IEC 27001 (Information Security)

Here, the requirement is clear and unequivocal:

  • Appendix A.5.9 (Inventory of assets / Inventory of information and other associated assets): The organisation must identify and maintain a register of all assets related to information. Business applications are key assets (so-called software/application assets).
  • The register must contain not only the name of the application, but also its owner (business owner), its severity level and access policies.

Industry Standards (e.g. ISO 13485 for medical devices, IATF 16949 for the automotive sector, GxP/GMP in the pharmaceutical sector)

In regulated sectors, the requirements are very strict:

  • So-called software validation / computerised systems validation (CSV) is required. Every application that affects product quality must be documented, tested, validated and entered into the register of validated software.

How should applications be described to meet the audit requirements?

Auditors usually expect this information to be presented in two ways:

  1. Application/Software Register (Matrix/Inventory):
    • Application name and version
    • Purpose / process it supports
    • Application owner (person responsible for its operation)
    • Licence type and backup policy
    • Criticality to business operations (high/medium/low)
  2. Description in procedures and process maps:
    • The workstation manual or process map explicitly states the following step: “The user enters the order into the ERP system (Application X)…”

Summary

Even if the standard does not use the term ‘application description’, in order to pass a quality or security audit, you need to know which digital tools the company uses, what they are used for, and who is responsible for them.

This means that:

  • we create a workflow and document model
  • we create a high-level design (HLD) architecture model for the IT system
  • for each application, we create a use case model (i.e. the services that the application offers and to whom)
  • we map use cases to tasks within business processes (BPMN)

MIRO/PlantUML/Confluence? Months of work that nobody will pay for! So what now? A CASE tool – and then hours rather than weeks of work.

If you’re interested, I do this remotely

Watch this short presentation:

If you’re interested in how much it costs

The cost of producing such documentation is in the region of 3–4 thousand GBP, whilst the monthly cost of updating and maintaining it starts at 100 GBP monthly.