Introduction

ISO 9001 is a standard of quality management systems (QMS) with international recognition, as is shown by over one million companies and organizations in over 170 countries certified [1]. ISO 9001 certification is not mandatory; however, it can be a useful tool to add credibility and differentiate an organization from its competitors [2]. The certification allows demonstrating that a company complies with standards and procedures that will provide a high level of customer service [3]. The primary motivation for ISO 9001 certification is to improve the products/services, and most importantly, the process that produces them [4]. If the process is done correctly, ISO standards can improve the business processes and add real value to the company, enhancing its performance[5]–[8].

For obtaining an ISO 9001 certification, an external body audits the company requesting the certification. This process includes verifying the control of the documentation, the records kept the conformity of the personnel and management with the system, the functioning of the system in each area of the organization, and the training of the personnel to comply with the requirements, among others [9]. However, suppose that the process is not well implemented. In that case, the company can not obtains the certificate or lost it. That produces continuous pressure on the company to maintain the certification, becoming a source of corruption risk. The company could be tempted to do unethical practices like paying a bribe, adulterating or falsifying registries, or other corrupted methods to keep the certification [10]. Even, for some industries in emerging markets, quality certification is a contractual requirement to export to some markets[5].

In this context, the audit of information in repositories and databases has some drawbacks since the registries can be modified, added, or deleted by unethical practices or even cyber-attacks [11], [12]. All this makes it impossible to guarantee real transparency and reliability of the information to be used by certifying bodies. It could be almost impossible for an auditor to detect whether a document was tampered with or whether the evidence is the actual result of a well-done procedure. Unless the system can maintain immutable records and allow traceability of the process.

Due to the aforementioned, in this study, a Blockchain-based Software Architecture to guarantee the immutability, traceability, and transparency of the quality assurance and certification process under ISO 9001:2015 is proposed. This architecture takes the essence of quality management systems, with their requirements and principles, to be reinforced by Blockchain technology. To provide greater confidence and transparency in the information and documentation needed to carry out an ISO 9001:2015 certification process that allows the audit of this information to be performed anywhere by any person with access to the Blockchain and even facilitates its automation.

Literature Review

This section explains the essential concepts regarding ISO 9001:2015 quality management systems and Blockchain technology.

Quality Management Systems and ISO 9001:2015

Nowadays, there are many interpretations of what quality is, a simple definition is meeting customer requirements. For ISO 9001:2015 Quality Management System[13], is the “degree to which a set of inherent characteristics of an object fulfills requirements”. The ISO 9000, is a generic series of quality management standards for quality management systems (QMS). A QMS includes all activities of the overall management function that determine the quality policy, objectives, and responsibilities and their implementation. ISO 9001:2015 apply to the business process within an organization and can be used by manufacturing or service industries [14]. ISO 9001 is based on seven principles that represent a set of fundamental beliefs, norms, rules, and values as described ISO [15], these principles are customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision-making, and relationship management, table 1 provides a description of them.

ISO 9001 may be implemented in different ways depending on organization management, thanks to its flexibility and the scope for the certification process, which might explain the unmatched performance of these standardized systems [16]. The standard was the first released in 1987, since then, it has been a significant quality movement and framework for all kind of organization worldwide; it is estimated that more than one million companies have adopted this standard since its creation[17].

According to the American Society for Quality [18], ISO 9001 is based on a plan-do-check-act methodology and provides a process-oriented approach to documenting and reviewing the structure, responsibilities, and procedures required to achieve effective quality management in an organization. Specific sections of this standard contain information on topics such as requirements for a quality management system, including documented information, planning and determining process interactions; responsibilities of management; management of resources, including human resources and an organization’s work environment; product realization, including the steps from design to delivery; measurement, analysis, and improvement of the QMS through activities like internal audits and corrective and preventive action [13]. Where standardized processes allow guaranteeing the repeatability in the product or service quality features.

The adoption of ISO 9001 in a company requires an implementation process which will be involved all company statements. In this sense, the British Assessment Bureau [19], suggests the following steps for a successful implementation:

1. Make the right choice: Make sure the standard it has chosen fits the organization’s needs; also make sure it already has processes that can be assessed.

2. Reviewing the standard: It will help it to learn the quality management system it wants to be certified.

3. Communicating the goal: The implementation process requires teamwork from all its collaborators. Additional effort will be necessary; it is important to communicate the objectives and the target to be achieved.

4. Establish training requirements: Get prepared to be ready. Based on its team knowledge about the standard, could be beneficial to improve its skills to help the implementation process

5. Using a consultant: ISO standards implementation requires a consultant to help companies get certified. It is not the consultant’s responsibility for implementing the ISO standard. Each company handles its implementation. Senior management should be actively involved in the process to achieve the goal.

6. Select a certification body: ISO implementations are based on a three-year cycle; make sure the certification body can provide it with the companionship it needs for this specific objective.

7. Developing a management system: These standards apply to any organization in any industry sector. The framework provided for this standard will not tell it how to manage processes in its organization; it has to implement a quality management system based on the standard that applies to its own organization in concordance with its resources, production, measurement, analysis, and improvements.

8. The stage 1 audit: The process starts with a "Stage 1 Audit". The auditor will review the process and provide a gap analysis that will help to identify the actions required for meeting the standard.

9. The stage 2 audit: Once your organization has filled the gaps identified during stage 1 audit, it comes to the Stage 2 Audit, this will demonstrate the effectiveness of your quality management system and that your organization meets the requirement for certification.

10. Maintaining the management system: This can be the hardest part of the certification, it is the organization responsible for ensuring that itself applies the quality management system once the certification has been granted. Communication and training will be necessary along the way, internal audits must be implemented to make sure the standards are being met, and corrective action should be held to assure quality management.

Once QMS is implemented, an organization that requests ISO 9001 certification should demonstrate that fulfills requirements to be certified [20]. Where the core of the certification process is the audit; in which the compliance standardized processes against the registries or document evidence provided by the company is verified. This process must be performed by an independent, impartial, and free from conflicts of interest certification body. Depending on the audit findings, the company or process is certified or not.

However, as was defined by the ISO 9000 principles, the result depends on the information registered in the evidence. This system feature could represent a weak element of the system in some contexts. Because the evidence could be changed or deleted for varied reasons, and the process will depend on the honesty of their participants (company and certification body). Unfortunately, these situations happen although contradict the system principles.

Blockchain

In 2009, as the world was reeling from a meltdown in the financial sector and politicians were musing about what could and should be done, a project called Bitcoin quietly dropped onto the global stage; Satoshi Nakamoto [21] published the article Bitcoin: A Peer-to-Peer Electronic Cash System in October 2008, in which he described the cryptocurrency called Bitcoin. Many electronic cash schemes existed prior to Bitcoin, but none of them achieved widespread use. By adopting Blockchain technology, Bitcoin achieved compelling capabilities that promoted its use. The use of a Blockchain-enabled Bitcoin to be implemented in a distributed fashion so that no single user controlled the currency and no single point of failure existed [22].

Blockchain may have been used as the underlying technology for all Bitcoin’s transactions; but its applicability goes beyond. This technology itself can be described as the general ledger for all transactions of any kind of assets ever made [23]. Blockchain enables a potentially evolving and open set of parties to maintain a safe, permanent, and tamper-proof digital ledger of transactions, without a central authority. The key to the technology is that transactions are not recorded centrally; instead, each party maintains a copy of the ledger. Most parties need to approve (verify) a new transaction before it can be recorded in the ledger – according to a notion of the majority that varies depending on the specific technology. Once a transaction is approved, it is almost impossible to change it or remove it. Hence, Blockchain technology can be seen as a replicated append-only transactional data store, and hence it can be used as a substitute for centralized registers maintained by single trusted authorities [24], it has the potential to revolutionize the digital world by enabling a distributed consensus where each and every online transaction involving digital assets, past and present, can be verified at any time in the future. It does this without compromising the privacy of the digital assets and parties involved. The distributed consensus and anonymity are two important characteristics of Blockchain technology.

Blockchain 2.0, goes beyond cryptocurrencies and is involved with Smart Contracts, which are mostly a computer protocol designed to facilitate, verify, or enforce the negotiation or execution of a contract digitally [25]. These contracts allow the realization of credible transactions without third parties and are stored under the Blockchain technology. Due to this technology potential, many industries have been working in order to adapt and adopt it in different business process, the main criteria to decide to use or not the Blockchain will define whether or not the assistance of intermediaries along the process.

There are different opportunities to apply Blockchain technology in varied industries as is described next. In agriculture Blockchain applications include food safety through traceability of provenance, information system, agro-trade, finance, crop certification, and insurance [26]. The provenance of products, and traceability is one the most important application of Blockchain in order to track the life-cycle of a product, information that can be used to make an informed purchase. Prior works have been done on this field, e.g., [27], [28].

Several bank entities are working together to adopt Blockchain technology, mostly for the settlement of transactions between financial entities; this will reduce the time in which a transaction is reflected from one entity to another. Blockchain platforms will also likely take some role in replacing the systems that now manage the distribution of electricity. As a smarter grid is built, Blockchains may aid in facilitating dynamic signaling between producers and consumers, especially as the line between those roles continues to blur [22].

Identity management systems based on Blockchain can facilitate the identification process in crucial situations like an emergency [22]. All the data about the medical records of a patient shared among all practitioners, making these records trustworthy and immutable [22]. Social programs are susceptible to be affected by unethical practices, due to its sense this contribution Cortes et al., [29] presents a model based on Blockchain technology with a reliable structure, in which the transactions are registered in Blockchain and smart contracts take control over the verification of the processes’ fulfillment.

Industry 4.0 [30] with the Internet of Things technologies could provide the links between Blockchain technologies and different applications as supply chains [31], even allows to recover process information. Also, there are many opportunities for implementing Blockchain technologies for circular economy strategies as is described by Vogel [32]. In this sense, Blockchain technology could be used in reverse logistics to reduce uncertainty about the quality and condition of used products [33].

The applications of Blockchain technology previously described have in common that they seek to provide credibility in the information. In this sense, they apply the principles of immutability, traceability and transparency of the transactions carried out in the Blockchain. These principles are used to solve problems in which there is a risk of losing, modifying or even adulterating information. It is precisely these characteristics that this study wishes to add to the quality management system towards to mitigate the risk of executing unethical actions, providing confidence to stakeholders.

Blockchain-enabled Software Architecture Proposal

The Blockchain-based Software Architecture to support ISO 9001: 2015 certification, is proposed to improve the current certification structure. As we have seen in section 2, currently there is a well-defined process to achieve this, involving third parties in the process, in terms of consulting and auditing.

An information system architecture without the use of Blockchain, such as those that currently exist in the market, may make unnecessary to use a consulting company to generate pre-audit readiness; However, this same information system, using Blockchain technology, can facilitate the audit process, due to the way in which the Blockchain is constructed, the traceability of the transactions generated during the preparation of the certification process can be determined.

In this case, the proposal of using Blockchain to support a quality certification under a specific standard, this means, the same software architecture we already know with an additional layer, see Figure 1, must consider the use of specifics Blockchain components as presented in Table 2, with the purpose of being able to validate conditions and business rules that are present in the information that is being stored into the Blockchain[39]. Given the fact that an audit model must generate action plans regarding the findings, they must be parameterized a priori, so that the necessary alarms can be generated to comply with the standard.

The main component of this architecture (see Figure 1) is the Business Process Management layer, which is used to communicate information among different audiences, in this case between the services layer and operative system layer.

As shown in Figure 2 The communication between QMS and Blockchain will be through REST² API³. Services, which endpoints are provided by the Blockchain and will be connected to the QMS server Creating the Block of chains (see Figure 1). For each transaction performed in the QMS that triggers a call to the Blockchain, will start a process (see Figure 3) to verify the validity of the transaction (consensus), validate the outcome of the process through the smart contract (validation), which will establish whether the processes is inside the control limits or not; with this information, it will send a response to the QMS server (alert) for the business process owner to take actions on the process, that, at the end, for this kind of certification will be a consider an opportunity for improvement and finally store the information on the Blockchain (Block 1).

This software architecture is proposed to work under a permissioned Blockchain, which means, the administrator, in conjunction with the organization, will decide who gets to participate and their roles.

Proof of development

A QMS is used by businesses to control vital activities through a set of policies, procedures, and processes for meeting customers’ requirements. Several types of QMS have been developed based on ISO 9000 Standard, which requires all intern operations to be documented and employees to follow them. One of major principles of QM is decision making based on evidence. Data gathered allows to inspect the actual result of the process and then compare it to the goal established in the quality objective in each process.

Based on the above, through a proof of concept (POC), we developed two smart contracts to simulate the monitoring of a task. This implementation was not carried out to see the overall functionality of the QMS but focused on checking the traceability of one activity, specifically the creation, review, and approval of one document. We chose Ethereum, an open-source blockchain platform with smart contracts functionality, for this implementation. It provides the object-oriented programming language Solidity, allowing easy business logic implementation and producing a digital ledger of transaction records. Finally, it was tested on the decentralized applications Ethereum ecosystem by using MetaMask.

Those contracts in Solidity contain persistent data in state variables, and functions can modify these variables. In this test, the contract CreatorTask creates the contract Responsible4Task. When the contract Responsible4Task is created, its constructor method, a function declared with the constructor keyword, is executed once.

Algorithm 1 models the responsibility concept through a contract; the ’owner’ variable is the type ’address’ that holds a 20-byte value corresponding to the last 20 bytes of the hash of a public key. The tasks and the owners (task responsible) are identified with addresses for this design. The addresses are pre-fixed ’0x’ since this represents the hexadecimal format (base 16 notation). It manages the data related to the employee in charge of the task, so the function exists to transfer responsibility to a new owner when the employee cannot make the task.

Algorithm 2 models the task concept, and only when a task is created a ’Responsible4Task’ contract must be constructed then. This contract creates a responsibility contract from the source code (and the binary). It manages the data related to the task, what it is about, where the evidence is stored (records and documents), its state, and who the employee is related to it.

Figure 4 is composed of three images. The black box on the left is the development environment just before deploying the contract. Above it, the upper rectangle in light blue color identifies the account ’0x737d..31F’ and the amount of Ether cryptocurrency in it; and the bottom rectangle indicates the contract name and its state. On the right is the graphical interface of MetaMask that is connected to the Account Rp1 ’0x737d..31F’ that belongs to the Rospten Network. Since the test uses the Ethereum blockchain, the account needs ETH gas, an amount of Ethereum cryptocurrency, which means an amount in Ether to pay the cost for users to interact with the network. Miners in the ecosystem set the price of ETH gas based on the network’s computational power they consume to verify a transaction and put on a layer of security to the network. At the bottom is the notification window that shows up when the transaction is done and the contract is ready for execution.

Figure 5 shows the TaskCreator and Responsible4Task contracts. The TaskCreator exposes the function ’createTask’ after it executes and included in a block which hash is ’0xf39Fd...’ (left side). In this test, the task is to create a document defined in the field type with the value ’0’, and the description field stores the detail of the task, which is a ’communication plan’. The source field relates to the absolute address where the document is stored, since database, repository, or local file system. And the data of the task responsible are bound with the ’role’ and ’id_employee’ fields. The top right picture shows the function ’getResponsibility’ that returns the description of the task. And the bottom right picture is the contract ’Responsible4Task’. The function getOwner returns the owner of the task address which is associated to account ’0xf39F...’

Discussion

The proposed architecture is attempting to make ISO certifications more transparent. Due to the Blockchain layer, certification information will be available for review and verification by anyone with permissions. Also, a business will have an integrated system that will ensure that all processes involved for certification are being monitored. This require sending sign when needed; collecting information regarding quality inspections, materials, products and more, these transactions are verified by smart contracts on the Blockchain and then make them available for audit[39]. In this sense, is mandatory to establish which transactions will be recorded at Blockchain, to avoid unnecessary efforts or resources consuming in this way.

Document control refers to the policies and procedures that should be in place to ensure that there is organizational accountability for records and demonstrate the effective operation of the quality management system: it is fundamental to all companies’ success. From a regulatory sense, it’s their way of proving your documentation is following requirements for compliance. Organizations must be able to prove that they are meeting their quality management goals. Documentation must be accurate, objective, and current in this regard, and practice must stand up to the scrutiny that a properly executed external audit will demand. The proposed architecture could help these tasks, allowing the organizations to establish and control their documents and records as evidence of conformity to requirements to obtain an ISO 9001 Certification. About this, in the QMS is suggested to identify what documents or information Blockchain must record and by how many time keep it.

The product/service quality hinges on the efficacy of the Organization’s system to manage your processes quality. It is essential to have the right foundation, infrastructure, and tools to oversee and maintain that quality. In this sense, the architecture proposed allows the automation of the audit process, which means early alerts systems to make the right decisions and keep the system efficient and trustworthy.

Conclusions

In this work, a software architecture based on Blockchain is proposed and explained to support an ISO 9001: 2015 QMS. The main objective of guaranteeing the immutability, traceability, and transparency of the quality assurance system is possible by the Blockchain’s transparent consensus mechanism. This makes it possible to verify transactions’ validity and how information has been modified or created in the process. In this manner, it supports QMS towards certification process.

The workflows’ execution of the software architecture proposed allows the automation of the regulatory processes by reporting and monitoring required data and checking compliance and approval processes. The Blockchain layer seeks to improve the ISO 9001:2015 certification audit process by maintaining the traceability and immutability of the records stored in it.

The proposed architecture is oriented to process and provides an intuitive and straightforward way to facilitate communication among the participants. All these allow the organizations to be in a constant improvement environment and have evidence to make crucial decisions. Also, the system could deliver more quality products and services if the processes are being performed and improved systematically.

Finally, with the evolution of this kind of solution, companies could expand and build an ecosystem for working together and self-regulated with quality standards like ISO 9001:2015, and represent an opportunity to provide customer confidence.

Authors' Information

• Rafael Bettín-Díaz has a degree in systems engineering from Universidad del Sinú, Montería, Colombia, and a M.Sc. in processes engineering from Universidad Ean, Bogotá, Colombia.

• Camilo Mejía-Moncayo has a degree and M.Sc. in mechanical engineering both from Universidad Nacional de Colombia, Bogota, Colombia. Currently he is Ph.D. candidate at École de Technologie Supérieure, Montréal, Canada.

• Alix E. Rojas has a degree in systems engineering from Escuela Colombiana de Ingeniería, and a M.Sc. in systems engineering from Universidad Nacional de Colombia, Bogota, Colombia. Currently, she is associate professor at the Universidad Ean, Bogota, Colombia.

Authors' Contributions

• Rafael Bettín-Díaz participated in writing the original draft, conceptualization, and software development.

• Camilo Mejía-Moncayo contributed with the conceptualization of the project, methodology, reviewing and editing.

• Alix E. Rojas: contributed with the conceptualization of the project, methodology, reviewing and editing.

Competing Interests

The authors declare that they have no competing interests.

References

---

1. The application that allows the participant to transact one another.↩︎

2. Representational State Transfer↩︎

3. application programming interface↩︎