Topics in this domain
- IT Governance vs. IT Management
- Board and Senior Management Roles
- IT Steering Committee
- IT Strategy and Business Alignment
- Balanced Scorecard
- COBIT
- ITIL
- ISO 27001/27002
- COSO: ERM and Internal Control
- Policies, Standards, Procedures, Guidelines
- IT Organizational Structure and Key Roles
- Segregation of Duties in IT
- Enterprise Architecture (Zachman, TOGAF)
- Risk Management Process
- Qualitative vs. Quantitative Risk Assessment
- Risk Responses: Mitigate, Transfer, Avoid, Accept
- Risk Appetite and Residual Risk
- Maturity Models (CMMI)
- KPIs and KGIs
- Outsourcing: Benefits and Risks
- Vendor Selection, Contracts, SLAs, Right to Audit
- Cloud and Offshore Governance
- Portfolio and Resource Management
- HR: Hiring, Training, Termination
- Legal and Regulatory Compliance
- Quality Management
Quality Management
Consistently good, not occasionally good
Quality management is about getting good results every time, not by luck. A quality management system (QMS) is the set of policies, processes and checks an organisation uses to make sure its products and services meet requirements, and to keep improving.
ISO 9001 sets out the requirements for a QMS and can be certified. It’s built on ideas like customer focus, leadership, a process approach, decisions based on evidence, and continual improvement.
QA vs QC
Think of a restaurant kitchen. Quality assurance makes sure the recipes are right, the ingredients are fresh and the cooks are trained: it prevents bad dishes. Quality control is the head chef tasting each plate before it goes out: it catches bad dishes.
| Quality assurance | Quality control | |
|---|---|---|
| Focus | The process | The product |
| Type | Preventive | Detective |
| Asks | Will this process produce good output? | Does this output meet requirements? |
| IT examples | Development standards, methodology reviews, process audits | Testing, defect tracking, inspections |
In IT, a QA function sets and checks standards for development, testing and change management. It must be independent of the developers whose work it reviews.
Software quality
Standards such as ISO/IEC 25010 list qualities software should have: functional suitability, performance, compatibility, usability, reliability, security, maintainability and portability. They help turn “quality” into testable requirements.
What the auditor checks
- Is there a QMS or quality policy for IT?
- Are standards documented and followed (QA), and are outputs tested (QC)?
- Is QA independent?
- Are quality metrics collected and used to improve?
Example. Developers mark their own changes as “QA passed” in the ticket system. On paper there’s a QA step, but it’s done by the people who wrote the code. The auditor reports that QA isn’t independent and recommends a separate QA role or peer review by someone outside the change.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Difference between QA and QC | QA is process and preventive; QC is product and detective |
| Certifiable QMS standard | ISO 9001 |
| Testing completed software is… | Quality control |
| Concern when QA reports to development | Lack of independence |
In short
- A quality management system (QMS) defines how an organisation makes sure its products and services meet requirements.
- ISO 9001 sets out requirements for a QMS and can be certified.
- Quality assurance (QA) is about the process and prevents defects.
- Quality control (QC) is about the product and detects defects.
- Software quality standards such as ISO/IEC 25010 define qualities like reliability, security and maintainability.
- QA must be independent of the teams whose work it reviews.
Exam traps
- QA = process, preventive. QC = product, detective.
- Testing a finished system is QC; setting standards and checking they're followed is QA.
- ISO 9001 certification shows a QMS meets the standard, not that every product is perfect.
- QA reporting to the development manager isn't independent.
Slides
Click the slide and use the arrow keys. F toggles full screen.
QA vs QC