ISO/IEC TS 33073:2017

Information technology - Process assessment - Process capability assessment model for quality management

ISO/IEC TS 33073:2017: - defines an integrated PRM and PAM that meets the requirements of ISO/IEC 33004 and that supports the performance of an assessment by providing indicators for guidance on the interpretation of the process purposes and outcomes and the process attributes as defined in ISO/IEC 33020; - provides guidance, by example, on the definition, selection and use of assessment indicators. A PAM comprises a set of indicators of process performance and process capability. The indicators are used as a basis for collecting the objective evidence that enables an assessor to assign ratings. The set of indicators included in ISO/IEC TS 33073:2017 is not intended to be an all-inclusive set nor is it intended to be applicable in its entirety. The PAM in ISO/IEC TS 33073:2017 is directed at assessment sponsors and competent assessors who wish to select a model and associated documented process method for assessment (for either capability determination or process improvement). Additionally, it can be of use to developers of assessment models in the construction of their own model, by providing examples of good service management practices. It can be used by: a) service providers to assess and improve a Quality Management System (QMS); b) service providers to demonstrate their capability for the design, development, transition and delivery of services that fulfil Quality Management requirements. Any PAM meeting the requirements defined in ISO/IEC 33004 concerning models for process assessment may be used for assessment. Different models and methods can be needed to address differing business needs. The assessment model in ISO/IEC TS 33073:2017 is provided as an assessment model meeting all the requirements expressed in ISO/IEC 33004. NOTE Copyright release for the PAM: Users of ISO/IEC TS 33073:2017 can freely reproduce the detailed descriptions contained in the assessment model as part of any tool or other material to support the performance of process assessments, so that it can be used for its intended purpose.

Technologies de l'information — Évaluation des processus — Modèle d'évaluation de l'aptitude des processus pour le management de la qualité

General Information

• Status: Published
• Publication Date: 31-Oct-2017
• ICS: 35.080 - Software
• Technical Committee: ISO/IEC JTC 1/SC 7 - Software and systems engineering
• Drafting Committee: ISO/IEC JTC 1/SC 7/WG 10 - Process assessment
• Current Stage: 9060 - Close of review
• Completion Date: 02-Dec-2028

Overview

ISO/IEC TS 33073:2017 specifies a Process Capability Assessment Model (PAM) for quality management in information technology and related service contexts. The technical specification defines an integrated Process Reference Model (PRM) and PAM that conform to ISO/IEC 33004 and supports process assessments by providing concrete assessment indicators for interpreting process purposes, outcomes and capability attributes (as defined in ISO/IEC 33020). It is designed to help assessors collect objective evidence, assign ratings and support capability determination or process improvement for a Quality Management System (QMS).

Key topics and requirements

• Two-dimensional model:
  • Process dimension - processes described by purpose, outcomes and base practices (process performance indicators). Examples in the PAM include communication management, documentation management, internal audit, risk management, configuration management, product/service design, verification and validation, supplier management and leadership.
  • Capability dimension - capability levels and process attributes based on ISO/IEC 33020 (Levels 0–5: Incomplete to Innovating) expanded with generic practices, resource indicators and input/output indicators.
• Assessment indicators - sets of process performance and process capability indicators used as the basis for collecting objective evidence and assigning process ratings.
• Guidance on definition, selection and use of indicators (examples and input/output characteristics are provided, e.g., Annex B).
• Conformance and applicability - the PAM meets the requirements of ISO/IEC 33004; Annex A contains statements of conformance.
• Copyright: users may reproduce the detailed PAM descriptions in tools or materials to support process assessments.

Applications and users

Who uses ISO/IEC TS 33073:2017:

• Assessment sponsors and competent assessors performing capability determinations or process improvement assessments.
• Service providers conducting self-assessments or seeking to improve or demonstrate their QMS capability for design, development, transition and delivery of services.
• Developers of assessment models and tool vendors who need exemplar indicators and model structure when constructing their own PAM/PRM or assessment tools.

Practical benefits:

• Enables consistent, repeatable process capability ratings and benchmarking.
• Supports selection and evaluation of assessment methods, tools and improvement programs.
• Applicable across organization sizes and domains where ISO 9001 alignment and QMS capability evidence are required.

Related standards

• ISO/IEC 33004 (requirements for PRM/PAM)
• ISO/IEC 33002 (requirements for performing assessments)
• ISO/IEC 33020 (process measurement framework)
• ISO 9001 (quality management)
• ISO/IEC TR 24774 and ISO/IEC 15504 series (related process assessment guidance)

Keywords: ISO/IEC TS 33073:2017, process capability assessment model, PAM, process assessment, quality management, ISO/IEC 33004, ISO/IEC 33020, ISO 9001, assessment indicators.

Standards Content (Sample)

TECHNICAL ISO/IEC TS
SPECIFICATION 33073
First edition
2017-11
Information technology — Process
assessment — Process capability
assessment model for quality
management
Technologies de l'information — Évaluation des processus
— Modèle d'évaluation de l'aptitude des processus pour le
management de la qualité
Reference number
©
ISO/IEC 2017
© ISO/IEC 2017, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. [phone]
Fax [phone]
[e-mail]
www.iso.org
ii © ISO/IEC 2017 – All rights reserved

Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Overview of the Process Assessment Model (PAM) . 2
4.1 General . 2
4.2 Structure of the Process Assessment Model . 3
4.2.1 Processes . 3
4.2.2 Process dimension . 4
4.2.3 Capability dimension . 4
4.3 Assessment indicators . 5
4.3.1 Process Capability Indicators . 7
4.3.2 Process Performance Indicators . 8
4.4 Measuring process capability . 8
5 The process dimension and process performance indicators (Level 1) .10
5.1 General .10
5.2 COM.01 Communication management .11
5.3
COM.02 Documentation management .12
5.4 COM.03 Human resource management .14
5.5 COM.04 Improvement .14
5.6 COM.05 Internal audit.16
5.7 COM.06 Management review .16
5.8 COM.07 Non-conformity management .17
5.9 COM.08 Operational planning .19
COM.09 Operational implementation and control . 22
5.10
5.11 COM.10 Performance evaluation .24
5.12 COM.11 Risk management .25
5.13 ORG.01 Asset management .27
5.14 ORG.02 Measurement resource management .27
5.15 ORG.03 Supplier management .28
5.16 TEC.01 Configuration management .29
5.17 TEC.02 Process changes .30
5.18 TEC.03 Product/service changes .31
5.19 TEC.04 Product/service design .32
5.20 TEC.05 Product/service planning .32
5.21 TEC.06 Product/service quarantine .33
5.22 TEC.07 Product/service requirements .34
5.23 TEC.08 Product/service review .35
5.24 TEC.09 Product/service supply .36
5.25 TEC.10 Product/service validation .37
5.26 TEC.11 Product/service verification .37
5.27 TOP.01 Leadership .38
6 Process capability indicators .40
6.1 General .40
6.2 Process capability levels and process attributes .41
6.2.1 General.41
6.2.2 Process capability Level 0: Incomplete process.41
6.2.3 Process capability Level 1: Performed process .41
6.2.4 Process capability Level 2: Managed process .42
6.2.5 Process capability Level 3: Established process .47
6.2.6 Process capability Level 4: Predictable process .52
© ISO/IEC 2017 – All rights reserved iii

6.2.7 Process capability Level 5: Innovating process .56
6.3 Related processes for process attributes .60
Annex A (informative) Conformity of the process assessment model .62
Annex B (informative) Input and output characteristics .67
Annex C (informative) Association between base practices and ISO 9001 requirements .107
Bibliography .298
iv © ISO/IEC 2017 – All rights reserved

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for
the different types of document should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following
URL: www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 7, Software and systems engineering.
© ISO/IEC 2017 – All rights reserved v

Introduction
This document provides a Quality Management Process Assessment Model (PAM) for use in performing
a conformant assessment of process capability in accordance with the requirements of ISO/IEC 33002.
It is structured in accordance with the requirements of ISO/IEC 33004 to reflect processes that enable
implementation of ISO 9001. The scale for assessing the extent of achievement of process capability is
based on ISO/IEC 33020.
The publication of the revised edition of ISO 9001:2015 has rendered the publication of this document
as both timely and appropriate.
An integral part of conducting an assessment is to use a PAM that is constructed for that purpose. A PAM
is related to a Process Reference Model (PRM) and is conformant with ISO/IEC 33004. ISO/IEC 33002
identifies the minimum requirements for performing an assessment in order to ensure consistency and
repeatability of the ratings. ISO/IEC 33002 addresses the assessment of process and the application
of process assessment for improvement and capability determination. Results of conformant process
assessments may be compared when the scopes of the assessments are considered to be similar.
The requirements for process assessment defined in ISO/IEC 33002 form a structure which:
a) facilitates self-assessment;
b) provides a basis for use in process improvement and capability determination;
c) takes into account the context in which the assessed process is implemented;
d) produces a process rating;
e) addresses the ability of the process to achieve its purpose;
f) is applicable across all application domains and sizes of organization;
g) may provide an objective benchmark between organizations.
The relationship between ISO/IEC TR 24774, ISO 9001, ISO/IEC 33002, ISO/IEC 33004, ISO/IEC 33020,
and this document is shown in Figure 1.
vi © ISO/IEC 2017 – All rights reserved

ISO 9001 ― Quality management ISO/IEC TR 24774 ― Guidelines for
systems ― Requirements process description
provides requirements informs
ISO/IEC 33004 Requirements for
process reference, process
ISO/IEC TS ― A process
assessment and maturity models
capability assessment model for
quality management
ISO/IEC 33002 ― Requirements
for performing process assessment
ISO/IEC 33020 Process
measurement framework for
assessment of process capability
Figure 1 — Relationships between relevant standards
Any organization may use processes with additional elements in order to suit it to the environment and
circumstances. This PAM contains a set of indicators to be considered when interpreting the intent of
its PRM. It provides greater detail to indicate process performance and capability. The indicators may
also be used when implementing a process improvement program or to help evaluate and select an
assessment model, method, methodology or tools.
As an exemplar, this PAM embodies the core characteristics that could be expected of any PAM consistent
with ISO/IEC 33004. Nevertheless, any other PAMs meeting the requirements of ISO/IEC 33004 may be
used in a conformant assessment.
This document has a similar structure to ISO/IEC 15504-5 and ISO/IEC 15504–6. It may be used in
conjunction with these process assessment models to support joint assessment of quality management
processes and system/software life cycle processes.
Within this document:
— Clause 4 provides a detailed description of the structure and key components of a PAM, which
includes two dimensions: a process dimension and a capability dimension. Assessment indicators
are introduced in this clause.
— Clause 5 addresses the process dimension. The processes are described in the PAM in terms of
purpose and outcomes. The PAM includes a set of process performance indicators called base
practices for each process. The PAM also defines a second set of indicators of process performance
by associating inputs and outputs with each process. Clause 5 is also linked directly to Annex B,
which defines the inputs/outputs characteristics.
— Clause 6 addresses the capability dimension. It duplicates the definitions of the capability levels
and process attributes from ISO/IEC 33020 and expands each of the nine attributes through the
inclusion of a set of generic practices. These generic practices belong to a set of indicators of process
capability, in association with generic resource indicators, and generic inputs/outputs indicators.
Annex B is also linked directly to Clause 6 as it defines the inputs/outputs characteristics.
© ISO/IEC 2017 – All rights reserved vii

— Annex A provides a statement of conformance of the PAM to the requirements defined in
ISO/IEC 33004.
— Annex B provides selected characteristics for typical inputs/outputs to assist the assessor in
evaluating the capability level of processes.
— Annex C contains three tables. Table C.1 identifies the base practices linked to requirements;
Table C.2 identifies the requirements linked to base practices; and lastly, Table C.3 identifies the
base practices not linked to requirements.
— Bibliography contains a list of informative references.
viii © ISO/IEC 2017 – All rights reserved

TECHNICAL SPECIFICATION ISO/IEC TS 33073:2017(E)
Information technology — Process assessment — Process
capability assessment model for quality management
1 Scope
This document:
— defines an integrated PRM and PAM that meets the requirements of ISO/IEC 33004 and that supports
the performance of an assessment by providing indicators for guidance on the interpretation of the
process purposes and outcomes and the process attributes as defined in ISO/IEC 33020;
— provides guidance, by example, on the definition, selection and use of assessment indicators.
A PAM comprises a set of indicators of process performance and process capability. The indicators are
used as a basis for collecting the objective evidence that enables an assessor to assign ratings. The set
of indicators included in this document is not intended to be an all-inclusive set nor is it intended to be
applicable in its entirety.
The PAM in this document is directed at assessment sponsors and competent assessors who wish
to select a model and associated documented process method for assessment (for either capability
determination or process improvement). Additionally, it can be of use to developers of assessment
models in the construction of their own model, by providing examples of good service management
practices. It can be used by:
a) service providers to assess and improve a Quality Management System (QMS);
b) service providers to demonstrate their capability for the design, development, transition and
delivery of services that fulfil Quality Management requirements.
Any PAM meeting the requirements defined in ISO/IEC 33004 concerning models for process assessment
may be used for assessment. Different models and methods can be needed to address differing business
needs. The assessment model in this document is provided as an assessment model meeting all the
requirements expressed in ISO/IEC 33004.
NOTE Copyright release for the PAM: Users of this document can freely reproduce the detailed descriptions
contained in the assessment model as part of any tool or other material to support the performance of process
assessments, so that it can be used for its intended purpose.
2 Normative references
There are no normative references in this document.
3 Terms and definitions
No terms and definitions are listed in this document.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— IEC Electropedia: available at http://www.electropedia.org/
— ISO Online browsing platform: available at http://www.iso.org/obp
© ISO/IEC 2017 – All rights reserved 1

4 Overview of the Process Assessment Model (PAM)
4.1 General
This document provides a PAM that includes examples of assessment indicators.
The PRM defined in this document, associated with the process attributes defined in ISO/IEC 33020,
establish a PAM used as a common basis for performing assessments of Quality Management system
process capability, allowing for the reporting of results using a common rating scale.
This PAM is a two-dimensional model of the process quality characteristic of process capability. In one
dimension, the process dimension, the processes are defined. In the other dimension, the capability
dimension, a set of process attributes grouped into capability levels is defined. The process attributes
provide the measurable features of the process quality characteristic of process capability.
CAPABILITY
Dimension
ISO/IEC 33020
Level 5 : Innovating (2 attributes)
Level 4 : Predictable (2 attributes)
Level 3 : Established (2 attributes)
Level 2 : Managed (2 attributes)
Level 1 : Performed (1 attribute)
Process Reference
Level 0 : Incomplete
Model (PRM)
PROCESS
Common
Dimension
processes
Processes
Organizational
Processes
processes
Technical
processes
Figure 2 — Relationship between the Process Assessment Model and its inputs
Figure 2 shows the relationship between the general structure of the PAM and ISO/IEC 33020.
A PRM conformant with the requirements defined in ISO/IEC 33004 and a capability dimension defined
in ISO/IEC 33020 cannot be used alone as the basis for conducting reliable and consistent assessments
of process capability since the level of detail provided is not sufficient. The descriptions of process
purpose and outcomes in a PRM, and the process attribute definitions in ISO/IEC 33020, need to be
supported with a comprehensive set of indicators of process performance and process capability that
are used for assessment performance.
The PAM defined in this document is conformant with the ISO/IEC 33004 requirements for a PAM and
can be used as the basis for conducting an assessment of Quality Management process capability.
In order to meet the PAM requirements of ISO/IEC 33004, a documented process supporting other
requirements of ISO/IEC 33002 is also required. This need may be met, for example, by the adoption of
a supporting method for conducting assessments.
2 © ISO/IEC 2017 – All rights reserved

4.2 Structure of the Process Assessment Model
This subclause describes the detailed structure of the PAM and its key components.
This PAM expands upon the PRM by including a defined set of assessment indicators. Assessment
indicators comprise indicators of process performance and process capability and are defined to
support an assessor’s judgment of the performance and capability of an implemented process.
Clause 5, together with its associated Annex B, describes the components of the process dimension,
and Clause 6 describes the components of the capability dimension. Annex A provides a statement of
conformance of the PAM to the requirements defined in ISO/IEC 33004.
ISO/IEC 33004 requires that processes included in a PRM satisfy the following.
“The fundamental elements of a process reference model are the descriptions of the processes within the
scope of the model.
The process descriptions in the process reference model incorporate a statement of the purpose of the
process which describes at a high level the overall objectives of performing the process, together with the
set of outcomes which demonstrate successful achievement of the process purpose.
A process description shall meet the following requirements:
a) a process shall be described in terms of its purpose and process outcomes;
b) the set of process outcomes shall be necessary and sufficient to achieve the purpose of the process;
c) process descriptions shall not contain or imply aspects of the process quality characteristic beyond the
basic level of any relevant process measurement framework conformant with ISO/IEC 33003."
4.2.1 Processes
Figure 3 shows the processes included in the process dimension of the PAM for quality management.
TOP.01 Leadership
Common ProcessesTechnical Processes
COM.01 Communciation management TEC.01 Conˆiguration management
COM.02 Documentation management TEC.02 Process changes
COM.03 Human resource management TEC.03 Product/service changes
COM.04 Improvement TEC.04 Product/service design
COM.05 Internal audit TEC.05 Product/service planning
COM.06 Management review TEC.06 Product/service quarantine
COM.07 Non-conformity management TEC.07 Product/service requirements
COM.08 Operational planning TEC.08 Product/service review
COM.09 Operational implementation and control TEC.09 Product/service supply
COM.10 Performance evaluation TEC.10 Product/service validation
COM.11 Risk management TEC.11 Product/service veriˆication
Origanizational Processes
ORG.1 Asset management
ORG.2 Measurement resource management
ORG.3 Supplier management
Figure 3 — Processes in the Process Assessment Model
© ISO/IEC 2017 – All rights reserved 3

4.2.2 Process dimension
The process dimension of the PAM includes all processes and shown in Figure 3. Each process in the
PAM is described in terms of a purpose statement. These statements contain the unique functional
objectives of the process when performed in a particular environment. A list of specific outcomes is
associated with each of the process purpose statements, as a list of expected positive results of the
performance of the processes.
Satisfying the purpose statements of a process represents the first step in building a level 1 process
capability where the expected outcomes are observable. The processes are described in Clause 5.
4.2.3 Capability dimension
For the capability dimension, the process capability levels and process attributes are identical to those
defined in ISO/IEC 33020.
Evolving process capability is expressed in the PAM in terms of process attributes grouped into capability
levels. Process attributes are features of a process that can be evaluated on a scale of achievement,
providing a measure of the capability of the process. They are applicable to all processes. Each process
attribute describes a facet of the overall capability of managing and improving the effectiveness of a
process in achieving its purpose and contributing to the business goals of the organization.
A capability level is a set of process attribute(s) that work together to provide a major enhancement
in the capability to perform a process. The levels constitute a rational way of progressing through
improvement of the capability of any process and are defined in ISO/IEC 33020.
There are six capability levels, incorporating nine process attributes.
— Level 0: Incomplete process
The process is not implemented or fails to achieve its process purpose.
At this level, there is little or no evidence of any systematic achievement of the process purpose.
— Level 1: Performed process
The implemented process achieves its process purpose.
— Level 2: Managed process
The previously described Performed process is now implemented in a managed fashion (planned,
monitored and adjusted) and its work products are appropriately established, controlled and
maintained.
— Level 3: Established process
The previously described Managed process is now implemented using a defined process that is
capable of achieving its process outcomes.
— Level 4: Predictable process
The previously described Established process now operates predictably within defined limits to
achieve its process outcomes. Quantitative management needs are identified, measurement data
are collected and analysed to identify assignable causes of variation. Corrective action is taken to
address assignable causes of variation.
— Level 5: Innovating process
The previously described Predictable process is now continually improved to respond to change
aligned with organizational goals.
4 © ISO/IEC 2017 – All rights reserved

Within the PAM, the measure of capability is based upon the nine process attributes (PA) defined in
ISO/IEC 33020. Process attributes are used to determine whether a process has reached a given
capability. Each attribute measures a particular aspect of the process capability.
At each level, there is no ordering between the process attributes; each attribute addresses a specific
aspect of the capability level. The list of process attributes is shown in Table 1.
Table 1 — Capability levels and process attributes
Process Attribute ID Capability Levels and Process Attributes
Level 0: Incomplete process
Level 1: Performed process
PA 1.1 Process performance
Level 2: Managed process
PA 2.1 Performance management
PA 2.2 Work Products management
Level 3: Established process
PA 3.1 Process definition
PA 3.2 Process deployment
Level 4: Predictable process
PA 4.1 Quantitative analysis
PA 4.2 Quantitative control
Level 5: Innovating process
PA 5.1 Process innovation
PA 5.2 Process innovation implementation
The process attributes are evaluated on a four point ordinal scale of achievement, as defined in
ISO/IEC 33020. They provide insight into the specific aspects of process capability required to support
process improvement and capability determination.
4.3 Assessment indicators
The PAM is based on the principle that the capability of a process can be assessed by demonstrating the
achievement of process attributes on the basis of evidence related to assessment indicators.
© ISO/IEC 2017 – All rights reserved 5

CAPABILITY
Dimension
For each attribute
Process Asessment
PA.1.1 to PA 5.2
Level 5 : Innovating
Process capability assessment (Level 1 to 5)
based on Process Attribute Indicators (PAI):
Level 4 : Predictable
GP  : Generic Practice
GR  : Generic Resource
Level 3 : Established
Ampli
ication
GIO : Generic Input/Output
for PA 1.1
Level 2 : Managed
Level 1
Level 1 : Performed Additional indicators for process
performance assessment based on
Level 0 : Incomplete
performance indicators:
BP : Base Practice
IO : Input/Output
Common
processes PROCESS
Dimension
Organizational
processes
Technical
processes
Figure 4 — Assessment indicators
There are two types of assessment indicators: process capability indicators, which apply to capability
levels 1 to 5 and process performance indicators, which apply exclusively to capability level 1. These
indicators are defined in 4.3.2.
The process attributes in the capability dimension have a set of process capability indicators that
provide an indication of the extent of achievement of the attribute in the instantiated process. These
indicators concern significant activities, resources or results associated with the achievement of the
attribute purpose by a process.
The process capability indicators are:
— Generic Practice (GP);
— Generic Resource (GR);
— Generic Input/Output (GIO).
As additional indicators for supporting the assessment of a process at Level 1, each process in the
process dimension has a set of process performance indicators which is used to measure the degree of
achievement of the process performance attribute for the process assessed.
The process performance indicators are:
— Base Practice (BP);
— Input/output (IO).
The performance of Base Practices (BPs) provides an indication of the extent of achievement of the
process purpose and process outcomes. Input/Outputs (IOs) are either used or produced (or both),
when performing the process.
The process performance and process capability indicators defined in the PAM represent types of
objective evidence that might be found in an instantiation of a process and therefore could be used to
judge achievement of capability.
6 © ISO/IEC 2017 – All rights reserved

Figure 4 shows how the assessment indicators are related to process performance and process
capability.
4.3.1 Process Capability Indicators
The three types of process capability indicators related to levels 1 to 5 are identified in Figure 5. They
are intended to be applicable to all processes.
Measurement framework
Capability
level 1-5
Process
Attribute
Process
attribute
outcome
Process capability indicators
Generic
Generic
Practice
Generic
Input/Output
Generic
Resources
Practice
Generic
Practice
Figure 5 — Process capability indicators
All the process capability indicators relate to the process attributes defined in the capability dimension
of the PAM. They represent the type of evidence that would support judgments of the extent to which
the attributes are achieved. Evidence of their effective performance or existence supports the judgment
of the degree of achievement of the attribute. The generic practices are the principal indicators of
process capability.
The Generic Practice (GP) indicators are indicators of activities of a generic type and provide guidance
on the implementation of the attribute's characteristics. They support the achievement of the process
attribute and many of them concern management practices, i.e. practices that are established to support
the process performance as it is characterized at level 1.
During the evaluation of process capability, the primary focus is on the performance of the generic
practices. In general, performance of all generic practices is expected for full achievement of the process
attribute.
The Generic Resource (GR) indicators are associated resources that may be used when performing
the process in order to achieve the attribute. These resources may include human resources, tools,
methods and infrastructure. The availability of a resource indicates the potential to fulfil the purpose
of a specific attribute.
The assessor should interpret the generic resources according to the process assessed, e.g. for PA2.1
resources (with identified objectives, responsibilities and authorities), an assessor would look for roles
(with identified objectives, responsibilities and authorities) in primary and supporting processes,
but for organizational processes, would look for governance structures (e.g. mandated committees,
positions) with identified objectives, responsibilities and authorities.
© ISO/IEC 2017 – All rights reserved 7

The Generic Input/Output (GIO) indicators are sets of characteristics that would be expected
to be evident in inputs/outputs of generic types as a result of achievement of an attribute. The
generic inputs/outputs form the basis for the classification of the inputs/outputs defined as process
performance indicators; they represent basic types of inputs/outputs from all types of processes.
These three types of indicators help to establish objective evidence of the extent of achievement of the
specified process attribute.
Due to the fact that Level 1 capability of a process is only characterized by the measure of the extent to
which the process purpose is achieved, the process performance attribute (PA.1.1) has a single generic
practice indicator (GP.1.1.1). In order to support the assessment of PA.1.1 and to amplify the process
performance achievement analysis, additional process performance indicators are defined in the PAM.
4.3.2 Process Performance Indicators
There are two types of process performance indicators: Base Practice (BP) indicators and
Input/Output (IO) indicators. Process performance indicators relate to individual processes defined in
the process dimension of the PAM and are chosen to explicitly address the achievement of the defined
process outcomes.
Evidence of performance of the base practices, and the presence of inputs/outputs with their expected
characteristics, provide objective evidence of the achievement of the process outcomes.
A base practice is an activity that addresses the purpose of a particular process. Consistently
performing the base practices associated with a process will help the consistent achievement of its
purpose. A coherent set of base practices is associated with each process in the process dimension. The
base practices are described at an abstract level, identifying “what” should be done without specifying
“how”. Implementing the base practices of a process should achieve the basic outcomes that reflect the
process purpose. Base practices represent only the first step in building process capability, but the
base practices represent the unique, functional activities of the process, even if that performance is not
systematic.
In this particular PAM, the base practices have been used as a vehicle to link the outcomes of each
process in the PRM with the requirements defined for that process in ISO 9001. This has been achieved
using the following strategy.
— Singular requirements from ISO 9001 have been identified and assigned a unique identifier (process
number plus sequential numbering within the subclause).
— Each process outcome has been linked to a single base practice.
This approach provides insight on how the singular requirements from ISO 9001 contribute to the
achievement of the process purpose and outcomes. The performance of a process requires inputs
and produces outputs that are identifiable and usable in achieving the purpose of the process. In this
assessment model, each input/output has a defined set of example characteristics that may be used
when reviewing the input/output to assess the effective performance of a process. Input/output
characteristics may be used to identify the corresponding input/output produced/used by the assessed
organization.
Clause 5 contains a complete description of the processes, including the base practices and the
associated inputs and outputs.
Annex B contains a list of generic inputs/outputs together with their characteristics.
4.4 Measuring process capability
The process performance and process capability indicators in this model give examples of evidence
that an assessor might obtain or observe in the performance of an assessment. The evidence obtained
in the assessment, through observation of the implemented process, can be mapped onto the set of
indicators to enable correlation between the implemented process and the processes defined in this
8 © ISO/IEC 2017 – All rights reserved

assessment model. These indicators provide guidance for assessors in accumulating the necessary
objective evidence to support judgments of capability. They are not mandatory.
An indicator is defined as an objective characteristic of a practice or input/output that supports
performing a conformant assessment in accordance with the requirements of ISO/IEC 33004. The
assessment indicators and their relationship to process performance and process capability are shown
in Figure 6.
Observable (objective) evidence collected during an assessment is used to confirm the indicators (e.g.
practices were performed). All such evidence comes either from the examination of inputs/outputs of
the processes assessed or from statements made by the performers and managers of the processes.
The existence of base practices, inputs/outputs, and input/output characteristics, provide evidence of
the performance of the processes associated with them. Similarly, the existence of process capability
indicators provides evidence of process capability.
GP’s
5.2 Process innovation implementation
Process Attribute
GP’s
GR’s
5.1 Process innovation
GR’s
GIO’s
Indicators
GP’s
GIO’s
4.2 Quantitative control GR’s GP’s
4.1 Quantitative analysis GIO’s GR’s
GP’s
GIO’s
3.2 Process deployment GP’s
GR’s
GR’s
3.1 Process deinition
GIO’s
GIO’s
GP’s
2.2 Work product management GR’s
GP’s
2.1 Performace management GIO’s GR’s
GIO’s
- Input/Output
1.1 Process performance
GP1.1.1
-
Process Performance
Common
Indicators
processes
Organizational
processes
Technical
processes
Figure 6 — Relationship between assessment indicators and process capability
The evidence obtained should be recorded in a form that clearly relates to an associated indicator,
so that the support for the assessor’s judgment can be readily confirmed or verified as required by
ISO/IEC 33002.
The output from a process assessment is a set of process profiles, one for each process within the
scope of the assessment. Each process profile consists of a set of the process attribute ratings for an
assessed process. Each attribute rating represents a judgment by the assessor of the extent to which the
attribute is achieved. To improve the reliability and repeatability of the assessment, the judgments of
the assessor are based on a coherent set of recorded objective evidences.
© ISO/IEC 2017 – All rights reserved 9

5 The process dimension and process performance indicators (Level 1)
5.1 General
This clause defines the processes and the process performance indicators, also known as the process
dimension, of the PAM. The processes in the process dimension can be directly mapped to the processes
defined in the PRM.
The processes are classified into Process Groups which are shown in Figure 3. The process purposes,
outcomes, the practices, the inputs and outputs of processes are included in this clause.
The individual processes are described in terms of process name, process purpose, and process
outcomes:
a) name: a short noun phrase that summarizes the scope of the process, identifying the principle
concern of the process, and distinguishes it from other processes within the scope of the PRM;
b) purpose: describes at a high level the overall objectives of performing the process;
c) outcomes: observable result of the successful achievement of the process purpose. Outcomes are
measurable, tangible, technical or business results that are achieved by a process. Outcomes are
observable and assessable.
In addition, the process dimension of the PAM provides information in the form of:
a) a set of base practices for the process needed to accomplish the process outcomes; a single base
practice is explicitly associated with a process outcome;
b) a number of inputs/outputs associated with each process and their relationship to one or more of
its outcomes by numbers in square brackets (i.e. [n]);
c) characteristics associated with each input/output.
The input/output identifiers and characteristics are contained in Annex B.
The base practices and the inputs/outputs constitute the set of indicators of process performance.
The associated inputs/outputs listed in this clause may be
...