ISO 9001 certification—what is it?

ISO 9001 certification can be seen as an external conformity assessment or control mechanism to assure and regulate quality and safety in health care. It is often compared to or described interchangeably within the “family” of external assessment strategies for health care organizations, and especially accreditation [19, 20]. The common purpose of these external assessment programs is to provide information and evidence that the organizational system and performance conform to a specific standard, and both certification and accreditation programs award the assessed organization with a certificate on successful conformity. Certification bodies and auditors should strive to build confidence and trust through a practice rooted in impartiality, competent assessments, and decisions based on objective evidence [21]. The ISO 9001 standard does not prescribe performance requirements. Rather, it proposes generic requirements for structures and systems that enable organizations to formalize production or service processes into a series of procedures, and to continuously monitor, document and improve its efficiency upon customer (patients) requirements and legal regulations [22, 23]. An audit program has a 3-year audit cycle: the initial certification process, two shorter “surveillance audits” over the next 2 years, and then re-certification in the third year.

Aim and research question

This paper reports on the sensemaking processes in an emergency department in a Norwegian hospital undergoing ISO certification. By combining institutional theory with sensemaking theory, the paper contributes to a better understanding of how external pressure meets a local conceptualization of quality management processes in ISO certification.

Theoretical approach

The rise in certification and accreditation practices in healthcare [17] reflects the shifting mode in regulation (often a reduction in “hard laws” and directives), spread and diffusion of modern management tools, and demands for accountability and transparency in our contemporary society. In this case study, we treat the interplay between the enforced internal control regulations and voluntary ISO certification from the perspective of re-regulation [28] or decentered or plural regulation [29]. Typical of such regulation is the transformation into modes of governance¹; with or without governments, often transnational in structure, and represented by non-binding “soft” rules and regulations. Such soft regulations are often diffuse and lead organizations to search for other means and control mechanism [28, 30].

To study the interplay between mandatory regulatory demands in healthcare and the voluntary adoption of ISO certification in a Norwegian hospital context, we draw on the contributions of institutional and sensemaking theory.

Context and internal control regulation in Norway

The Ministry of Health and Care Services has the overall responsibility for the specialized health care services in Norway. Public hospitals are owned by the Government and organized in four Regional Health Authorities (RHA).

The regulation of quality and safety for health service providers in Norway is based on a functional legislation, outlined as enforced self-regulation [34], where different regulatory requirements are based on an internal control system [35]. Hospitals have in this perspective a great deal of latitude to make decisions and set priorities about their organization and services [36].

All hospitals, their service and health personnel, are subject to supervision by the Norwegian Board of Health Supervision (NBHS), through the 18 Offices of the County Governors. The main supervision of hospitals is performed as system audits, whose aim is to ensure and control whether health services are complying with national acts and regulations. In practice it involves auditing the health service’s internal control system.

In 2005, a RHA voluntarily adopted the ISO 9001 as a guide for all its hospitals, in order to operationalize the internal control system requirements [37]. It was argued that an identified lack of follow-up on the internal control system could be connected with difficult conceptualizations, vague demands, and uncertainties about overall quality management systems and its advantages [38].

Design

The present study is designed as an explanatory single-case study [39]. For explanation building, we used a narrative approach [40–45] and storytelling [46] to retrospectively follow sensemaking during the local ISO 9001 certification process of an ED in a hospital trust in Norway. The process ran from autumn 2008 until spring 2012.

An overall story or narrative was produced during the research process. It illustrates how those involved in a local project group collectively made sense of the practices and experiences that unfolded during the certification process. The stories and meanings that the informants provide about past experiences can in itself be seen as a sensemaking process, as the nature of sensemaking builds upon frames that continuously change as the informant act and acquires experience [24]. The narrative can as such be seen as a co-construction between the informants and the author (the researcher), in addition to stories from documents (artefacts), and are constructs through which events are made sense of rather than just representations of these processes [40].

Sample and data collection

Semi-structured interviews were conducted in June and August 2012, according to an interview guide and centered upon three themes: (1) the subjects’ role, the organization, and aspects concerning quality and safety work; (2) the certification process and its results; and (3) how ISO 9001 standard and certification was understood in relation to formal quality and safety regulations and management tools. Open questions were generally used, often followed by either preplanned or ad hoc probing questions, in order to help subjects to recall and tell more detailed stories about the ISO certification process and their experiences.

Analytical framework and process

Organized sensemaking is primarily a process theory. When conceptualized organized sensemaking can be treated as a sequence of “ecological change—enactment—selection [and]—retention [31]”. Ecological changes in this context are treated as both intra- and inter-organizational environments. In the organizing process of enactment, people are shaped by environments and sense anomalies that are “…triggered by discrepancies and equivocality in ongoing projects, [and] begin to change the flux of circumstances into the orderliness of situations” [31]. Selection is a process of narrative reduction where possible meanings are reduced and generate a tentative and plausible story. In retention the plausible story is connected to past experience and fit with identity, and such makes a new script or cognitive frame that feeds back to the prior processes. In this case study we have applied the following analytical categories, modified, and adopted from Steyer et al. [48], that aims to emphasize the key elements in organized sensemaking processes [24, 31, 49] (See Fig. 2):

Frame (retention): Involves cognitive frames (retained plausible stories, such as acquired from work, training or life experiences) and formal frames (e.g., categories, plans, procedures, organizational structures, and artefacts). Frames are sources of guidance for interpretation and action.

Cue: Information or event extracted from the environment by actors. People ascribe meaning to cues by relating them to frames.

Discrepancy: Equivocality and discrepancies between cues, and between cues and frames. It gives an occasion to search for and reconsider a meaning. It is related to the question “same or different” [31]. When a situation feels different, it activates a search for meaning.

Concern: A tentative plausible story (e.g., an opportunity, problem, perceived uncertainty, issue, or controversy) that the individual or group pay attention to.

Action: Through action, people produce parts of their environment and are “making” what is sensed [24]. People also enact what has been made sense of back into the world. In this study the main actions are identified, while acknowledging the challenge of simultaneously identifying both action and cognition [48].

Our analytical process follows the principle of “narrative analysis” proposed by Polkinghorne [50], incorporating analytical features from Boje’s [45] causality analysis in an antenarrative perspective. Our narrative follows the characteristics of a narrated plot [42, 45, 50], where beginning, middle, and ends of the story come into being. Such retrospective reconstruction often starts with the outcome as a starting point for how this event came about. In this case study the guiding outcome was the ED’s adoption of ISO 9001 certification. Our first analytical step was to arrange the data elements chronologically and construct a baseline story. The baseline story was modified in an ongoing process along with a repeated reading of the interviews. In our next step we identified elements that are contributors to action and outcome [50]. Here the baseline story was categories into our analytical framework (Fig. 2). Our final analytical step was an ongoing construction (writing, categorizing, and rewriting) of the narrative into a temporally patterned whole [50]. We have visualized in brackets the categorization in the final narrative presented in this paper, to make the analytical process more transparent. To ensure trustworthiness, the narrative, with its analytical categories, was sent by e-mail to six of the informants, who confirmed the narrative. Only slight changes in the narrative were done after the informants’ responses.

The story of change

The following story is presented in two stages. The first outlines the initial establishment of the external project that initiated the pilot process in the ED. The second narrates the intra-organizational sensemaking that contributed to continuity and change in favor of ISO 9001 certification.

Following up on unacceptable conditions in emergency departments

In 2007 the Norwegian Board of Health Supervision (NBHS) carried out a countrywide supervision of 27 out of 54 hospital emergency departments in Norway, and concluded that in general, there was a lack of management responsibility for ensuring that daily tasks were planned, organized, carried out, and improved in accordance with legislative requirements [51]. The NBHS described the situation as unacceptable and required the management to take action.

As a direct follow-up of this report the Norwegian Accreditation (NA)² and one Regional Health Authority (RHA) initiated a collaborative project. Its objective was to set a standard that EDs could use to ensure and improve internal control and management systems, and for accreditation or certification purposes [52]. A sector committee³ including an administrative project organization, the regional project group (RPG), was established in the spring of 2008.

The sector committee was composed of representatives from all the RHA, NBHS, and other professional experts, and their work took place from August 2008 until March 2010. The new accreditation standard for EDs was supposed to concretize the generic requirements in the legal internal control regulation. The committee considered different management standards to build upon or implement, and decided on the ISO 9001:2008 Quality Management System - requirements standard, with its additional guidelines for use in health services [23]. The main reason was that the ISO 9001 was in compliance with the current Norwegian internal control regulation. Two ED was chosen as pilots for the project, in order to (1) identify core processes and risk areas to specify new requirements for EDs and (2) become ISO 9001 certified and meet the new requirements. One of the EDs ended the process before becoming certified, and the other, whose story is told in the next section, became certified in 2010 [53].

The initial phase

The ED had struggled for years with a heavy and challenging patient flow, and worked to improve the system without acceptable results [frame]. During this time there had been a change towards more attention to quality improvement and control, both through central, regional, and local initiatives. The RHA had become more explicit on requirements about, among others, waiting time for patients, patient safety, and prevention of infections [frame]. The ED was also in the middle of a rebuilding and merging process to take over the emergency functions from another hospital. The volume of patients was high, they were kept waiting, and there was not enough beds [concern].

The ED got two nonconformities from the countrywide supervision that required managerial follow-up. The first nonconformity pertained to the accumulation of patients that could lead to failure of treatment; the second was related to the examination conditions in the ED, which did not ensure adequate protection of confidentiality, patient integrity, and information exchange [cue]. The challenges in the ED were once again highlighted [cue] and the hospital top management became more involved in resolving these challenges [discrepancy]. The ED once again started to look for solutions and make efforts to improve patient flow [action].

Some months after the report from the NBHS, the hospital trusts in the RHA were asked to participate in the pilot project. The ED was then asked by their hospital CEO [cue]. The Head of Department had a quick consultation with middle managers in the ED, and the response was “Yes, let us jump on it” (Informant Y). They immediately decided to participate in the pilot [action]. Their expectation was to get the assistance to work systematically to resolve the challenges in the ED [concern].

The process in the ED started in autumn 2008. The first meeting was represented by people from the hospital who delivered services to the ED (e.g., physicians and the X-ray department) in addition to people from the regional project group. The intention was to anchor the project with concern to those departments that delivered services to the ED, and not just the ED in isolation [concern]. Especially, the integration of physicians was considered important [concern]. The head of department was the hospitals representative in the RPG and was highly involved in the development of the new requirement for EDs during spring 2009. She also became a key actor and a primer for the local pilot throughout the project.

During spring 2009, the ED established a local project group (LPG) led by the head of department and three middle managers [action]. At that time they did not know what to expect, other than they would be assessing and describing processes, identification of system vulnerabilities, and implementation of relevant actions in the ED [discrepancy]. In any case, they immediately threw themselves into the work, starting to describe processes and identify vulnerabilities [action]. After a while they were made aware of [cue] that the pilot project would involve the use of the ISO 9001 standard [discrepancy]. Then they realized their need for local assistance about developing quality management systems [concern]. A quality adviser from the Quality and Research Department integrated in the LPG [action]. The main work on ISO 9001 certification began in the summer of 2009.

The standardization and certification phase: summer–autumn 2009

None of the LPG members had experiences [frame] with ISO 9001 standardization and certification processes [discrepancy], except for one member of the quality department, who became an important “translator” [cue] of the ISO standard during the pilot project. The standard needed contextual adaptations to be legitimated in the ED [concern]. Terms like risk assessments, measuring, monitoring, and recording are obvious concepts and parts of an ISO quality management systems, but it was an unfamiliar terminology for the LPG [discrepancy]. The additional ED requirements developed during the project became important concretizations of the ISO 9001 standard and the internal control regulations. It generated a contextual translation [cue] of rather general requirements [discrepancy] and so ordinated a meaningful operationalization in the ED [action]. As “newcomers” [frame], the LPG needed concretization [concern].

The LPG referred favorably to the certification body. In the first phase of preparing the ED for the initial onsite document review, there was a large amount of e-mail between the ED and the certification body. The hospital received much advice and help on how to improve the organization [cue]. The auditors were considered very detailed, sometimes almost too much [discrepancy], especially during document reviews and the certification audit. At the same time the auditors created confidence with their detailed knowledge and ability to identify salient points and ask questions about the documents and systems [cue]. They also transferred experiences from other organizations and brought expert knowledge on systems and change processes. The LPG experienced the certification process more as guidance than as control [discrepancy].

It was a turning point for the LPG when they received feedback from the certification body and gained experience from the standardization process itself [cue] that changed their understanding of systems that they had considered well-functioning: “things that we took for granted” (Informant Y), but were not good enough [discrepancy]. They started working differently with their systems [action] which generated an improved overview of their organization and tasks [cue], the number of procedures was reduced considerably [cue], and explicit objectives for improvement was created [cue]. The latter was a shift from describing objectives in general concerns, like “we should be better at…” to develop measurable objectives that could be monitored. The entire improvement and certification process [action] was considered as an important help [frame].

The initial countrywide supervision pinpointed the responsibility of other professions, especially physicians, to hold them accountable for the challenges in the ED [cue]. The emphasis on creating descriptions and visualization of core processes in the ED [action] made the department more visible and the process was considered a key to the shared understanding and commitment among leaders in other departments [cue]. The certification body drove this accountability concern further, and mutual contracts with “service” departments (including physicians) was a requirement for certification [cue]. “A milestone could be seen when agreements with other heads of departments became evident” (Informant X).

After following up on the nonconformities that were given during the certification audit, the ED finally received its first ISO 9001 certificate in January 2010.

The time after: winter 2010–summer 2012

Even though the LPG considered the certification process to imply system improvement [frame], they did not expect that the employees would perceive quality improvements, or associate system changes with the ISO certification [concern], since the certification process did not really affect the daily operations and patient treatment. At least two other quality improvement initiatives (triage and nurses’ continuing education) were initiated in parallel with the certification process, and these were considered to have more positive association with improved treatment quality compared to the ISO certification [cue].

The ED underwent two yearly surveillance audits⁴ conducted by the certification body after the initial certification audit. These external assessments were considered important for sustainability of quality improvement [cue], even though the management understood that quality improvement should be part of everyday practice [discrepancy]. Whether these audits needed to be performed by a third-party certification body was not considered of major importance, and neither was the importance of the certificate in itself [Frame].

Situational triggers

The first trigger relates to the nonconformities from the countrywide ED supervision. For the ED management, the nonconformities did not cause disruption, but rather verification of known challenges. What they now perceived as different from earlier (a discrepancy), was the increased focus upon these known challenges and turbulence from the hospital’s top management. Treated institutionally, such an increased focus can be explained by demands to follow up on nonconformities through institutional coercion [56, 57] or regulatory enforcement [58]. But in the sense that these onsite supervisions are ad hoc initiatives, most often with years in between, they also have the potential to cause careless disruption or surprises for organizations that can offer strong occasions for sensemaking. Basically, it can be an interruption produced by new and unexpected circumstances [24]. This seems to be true in this case study, where the received nonconformities made known challenges “visible” [59] for other parts of the organization and especially the top management, and so triggered further actions for control and accountability.

The second trigger relates to the way in which external possibilities for assistance and support led to “quick” action and interpretation. The ED management’s uncertainty about proper solutions threatened their social identity. The external possibilities for support prompted almost immediate action. Organizational uncertainty can be seen as a form of ignorance or an inability to extrapolate current actions and therefore foresee future consequences [24]. Such occasions lead people to construct processes of sensemaking to reduce that ignorance. Plausibility and belief about current action, rather than accuracy about the future, are salient in such sensemaking processes. Early available sources and information that gave some sort of plausible directions for the ED, replaced uncertainty about the future, with more certainty about the present, and as such made it possible to continue. The shared belief among the ED management prompt action, rather than change resistance, that often are seen in organizational change when identity is challenged due to identity replacement, updating, or transformation [26, 55].

Institutional triggers

The third trigger relates to institutional structures in the current internal control regulation. Adoption of internal control system has shown to be a challenging task in health care [60], and the ED did not have a system that was clearly built up around a fulfillment of these regulatory requirements. Finding solutions to operationalize these requirements was inherent in the pilot project. The LPG’s work on concretizing the requirements and developing additional requirements for EDs set in motion important sensemaking processes about the internal control regulation. The internal control system is founded in a functional legislation [34, 61] with a wide scope and possibilities for organizations to choose among a variety of tools for quality and safety work [62]. It is a form of soft regulation that can be (too) diffuse and therefore trigger organizations’ search for control [28, 30]. It becomes a question of transparency and accountability [59], not just in the eyes of external actors, but for the organizations themselves. Because making things transparent is not just about documenting and open the “curtains” for direct insight, it is also about adopting new technologies that make organizational performance visible [59]. The process of concretizing the requirements in the internal control regulation that the LPG performed was such a necessary visualization that gave meaning to their own system and processes [32]. When analyzed from the perspective of Weber and Glynn’s [25] institutional trigger mechanism, we see that the stable institutional structure inherent in the regulatory system became ambiguous for the LPG and trigged further sensemaking that made organizing possible. These findings support other research arguing that a lack of competence on developing internal control systems makes it difficult to adapt to the internal control regulation in Norway [60].

The fourth trigger relates to the institution of ISO 9001 certification. The present case study shows that the ISO 9001 standard consisted of general and unfamiliar concepts and systems that triggered the LPG to find ways to translate and contextualize these ambiguities, in their efforts to make sense of the standard. Seeing the ISO standard as a trigger relates to the same institutional triggering mechanism as for the third trigger. What is different about the institution of ISO 9001 certification is that it involves auditing process performed by external auditors, and therefore integrates direct feedback mechanisms that are interlinked with sensegiving perspectives [31, 63] or mechanisms on how institutions edit sensemaking [25]. Auditors control, negotiate, and guide during their interactions with the organizations, and those tasks give auditors room for different interpretations and conducts of their same auditing role. Concerns about interaction are important, because research on accreditation shows that when health professionals are given the opportunity to participate in assessment contexts that are collaborative and supportive, it can self-reinforce a collaborative quality and safety culture [64]. These considerations on the auditor–auditee encounter may also underpin our present findings where there was a perceived discrepancy between the conduct of the first audit team (performing both the initial certification audit and the first surveillance audit the first year) and the conduct of the last surveillance audit team the second year. The first team was perceived by the LPG to have real impact upon the standardization and improvement work in the ED. The conduct of the second team was so different that it made the ED management question the reliability of the certification process and the meaning of renewing their certificate.

A recent study [65] on stakeholder perspectives identified four factors that seemed important to increase the likelihood of a successful implementation of accreditation: (1) the program is collaborative and valid and uses relevant standards; (2) that accreditation is favorably received by health professionals; (3) that healthcare organizations are capable of embracing accreditation; (4) and that accreditation is appropriately aligned with other regulatory initiatives and supported by incentives. These findings highlight external regulatory structures and intra-organizational factors that seem to be in line with findings on triggers and organizing perspectives related to certification in our study.

Limitations

This single-case study is limited to meaning making processes within a single emergency department in a single hospital in Norway. The small sample is a clear limitation of generalization from this study.