DRAFT GUIDELINE - DUE DILIGENCE FOR THE CONSTRUCTION INDUSTRY

You feel strong when you work in a strong team rather than working alone.

hashtag#duediligence hashtag#construction hashtag#constructionindustry hashtag#riskmanagement hashtag#auditor hashtag#qaqc hashtag#safety

I once collaborated with a team of professional consultants, including a Professional Engineer, a Chartered Auditor, a Legal Practitioner, Risk Management Consultant and I was put in charge of systems and methodologies including QA/QC/SHE elements.

This draft guideline (customized to the construction industry), which I devised, has proven instrumental in assisting numerous auditors tasked with conducting due diligence on large-scale construction projects, as mandated by regulatory authorities. To maintain confidentiality, specifics such as project names, authorities involved, team members' identities, and exact dates are withheld.

I hope this will serve you well, make amendments if you wish.

RISK & OPPORTUNITIES - BASIC CONCEPT - Nik Zafri

ISO 9001:2015 and ISO 45001:2017

PENCEGAHAN LEBIH BAIK DARI BERUBAT

Tengku Adnan

KUALA LUMPUR: Pusat Tahfiz Darul Quran Ittifaqiyah, Jalan Keramat Hujung, di sini, dilaporkan tidak memenuhi tahap keselamatan ditetapkan.

Menteri Wilayah Persekutuan, Datuk Seri Tengku Adnan Tengku Mansor, berkata pusat tahfiz berkenaan hanya mempunyai satu laluan keluar dan masuk menuju ke tingkat atas.

"Kita memuji langkah pengurusan pusat tahfiz yang menawarkan pendidikan percuma kepada pelajar yang terdiri daripada keluarga kurang berkemampuan, namun aspek keselamatan perlu diberi keutamaan.

"Berdasarkan tinjauan bersama Dewan Bandaraya Kuala Lumpur (DBKL), kita dapati wujud kesalahan kerana premis ini hanya mempunyai satu laluan dan ia berbahaya dari segi keselamatan," katanya selepas meninjau lokasi kejadian, pagi tadi.

Tengku Adnan berkata, pemilik dan pengurusan pusat tahfiz berkenaan juga didapati tidak mempunyai kelulusan Jabatan Bomba dan Penyelamat serta DBKL untuk menjalankan aktiviti pengajian tahfiz di premis berkenaan.

"Kadang-kadang bila kita tegur dan suruh tutup sesebuah premis, saya dan DBKL dimarahi dan dikatakan berlaku tidak adil namun sebenarnya kita tidak mahu perkara seperti ini berlaku," katanya.

Katanya, beliau sudah mengarahkan semua pegawai di Kementerian Wilayah Persekutuan dan DBKL menjalankan pemeriksaan ke atas semua pusat tahfiz di ibu negara dan Putrajaya, hari ini.

----------------


Nota

Saya harap pembaca membaca dulu halatuju komen yang saya tulis ini. Ianya tidak berniat untuk menyalahkan samada pihak tahfiz mahupun pihak berkuasa. Yang sudah berlaku, sudahpun berlaku - yang telah pergi, telah pun pergi dan tidak dapat dikembalikan lagi.

Yang penting, apa langkah kita selanjutnya untuk mengelakkan perkara yang sama berulang - sebagai salah satu dari cabang usaha ikhtiar?

----------------

Innaa lillaahi wa innaa ilaihi roo ji-'uun - Al-Fatihah.

Pertama saya ingin merakamkan ucapan takziah kepada keluarga yang terlibat. Semoga semua anak-anak ini digolongkan Allah SWT di kalangan syuhada. Saya harap dapatlah kaum keluarga redha akan tragedi ini.

Apa yang disebut oleh Datuk Seri Tengku Adnan Tengku Mansor memang ada kebenarannya. Namun pada saya, DBKL perlu bertegas demi keselamatan premis terutamanya yang berada di tengah-tengah bandaraya.

Atas dasar kemanusiaan, saya turut bersetuju dengan apa yang disebut oleh YB Menteri Wilayah mengenai perkhidmatan percuma yang diberikan oleh tahfiz berkenaan tetapi aspek keselamatan dan kesihatan pekerjaan perlu bersifat preventif serta bukannya "corrective". Ianya seolah-olah kita menanti bencana akan berlaku. Kita tidak boleh ada sikap "berserah sahaja" dan tiada usaha ikhtiar yang dilakukan untuk mencegah. Dan apabila sesuatu tragedi berlaku, kita ada budaya "menuding jari" (blaming culture)

Sudah tiba masanya, DBKL, JKKP, JAS, BOMBA dll yang berkenaan perlu duduk bersama dan memikirkan cara-cara proaktif seperti mengadakan "fire-drill", pemeriksaan berkala dan penilaian risiko bukan sahaja ke atas premis seperti ini tetapi ke atas semua premis. Ini kerana saya lihat, banyak tangga kecemasan (fire escape) di belakang bangunan telah dirobohkan, "fire door" yang tidak berfungsi, tangga kecemasan dalaman dijadikan stor barangan, penggunaan dapor gas dengan cara yang tidak selamat, tiadanya alat pemadam kebakaran (atau bertarikh luput atau ada tetapi tidak tahu digunakan), kesukaran akses kepada pihak BOMBA untuk memadamkan kebakaran, kesukaran akses untuk mangsa keluar, tiadanya penggera keselamatan, tiadanya pelan lantai, tiadanya "emergency escape route" dll.

Yang paling penting bila bercakap mengenai "preventive action" atau "risk management" ialah LATIHAN, BENGKEL, INDUKSI yang secukupnya perlu diberikan kepada semua pengusaha-pengusaha mengenai pentingnya aspek keselamatan dan kesihatan pekerjaan (dan alam sekitar) (SHE) terjaga.

Aspek SHE bukan sahaja perlu dijaga semasa premis dibina, ianya perlu dirancang semasa fasa rekabentuk, fasa tender, fasa pembinaan, fasa pasca-pembinaan, fasa penyerahan kembali tapak - MALAH perlunya susulan semasa ianya beroperasi.

TYPICAL PITFALLS IN CORPORATE GOVERNANCE - Nik Zafri

Lesson No. 1 : The CEO must be well-informed of any risks (both technical and financial) when deciding to invest in "new innovation"

Innovative ideas may sound "juicy" but potentially may also become a great threat to sound governance practices. Few gigantic motor corporations thought innovation was a good investment hence a lot of money went to Research and Development (R and D) to produce "innovations" to only knew later that they have breached the law.

a) The VW emissiongate/dieselgate

Quoting Ian McVeigh, Head of Governance at Jupiter Asset Management wrote in the Telegraph UK in 2015 : 

"The revelation that the car giant (VW) has been using so-called “defeat device” software to get its diesel cars to pass strict emission tests has been an unmitigated disaster. Since the scandal broke, the value of the company has fallen by around €30bn (£22bn)"

Source : https://commons.wikimedia.org/wiki/File%3AVW_stock_price_after_emissions_violations.png (Analysis by Dennis Bratland)

He wrote further about the significance of the CEO being well informed of investment analysis without the investors finding out about it first. Ian also mentioned about the corporate structure of German companies - having split boards - a supervisory and a management board making it potentially unclear of the "who is responsible or authorized for what?". UK however adopted the principle of putting the final responsibility with only one board.

The Volkswagen dieselgate or emission gate case started on 18 September 2015, when the US EPA issued a notice of violation of the Clean Air Act to German automaker Volkswagen Group for intentionally programmed turbocharged direct injection (TDI) diesel engines to activate certain emissions controls only during lab emission test. The programming caused the vehicles' NOx output to meet US standards during regulatory testing but emit up to 40 times more NOx in real-world driving. 

The CEO sportingly have since apologized to the customers, users and the general public. Later, he resigned.

Although Volkswagen is embarking on new policies and slowly regaining the trust of stakeholders and the car buyers, but the price they have paid is high.

Lesson No. 2 : Hiring "external party" to advise the Board can also lead to disaster.

I once heard somewhere that billionaire Warren Buffet; at some point; do not fully trust "external party's" judgement. He would rather make his own final decision.

Be careful when appointing external "subject matter experts" especially authorizing them to speak in a Board Meeting. If it is not necessary to hire, then DON'T! 

Many important decision cannot be made unanimously because the "so-called guru" says "NO". Ironically, the CEO agrees and subscribes to the "gurus" advice rather than seeking majority opinions from the experienced board members. (I've seen this happened before - it was a disaster!)

Hiring consultant assisting in corporate governance implementation is fine but these practices should be restricted to mid and support levels where CEO leads the initiative - not vice-versa. Board Members meeting must always be treated as CONFIDENTIAL.

Remember : Not everyone in the boardroom are smart guys!

Lesson No. 3 : There are always good rationales of why laws are implemented and enforced. 

Those who try to avoid the law are deemed to have "cheated" the government/ lawmakers and other stakeholders. Or put simply, betraying everyone's trust. 

One of the top cases that I've bumped into is misappropriation of funds (breach of trust) due to shareholders "manipulating" their unclear roles, responsibilities and authorities to serve their own ends. Other cases include : board ineffectiveness, unethical audit and risk practices, "unfair" pay, bad relations with external parties such as accountants and company secretaries. (aah yes, accountants and company secretaries can tell stories too - they know your secrets!)

We've witnessed how prolonged "conflict" between corporate entities and the lawmakers ending up in series of investigations and prosecutions. Long battles in the court of law not only endanger the company's reputation (even if you win the case) but the sad consequences that follow it - from people loosing jobs to reduction of market values.

Lesson No. 4 : Risk is always PROACTIVE

Never wait until problem arises. Learn the lessons from others who have failed. Take proactive measures by adopting Risk Management. (and don't just simply say....DO IT!) Proactive Risk Identification will provide you with a guide on Plan of Action (mitigation), brainstorming and develop a strategic plan. 

All these activities must happen prior to operation/project implementaton, assessed during the operation (comparing with the Risk Register for proactive risk identification stage) and mitigate during post-operation stage.

Adopt good practices of Risk Management but do not try to be too bold by taking unwanted risks!

Lesson No. 5 : Do What You Say and Say What You Do.

When you have given solemn promises or have put them in your customer charter or have addressed them in Manuals and Procedures - deliver them. Don't just file everything up and ignore them, or displaying what needed to be displayed and "that's it...end of story" - hoping that your PR will do the rest for you.

Sometimes, as a shareholder, you need to realize what you think is "impossible" can happen and do happen - whereby other shareholders (your own friends) can turn against you due to one or two angry customers who feel that you are not delivering what you have promised.

There are so many reasons of why ISO 9000 or Total Quality Management is introduced on the first place. Surely they are not to burden you but to help you.

Lesson No. 6 : Non-Conformance and Risks are opportunity for improvement

Don't scare auditors with cold bullying remarks such as :

• "I'm your paymaster",
• "Make it looks like there is more "loss" than "profit",
• "I know your boss",
• "Don't try to be too smart - remember Enron?" 

Remember, auditors are human beings too. If they feel threatened, despite the Non-Disclosure Agreement, they still can adopt the "Need to Know Basis" vs your "Transparency" - they can even get court-orders. Believe me, the end-results won't be good.

Treat auditors as friends who are trying to help you not destroy you. Treat any non-conformances as opportunities for improvement and not some "fault-finding activities". In the end, you'll be in every auditors "good book"

Don't make your company becoming one of the case study being discussed in front of other auditors in their association.

Lesson No. 7 : Be careful when setting limits on shareholder voting power.

One study (by Ken L. Bechmanna, Department of Finance, Copenhagen Business School and Johannes Raaballeb Department of Economics and Business, Aarhus University) shows that the bad corporate governance in the banks is visible in the shape of severe restrictions on shareholder rights, including voting and ownership ceilings, etc. These severe restrictions are quite unique, especially from an Anglo-Saxon perspective. In the U.S., ownership ceilings are not allowed and in a sample of 4,399 U.S. firms, only 24 had voting ceilings (see Commission of the European Communities, 2007). 

Similarly, voting and ownership ceilings are not among the 24 corporate governance provisions carefully examined by Bebchuk, Cohen and Ferrell (2009), who show that restrictions on shareholder rights lead to significant reductions in firm value.

Out of the six entrenchment provisions found to be value destroying, four of them set limits on shareholder voting power and the ability of a majority of shareholders to impose their will on the management.

And FINALLY!!

When you are having problems, try avoiding easy paths such as buyover, mergers, bailouts etc or worse - let yourself willingly to become "victim" to "hostile takeover" or ending up in government intervention. 

Even if you feel like selling your shares or the company itself, don't give up yet - try your best to first to solve your problems - who knows, you might succeed against all odds. 

Be transparent to your employees - let them know what is happening, many companies have gone down to earth and surprisingly, their employees have very good ideas on how to save the company. If the idea works, give these employees the rewards that they deserve!

ISO 9001:2015, OHSAS 18000, EMS ISO 14000 - SOME USEFUL FLOWS - NIK ZAFRI

#ISO90012015 #OHSAS18000 #EMSISO14000 #ISO14000 #NikZafri

FOR MORE INFO : Contact  me/RFQ for more details or Click on Online Enquiry Form 

(Serious Enquiries Only)

MENGENALPASTI, MENILAI DAN MENGAWAL RISIKO DAN SUASANA BERBAHAYA - Pengenalan asas(Keselamatan Kerja) - Nik Zafri

Mengenalpasti suasana berbahaya (Hazard) dan penilaian risiko melibatkan kesinambungan maklumat secara kritikal bagi membuat sesuatu keputusan. Proses ini dapat membantu mengenalpasti punca berlakunya kemalangan (mengenalpasti suasana merbahaya - Risk Identification) , kemungkinan berlakunya kemalangan (penilaian risiko) dan apakah akibat-akibat yang berpotensi dari kemalangan berkenaan. Selain itu ianya juga dapat membantu untuk mengambil langkah-langkah yang sepatutnya bagi mencegah dan menghalang kemalangan berkenaan secara proaktif (mengawal – control)

Nota : Versi terkini ISO 9000 (ISO 9001:2015) boleh dijadikan asas rujukan di mana ianya menekankan bahawa penilaian risiko boleh dikenalpasti semasa fasa Perancangan di mana peralatan seperti Analisa SWOT dan PDCA boleh digunakan untuk mengenalpasti Potensi Risiko berdasarkan pengalaman yang direkodkan dalam sesi audit, pemeriksaan, penilaian risiko terdahulu (jika ada) dan mesyuarat semakan semula pengurusan.

Terdapat banyak cara untuk mengenalpasti suasana berbahaya dan menjalankan penilaian risiko. Teknik yang digunakan adalah bergantung kepada suasana tempat kerja. Namun apa yang penting ialah, kerjasama antara pihak pengurusan dan kakitangannya amatlah mustahak bagi mencapai penilaian suasana berbahaya yang berkesan dan efisyen.

Kemalangan yang berat biasanya jarang berlaku. Ini kerana sudah ramai pihak pengurusan, kakitangannya telah sedar mengenai kepentingan menjaga keselamatan dan kesihatan pekerjaan di tempat kerja.

Walaubagaimanapun, kemalangan pada kekerapan yang rendah kadangkala bukan bermaksud tiada potensi kemalangan itu tidak akan berlaku. Biasanya, dalam keadaan yang tidak disangka-sangka, ianya boleh berlaku, ini kerana sesebuah organisasi yang beranggapan tempat kerja mereka selamat akan cenderung kepada sifat mengambil mudah.

Di sinilah kepentingan pengenalpastian potensi kemalangan, penilaian risiko dan langkah-langkah kawalan boleh diambil bagi mencegah insiden dan kemalangan secara proaktif.

Sistem pengenalpastian potensi suasana berbahaya dan penilaian risiko perlu melibatkan :

a)    Mengenalpasti operasi dan rekabentuk yang berpotensi menampakkan kelemahan – contohnya jika ianya beroperasi melebihi masa atau rekabentuk yang berkali-kali disemak.

b)    Berfikir di luar kotak berdasarkan pengalaman

c) Memastikan langkah-langkah kawalan yan sediada termasuk prosedur standard operasi yang digunakan masih relevan dengan proses (contohnya, jika ada teknologi baru, perlukah prosedur itu dipinda dan perlukah langkah-langkah kawalan ditambahkan untuk disesuaikan dengan suasana yang baru?

d) Berkongsi pengalaman dengan organisasi lain – biasanya menerusi penyertaan dalam seminar, persidangan, kursus dan bengkel mengenai penilaian risiko.

Antara cabaran yang biasa dihadapi :

a)  Pengurusan masa yang diperlukan untuk mengenalpasti suasana berbahaya dan potensi kemalangan yang akan berlaku jika tiada kawalan dilakukan.

b) Perlunya kombinasi kepakaran dalam teknik-teknik mengenalpasti suasana berbahaya dan kawalan risiko (HIRARC (Hazard Identification, Risk Assesment and Risk Control, HAZID (Hazard Identification Techniques), HEMP (Hazard and Effect Management Process), HAZOP (Hazard and Operability Studies) Hal ini boleh dilakukan dengan perkongsian maklumat di antara satu organisasi dengan satu organisasi yang lain, perkhidmatan perunding atau pakar dari luar untuk membuat penilaian bebas tanpa sebarang kecenderungan dan pengalaman yang direkodkan (di sini data sangat diperlukan)

c)    Pengetahuan dan pengalaman mengenai tempat/premis/tapak kerja dan teknik yang diperlukan.

d)    Memastikan mereka yang menjalankan tugas penilaian, audit mahupun pemeriksaan adalah mereka yang bertauliah.

THE NEW ISO 9001:2015 - NIK ZAFRI

WHAT TO EXPECT IN THE NEW ISO 9001:2015 (PART 1)

Disclaimer : Most of the contents here are not the 'actual/literal' text of the actual new ISO 9001:2015. It's the personal interpretation of the author.

0.1 – QMS as a strategic decision, a robust Quality Management Systems (QMS) – to help organization to improve its overall performance and forms an integral component of sustainable development. Design and implementation of QMS is influenced by the context of organization and   (including) the changes.

Definition

a. Strategic– Identification of long term/overall aims and interest and means to achieve them (taking into account coping up with fundamental changes – susceptible to the surroundings (what is happening around you) – law, competition, regulations, standards, trends, new technology, innovation, Research and Development etc.)

b. Robust– a process, system able to withstand or overcome adverse conditions (defects, non-conformance, corrective action request)

c. Improve overall performance – integral component of sustainable development– no system is perfect, it should be improved and become part and parcel of company's culture to achieving excellence.

d. Designed and Implemented by the sort of industry-specific – service/product provided by the company (to achieve such purpose – goals and objectives) – customization/tailor-made (1)

The rest of the content in 0.1 also talks about culture (already covered), external factors – socio-economic conditions under which it operates) – when we talk about socio-economic conditions – it talks about how the process - impacts the general public, public perception, surroundings  – possibly employment opportunity and most important – the organization must realize its financial capacity –not to do something way beyond their ability. Do something that suits the organization ONLY  (2)

Also touched on QMS can differ from one organization to another(See (1) - customization)

0.2 – not much have been changed except more emphasis is given in point no. 2 – ISO 9001 – improved internal communication, better understanding and control of process – reduction in defects and waste 

(the only way to do all these is to adopt principle of “no walls, no politics, no overlapping of duties, no pinpointing, no blaming culture” - so 100 points go to"Improved Internal Communication"  - everything starts here....

and also point no. 4 of 0.2 – ISO 9004 which touches on configuration management; apart from other elements – quality plan, project QM, measurement process/equipment, documentation, (and again - ) financial/economic benefits of the system (See (2), Statistics etc.

Definition

Configuration Management - system engineering process for establishing and maintaining consistency of a product's (or services) performance, functional and physical attributes with its requirements, design and operational information throughout its life.

0.3– comprehensive process-approach explained in better details. What's interesting are the words “understood” and “understanding” are being used. It means that the system HAS to be understood – on company-wide basis.

There is no point making a system only to be understood by a certain 'exclusive top management level'.

How to make everyone understand?

Mind you, I'm not talking about the typical (word by word) memorizing the policy or objectives – remember UNDERSTAND is totally different than MEMORIZE....

- a laymen understanding – is to understand QMS in their OWN work! (refer Job Description and Responsibilities/Authorities) – if these are not clear, DON'T HOPE everyone to understand – you will receive typical provoking comments from them just like when the previous system was implemented - “This is not my job?” “Having ISO is like having NOTHING – no impact – nothing for me” - hence - they don't feel the system!

0.4 including Figure 1 and 2 talk about 'Plan-Do-Check-Act” in much more simple understanding but implementable.

0.5 Something new – Risk-Based Thinking (in fact it's partial risk management) – which I agree 100%.

Definition

Simply look back at your Management Review Meeting, Data Analysis and Continual Improvement Plan (if you have any - if you don't, then 'BIG TROUBLE') – now PROACTIVELY start identifying, assess and prioritize the risks (the effect of "uncertainty") – how do you that? 

Yes, look back at frequent problems in your data? 

And prioritize - put them according to order, mark them with RED, YELLOW or GREEN and discuss the solution further. You can also integrate ITP, HIRARC, SHASSIC, CONQUAS or whatever specific assessment/inspection system you have (if you have one - if you don't, then go for the normal inspection that you do - incoming, in-process and outgoing) etc. into it. 

No overlapping please...let all the system be harmonized and co-exist.

Now, should you have a full (projected) Risk Management Plan before starting the operation? (Preliminary, Design, Interim and Final) – if you have the time – the answer is YES!

Project Management - Critical Path Method - justify the RED ones by thinking outside the box (outside the software) - there must be alternative ways of justifying it. Yes, I have the great CPM and the 'technical S Curve'  but why is there still delay?

Just match it with your MRM Data...you'll be on the right track.

0.6– compatibility with other management systems – explained in greater details.

VERDICT?

Yes, the new ISO 9001:2015 is attempting to cover and solve ALL kinds of management and technical problems (sound kind of ambitious - don't you think?) – however, lots of cross-referencing need to be made. Act smart for a while...please

(wait for Part 2)