Podcast: From standards to strategy - leveraging management systems and artificial intelligence

Holly: Hello everyone to all of our listeners worldwide. Welcome to LRQA's Future in Focus podcast. My name is Holly Plackett and it is my pleasure to host this podcast episode for you. Today I'm joined by two very special guests. Global Head of Operational Excellence at DXC Technology, and our very own Shirish Bahpat, Technical Product Manager for Cybersecurity at LRQA.

Hi Anshuman, welcome to the Future in Focus podcast. It's so great to have you here today and thank you so much for joining us. How are you doing? 

Anshuman: I am fantastic, Holly, and thank you for inviting me to this lovely podcast. A pleasure to be here and sharing my views. Of course, we work together with LRQA quite a bit, so happy to join this.

Holly: Excellent. Thank you so much for joining. And Shirish, thank you for joining us. It's great to have you here also. I think this is your first time on the podcast, so thank you. How are you today? 

Shirish: I'm doing good, Holly. Thank you. And it's really nice that I'm here with Anshuman, with whom I've worked in the past. So it's great to be on this topic. Thank you. 

Holly: Wonderful. Thank you, Shirish. So before we start, I'd like to do some introductions. And if you don't mind, Anshuman, I'd like to start with you. Could you briefly explain to the audience a bit about who you are and what you do for us, please? 

Anshuman: Sure, that's always a tough job, Holly, but I'll try. So I, of course, like you said, I head up operational excellence for DXC technology. DXC is a global IT services organisation spread across the world. We deliver IT services to some of the world's leading organisations. My role is to make sure that I can help DXC keep its promises to customers by making sure that we follow processes. We have the right processes, first of all, and then we follow those processes and from time to time, we improve those processes. So those who are familiar with the Durand trilogy of, you know, processes, planning, control and improvement, um, and similar words. We try and implement that in everything that we do. So have a process, comply to it and then improve upon it. That is in summary what I do. Uh, my team works globally because DXE is a global organisation across many organised countries and, um, yeah, that should be a nice summary. 

Holly: Excellent. Perfect summary. Um, thank you for that. And Shirish, could you please introduce yourself for our audience?

Shirish: Thank you. Sure. Thank you, Holly. Uh, as far as I'm concerned, before joining LRQA, I have worked with, uh, computer systems and networks, also software quality. In LRQA, I have been an auditor and trainer, so being an auditor has given me exposure to various industries and various systems. And post that, currently, currently I'm doing the role of product manager, so I'm helping LRQA maintain its accreditations with regard to all the Cyber certifications that we have. So I'm involved in that activity. Similar to what, uh, Anshuman said, where they have their processes. We at LRQA have our own processes. We need to improve them, maintain them and introduce new ones. So that is where I'm involved. Thank you. 

Holly: Thank you, Shirish. Very important. To us here at LRQA. Um, so thank you both for those introductions.

We are here today to talk about business excellence and more importantly how management system standards contribute to business excellence and later in the podcast we'll be leaning into the topic of the moment artificial intelligence or AI as it's commonly known. So Anshuman, could you kick us off by describing what business excellence looks like to you and how you would define business excellence?

Anshuman: And that's a good question. Uh, we get this question quite a lot, uh, those who are in this field. And the way I usually respond is that anything that can be done or that is being done can be done better. So the general premise is that everything can be improved and that's how we were all trained in the field of quality over the years, quality has morphed into multiple.

Subjects, including business excellence or delivery excellence or operational excellence. And, uh, I won't say that they are all the same, but they're quite similar in the same family. So point number one, anything that should be done is being done, can be done better is the general premise. Then of course, topics come in that point two would be.

whatever can be measured, can be improved, or unless you measure something, you can't really improve those things. And this applies to really everything. And in the modern era, more components are added because a lot of stuff is being done through the use of technology today. And nobody really is touching or seeing those pieces of information that are flowing across the organisation.

So that demands some new elements of using technology to, to, to find those defects and maybe even rectify those defects. So those are some new elements, uh, I would say. Whether one is working for a hardcore manufacturing firm or a top end IT services firm, some of these principles don't change. Of course, in an IT environment, maybe the way you identify defect, the way you rectify the defect, the way you prevent the defect might be different, but in general, the more things change, the more they remain same.

Holly: Great definition. Thank you. And we'll touch back on technology later in this podcast. But moving on to the next question, if I may. What role does quality and related certifications such as ISO 9001, the globally recognised quality management system standard, play in business excellence? 

Anshuman: I'll try and take that, Holly.

And in my view, these are foundational elements. So every. Every building, every tower that stands today, tall today needs a strong foundation. And I was growing up in the field of quality when the ISO 9000 series came about. And to me, it has always remained that foundational element to everything that we do.

The principle that we all learned when we were learning more about ISO series was that you document what you do and you. You know, do what you document, that's where it, everything starts, of course, over the years, it has become more, more, I would say, all encompassing more features, more clauses, more elements, but eventually at the end of the day, it talks about, are you doing the right thing?

And are you writing what you are doing? And then are you able to verify that you are doing what you wrote? And Business excellence is nothing but these three things. If we, if we follow global best practices and we are able to adapt those global best practices to our organisation and then go ahead and implement that, that is business excellence in its purest form.

And then of course, you know, layers get added in terms of technology and other areas, but I like to strip down things to the bare minimum. And that's how I see this, uh, this whole ISO bit. 

Holly: Fantastic. Thank you Anshuman and sticking with you if I can. So we just touched on ISO other ISO standards. ISO 9001 as we know is the starting point for many organisations management system certification journey.

So how easy is it for businesses to implement standards such as ISO 14001 and ISO 45001 after the requirements of ISO 9001 have been embedded? That's it. 

Anshuman: Oh, that's a brilliant question, Holly, because not only the two standards you mentioned, the 14 and 45, I believe that almost every ISO standard or ISO series standards become easier once you implement 9000, because the basic principles, the basic format, the basic structure of all the, or at least most of the standards is similar.

So I did speak about some of these. basic structure that you identify best practices, which the ISO series has done more or less in the standard. You then adapt them to your organisation and then implement. For example, for 14 and 45, 000, you may need to understand what applies in your industry. and what could be the best for your industry and that may need some research.

But if you have the foundation of 9000, then the rest of it is fairly easy and straightforward. Easy as in intellectually easy. It may still need effort. It may still need time, but it won't be an intellectual challenge to understand, implement, and deploy any standard, actually, not only these two, but any standard, in my view.

And I have been doing this for about 25 years in various capacities, sometimes as a consultant, sometimes as an auditor, sometimes as a, as a function head. And so I've seen this happen from multiple point of views. The basic premise never fails. If you, if you are open minded, if you are willing to learn from other organisations, if you are willing to learn from what the world is doing and then adapt and implement it in your organisation, then quality is very easy.

Holly: Fantastic. And just one more question for you Anshuman before we move on to the next topic. Do you have any examples of where you have seen a management systems based approach deliver business excellence? I'm sure you have. 

Anshuman: Oh, quite a bit. Uh, I think not, not only the ISO series, but there are other management systems, including national quality awards or global awards and those kinds of things.

And all of them actually require an organisation to document their management system. Now, I, as a consultant during my consulting days, I had a large textile major in Southeast Asia. which was struggling to basically deliver to the promises that they had made to customers and the first assignment. And of course they hired us for turning things around.

And after about a week's, uh, diagnostic review, my recommendation to them was that forget about large scale changes, you need some fundamental stuff around. making sure that your documentation is right and your people are following those documentation or the standards that are put in place. We were able to convince the management for giving us about six months and very rigorous implementation of basic process documentation.

And we had a huge turnaround. In that six months itself, this was meant to be a two year assignment, but in six months itself, we were able to turn around with zero investment in technology, zero investment in any new manpower and, you know, significantly reduced defects and, uh, You know, returns, since it was a manufacturing firm, it had a lot of returns, uh, as well.

And then once this platform was ready, we were then able to add global best practices and so on. So that I think, uh, would be a good example. Subsequently, I've, uh, been involved in many similar exercises, but this was one of the early ones. And this has always stayed with me, um, only in terms of the power of.

management systems, and if you are willing and open to listen to it and adapt. So that would be one example I would share. 

Holly: That's a really great example. And I think it's so true. Management systems are the core of, I think, a lot of business excellence now. And I don't think that you can move on to larger projects and risk management strategies until you've got those fundamentals in place.

So really, really important to highlight that. Um, thank you Anshuman. I may come back to you in a little bit, but for the next couple of questions. 

Anshuman: Can I jump in and add a little bit more, you know, there is this general perception that in the world of startups in this modern world where companies need to be more nimble, agile, and whatnot, there is no place for a management system standard.

To my thinking and my experience, that is the purest nonsense anyone can. Talk about because the more agile you are, the more nimble you are, the more you need a system actually, because otherwise you, it will be complete chaos. Uh, we will be just subjecting ourselves to chaos and, uh, everybody does.

whatever they feel like. Imagine the cost of doing that. When the organisation, a particularly startup organisation is well funded, nobody minds that extra cost. But when the screws are being tightened and the investors start asking for returns or performance. That is when everybody remembers, Oh, where is that quality guy?

Bring him on and let him, let him work his magic or her magic. So I do remind everybody that please don't think that in the modern world. In the startup world or in the smaller Nimbler enterprise, you don't need quality and quality or management system standard, you actually need more of it. Uh, so that is something I thought I'll add, uh, you know, but back to you.

Holly: No, thank you so much for that. It's I think something a lot of businesses struggle with now, the new world of risk and how they manage it, but it's important to remember the building blocks and the fundamentals. So thank you for highlighting that point. Um, Shirish, I'd like to come to you, if I may, so we touched on quality, environmental health and safety, along with other ISO standards, and not just ISO rightly mentioned, but various management system standards, but I'd now like to switch the focus to information security, which, as we know, is a huge, huge topic of conversation at the moment, and something businesses globally are taking very seriously.

What does information security best practice look like to you, Shirish? 

Shirish: Yeah, Holly, this is excellent and very relevant to, uh, but before I touch upon security, I would like to pick it up from where Anshuman, you know, linked the whole, uh, bit of excellence. So if you look at security, it comes in, uh, mainly post IT enablement.

Uh, in the organisations. It is not that security was not a subject in the physical world. It was always there. Having secure premises was always there, but I T enablement and digital transformation more in today's times has brought this topic to the floor. And today we know we are more than exposed. Uh, when it comes to the information security risks.

So when Anshuman was explaining how in today's times we are not able to grapple the way information moves and data moves. So these are the things where security becomes very important. And as far as management systems and the whole excellence moment is concerned. All these things we know are really dependent upon true transformation of people's mindsets, relationship and a continuous improvement culture.

Now, these are exactly the things which are important, even in security, because after the Companies or organisations have set up everything that they could do from a technology perspective and putting in the policies into place. We know that human factor or people factor becomes a very important factor.

So you'll find that most of the organisations are continuously investing in training their employees. Plus, we know that the various kind of attacks that are happening today on organisations are really smarter than what we can think of. And this is where the awareness levels of the employees becomes very important.

And this is where organisations, if you see, have multiple best practices. So other than ensuring that their networks are fully hardened and segregated, so that data movement is fully under control. And they also know how this data movement can happen across various segments of that network. Like we all know, in the industry, we have, other than having information technology, which is more towards the corporate and towards putting organisational systems in place, we also have operational technology, which is working across on the field, Giving us data, we have manufacturing industry where we are using various organ, uh, various, uh, operational techniques.

We also have, uh, maybe national critical infrastructure, like, say, power systems, water systems. These are all based on maybe SCADA systems. Now, when all these systems are working with operational technology. They eventually have to interface with, uh, the information technology network that we have. And that interface on both sides has to be secure.

We need to maintain our OT network securely, and we need to maintain our information technology networks. So we have seen that for these kind of things, companies do have practices where they ensure that they have multi factor authentication, They have proper access control in place. They put various encryption techniques and they are constantly making, uh, employees change their passwords and from a technology perspective, they also now have, uh, data leakage prevention tools in place.

They will filter everything that goes through the web. So all these practices are being put, and on top of that, uh, even from a security perspective, organisations today are looking at the ICT readiness for business continuity. So, all this adds up and creates a security posture for the organisation. And this is what helps them, uh, build that better interface.

Another two elements that have now come for organisations. One of them is, um, cloud services. So all organisations are dependent on, uh, data in cloud. So information security with regard to the cloud services and the relevant supply chain, because you may not always have. Uh, your own, uh, cloud centers and you may be using hybrid cloud.

So in these cases, those understanding and kind of agreements become very important. And yes, I would end by saying threat intelligence is something which all organisations today are investing, trying to connect with suppliers who can help them. Uh, based on the kind of network data or industry they are in so that they keep getting that information and they are able to build upon that.

Holly: Wow. Fantastic. Thank you. Um, so moving on to the topic of the moment, artificial intelligence or AI, we. We've all seen how AI has exploded over the last couple of years and how businesses worldwide have been quick to embed AI strategies, um, from marketing through to consumer facing tools, such as AI powered shopping assistants. Even more fascinatingly, AI is actually being used by some companies to identify fraud and cybersecurity breaches, which for me really does highlight how much of a game changer artificial intelligence is. But, um, and it's a big book, right? As with many things in life, there are significant risks associated with AI.

In fact, this year, the International Organisation for Standardisation, or ISO, published the first AI management system standard, ISO 42001, which specifies the requirements and provides guidance for establishing, implementing, and maintaining and continually improving an AI management system. So, Shirish, could you tell us how you see AI being used and do you think businesses who are actively implementing AI into their processes should be looking to implement a standard such as ISO 42001 to help them better understand and manage the associated risk?

Shirish: Yeah, sure, Holly. I think this is something which is getting discussed maybe on a daily basis nowadays and in some way or the other when we are looking at news items. So we pick up newspapers and we see information with regard to a lot of. Uh, AI generated stuff. We look at many other articles where experiments are going on where automated vehicles are being used.

But before coming to all that and linking it to 42001, I would like to say that industry has always been using automation for repetitive processes. And these kind of tools or these kind of equipment have always been there on the, say, a shop floor or any kind of organisation that we look at. So we did always use automation.

What happened in the last few years is that now we have automatic decision making that has been built into these systems. Now, we all know that software's always decided something. They had a logic built into them so that they can use the gates given and they can move through that to take some decisions based on the user inputs.

But that was limited and that framework was within that software the way it has been programmed. But when we look at today, automatic decision making, we are talking of Self learning or AI learning or machine learning where over a period of time, the tool is becoming smarter by gathering more information from the questions or the prompts that are given and it is building itself up over a period of time.

So what we can see in such cases is that over a period of time, the decision making that can come out of such equipment. Is something that we ourselves cannot explain. As I said earlier in automation or where we use software programs we could clearly define or we could clearly judge what could be the output.

Now in self learning tools we cannot always predict the outcome and that is where the whole Uh, game of AI changes, you know, or artificial intelligence comes into play. Now you're, this makes it non explainable for us or non transparent. And, uh, we know that this machine learning has is based upon a lot of data analysis at the backend, which the tool itself is doing, and it then gives us that, uh, you know, insight.

So there is a leap that will happen over a period of time with this continuous learning. Now, the next step that would happen eventually is when there is so much decision making and knowledge within a equipment or a tool, there is going to be a change of behaviour of that tool itself. You know, this is very relevant or this is very similar to how humans behave actually.

Now, this brings in a big societal challenge of ethical use of artificial intelligence tools. Now, today we may be building smaller tools. You know, I, uh, recently interacted with a client where, uh, they are building a tool to read radiographs. So, naturally to do that, they have fed that program with all the radiographs that are available in that hospital.

So, that particular tool has a lot of data and it keeps piling up. Predicting and every time the doctor corrects that prediction. So over a period of time, that tool will predict better. And that is what they are looking at. So there is continuous learning and this is what is going to create a societal impact.

Plus what will happen is, uh, as we go forward, there are going to be more used cases of AI. And here, this is where we will have to balance between governance and innovation, because then we would have seen the risks. And at the end of the day, what is it that we want? We want trustworthy systems. We want AI which is trustworthy.

We want to be secure, uh, working with the tools. Uh, we want to manage safety, have fairness, bring in transparency all throughout. And the data quality of AI system has to be Good, because if the data itself is biased, then there is a possibility that over a period of time, the decisions of that tool may also vary.

So all these things are very, very interesting with regard to AI technology. Plus, we have to look at various aspects. Like when we talk of AI, we are looking at learning, recognition, and eventually prediction. Uh, we are also looking at, say, from a research perspective, inference, knowledge, and reaching language, you know, so we have language processing, uh, we have discovery, search, and eventually creation.

So we know that, uh, innovation can be driven by AI itself. Now, sometime back, I think in your question itself, you mentioned about some AI tools, you know, like fraud detection tools that are there. Like, currently we know that there are fraudulent credit card charges. Now, these get picked up by the AI tool at the back end.

Uh, there are fraudulent loan applications, insurance claim. Various account accesses, any unusual activity in the ecosystem can be picked up by these AI tools. Uh, I, uh, recently saw one, um, sample at a client's place where this was for a U. S. supermarket. And these people were picking up the images, the face images of all the clients who come and walk in.

And this was a huge experiment they did. And then, uh, they tagged some activity. knowingly to some individuals. So next time that person enters, the system would start giving them a warning, and this is how they are trying to build a system. So here we can see that the system behaviour itself will become very interesting over a period of time.

Another big example that we're looking at nowadays is the automated vehicles. So we know that routes get optimised. Google has always been doing that for us. And, um, then even lane changing will be automated. So now what is the difference? I recently we were discussing the same topic about automated vehicles, and we already know that airlines have been using automatic landing systems.

Automatic landing systems are locked in at the last phase of landing when they have to land in low visibility. Here we have vehicles, uh, which are working with more moving objects around them on the street. There are people that are cars. So there is object avoidance involved. So that vehicle has to fully depend on computer vision and planning.

So this is also part of the AI that is getting developed. And currently, I think, in direct public application, automated vehicles AI One of the biggest things that is really coming up. So after giving the example of say automated vehicles and if we have to Holly go back to your question and look at ISO 42001.

Firstly, I would connect it to what Anshuman said to start with that management systems basically give us the foundations. So 42001 also does that. Earlier you discussed 9, 001. Uh, 45, 001 and 14, 001. So we look at environment safety quality. Now we can look at information security and say artificial intelligence.

But again, it is the foundation as far as the management system is concerned. And when it comes to an organisation, it helps classify itself and its suppliers. into various categories because today the field of AI is very big and very open from that perspective. So there are a lot of tools being introduced.

There are, there's a lot of technology which is coming. So when we look at this, uh, we would know whether one is an AI, just an AI user. So I want a tool, I want this particular process to be Uh, using an AI tool, whether I'm a developer or I'm a producer of multiple tools. So based on that, it will depend what is the risk that the organisation has.

And what is the system impact of that particular risk? Now, when we look at, say, the system impact, we need to know whether, uh, it is sensitive or non sensitive context, uh, in a perspective that, uh, some of the, uh, impacts could be very sensitive, socially sensitive, and, uh, that can create a lot of, uh, issues with regard to the organisation in a social context.

Then, um, Also ensure that there is a proper risk management. We know that all management systems heavily depend on a risk management process. So in this case, for the artificial intelligence management system, there would be process risks, which would be identified. Uh, again, linking back to the multiple standards.

We spoke, uh, From the moment we have been looking at, say, a process approach, we know we could easily bring in quality, safety, environment, or information security. The same way we can bring artificial intelligence to the process approach, we also need to know if we are working in more than one process.

Legal frameworks and what is going to be the same system impact of this, uh, artificial intelligence tools that we are using also the diversity of applications that are there. So when we consider all that we know that a management system basically will help, uh, you know, tie all these things together into a framework because it does give a very good structure which currently management systems are used to buy.

Most of the organisations and they understand the structure that ISO promotes and, uh, this particular structure will ensure that there are proper objectives in place. Uh, the organisation know, uh, which interested parties are getting impacted. The risks get managed. Well, uh, they can also ensure that their concerns related to trustworthiness of the AI systems and the earlier points that I mentioned with regard to transparency, data quality.

All these things throughout the life cycle can be managed. I think that is what is important. This is not a single decision that a. Organisation takes it has to work through the life cycle and also ensure that they have more uh, controlled, uh, interactions with their suppliers, partners and third parties, you know, who bring in AI products to them so that the whole network gets covered for them. So I think that is how I would look at 42001. 

Holly: Great insights there. It's all very fascinating stuff. Thank you, Shirsh. Final question from me, and Anshuman, this one is for you, if you don't mind. How does AI fit into business excellence, in your opinion? 

Anshuman: So this is an emerging field, um, Holly, I think I would say that the jury is still out.

But in general, there are some patterns or trends that we can already observe. Like in almost every field, low end tasks, repetitive tasks, will certainly get You can say automated or AI enabled in some ways. Any task that requires some element of search will get, I would say, uh, implemented within the organisation.

Now from, we have been experimenting and I know of other organisations also who are experimenting with this. So within business excellence, there is one element of quickly finding what clause applies to this situation. There can be other elements. For example, I manage teams related to business continuity.

In a, in a very quick situation, we may need a summary of what we have promised to the client. And from a business continuity point of view, and because it's a crisis situation, usually these situations exist only You know, in flood, fire, fury, flu kind of situation, the 4F situations. So in those situations, AI is certainly extremely useful already, right?

So this is not a future scenario. It is already useful in quickly reading and summarising requirements or promises that we have made to clients. That I think is great help already. Now, the other aspect is data, uh, or number clenching, you can say, which was already happening for some years with, with, um, faster tools and clever technologies, but, uh, AI could be.

would be trained to identify to look for some specific patterns, which existing technologies don't do. For example, if there are networks that have multiple outages over a period of time across the world, we could actually study, and we are trying to find some ways to do this. We could actually study in what conditions these what coexisting conditions these network outages happen.

And if any of those or a one or more of those coexisting conditions start happening in other locations, we could predict outages. So some of these are already, this is already happening. I'm sure with implementation, uh, deeper implementation, more use cases will emerge, but, uh, it is a progression for us.

So some of these things were already possible. Maybe five years ago, uh, but maybe very expensive to run. Maybe, maybe needed some very, very smart people in, in, uh, in a corner of the world doing this today. It is democratised. It is available in the, in this. application itself. It can be run on a normal laptop.

It can sometimes be run on your mobile phone. So that is, I think the access and availability of many of these tools will make it significantly better. So to summarise. From, from our point of view, from a business excellence point of view, we see a lot of advantage in terms of predicting what could go wrong.

Now, obviously the best way to, or the cheapest way to, uh, you know, avoid cost or any defect is to not let it happen. Because once any defect happens, there will always be cost related to it. If you don't let it happen, It can, it can be really nice scenario. So that is where I would like to focus. And, um, but it is still early days in many ways.

Holly: Wonderful. Thank you so much for that. 

Shirish: Can I add a point, Holly? 

Holly: Of course, please do. 

Shirish: Thank you. Yeah, I think, uh, adding to what again Anshuman said, I would say that in the last, um, decade or so, what we have seen is that other than IT, mainly manufacturing firms have. Uh, already implemented a lot of these security systems, information security systems and going forward.

These are the organisations manufacturing companies, uh, they have more AI applications than many other organisations and they seem to be moving fast on that because they realise that, uh, there is a lot of predictive technology that they can use. Uh, when it comes to costly maintenance, uh, when it comes to, uh, today, uh, organisations say a manufacturing plant, say like a cement manufacturing plant would have a kiln, which, uh, works at very high temperatures and, uh, working there was always difficult.

So any kind of data or a period of time, which. gives them predictive analysis using AI tools is what they are looking at. I have also seen one example where in a wind farm, uh, it is not easy to maintain wind farm infrastructure. So when it comes to that, the cost is very high. So they don't want to do any kind of repeat maintenance.

So this is where they are implementing AI tools to find out and predict things better. So earlier, uh, while There was some data analysis, which was there, which again required some intervention. Now they're trying to go to the next level. So yes, and as he said, the picture is surely emerging and we will see how it goes.

Holly: Brilliant. Thank you both once again for joining me today. It's been a real pleasure to have you on the podcast and to speak to you and I hope that you will join us again. 

Anshuman: It's been a pleasure, Holly, and I will certainly join if you invite, um, and as a parting comment, I would say that the world of quality operational excellence, business excellence is very much alive in as the world changes, multiple new technologies, multiple new processes, ways of working will emerge.

But the fundamentals have not changed for thousands of years and We'll hopefully not change for a few more thousands of years. 

Holly: Thank you so much. 

And finally, just a reminder to our listeners that you can visit our homepage on Spotify to listen to more episodes and stay up to date with new releases.

And to find out more about LRQA's services, please visit www.lrqa.com. You've been listening to the LRQA Future in Focus podcast. Thank you so much for listening and we hope to see you again soon.