Procedure for the Control of Documents
ISO/IEC 20000 Toolkit Version 7 ©CertiKit
Procedure for the Control of Documents
Implementation Guidance (The header page and this section must be removed from final version of the document)
Purpose of this document This document describes the controls in place for naming and versioning of documents and associated attributes.
Areas of the standard addressed The following areas of the ISO/IEC 20000:2011 standard are addressed by this document: 4.3.2 Control of documents
General Guidance You may decide to change the version control scheme suggested in this document if it differs from that already in use within your organisation. If you currently have a quality management system in others areas of your business such as ISO9001 then it may be preferable to make use of existing procedures for document control. Note that the printing and physical signing of approved documents is not a necessity; auditors will generally accept other methods of showing that a document has been officially approved such as digital signing and the use of an “Approved” folder structure.
Review Frequency We would recommend that this document is reviewed annually.
Toolkit Version Number ISO/IEC 20000 Toolkit Version 7 ©CertiKit.
Document Fields This document may contain fields which need to be updated with your own information, including a field for Organization Name that is linked to the custom document property “Organization Name”.
Version 1
Page 1 of 13
[Insert date]
Procedure for the Control of Documents
To update this field (and any others that may exist in this document): 1. Update the custom document property “Organization Name” by clicking File > Info > Properties > Advanced Properties > Custom > Organization Name 2. Press Ctrl a on the keyboard to select all text in the document (or use Select, Select All on the ribbon) 3. Press F9 on the keyboard to update all fields 4. When prompted, choose the option to just update TOC page numbers If you wish to permanently convert the fields in this document to text i.e. so that they are no longer updateable, then you will need to click into each occurrence of the field and press Ctrl Shift F9. If you would like to make all fields in the document visible then go to File > Options > Advanced > Show document content > Field shading and set this to “Always”. This can be useful to check that you have updated all fields correctly. Further detail on the above procedure can be found in the Toolkit Completion Instructions within the Project Resources folder.
Copyright notice Except for any third party works included in this document, as identified in this document, this document has been authored by CertiKit, and is © copyright CertiKit except as stated below. CertiKit is a trading name of Public I.T. Limited, a company registered in England and Wales with company number 6432088 and registered office at 5 Falcons Rise, Belper, Derbyshire, DE56 0QN.
Licence terms This document is licensed on and subject to the standard licence terms of CertiKit, available on request, or by download from our website. All other rights are reserved. Unless you have purchased this product you only have an evaluation licence. If this product was purchased, a full licence is granted to the person identified as the licensee in the relevant purchase order. The standard licence terms include special terms relating to any third party copyright included in this document.
Disclaimer Please Note: Your use of and reliance on this document template is at your sole risk. Document templates are intended to be used as a starting point only from which you will create your own document and to which you will apply all reasonable quality checks before use. Therefore please note that it is your responsibility to
Version 1
Page 2 of 13
[Insert date]
Procedure for the Control of Documents
ensure that the content of any document you create that is based on our templates is correct and appropriate for your needs and complies with relevant laws in your country. You should take all reasonable and proper legal and other professional advice before using this document. CertiKit makes no claims, promises, or guarantees about the accuracy, completeness, or adequacy of our document templates, assumes no duty of care to any person with respect its document templates or their contents, and expressly excludes and disclaims liability for any cost, expense, loss or damage suffered or incurred in reliance on our document templates, or in expectation of our document templates meeting your needs, including (without limitation) as a result of misstatements, errors and omissions in their contents.
Version 1
Page 3 of 13
[Insert date]
Procedure for the Control of Documents
[Replace with your logo]
Procedure for the Control of Documents
Document Ref. Version: Dated: Document Author: Document Owner:
Version 1
Page 4 of 13
SMS-DOC-043-2 1 [Insert date]
[Insert date]
Procedure for the Control of Documents
Revision History Version Date
Revision Author
Summary of Changes
Distribution Name
Title
Approval Name
Version 1
Position
Signature
Page 5 of 13
Date
[Insert date]
Procedure for the Control of Documents
Contents 1
INTRODUCTION ....................................................................................................................................... 7
2
DOCUMENT CONTROL PROCESS....................................................................................................... 8 2.1 OVERVIEW ................................................................................................................................................ 8 2.2 CREATION OF DOCUMENTS ....................................................................................................................... 9 2.2.1 Naming Convention ........................................................................................................................ 9 2.2.2 Version Control ............................................................................................................................ 10 2.2.3 Status ............................................................................................................................................ 11 2.2.4 Documents of External Origin ...................................................................................................... 11 2.3 DOCUMENT REVIEW ............................................................................................................................... 11 2.4 DOCUMENT APPROVAL ........................................................................................................................... 11 2.5 COMMUNICATION AND DISTRIBUTION .................................................................................................... 12 2.6 REVIEW AND MAINTENANCE OF DOCUMENTS ........................................................................................ 12 2.7 ARCHIVAL OF DOCUMENTS ..................................................................................................................... 13 2.8 DISPOSAL OF DOCUMENTS ...................................................................................................................... 13
List of Figures FIGURE 1 - DOCUMENT CONTROL PROCESS ............................................................................................................... 8
List of Tables TABLE 1 - SUBJECT AREA REFERENCES .................................................................................................................... 10 TABLE 2 - DOCUMENT REVIEW GUIDELINES ............................................................................................................. 11 TABLE 3 - DOCUMENT APPROVAL BOARDS ............................................................................................................... 12
Version 1
Page 6 of 13
[Insert date]
Procedure for the Control of Documents
1 Introduction The ISO/IEC 20000 standard requires that all documents that make up the Service Management System (SMS) must be controlled. Such control is essential in order to ensure that the correct processes and procedures are in use at all times within the organisation and that they remain appropriate for the purpose for which they were created. The general principles are that all service management documentation must be: ➢ ➢ ➢ ➢
Readily identifiable and available Dated, and authorised by a designated person Legible and readable Maintained under version control and available to all locations where service management activities are performed ➢ Promptly withdrawn when obsolete and retained in/as an archive where required for legal or knowledge preservation purposes, or both This procedure sets out how this level of control will be achieved within [Organization Name].
Version 1
Page 7 of 13
[Insert date]
Procedure for the Control of Documents
2 Document Control Process 2.1
Overview
The overall process of document control is shown in the diagram below.
Document Creation
Document Review
Documents of External Origin
Document Approval
Communication And Distribution
Review and Maintainance
Archival
Disposal
Figure 1 - Document control process
Each of these steps is described in more detail in the remaining sections of this document.
Version 1
Page 8 of 13
[Insert date]
Procedure for the Control of Documents
2.2
Creation of Documents
The creation of documents will be at the request of the [Service Provider] management team and may be done by any competent individual appropriate to the subject and level of the document. However there are a number of rules that must be followed when creating a document to be used in the SMS. 2.2.1
Naming Convention
The convention for the naming of documents within the SMS is to use the following format: SMS-DOC-xxx-yy Document Title Vn Status dd where: SMS DOC xxx yy Document Title Vn Status dd
= Service Management System = Document = Subject area reference (see Table 1) = Unique document number = Meaningful description of document = Version n = Status of document (Draft or Final) = Number of draft, if appropriate
A unique number will be allocated for each document and an index of document references maintained within the SMS quality system - see Service Management System Documentation Log for more details. Subject areas references are designed to map onto the sections of the ISO/IEC 20000 standard as follows (further subject areas may be created as required): Reference 040 041 042 043 044 045 050 060 061 062 063 064 065 066 070
Version 1
Subject Area Service management system general requirements Management responsibility Governance of processes operated by other parties Documentation management Resource management Establish and improve the SMS Design and transition of new or changed services Service delivery processes Service level management Service reporting Service continuity and availability management Budgeting and accounting for services Capacity management Information security management Relationship processes
Page 9 of 13
[Insert date]
Procedure for the Control of Documents
Reference 071 072 080 081 082 090 091 092 093
Subject Area Business relationship management Supplier management Resolution processes Incident and service request management Problem management Control processes Configuration management Change management Release and deployment management
Table 1 - Subject area references
No fixed format is prescribed for records and logs as these will often be determined by other systems and software. Where possible the name of a log or record should be self-explanatory and meaningful in the context of its use. See the Procedure for the Control of Records for more detail. 2.2.2
Version Control
Document version numbers will consist of a major number only e.g. V2 is Version 2. When a document is created for the first time it will have a version number of 1 and be in a status of Draft. Each time a draft is distributed, any further changes will result in the draft number being incremented by 1 e.g. from 1 to 2. For example when a document is first created it will be Version 1 Draft 1. A second draft will be V1 Draft 2 etc. When the document is approved it will become V1 Final. The version number will be incremented when a subsequent version is created in draft status. For example a revision of an approved document which is at V1 Final will be V2 Draft 1 then V2 Draft 2 etc. until approved when it will become V2 Final. The document must include a revision history as follows: Revision History Version Date
Revision Author
Summary of Changes
Once the document reaches its final version, only approved versions should be recorded in this table.
Version 1
Page 10 of 13
[Insert date]
Procedure for the Control of Documents
2.2.3
Status
The status reflects the stage that the document is at as follows: Draft = Document under development and discussion i.e. it has not been approved Final = Following acceptance at approval board and released into live work environment 2.2.4
Documents of External Origin
Documents that originate outside of the organisation but form part of the SMS will be allocated a reference and a header page attached at the front of the document, setting out information that is normally included in internal documents i.e.: • • • • •
Document reference Version Status Distribution Storage location
Such documents will then be subject to the same controls as those that originate internally. 2.3
Document Review
Draft documents will be reviewed by a level and number of staff appropriate to the document content and subject. Guidelines are as follows: Document Type Strategy Policy Procedure Plan
Reviewers
Table 2 - Document review guidelines
Once approved, the date of next scheduled review should be recorded in the Service Management System Documentation Log. 2.4
Document Approval
All documentation must go through an approval board to ensure that it is correct, fit for purpose and produced within local documentation control guidelines. The board
Version 1
Page 11 of 13
[Insert date]
Procedure for the Control of Documents
will differ dependent upon the type of documentation and may go to numerous groups prior to being approved as a Final document. In standard terms, approval boards are: Document Type Strategy Policy Procedure Plan
Approvers
Table 3 - Document approval boards
Each document that requires approval should have a table for the purpose as shown below: Approval Name
Position
Signature
Date
Once approved a copy of the document must be printed and signed by the approver. This copy will then be retained in a central file. Upon approval of a new version of a document, all holders of previous versions will be instructed to obtain a new version and destroy the old one. 2.5
Communication and Distribution
A distribution list will be included as follows: Distribution Name
Title
This list must be accurate as it will be used as the basis for informing users of the document that a new version is now available. 2.6
Review and Maintenance of Documents
All final documents must be stored electronically and in paper format both locally and off-site to ensure that they are accessible in any given situation.
Version 1
Page 12 of 13
[Insert date]
Procedure for the Control of Documents
Service Management documents are stored electronically on the shared drive under the relevant sub-folder (e.g. IT Service Continuity, Incident Management etc.). The drive is a shared drive to which all members of [Service Provider] have access. Final documents are stored in paper format in a filing structure that mimics the electronic version. [State the location of the paper files]. A full copy of final documentation will be reproduced and stored within the Definitive Media Library. 2.7
Archival of Documents
Approved documents exceeding their useful life are stored in a Superseded Folder on the shared drive in order to form an audit trail of document development. They should be marked as being superseded in order to prevent them being used as a latest version by mistake. 2.8
Disposal of Documents
Paper copies of approved documents that have been superseded are to be disposed of in secure bins or shredded.
Version 1
Page 13 of 13
[Insert date]