Document Management Guidance
Table of Contents 1.
INTRODUCTION ................................................................................................................. 2
2.
DIFFERENCE BETWEEN DOCUMENTS AND RECORDS ............................................... 2
3.
REQUIREMENTS FOR CONTROLLING DOCUMENTS AND RECORDS ........................ 3 3.1 DOCUMENT CONTROL ................................................................................................... 3 3.2 CONTROL OF RECORDS ................................................................................................ 3
4.
WHAT’S SO IMPORTANT ABOUT RECORDS? ................................................................ 3
5.
21 RECORDS REQUIRED BY ISO 9001:2008................................................................... 4
6.
THE DOCUMENT CONTROL FUNCTION.......................................................................... 6
7.
SUMMARY........................................................................................................................... 6
www.iso-9001-checklist.co.uk
Page 1 of 6
Document Management Guidance
1.
Introduction The document control procedure, the control of records procedure and their associated forms which are included in this package are to be used as templates in developing your own document management system. Review the text in the procedures and forms; replace the text to match your requirements. At a minimum, the blue text should be replaced with your information. [Your Company] indicates that you should use your Company’s name in that location. The package comprises the following documents: Title
Ref.
No. of Pages
4.2.3 Control of Documents Procedure
QP1
6
Master Document Index
F101.1
1
Document Issue Sheet
F101.2
1
Document Change Request
F101.3
2
QP2
5
F102.1
1
4.2.4 Control of Records Procedure Master Quality Record Index
The document control procedure (4.2.3) and control of records procedure (4.2.4) are usually the first of the six mandatory procedures to be initiated when implementing an ISO 9001:2008 quality management system.
A robust document management process invariably lies at the heart of any compliant quality management system; since almost every aspect of auditing and compliance verification is determined through the scrutiny of documented evidence. With this in mind, it becomes apparent that the ongoing maintenance of an efficient document management system must not be overlooked.
2.
Difference between Documents and Records What does ISO 9000:2005 tell us about the difference between documents and records and furthermore; why it should matter?
The standard tells us that documents are considered as information (e.g. specifications or procedures) and its supporting medium (e.g. paper or electronic). The standard implies that over time these documents will evolve as new information supersedes old and that change must be managed. Documents are active and dynamic.
Records, on the other hand, are more static since they are historical in nature. They are the documents that state the results of activities undertaken in accordance with the product realization, measurement, analysis and improvement processes (e.g.
www.iso-9001-checklist.co.uk
Page 2 of 6
Document Management Guidance
calibration logs and non-conformance or corrective action reports). They also provide evidence that an activity was performed in the manner specified (e.g. inspection and test records).
3.
Requirements for Controlling Documents and Records What does ISO 9001:2008 tell us about ensuring compliance with the principal requirements of document control procedures?
3.1
Document Control Clause 4.2.3 tells us that an organization must control the documentation required by the quality management system and that a suitable document control procedure must be implemented to define the controls needed to; approve, review, update, identify changes, identify revision status and provide access. The document control procedure must clearly define the scope, purpose, method and responsibilities required to implement these parameters.
ISO 9001:2008 does not define how an organization should format its documentation, since most organizations maintain a consistent corporate image, it is expected that any corporate format will suffice.
3.2
Control of Records Similarly; Clause 4.2.4 demands that an organisation must implement a documented procedure to define the controls needed for the identification, storage, protection, retrieval, retention and disposal of records and that these records must remain legible and identifiable throughout their retention period.
It is acceptable to combine the control of records procedure with the document control procedure but care should be taken not to obscure the fundamental intent behind record keeping and document management.
4.
What’s so important about Records? Records are an important organizational asset; they provide the primary route for evidence based verification and traceability since they demonstrate compliance with customer requirements. Records also prove the efficacy of the quality management system.
www.iso-9001-checklist.co.uk
Page 3 of 6
Document Management Guidance
Delivery of such records to a client is often a contractual and legal requirement. In certain industries, such as civil engineering, assurance records become a fundamental point of reference when determining compliance with the intended design as well as helping to satisfy the requirements prescribed by building control authorities and the health and safety executive. These records are demonstrative of a contractor’s duty of care and that the end product is fit for purpose.
5.
21 Records Required by ISO 9001:2008 Implementing a compliant document management system could mean keeping certain records that your organization might not be already keeping. Some of these records may seem a little confusing until you become more familiar with the quality standard.
Of course, you might decide to keep more records than those listed below, if you feel your organization needs them, but as we always preach; keep your system simple. The fewer documents and records you keep, the fewer things that will be audited, and the more time you will have to actually run your business.
Records required by ISO 9001:2008: Clause Ref. 5.6.1
6.2.2 (e)
7.1 (d)
Record Description
Management reviews
Education, training, skills and experience Evidence that the realisation processes and resulting product fulfil requirements
Example Record
Process Owner
Management review minutes
Project Manager
Training plan, training matrix, training records and CVs
Human Resources
Project quality plan
Quality Manager
Change review
Design Manager
7.2.2
Results of the review of requirements related to the product and actions arising from the review
7.3.2
Design and development inputs relating to product requirements
Customer specifications, design approval logs
Design Manager
7.3.4
Results of design and development reviews and any necessary actions
Design development minutes
Design Manager
7.3.5
Results of design and development verification and any necessary actions
Design plan, test plan document outputs
Quality Manager
www.iso-9001-checklist.co.uk
Page 4 of 6
Document Management Guidance
Clause Ref.
Record Description
Example Record
Process Owner
Test plans, test reports and acceptance records
Quality Manager
7.3.6
Results of design and development validation and any necessary actions
7.3.7
Results of the review of design and development changes and any necessary actions
Design review minutes
Design Manager
7.4.1
Results of supplier evaluations and any necessary actions arising from the evaluations
Supplier and /or subcontractor evaluations and/or assessments, approved supplier list
Procurement Manager
7.5.2 (d)
As required by the organization to demonstrate the validation of processes where the resulting output cannot be verified by subsequent monitoring or measurement
Schedules of achieved results
Quality Manager
7.5.3
The unique identification of the product, where traceability is a requirement
Serial number logs
Quality Manager
7.5.4
Customer property that is lost, damaged or otherwise found to be unsuitable for use
Delivery notes, defective material reports or NCRs
Plant Manager
7.6 (a)
Basis used for calibration or verification of measuring equipment where no international or national measurement standards exist
Customer specifications/corporate standards
Quality Manager
7.6
Validity of the previous measuring results when the measuring equipment is found not to conform to requirements
Test plan document outputs
Quality Manager
7.6
Results of calibration and verification of measuring equipment
Calibration certificates/records and calibration logs
Quality Manager
8.2.2
Internal audit results and follow-up action
Internal audit report
Quality Manager
8.2.4
Indication of the person(s) authorising release of product.
Release acceptance record
Quality Manager
8.3
Nature of the product nonconformities and any subsequent actions taken, including concessions obtained
Non conformance report, concession report
Quality Manager
8.5.2
Results of corrective action
Corrective action reports and logs
Quality Manager
8.5.3
Results of preventive action
Preventive action reports and logs
Quality Manager
www.iso-9001-checklist.co.uk
Page 5 of 6
Document Management Guidance
Also keep in mind that you are free to combine some of these records where it makes sense, for example, you could combine the corrective action request and preventive action request records with a simple checkbox to note which one it is. You could also combine both corrective action and preventive action requests onto one form, again with a check box to designate if it is a corrective or preventive action request. Please note this is a list of the records you will be required to keep. This does not deal with the mandatory documents, comprising of the quality manual, policy and procedures, &c.
6.
The Document Control Function The document control function is an administrative management activity and operates on the frontline by ensuring compliance with Clause 4.2, amongst others, and the associated control of documents and records procedures. Generally, the document control function should have a direct report to the Quality Representative.
7.
Summary Remember; keep it simple and allow the process owners to write or revise the documents they need. Use the document management function to apply formatting and revision changes as well as looking after distribution and retention. It is best to interpret the requirements as they apply to your company; there is no hard and fast method.
www.iso-9001-checklist.co.uk
Page 6 of 6