Documenting procedures in ISO 9001

Documented information

The Annex SL Appendix 2 clause on Documented Information has been adopted without significant change or addition. Where appropriate, text elsewhere in the standard has been aligned with its requirements. Consequently the terms ‘document’ and ‘record’ have both been replaced throughout the
requirements text by ‘documented information’.

Documented information can refer to

• The management system including related processes
• Information created in order for the organization to operate (documentation);
• Evidence of results achieved (records).

What is a “document”?

The following are some of the main objectives of an organization’s documentation, independent of whether or not it has implemented a formal QMS.

• Communication of Information: as a tool for information transmission and communication. The type and extent of the documentation will depend on the nature of the organization’s products and processes, the degree of formality of communication systems and the level of communication skills within the organization, and the organizational culture.
• Evidence of conformity: provision of evidence that what was planned, has actually been done.
• Knowledge sharing: to disseminate and preserve the organization’s experiences. A typical example would be a technical specification, which can be used as a base for design and development of a new product.

It must be stressed that, according to ISO 9001 clause 3.11 documented information: Information required to be controlled and maintained by an organization (3.01) and the medium on which it is contained can be in any format and media and from any source. And that documented information can refer to

• The management system (3.04), including related processes (3.12);
• Information created in order for the organization to operate (documentation);
• Evidence of results achieved (records).

Documentation requirements:

ISO 9001 clause
4.3 Determining the scope of the quality management system which shall be available as documented information and;
4.4 Quality management system read with 4.4.1 General specifies that the organization shall establish, implement, maintain and continually improve a quality management system, including the processes needed and their interactions, in accordance with the requirements of this International Standard.

Documenting Quality policy

A specific ISO 9001 clause 5.2 Quality policy requires that the top management shall establish a quality policy that:

• is appropriate to the purpose of the organization;
• provides a framework for setting quality objectives;
• includes a commitment to satisfy applicable requirements, and
• Includes a commitment to continual improvement of the quality management system.

Further requiring that the quality policy shall:

• Be available as documented information;
• Be communicated within the organization;
• Be available to interested parties, as appropriate; and d) be reviewed for continuing suitability.

It also emphasizes that the extent of the QMS documentation may differ from one organization to
another due to:

• the size of organization and type of activities;
• the complexity of processes and their interactions, and
• The competence of personnel. It is also noted that Quality Management Principles can be used as the basis for the quality policy while documenting it.

Quality objectives:

ISO 9001 2015 Clause 6.2 Quality objectives and planning to achieve them requires that an organization will document and establish quality objectives at relevant functions, levels and processes. The quality objectives shall

• Be consistent with the quality policy
• Be relevant to conformity of goods and services and customer satisfaction,
• Be measurable (if practicable),
• Take into account applicable requirements, e) be monitored,
• Be communicated, and
• Be updated as appropriate.

It is important to note that the organization shall have to retain documented information on the quality objectives.

Documentation on Monitoring and measuring devices:

As applicable ISO 9001 2015 clause 7.1.4 requires that the organization shall retain appropriate documented information as evidence of fitness for purpose of monitoring and measuring devices. Monitoring and measurement devices can be calibrated or verified, or both, at specified intervals, or prior to use, against measurement standards traceable to international or national measurement standards and documented information on the treacibilities/certificate of appropriate approved laboratory be maintained.

Documentation on competence:

ISO 9001 clause 7.2 requires that the organization shall:

• Determine the necessary competence of person(s) doing work under its control that affects its quality performance, and
• Ensure that these persons are competent on the basis of appropriate education, training, or experience

The organization is required to retain appropriate documented information as evidence of competence.

Documented Information handling:

ISO 9001 Clause 7.5 Documented information specifies the document management system required by the organization.

Clause 7.5.2 Creating and updating requires that:
When creating and updating documented information the organization shall ensure appropriate

• Identification and description (e.g. a title, date, author, or reference number),
• Format (e.g. language, software version, graphics) and media (e.g. paper, electronic),
• Review and approval for suitability and adequacy.

Controlling documented information:

ISO 9001 clause 7.5.1 requires that the organization’s quality management system shall include

• Documented information required by this International Standard,
• Documented information determined by the organization as being necessary for the effectiveness of the quality management system.

The extent of documented information for a quality management system can differ from one organization to another due to

• The size of organization and its type of activities, processes, products goods and services,
• The complexity of processes and their interactions, and
• The competence of persons.

Further ISO 9001 clause 7.5.3 Control of documented Information specifies how to control the documents.
Documented information required by the quality management system and by this International Standard shall be controlled to ensure

• it is available and suitable for use, where and when it is needed, and
• It is adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity).

For the control of documented information, the organization shall address the following activities, as applicable

• distribution, access, retrieval and use,
• storage and preservation, including preservation of legibility,
• control of changes (e.g. version control), and
• Retention and disposition.

Controlling external documented information

Note that documented information of external origin determined by the organization to be necessary for the planning and operation of the quality management system shall be identified as appropriate, and controlled.

Documentation on review of requirements related to the goods and services

ISO 9001 clause 8.2.3 requires that

• Goods and services requirements are defined and agreed,
• Contract or order requirements differing from those previously expressed are resolved, and
• The organization is able to meet the defined requirements.

Documented information describing the results of the review shall be maintained.

Where the customer does not provide documented statement of their requirements, the customer requirements shall be confirmed by the organization before acceptance.

Where requirements for goods and services are changed, the organization shall ensure that relevant documented information is amended and that relevant personne
l are made aware of the changed requirements.

Documented information for external providers:

ISO 9001 2015 clause 8.4.3 Documented information for external providers requires that:

Documented information shall be provided to the external provider describing, where appropriate:

• The goods and services to be provided or the process to be performed,
• The requirements for approval or release of goods and services, procedures, processes or equipment
• The requirements for competence of personnel, including necessary qualification
• The quality management system requirements
• The control and monitoring of the external provider’s performance to be applied by the organization
• Any verification activities that the organization, or its customer, intends to perform at the external Provider’s premises, and
• The requirements for handling of external provider’s property provided to the organization.

The organization shall ensure the adequacy of specified requirements prior to their communication to the external provider.

Documentation on development of goods and services:

ISO 9001 clause 8.5.1 requires that the organization shall plan and implement processes for the development of goods and services consistent with the process approach.

It is essential to maintain the necessary documented information on the application of development processes, the outputs and their suitability

Documentation on Production of goods and provision of services:

ISO 9001 clause 8.6.1 requires that

• The availability of documented information that describes the characteristics of the goods and services;
• The availability of documented information that describes the activities to be performed and the results achieved, as necessary;

Documentation must validate

• Definition of criteria for review and approval of the processes;
• Approval of equipment and qualification of personnel;
• Use of specific methods and procedures; and
• Definition of requirements for documented information

If any property of the customer or external provider is lost, damaged or otherwise found to be unsuitable
for use, the organization shall report this to the customer or external provider and maintain documented
information.

Documentation on Release of goods and services

ISO 9001 clause 8.7 requires that The release of goods and services to the customer shall not proceed until the planned arrangements for verification of conformity have been satisfactorily completed, unless otherwise approved by a relevant authority and, where applicable, by the customer.

Documented information shall indicate the person(s) authorizing release of goods and services for delivery to the customer

Documents needed by the organization to ensure the effective planning, operation and control
of its processes:

In order for an organization to demonstrate the effective implementation of its QMS, it may be necessary to develop documents other than documented procedures. However, the only documents specifically mentioned in ISO 9001:2015 are:

• Quality policy (clause 5.2)
• Quality objectives (clause 5.2.1)

However the requirement for maintaining the quality manual has been done away with.

There are several requirements of ISO 9001 where an organization could add value to its QMS and demonstrate conformity by the preparation of other documents, even though the standard does not specifically require them. Examples may include:

• Process maps, process flow charts and/or process descriptions
• Organization charts
• Specifications
• Work Instruction
• Documents containing internal communications
• Production schedules
• Approved supplier lists
• Test and inspection plans
• Quality plans/Project plan/ process plan

All such documents have to be controlled in accordance with the requirements of clause 7.5.3. Documented information specifying the processes of the quality management system (including the
realization of goods and services processes) and the resources to be applied to a specific good and service, project or contract can be referred to as a quality plan.

Control of changes in the documents:

ISO 9001 2015 clause 8.6.6 requires that the organization shall undertake change in a planned and systematic manner, taking account of the review of the potential consequences of changes (with clause 6.3) and taking action as necessary, to ensure the integrity of goods and services are maintained. Documented information describing the results of the review of changes, the personnel authorizing the change and any necessary actions shall be maintained

Documentation of Nonconforming goods and services

ISO 9001 2015 clause 8.8 Nonconforming goods and services requires that documented information describing the nature of nonconformities and any subsequent actions taken, including concessions
obtained, shall be maintained to satisfy that When the nonconforming goods and services have been delivered to the customer, the organization shall also take appropriate correction to assure that
customer satisfaction is achieved.

Documentation on Monitoring, measurement, analysis and evaluation

ISO 9001 2015 clause 9.1 Monitoring, measurement, analysis and evaluation requires that the organization shall retain appropriate documented information as evidence of the results based on which
the organization shall evaluate the quality performance and the effectiveness of the quality management system.

Documentation on internal audit:

ISO 9001 2015 clause 9.2 requires that the organization shall conduct internal audits at planned intervals to provide information on whether the quality management system. It is essential to retain documented information as evidence of the implementation of the audit programme and the audit results as conducted as per procedure laid down in this clause.

Documentation on management review:

ISO 9001 clause 9.3 requires that top management shall review the organization’s quality management system, at planned intervals, to ensure its continuing suitability, adequacy, and
effectiveness.

The organization shall retain documented information as evidence of the results of management reviews including actions taken as per procedure laid down in this clause

Documentation on Nonconformity and corrective action

ISO 9001 clause 10.1 requires that the organization shall retain documented information as evidence of

• The nature of the nonconformities and any subsequent actions taken; and
• The results of any corrective action.

As per the procedure laid down in the clause.

Summary:

For organizations that are in the process of implementing a QMS, and wish to meet the documentation requirements of ISO 9001, the following comments may be useful.

For organizations that are in the process of implementing or have yet to implement a QMS, ISO 9001:2015 emphasizes a process approach. This includes:

• Determining the processes necessary for the effective implementation of the quality management system
• Determining the interactions between these processes.
• Documenting the processes to the extent necessary to assure their effective operation and control.

These processes include the management, resource, product realization and measurement processes that are relevant to the effective operation of the QMS.

Analysis of the processes should be the driving force for defining the amount of documentation needed for the quality management system, taking into account the requirements of ISO 9001:2015. It should not be the documentation that drives the processes.

About the author: Jay P. Patel is an ASQ Fellow, Master BB, Lean Expert, PMP, Risk Management Professional with 10 ASQ Certifications, and many other certifications. He has over 30 years experience in improving processes, people and achieving breakthrough performance at many companies.

For more information or questions, contact jayp@qpsinc.com. (Website: www.qpsinc.com)