ISO
9001-Clause 4.2 Documentation requirements
ISO 9001 requirement:
The quality management system documentation shall include
The quality management system documentation shall include
a)
documented statements of a quality policy and quality objectives,
b)
a quality manual,
c)
documented procedures and records required by this International Standard, and
d)
documents, including records, determined by the organization to be necessary to
ensure the effective planning, operation and control of its processes.
NOTE
1 Where the term “documented procedure” appears within this International
Standard, this means that the procedure is established, documented,
implemented and maintained. A single document may address the requirements
for one or more procedures. A requirement for a documented procedure may
be covered by more than one document.
NOTE
2 The extent of the quality management system documentation can differ from one
organization to another due to
a) the size of organization and type
of activities,
b) the complexity of processes and their interactions, and
c) the competence of personnel.
b) the complexity of processes and their interactions, and
c) the competence of personnel.
NOTE
3 The documentation can be in any form or type of medium.
Explanation:
Clause
4.2.1 specifies all the different types of documentation needed for your QMS.
The need to have additional documentation beyond those specified in this
standard may depend upon – customer; regulatory and your own organizational
requirements. Other factors to consider may include complexity of products and
processes, effect on quality,risk of customer dissatisfaction, economic risk,
effectiveness and efficiency, competence of personnel. Clause 4.2.1d requires
you to have documents needed to ensure the effective planning, operation and
control for QMS processes. Each organization must determine what documentation
is needed to achieve this based upon complexity of products and processes,
effect on quality,risk of customer dissatisfaction, economic risk,
effectiveness and efficiency, competence of personnel.You must have documented
statements of your quality policy and objectives. A procedure is a specific way
to perform an activity or process, and it may or may not be written. If it is
established, documented, implemented and maintained, it is called a documented
procedure. A document is information that is written or recorded on some medium
such as paper or computer. A document may specify requirements for e.g. a
drawing or technical specification, may provide direction for e.g. quality
plan, or show results or evidence of activities performed for e.g. records.
ISO 9001 requirement:
The organization shall establish and maintain a quality manual that includes
The organization shall establish and maintain a quality manual that includes
a)
the scope of the quality management system, including details of and
justification for any exclusions (see 1.2),
b)
the documented procedures established for the quality management system, or
reference to them, and
c)
a description of the interaction between the processes of the quality
management system.
Explanation:
The
quality manual is a special type of document that describes your QMS. Besides
describing your QMS, your quality manual could provide information on
organizational background and capabilities. It may be used by customers,
regulatory bodies, suppliers and company personnel for a variety of purposes.
There are many acceptable ways to document your quality manual. You must
define the scope of your QMS in your quality manual. Your QMS scope should
include facilities (manufacturing and support locations), products, processes,
Quality Management and other standards, etc. Customers will want to know the
extent of your capabilities and the Registrar will want to determine the time
and effort needed to audit your organization.Provide details of any clause
exclusions from your scope, and justification for it. You must justify all
exclusions and remember, exclusions can only be made from clause 7.Your quality
manual must include a description of the interaction of your QMS processes.You
have flexibility in whether or not to include your procedures and lower level
documentation with your quality manual or organize them in some other fashion.
You may include all or some of your procedures in your Quality Manual or
reference them to your Quality Manual. Keep a listing or index at the front or
back of your Manual showing the complete list of your procedures whether
included or referenced.As a controlled document, the quality manual is subject
to all of the controls in clause 4.2.3.
ISO 9001 requirement:
Documents
required by the quality management system shall be controlled. Records are a
special type of document and shall be controlled according to the
requirements given in 4.2.4.
A
documented procedure shall be established to define the controls needed
a)
to approve documents for adequacy prior to issue,
b)
to review and update as necessary and re-approve documents,
c)
to ensure that changes and the current revision status of documents are
identified,
d)
to ensure that relevant versions of applicable documents are available at
points of use,
e)
to ensure that documents remain legible and readily identifiable,
f)
to ensure that documents of external origin determined by the org to be
necessary for the planning and operation of the quality management system
are identified and their distribution controlled, and
g)
to prevent the unintended use of obsolete documents, and to apply suitable
identification to them if they are retained for any purpose.
Explanation:
A
document is information that is written or recorded on some medium such as
paper or computer. Clause 4.2.1 tells you what documents you must include in
your QMS. All documents that you determine under clause 4.2.1 to be needed for
your QMS processes must be controlled. This clause 4.2.3 provides requirements
on how these documents must be controlled. Documents outside the QMS need
not be subject to these controls. This clause requires you to have a
documented procedure. Ensure that your procedure specifically addresses each
of the control requirements, in terms of who, what when, where and how as
applicable. Your procedure must address new and old as well as internal and
external documents used by the QMS. You must approve all new QMS documentation
prior to issue. Some degree of checking, examination or assessment is inherent
in ‘approval for adequacy’. You must periodically determine if any updating or
revisions of any QMS documentation is needed, and if they are changed, they
must be re-approved for adequacy.
The
frequency of this review, responsibility and method must be defined in your
procedure. This will be determined by events within your organization and how
mature or recent your QMS is. Auditors will explore this if they find that your
documents have not changed in years, while the nature of your business has
changed significantly. Identify changes made to documents so users know
exactly what has changed. There are many ways of doing this on printed as well
as computerized documents. Have a method for revision control such as a
revision log and master-list of documents which identifies the current revision
status. Again, there are other ways of doing this as well.
Not
all documents need to be available everywhere within your organization. You
must determine what document is applicable (i.e. needed to assure product or
process quality) to a specific process or activity and make the relevant
version of that document available to that activity, e.g. providing current
packaging and shipping work instructions to the shipping department.Once you
determine that certain documents need to be made available at various
locations, implement some form of distribution control. There are many ways to
do this. One way would be to keep a distribution log.
Documents
can take a beating in very harsh environments (covered in oil, dust, acid
eaten, weather-beaten, etc.) to the point of being illegible. You must
regularly review the condition of frequently used hard copy documents to
determine whether they need to be replaced. Documents must also be readily
identifiable as to its purpose and scope. A simple heading may suffice, (e.g.
In-process Inspection Sheet). Computerized documents are sometimes given
file names that don’t identify its contents and this might require numerous
files to be opened before you find the right one. Identification also implies
effective filing for timely retrieval, whether manual or computerized. A
frequent nonconformity is not being able to retrieve a document or record
because of poor filing procedures. External documents (such as customer
drawings or supplier material/part specifications) must be identified. There
are many ways to do this. One way would be to keep a manual or computer list of
these documents. Determine who needs these documents and have some form of
distribution control. Don’t overlook supplier, regulatory or industry
documents. Apply applicable controls to these as well.
Obsolete
documents can cause many problems if not controlled. There are many ways to do
this. One way would be to provide computerized documents in read-only mode and
make only the current version accessible at workstation computer screens.
Obsolete hard copy documents can be removed through distribution control.
Ensure your procedure a covers methods to disallow unauthorized and unapproved
or incorrect documents from being created, used or distributed.If documents are
archived, make sure that all such documents are properly identified, indexed
and filed, and preferably have controlled or restricted access to
them. Nonconformities against the document control process are one of the
most frequent audit findings. Develop appropriate performance indicators to
demonstrate effective implementation of your document control process. Examples
include – number of obsolete or unauthorized documents found being used; number
of unauthorized changes found; number of instances documents were not available
at points of use; etc. Track trends in these indicators and use this
information to tighten your controls and continually improve your document
control process. Use the PDCA to plan, implement, measure and improve
your document control process.
ISO 9001 requirement:
Records
established to provide evidence of conformity to requirements and of the
effective operation of the quality management system shall be controlled.
The
organization shall establish a documented procedure to define the controls
needed for the identification, storage, protection, retrieval, retention
and disposition of records.
Records
shall remain legible, readily identifiable and retrievable.
Explanation:
A
record is a special type of document that provides written evidence of results
achieved or activity performed (e.g. an inspection record). Records provide one
of the strongest forms of evidence of maintaining and demonstrating the
effectiveness of your QMS. Ensure that your documented procedure for
control of QMS records addresses each of the control requirements specified in
this clause, in terms of who, what when, where and how. These controls apply to
all QMS records whether they are hard copy or computerized.ISO 9001 calls for
many records. Some records are specified, while others are implied. The onus is
on you to demonstrate or provide evidence (records) of conformity to
requirements, whether the specific clauses ask for records or not. Requirements
for records may originate from the customer, regulatory, industry, or within
your organization. Ensure you maintain records to conform to all of these as
applicable. Records may also come from suppliers and vendors. All these records
are subject to the above controls. The comments under document control
regarding legibility, being identifiable and retrievable apply equally to QMS
records.
Readily
identifiable – relates to easily determining the purpose and scope of the
record, e.g. an inspection record for a product at final inspection. The design
of QMS records must prevent confusion or ambiguity in the completion and use of
records. Records must be written legibly to be useful. Also make sure that they
are not exposed to unauthorized change or alteration. For the duration that
they are kept, store records in locations and mediums that will protect against
unauthorized access and environmental damage – (covered in oil, dust, acid
eaten, weather-beaten, etc.). Regularly review the condition of records. The
indexing and filing of records (hardcopy or computer) must ensure easy
retrieval. Keep a listing of all the different categories of records and
define the retention times associated with each category (inspection and test;
sales and purchasing; management review; calibration; training; etc). Retention
times are typically determined by customer, regulatory, industry or
organizational requirements and policies.
Records
must eventually be disposed off once past their defined retention times.
Disposition could range from permanent destruction of records to permanent
storage in a secure onsite or off-site archive. The intent here is to remove
the risk of inadvertent use and availability for current activities and
unauthorized access. Depending upon the industry, specific records may be kept
indefinitely.
Nonconformities
against the process for control of records arise frequently. Develop
appropriate performance indicators to demonstrate effective implementation of
your record control process. Examples of indicators could include – number of
instances of inability to retrieve records; amount of time spent looking for
records; number of instances of incomplete records; number of instances of
damaged records found; etc. Track trends in these indicators and use this
information to tighten your controls and continually improve your record
control process. Use the PDCA to plan, implement, measure and improve your
process for record control.
Audit
Checklist
An audit checklist should cover
these areas:
- Does the documented Quality Management System (QMS) include a Quality Policy, Quality Objectives, Quality Manual, Procedures, Work Instructions and Records?
- How does the Quality Manual address the ISO requirements? Does it show the the exclusions which are not applicable? Does it have the all the procedures or reference of Procedures?
- Does it covers the mandatory 6 Procedures and 19 Records, as required by ISO 9001 std?
- How are QMS controlled documents identified? (Master List?)
- Are personnel using up-to-date “instructional” QMS documents?
- How are these QMS documents kept current? What triggers a review?
- How was the last new QMS document issued? How was the last change or revision handled? Who approved these changes?
- How are new/ changed QMS documents communicated? Was any training done?
- Is there a list of QMS records that are controlled? Verify through sampling that they exist, are legible, are retained, and kept in a secure/safe location. Look at both electronic and paper records.
No comments:
Post a Comment