ISO 9000 Document Control Procedures
The ISO 9000 Standard requires that a documented procedure be established to define the controls needed.
This requirement means that the methods for per-
forming the various activities required to control
different types of documents should be defined and
documented.
Although the standard implies that a single proce-
dure is required, should you choose to produce
several different procedures for handling the differ-
ent types of documents it is doubtful that any auditor
would deem this noncompliant. Where this might be
questionable is in cases where there is no logical reason for such differences
and where merging the procedures and settling on a best practice would
improve efficiency and effectiveness.
Documents are recorded information and the purpose of the document
control process is to firstly ensure the appropriate information is available
where needed and secondly to prevent the inadvertent use of invalid
information. At each stage of the process are activities to be performed that
may require documented procedures in order to ensure consistency and
predictability. Procedures may not be necessary for each stage in the process.
Every process is likely to require the use of documents or generate documents
and it is in the process descriptions that you define the documents that need to
be controlled. Any document not referred to in your process descriptions is
therefore, by definition, not essential to the achievement of quality and not
required to be under control. It is not necessary to identify uncontrolled
documents in such cases. If you had no way of tracing documents to a
governing process, a means of separating controlled from uncontrolled may
well be necessary.
The procedures that require the use or preparation of documents should also
specify or invoke the procedures for their control. If the controls are unique to
the document, they should be specified in the procedure that requires the
document. You can produce one or more common procedures that deal with
the controls that apply to all documents. The stages in the process may differ
depending on the type of document and organizations involved in its
preparation, approval, publication and use. One procedure may cater for all the
processes but several may be needed.
The aspects you should cover in your document control procedures, (some
of which are addressed further in this chapter) are as follows
Planning new documents, funding, prior authorization, establishing need
etc.
- Preparation of documents, who prepares them, how they are drafted,
conventions for text, diagrams, forms etc.
- Standards for the format and content of documents, forms and diagrams.
- Document identification conventions.
- Issue notation, draft issues, post approval issues.
- Dating conventions, date of issue, date of approval or date of distribution.
- Document review, who reviews them and what evidence is retained.
- Document approval, who approves them and how approval is denoted.
- Document proving prior to use.
- Printing and publication, who does it and who checks it.
- Distribution of documents, who decides, who does it, who checks it.
- Use of documents, limitations, unauthorized copying and marking.
- Revision of issued documents, requests for revision, who approves the
request, who implements the change.
- Denoting changes, revision marks, reissues, sidelining, underlining.
Amending copies of issued documents, amendment instructions, and
amendment status.
- Indexing documents, listing documents by issue status.
- Document maintenance, keeping them current, periodic review.
- Document accessibility inside and outside normal working hours.
- Document security, unauthorized changes, copying, disposal, computer
viruses, fire and theft.
- Document filing, masters, copies, drafts, and custom binders.
- Document storage, libraries and archive, who controls location, loan
arrangements.
- Document retention and obsolescence.
With electronically stored documentation, the document database may provide
many of the above features and may not need to be separately prescribed in
your procedures. Only the tasks carried out by personnel need to be defined in
your procedures. A help file associated with a document database is as much
a documented procedure as a conventional paper based procedure.
the controls needed.
This requirement means that the methods for performing the various activities required
to control different types of documents should be defined and documented.
Although the standard implies that a single procedure is required, should you choose
to produce several different procedures for handling the different types of documents
it is doubtful that any auditor would deem this noncompliant. Where this might be
questionable is in cases where there is no logical reason for such differences
and where merging the procedures and settling on a best practice would
improve efficiency and effectiveness.
Documents are recorded information and the purpose of the
documentcontrol process is to firstly ensure the appropriate information is available
where needed and secondly to prevent the inadvertent use of invalid
information. At each stage of the process are activities to be performed that
may require documented procedures in order to ensure consistency and
predictability. Procedures may not be necessary for each stage in the process.
Every process is likely to require the use of documents or generate documents
and it is in the process descriptions that you define the documents that need to
be controlled. Any document not referred to in your process descriptions is
therefore, by definition, not essential to the achievement of quality and not
required to be under control. It is not necessary to identify uncontrolled
documents in such cases. If you had no way of tracing documents to a
governing process, a means of separating controlled from uncontrolled may
well be necessary.
The procedures that require the use or preparation of documents should also
specify or invoke the procedures for their control. If the controls are unique to
the document, they should be specified in the procedure that requires the
document. You can produce one or more common procedures that deal with
the controls that apply to all documents. The stages in the process may differ
depending on the type of document and organizations involved in its
preparation, approval, publication and use. One procedure may cater for all the
processes but several may be needed.
of which are addressed further in this chapter) are as follows
Planning new documents, funding, prior authorization, establishing need
etc.
- Preparation of documents, who prepares them, how they are drafted,
conventions for text, diagrams, forms etc.
- Standards for the format and content of documents, forms and diagrams.
- Document identification conventions.
- Issue notation, draft issues, post approval issues.
- Dating conventions, date of issue, date of approval or date of distribution.
- Document review, who reviews them and what evidence is retained.
- Document approval, who approves them and how approval is denoted.
- Document proving prior to use.
- Printing and publication, who does it and who checks it.
- Distribution of documents, who decides, who does it, who checks it.
- Use of documents, limitations, unauthorized copying and marking.
- Revision of issued documents, requests for revision, who approves the
request, who implements the change.
- Denoting changes, revision marks, reissues, sidelining, underlining.
Amending copies of issued documents, amendment instructions, and
amendment status.
- Indexing documents, listing documents by issue status.
- Document maintenance, keeping them current, periodic review.
- Document accessibility inside and outside normal working hours.
- Document security, unauthorized changes, copying, disposal, computer
viruses, fire and theft.
- Document filing, masters, copies, drafts, and custom binders.
- Document storage, libraries and archive, who controls location, loan
arrangements.
- Document retention and obsolescence.
With electronically stored documentation, the document database may provide
many of the above features and may not need to be separately prescribed in
your procedures. Only the tasks carried out by personnel need to be defined in
your procedures. A help file associated with a document database is as much
a documented procedure as a conventional paper based procedure.
