The concept of Document Control is a very old quality system requirement that dates back long before ISO made its’ way to the USA. For many years the most common quality audit finding was related to poorly controlled documents. Now with the advent of computer networks managing documents and records, document issues are among the least noted of quality audit findings. But they do occur, so here is some information to help clarify the concepts and requirements.
Documents come in two types: Controlled and Uncontrolled.
If the document is “controlled” then you are assured that you have the latest revision and will be given the newest revision when a change occurs.
If the document is “uncontrolled” then you have a document for immediate use; however, you must ensure that the document is current.
Documents are often stamped/identified “Controlled.” Uncontrolled copies often have a statement such as “Uncontrolled” or “Printed Copies are Uncontrolled” or “Reference Only”.
The intent is that everyone who needs a document (procedure, work instruction, etc) has access to the controlled version. Uncontrolled documents in use at a workstation for someone to refer to is not acceptable. “How-to” notes taped to a machine is an example of necessary instructions that you have failed to properly document and control.
Q When is an uncontrolled document appropriate?
When the document is sent to requester outside of your organization.
There may be other uses for uncontrolled documents, but if the requester is an employee, they should be looking at a controlled copy.
Q What documents do I need?
Now called “Documented Information” is required for:
Scope and boundaries of your quality management system. Including listing non-applicable requirements and the justification as to why the requirement is not applicable.
Maintain documented information to support the operation of its processes;
General description of relevant interested parties
Description of the processes needed for the quality management system and their application throughout the organization
The sequence and interaction of these processes
Assignment of the responsibilities and authorities for these processes.
Quality Policy
Quality objectives
Control of non-conforming outputs (aka products and services)
maintain documented information that defines the nonconformity and corrective action management processes.
Definition of competency for all those who affect and are a part of the quality management system.
Any process, task, requirement that you determine to need a procedure or work instruction for. It’s your call!
Now called “Retained Documentation” (aka records) are also required and is a part of this document control process. Why? Because forms must be controlled and completed forms are records that must be protected and maintained.
Q If a “form” is completed, is it a record?
Maybe. If it is retained to show evidence of completion and/or conformance, then it is a record. If the data entered on a form is later entered into an electronic system (database, ERP, MRP, etc) then that form is a tool and should not be retained and is not a record. The record is in the system.
Q If there is a controlled form and data are entered on the form, do I need to change the revision of the form?
NO! It is now a record. (yes, this question does come up.)
The QMS Database is designed to manage all the documents and records in one place and gives instruction on how to use the forms. Resulting reports are pre-programed for you.
Q How do I create and change a document or form?
A standard templet for procedures is a good idea. Be sure to include title, revision, change history, date and approvals.
Changes should be documented, and the record should include date of change, what changed and who approved the change. Additionally, consider documenting what caused the change (customer, defects, audit finding), assess the impact on products, processes, WIP, finished goods and is training necessary to communicate the change. All of this is often in a change notice kept as a record.
Q Do I need a Master List of Documents?
No. But it is nice to have.
Q What do I do with old revisions of documents?
Trash them. Most companies keep obsolete documents and never refer to them. If you keep them, put them in a location that most people cannot access, identify them as “Obsolete.”
Q What do I do with documents that are not created or controlled by my company?
Documents of external origin must also be controlled to ensure you are working with the latest revision. This can be done by verifying before use by using resources such as the customer’s portal, internet search, document services website e.g. www.Everyspec.com
Q What records do I need?
A record validates the performance of an activity. The QMS standard you’re working to defines what records (documented information) is required. If you need to prove that you did it, you’ll need a controlled record(s).
Q How long should I keep records?
Check your customer requirements. Your minimum record retention should be the maximum time required by your customer.
Last Word
You may have heard that “ISO is easy, just say what you do, and do what you say.”
This is partially true, just be sure that what you say is said correctly. Documentation needs to include QMS, customer and regulatory requirements.
