Electronic Documentation Systems - Security, Approval and Editing

[Marc]

From: "Edwin"
I've watched this thread with considerable interest.
Some responses:

SECURITY
The best way to secure documents over the Intranet is with network facilities: either using your web server's security features, or restricting write access to the directories in which the documents are filed. We try not to use Word documents: HTML and PDF formats are much smaller and create consequently less network traffic. The rule is: if it's only going to be accessed on-line, use HTML; if it's also going to be printed, use PDF.

EDITING
With HTML software so easy to use, it's easiest to convert the files into HTML, and when satisfied, delete the Word files: that way, you only have one version of the file (therefore no version conflicts), and any links you create in the HTML file aren't lost on re-exporting from Word. Don't, for heaven's sake, use Word to edit the HTML files: it's a dog of an HTML editor and produces the worst HTML imaginable. PDF is not an editable format, so any editing must be done in Word, and then the final document exported into Acrobat and bookmarks added, if required.

APPROVALS
The simplest method of ensuring appropriate approval is to discipline the posting process by restricting write access to the directories to those responsible for the document. Then, when the document is altered, if the revised document is online, it can only be because it has been posted (i.e., authorised) by the responsible person). Control is by the logic of the process, not elaborate digital signatures or similar.

Best Regards
Edwin Humphries

------------------------

From: ISO Standards Discussion
Date: Wed, 12 Jul 2000 14:39:50 -0500
Subject: Re: Web Based QMS /../Humphries/Pfrang

I like Edwin's suggestions, as well as a few others that have been posted, because they address the important issues related to Intranet use without going overboard. Some people have the mistaken idea that Intranet use demands all sorts of extreme procedures for document security, editing and approval. In fact, unless the firm has (or is likely to have) a widespread problem with employees deliberately falsifying documents, the firm should do just fine with a minimal document control system (electronic- or paper-based) that merely prevents accidental tampering.

In other words, the level of document security, editing and approval depend more on the character of the firm and whether it has (or is likely to have) forgery problems than on whether the firm chooses paper or an Intranet as its document storage medium. If the firm has no forgery problems with paper documents, then switching to electronic media should require no significant new procedures for document security, editing and approval.

-- Doug

I was reading some of the posts for electronic documentation. I did not see anything that could answer my questions.
I would like to ask 2 questions along this line. We are going to a full electronic system, meaning procedures and work instructions on line with each department responsible for assuring the current copy is posted, (pdf file) at this time. First, does ISO require us to keep a original Hard copy? And second, if a hard copy is not required, is it just a matter of how we define/document how we will do electronic approvals/signatures ? (is this allowed for ISO)
Thanks for any input you can give.

Bryan

[Roger Eastin]

No, you do not need hard copies (I assume this means paper copies). Electronic signatures are great if you can confirm that the person who's responsible for review/approval are responsible for the signature. For instance, you have an e-mail message stating that the document is reviewed /approved by the responsible person. I'm sure there are other approaches, but something like this works.

[CarolX]

Bryan,

This is what I am doing.

We are going to an electronic system, but I need to maintain approval signatures on file.
I keep a hard copy of the procedure in my "records" file along with a cover sheet listing all the documents released and all the required approval signatures.

Hope that helps a little.

CarolX

Bryan:

The company I work for also has an electronic document system including electronic approvals. Our system is set up such that each document has an on-line Index which includes identification of the "Owner" of the document. Our electronic approval document requires that the "Owner" be the first signature sign-off and identifies all the other required signatories by title. When the document(s) hit our Doc Sys Group all they have to do is cross reference the Index to verify that the "Owner" has approved the document revision. The Index eliminates the need for us to keep a separate approval file. Our Level 2 document describes our system and indicates that this is the method we use to ensure compliance with ISO element 4.5.3. So far our Doc Sys Group and the system has been one of the consistent favorites of Third Party and Customer auditors.

[rrramirez]

I can convert your quality manual to e-books without the need of Acrobat or any other program.

[Marc]

Also see http://Elsmar.com/ubb/Forum7/HTML/000091.html and http://Elsmar.com/ubb/Forum7/HTML/000106.html and http://Elsmar.com/ubb/Forum7/HTML/000041.html

[Sam]

1- No, you are not required to keep a har copy, however, your registrar may request that you keep one controlled copy; just to give them that warm fuzzy ...

2- Develop a document control procedure for electronic media just as you would for hard copy , no difference.