When NOT to control a process in your QMS

[ISOBlue]

Hello everyone! I'm new to this forum although I've reviewed some interesting threads on it in the past. I thought i would throw a question out there to see what others thought of this. My company is in the medical device industry, and we have developed a QMS that has passed quite a few inspections now.

We have a few areas of our business that I have not included in our QMS documentation. specifically i have chosen to eliminate some of our accounting and human resources work from our existing document controls because many of these processes are unrelated to our products or services and would not have an impact on them. So far so good; our auditors have agreed with this decision and I have not had any issues.

Recently, our HR department (which is very small) has created quite a few uncontrolled forms and documents for their own internal processes. These processes are NOT related to our training or anything like that, so they really don't qualify as part of our QMS. I hesitate to let them remain uncontrolled though because i keep thinking that if our HR person leaves, whoever replaces them is going to face a nightmare to figure out exactly what documents were once necessary and what documents were created at the fancy of our existing department for needs that might not be applicable anymore.

Has anyone else considered applying controls to areas of the company where it might not be necessary? Specifically, has anyone else put a lot of controls on HR type processes such as medical benefit management, disability leave, and whatnot? I would love to hear from some other professionals since i'm somewhat green at this!

[Coury Ferguson]

Originally Posted by ISOBlue

Hello everyone! I'm new to this forum although I've reviewed some interesting threads on it in the past. I thought i would throw a question out there to see what others thought of this. My company is in the medical device industry, and we have developed a QMS that has passed quite a few inspections now.

We have a few areas of our business that I have not included in our QMS documentation. specifically i have chosen to eliminate some of our accounting and human resources work from our existing document controls because many of these processes are unrelated to our products or services and would not have an impact on them. So far so good; our auditors have agreed with this decision and I have not had any issues.

Recently, our HR department (which is very small) has created quite a few uncontrolled forms and documents for their own internal processes. These processes are NOT related to our training or anything like that, so they really don't qualify as part of our QMS. I hesitate to let them remain uncontrolled though because i keep thinking that if our HR person leaves, whoever replaces them is going to face a nightmare to figure out exactly what documents were once necessary and what documents were created at the fancy of our existing department for needs that might not be applicable anymore.

Has anyone else considered applying controls to areas of the company where it might not be necessary? Specifically, has anyone else put a lot of controls on HR type processes such as medical benefit management, disability leave, and whatnot? I would love to hear from some other professionals since i'm somewhat green at this!

Good first post ISOBlue.

Are any of these forms related to the QMS? I believe you said no.

First, and probably the one important thing that I see, what are these forms and what are they used to document? Meaning, does the information contained in the forms have any bearing on the way the Organization functions.

I am not a Subject Matter expert in Medical, so I may be leading you down the wrong path. I am basing this on personal experience and knowledge with other Quality Management Systems.

[howste]

I look at it this way: If you don't care what results you get, then don't control the process.

When you say "might not be necessary" I think you're referring to the requirements of standards or regulations making them necessary. Don't forget that your business has needs, and that some controls may be necessary for your business - not just to pass an audit.

If the forms remain uncontrolled, what will happen? Will there be problems if someone has the wrong version of a form?

[atitheya]

Hi ISOBlue,

Agreeing with Courey Ferguson and Howste, I would suggest you ask yourself - 'Why are these forms/records there if their existence is not important to your business operations?' There must be some purpose.

In my opinion these must be controlled at least to be identified, retrievable and show the order or sequence of the activities recorded. The control may remain only with the process owner or as suitable to your organisation and so defined.

Use ISO9001 and incorporate the standard in your system for effective results. ISO9001 compliance / certification should not be the end result, but a means for moving ahead.

[JaneB]

Originally Posted by ISOBlue

Has anyone else considered applying controls to areas of the company where it might not be necessary?

Depends on how you define 'necessary'. Instead of focussing narrowly on 'is this in or out of ISO', I'd turn the question on its head, and ask myself:

Q: WHY do Standards such as ISO 9001 (and others) require us to control documents?

A: Because it's good practice.

In other words, I'd readily apply or encourage ISO disciplines to be applied elsewhere in the organisation because it's good practice and leads to all those good things.

YOu appear to be really only asking about controlling docs, whereas the thread title asks about controlling processes - I firmly contend that ANY process in an organisation requires some form of control. I doubt anyone is simply allowed to go on leave or paid without some form of control over the process! (If they are, it's definitely bad practice)

It's handy to know which the latest version of any document is, for example. But I'd not stomp around with a big stick beating people over the head, either. You can often accept a lesser type of control on less important docs (eg, a leave form is generally a leave form, and the world probably won't end if it isn't well controlled) than the design drawings for manufacturing, for example.

But you're right - if someone leaves (and they do!) how will anyone else know what docs exist, what state they're in, who signed 'em off (if anyone did), where they are, etc etc.

To me, these are some of the reasons why ISO requires such things to be managed & controlled.

But you seem really to be just asking about controlling documents, whereas your thread title asks about controlling processes. Any process needs some kind of control! After all, even in HR, surely you don't just have people going off on leave or being recruited without any kind of controls, do you?

[Kevin Mader]

ISOBlue,

My advice is to keep business system requirements separate from quality management system requirements. Bundling these together can lead to unwarranted observations and findings during a QMS audit.

This being said, where to control documentation of a business nature becomes the question. More and more I believe that organizations, especially those required to follow Sarbanes-Oxley will have to develop parallel systems to control policy, procedures and forms. In an unregulated business, it might make sense to couple the business documentation program with the quality program documentation, but as you are working in the medical device industry, again my advice is to keep things separate.

Our peers here are giving good advice: business excellence cannot be achieved by mere compliance with QMS standards and requirements. Businesses must look beyond the narrower interpretation and utilization of requirements and tools and apply what works more broadly. The thing of it is, in regulated industry, you need to simplify QMS approaches to remain in the highest state of compliance. Here, I believe QA and RA managers need to determine the appropriate strategy that balances compliance risk with an organizations documented QMS program.

Keep in mind that compliance can take different forms: financial, regulatory and ISO for instance. Beyond the QA and RA managers, the business folks need to offer their suggestions as well.

Regards,

Kevin

[Kevin Mader]

P.S. Welcome to the Cove!! I hope that now that you have entered into discussions here that you find it to be personally and professionally rewarding. Enjoy the learning!!!!

[ISOBlue]

First I'd like to thank everyone for providing so much information in your posts. It has all been very helpful. The documents that my HR department are creating are things like FLMA (family medical leave act) signoffs, medical leave notification documents, change of status (full-time to part-time/night shift) and things like that.

I believe after reading all of your posts that you are all leaning towards having at least some moderate control over these documents, so i will give some thought as to the least burdensome way to handle such a project. Since our HR department has only a single employee, right now its easy enough for him to know what documents he's handling, but passing the torch is going to be an issue one day!

I think maybe i will implement a more relaxed type of control where i at least catalog what documents HR is using and what their purpose is, but maybe not rigidly control their specific format so that they can be changed more easily as labor laws shift.

I would not be as concerned about this issue if there was more organization in the department. Our accounting department for instance has little in the way of written procedures and forms, but i'm confident that they can pass on their methods and policies to new workers because they have more organization and more employees to share the knowledge. HR is very small though, and to a degree it can be a black hole of knowledge about the procedures.

Once again, thanks to everyone for being so helpful. You have given me much to think about and plan!