ISO 9001:2000 Documentation Requirements

[Marc]

From: ISO Standards Discussion
Date: Fri, 13 Oct 2000 16:16:22 -0500
Subject: Re: ISO 9000:1994 Vs. ISO 90002000 /../Whitcomb/Robinson/Paten

From: Mike Paten

In my opinion, Clause 4 of ISO 9001:2000 is auditable / audited for the same reasons Clause 4.2 of ISO 9001/2: 1994 was:

The General Requirements of clause 4.1 are met if the specific requirements of clauses 5-8 are met ( i.e. have you established a system that meets the requirements of ISO 9001:2000 ) - could be audited as follows:

Review quality manual to determine if a systematic approach is defined for:

1) identifying and managing QMS processes (or elements) in accordance with the "process approach" defined in clause 0.2 and Figure 1 of ISO 9001:2000 identifying and showing the relationship between the following QMS processes (or elements) and their related sub-processes: Clause:

* Management Responsibility
* Resource Management
* Product Realization
* Measurement, Analysis and
* Improvement

2) ensuring the criteria, methods, information and responsibilities for managing QMS processes are in place.

3) ensuring that data is collected, analyzed and used to assess QMS process effectiveness and to identify needed actions or improvements.

Likewise, The General Documentation Requirements of clause 4.2 could be audited as follows:

Review quality manual to ensure required procedures are included or referenced (per clause 5.5.5).

Review QMS documentation to determine if documented procedures are appropriate for the size and type of the organization, the complexity and interaction of processes, and competence of personnel.

Review QMS processes to ensure they are adequately defined in procedures, process or job descriptions, work instructions, or other appropriate system documentation.

Note: there are only six "required" procedures:

* Document Control (clause 5.5.6)?
* Control of Quality Records (clause 5.5.7)?
* Internal Audit (clause 8.2.2)?
* Control of Nonconformity (clause 8.3)?
* Corrective Action (clause 8.5.2)?
* Preventive Action (clause 8.5.3)?

If/as appropriate, procedures may also be "needed" for:

* Planning (5.4, 7.1, 8.1, 8.5.1)
* Communications (5.5.4)
* Management Review (5.6)
* Resource Management (6)
* Training (6.2.2)
* Customer Processes (7.2)
* Design and Development (7.3)
* Purchasing(7.4)
* Operations Control (7.5.1)
* Product ID/Traceability ( 7.5.2)
* Customer Property (7.5.3)
* Preservation of Product (7.5.4)
* Validation of Processes (7.5.5)
* Process Measurement/Monitoring (8.2.3)
* Product Measurement/Monitoring (8.2.4)
* Analysis/ Improvement (8.4, 8.5)

Review applicable standards and statutory/regulatory documents to determine if the QMS identifies required documentation and records.

Review other external or internal documents to ensure QMS identifies documentation and records needed to effectively manage the organization's products, processes and activities.

Note: Clause 4.2 requires that documentation be defined here - QMS document and record controls must be per clauses 5.5.6 and 5.5.7).

This is how I read it anyway!

Mike Paten

 

[Marc]

From: ISO Standards Discussion
Date: Mon, 9 Oct 2000 13:01:46 -0500
Subject: Re: ISO 9000:1994 Vs. ISO 90002000 /van Putten/Hankwitz/Robinson

From: "Ralph E. Robinson"

<John.Hankwitz> wrote
<snip>
> and you no longer are required to have everything you
> do documented. (You can even rip the work instruction off
> your coffee maker if you want to.) ;-)
<snip>

This is exactly the kind of actions that I feel will create all kinds of grief between registrars and clients. If you look at the preamble to ISO\FDIS 9001:2000 (also in ISO\DIS 9001:2000) clause 4.2, Documentation Requirements, states that quality system documentation shall include - item d) "documents needed by the organization to ensure the effective planning, operation, and control of its processes". Now I know that this area is not one of the auditable modules, but it is general advice to all organizations. Does anyone care to guess at how many disagreements will erupt over determining how much is "needed by the organization...of its processes"?

I personally feel that this may become the achilles heel of this version of the ISO standards, and I don't think the standard has done anyone any favours in this regard. Many companies, I fear, will adopt this attitude and either delete any documentation not specifically called up in the new standard, or just let those existing pieces fall by the wayside.

If you don't have your processes documented, how can you be sure everyone is doing things correctly? Just what way is the correct way? How can you be sure your processes have any integrity? I can see a great proliferation of industry specific standards coming into being where product quality can have life threatening impacts - medical devices, aerospace (already in place to address perceived shortfalls in the 1994 version), automotive (already in place to address perceived shortfalls in the previous versions), pharmaceuticals, chemical manufacturing, and many others. Service industries will not escape this either. Can you see hospitals not having full and complete documentation for its processes?

It will be a shame if, during the five or six year life of this version of ISO 9001, the standard becomes considered to be of less value that it currently possesses. If the Firestone/Ford situation can happen under the 1994 environment, what does the future hold for the 2000 version?

It's not a rosy picture to contemplate.

Ralph E. Robinson

 

[Marc]

The FDIS six "required" documented procedures:

Document Control (clause 4.2.3)
Control of Quality Records (clause 4.2.4)
Internal Audit (clause 8.2.2)
Control of Nonconformity (clause 8.3)
Corrective Action (clause 8.5.2)
Preventive Action (clause 8.5.3)

 

[David Mullins]

It's intersting that these relate back directly to those areas that typically the "Quality Section" of a company is responsible for. This kind of suggests that it is the bare bones approach, and that if you do anything that adds value, beyond the QA stuff mentioned, then you'd better be able to back them up with something as well.

If we had a a think tank company staffed by PHD's who did little more than create ideas for industry, at no charge (funded by Hugh Heffner), and they wanted ISO 9001, then they might only need the minimum number of procedures.

------------------

 

[Al the Elf]

Ralph pondered :

"If you don't have your processes documented, how can you be sure everyone is doing things correctly? Just what way is the correct way? How can you be sure your processes have any integrity? "

We as an organisation are delighted that the standard is not being prescriptive about the need for written procedures, as we're finding it is empowering our managers to start deciding for themselves where they do or don't need procedures.

I'd also note that the new standard requires a much greater emphasis on measurement, including satisfaction of customers (or should that now read interested parties !). This must surely provide you with the evidence that you are satisfactorily controlling your processes.

Cheers, Al.

 

[David Mullins]

That very much depends on how you measure customer satisfaction. If you measure it based on customer feeedback, like complaints, it is a soft measure of the actual level of customer satisfaction - most dis-satisfied customers simply take their business elsewhere, why should they bother sorting out the performance of a company that doesn't make product that suits their needs.

And what about all the customers who don't understand - for example in the health sector, where most people have little to no idea or understanding of the quality of service they should be receiving, hence they are clueless when they've been duped. What a wave of emotion a card from the loved ones of a deceased patient makes, they thank the organisation and staff for their desperate efforts, and you know there were clinical bungles made that probably cost the life of the patient. Customer Satisfaction = 100%.

------------------

 

[Al the Elf]

David

I agree that customer satisfaction measurement can be flawed and thus meaningless, but is this any worse than having procedures that are neither read nor updated.

We are trying to turn things around to promote better measurement of the key things that matter, and I guess in the case of your example this may include how our staff feel about our performance in delivering health services. Then if the team decides it will improve (or maintain) the level of perfomance by using a procedure or written instruction, then that is what we will do. The key difference now is that the standard is not being prescriptive (with the 6 exceptions).

Your example raises another interesting issue - how far should we consider the interests of the other interested parties ?

To look at your example, in the UK, the taxpayer is an interested party in the provision (costs) of health care services. If the less than 100% service (clinically) is all that was planned to be delivered inside the budget, could you validly claim to an auditor to be creating interested party satisfaction !

Al.

 

[David Mullins]

What I'm trying to say is - be careful with customer satisfaction data if you are using complaints as the data source.

From first hand experience in one of the states of Australia (not the one I'me currently in), the ambulance service operates under an Act, which is then enforced (so to speak) by the health department. The department requires the ambulance service to report a small range of financial and transport number info. This includes the number of compliments and complaints.

One Region for example tranports 22,000 patients a year and receives nominally about 22 complaints per year. That's 99.99% Satisfaction, right? Two pilot patient surveys conducted in the same Region in the same period, although identifying a number of issues that required improvement, still recorded an overall satisfaction rating of 99%. The same Region conducts clinical inspections of the patient care records to determine clinical nonconformance and corrective action through training and reinforcement. Let's just say the clinical compliance rate was less than 90%. (Note - the only true method is direct observation of the delivery of the service)

So, we've gone from a very good process capability of 99.99% (complaint data), or a Cpk of just less than one, to less than 90% capapble, or a Cpk less than 0.4

Sometimes it's best not to know these things, but if your in business to make money you'd better be measuring real things that are critical indicators of performance.

Alas production/operation managers like measures that make them look good. Come up with something else / new, and they'll fight like a pitbull.

This is not worse than procedures that are neither read nor updated, it merely completes the illusion!

------------------

 

[isodog]

"Ralph pondered : "If you don't have your processes documented, how can you be sure everyone is doing things correctly? Just what way is the correct way? How can you be sure your processes have any integrity? ""

Hasn't anyone ever heard of a Work Instrauction??? It's like a Procedure but is controlled in the department where it's used.
(Much more cost effective)

Also, if you can demonstrate you omply with the requirements in, lets say, Purchasing. What difference does it make if you've documented it with a hand written memo?

------------------

 

[David Mullins]

What difference does it make?
One method has a chance of working, and the other has none.

Memo's, if even read, have a life span of a few minutes. Could you conceive that people undergoing an audit could demonstrate ready access to memos on policy? Or do we need a memo to tell us how to file memos, and should there be a color scheme for different types of memos, and do we need a memo to explain the color schemes, and another memo on retention and disposition of records.........?

For the purposes of this discussion, I'm happy to include a Work Instruction as being a controlled system document (just like a procedure). (WIs are not only controlled in a specific dept., they can be at the highest system level - e.g. a WI on Internal Quality Auditing that explains how to fill out the audit report form (if you had one))

The bottom line should of course be, what is going to work for this organisation (based on their needs, culture, etc). The number of procedures should not be based on how slack your registrar is. But as always, if you're only in it for the registration as a sales tool, then do what you must!


------------------