ISO 9001:2008 Fundamentals: Basic Questions - Controlled Documents

[FreeIndeed]

Hi all. I work in a small manufacturing company where we're struggling to get an ISO push started. We have about 20 team members and have a long history working under Mil-spec. We have a very detailed QA manual already, but it is perhaps a little too detailed for our size. I'm trying to wrap my head around a a couple of the fundamentals of 9001 and having a hard time. I've read a couple books on ISO and ISO in a small company and have been perusing threads here to help as well. I'm wondering if you all could help me understand a few things better. Most of my confusion comes from 3 major topics, which I'll list below with some examples that I'm confused on. I'd appreciate any and all help you could give! Thanks.

1) Document Control. Does every document in the company need to be a controlled document? Or just items that are a procedure, work instruction, form or record?
Examples: Someone makes a sign to post on the fridge: "No batteries in fridge." Does that have to be a controlled document with a number and reference and be indexed in the doc control log?

How about if someone saves a doc from the web about common OSHA infractions and adds that to the server?

Or manufacturing runs a job and takes some notes on how it ran.

Or if shipping has a label template that it uses for shipping to customer X?

Or if there's a page of notes on shipping requirements for Customer Y?

Can you have documents that are controlled and others that are uncontrolled?

 

[FreeIndeed]

Re: 9001 fundamentals: basic questions

2) How to organize our server/ common computer drive. This needs to be figured out before we start to organize documents and link them to a location. In the past we had a common drive that each department had a folder on. Within each department there were some common folders (policy, metrics, etc) and then any other files. Our previous QA facilitator created a generic shared "documents" folder that was then split up into departments. I thought this was kind of redundant/complicated.

Should we just have folders for Procedures, WI's, forms, records and then break that out into departments? Or stick with departments and then have each have a folder for the 4 document types?

What works for others here? Is there a somewhat standard way of organizing your network?

 

[FreeIndeed]

Re: 9001 fundamentals: basic questions

3) Our last big fundamental question/ issue has to do with the scope of procedures/work instructions. We've been told we already have more procedures than most mid-large companies and we only have 20 employees total. Do we just take the major processes and keep them general (i.e. purchasing, manufacturing and item, etc.), or do we have to have a procedure or WI for everything that happens here?

A good example I can think of is using your copier. Everyone makes copies and everyone needs to be taught how to do advanced things on the document station. But I assume having a set of WI's for it and then documenting training etc. is way over the top, right?

I feel that we're in a catch 22 being smaller; we can't document too much or the QMS becomes something we can't live by - however, there are a lot of things that we do where we don't do very frequently or where we are a back-up for someone else, and if we don't write some things down, we won't remember to do them or how.

An example of this this for us is on-boarding a manufacturing employee. In the past it was mostly all verbal training and job shadowing. However, the plant manager or supervisor would inevitably forget something. So, we created a very detailed onboarding plan that calls out a long list of skills that the new hire must be trained on. It is very specific and leaves nothing out, but that makes it a 5 page document. As I understand ISO so far (not well, I know) we could say that we train new hires to be competent at running X machine and then just sign them off after they are competent. My question is; if we want to use a document like the on-boarding one, do we have to list all of those skills in the training matrix and then have documented procedures or WI's for each skill?

I hope that makes sense; It's hard to even frame the question some times.

 

[qpled]

Re: 9001 fundamentals: basic questions

2) How to organize our server/ common computer drive. This needs to be figured out before we start to organize documents and link them to a location. In the past we had a common drive that each department had a folder on. Within each department there were some common folders (policy, metrics, etc) and then any other files. Our previous QA facilitator created a generic shared "documents" folder that was then split up into departments. I thought this was kind of redundant/complicated.

Should we just have folders for Procedures, WI's, forms, records and then break that out into departments? Or stick with departments and then have each have a folder for the 4 document types?

What works for others here? Is there a somewhat standard way of organizing your network?

For #2 I would recommend one location for each: procedures, work orders, etc... and then organize them: start with the procedures/work orders/etc... that everyone has to follow (ie forms for vacation requests) and then split the rest up by the departments they affect. Hopefully that will be less redundant/confusing than the system your previous facilitator set up...

 

[qpled]

Re: 9001 fundamentals: basic questions

For question 1) I am still learning this after 3+ years! I control forms and documents that are needed to meet customer and internal requirements. So the sign on your frig would be uncontrolled. Should be fine to have both controlled and uncontrolled documents as long as you can explain why they are what they are...

 

[drgnrider]

Re: 9001 fundamentals: basic questions

2) How to organize our server/ common computer drive.
<snip>
Is there a somewhat standard way of organizing your network?

Welcome to the Cove, FreeIndeed.

A “Standard way” to organize... probably not.

This is only one example, and its pretty simple:
On our shared network drive is the "ISO Documents" folder, (yes, that is the name of the folder; we have multiple ISO systems), and all sub-folders and documents, are locked to where only the "Factory Director" & I.T. administrators (didn't have a choice in either) and myself, (Management Representative/Lead-Auditor), have full access, everyone else has read-only access.

Next is a folder for each ISO system and one titled “Common to all”. “Common” has the organization chart and Internal Audit procedures. Each of the ‘ISO system’ folders has its respective “manual” (“Quality”, “Environmental”, etc.), then sub-folders for “Procedures” and “Work Instructions”. The forms/lists (i.e.: "Master Document List") are appendices to the controlling Procedure, so it resides in the "Procedures" folder.

As for:
1) Document Control… what I am hearing from my CB auditors, if it is deemed critical/necessary to avoid an issue (non-conforming product, environmental issue, etc,) in the ISO system, then yes, it needs to be under document control.

3) Procedures & Work Instructions – Again, what I am being told… in the Quality system: if it affects the product output and is critical to making the product correctly, then yes. Our programs for our CNC machines are not under ISO document control, but the programming department has their own way to control which version of the program is released. Copier training – change the name from “procedure” or “Instruction” to ‘guide’… this and 'not critical to product' are two ways to opt this from document control.
- As for the in-process form, we too have that problem, so we made a checklist for the initial overview (safety, environmental, ISO, etc.) for all departments. Then, if the receiving department for the employee deems a written procedure is required, they need to make one that is appropriate.
- Training matrix – be general: “operate press-brake” vs. listing each press-brake (we have three).

Hope these help.

 

[rickpaul01]

Document Control. Does every document in the company need to be a controlled document? Or just items that are a procedure, work instruction, form or record?

In a nutshell, if you need the document to deliver the end product, it should be controlled.

Examples: Someone makes a sign to post on the fridge: "No batteries in fridge." Does that have to be a controlled document with a number and reference and be indexed in the doc control log?

If this is the lunch-room fridge, than no. But if this fridge is used to deliver the end product, and you have found that proximity to batteries affects the product quality (or delivery), then yes.

How about if someone saves a doc from the web about common OSHA infractions and adds that to the server?

What was the reason it was added to the server? See how the answer to this question would lead you to decide if it needs to be controlled or not?

Or manufacturing runs a job and takes some notes on how it ran.

You might want to keep this record! Could be important.

Or if shipping has a label template that it uses for shipping to customer X?

Great idea to control templates.

Or if there's a page of notes on shipping requirements for Customer Y?

Control.

Can you have documents that are controlled and others that are uncontrolled?

Yes. And equally as important: If you state in your QMS that some type of document needs to be controlled, then it needs to be controlled.

 

[Randy]

It clearly states in the 1st paragraph of 4.2.3 what documents need to be controlled, and it clearly states in 4.2.1 what are considered management system documents....So only you can make a decision on what the correct answer is

Sorry but you're gonna get 500 different answers about what everyone feels or thinks when in the end it's up to you alone to decide what is and what isn't

 

[FreeIndeed]

Thanks for the replies!
So in regard to document control, we decide what is essential for the effective operation of our business and those docs (as well as the ones specifically required by the standard) are all we need to control.

I saw some reference to "guidelines" which I take it are for non mission critical tasks. is that right?

And how about "reference documents"? I've seen that term used before as well, but am not sure how they apply.

How about things required by other governing bodies - like OSHA? OSHA mandates a lot of "programs" and instructions that a manufacturer has to follow, but it is easily arguable if they are essential to the effective operation of the business. Ladder inspection comes to mind. Respiratory protection...

I keep reading ISO articles about the tendency for companies to over-document because they think ISO requires EVERYTHING to be documented and I think that's where we are. We are a high mix low volume shop, so we do a lot of different things, but we only have about 20 people and we already have over 250 documents that are controlled (procedures, forms, WI's). Our old (based on mil-spec) QA manual is about 25 pages with about 30 addenda. So, thanks for helping me narrow things down.

 

[drgnrider]

How about things required by other governing bodies - like OSHA? OSHA mandates a lot of "programs" and instructions that a manufacturer has to follow, but it is easily arguable if they are essential to the effective operation of the business. Ladder inspection comes to mind. Respiratory protection...

OSHA mainly deals with the safety of your employees/workers. While you still have to follow these in order to DO business, do they affect the QUALITY of your product/service? Just because OSHA requires respirators while painting, does it affect the quality of the paint application? Most likely not.