Am I doing to much documentation?



I'm an IT manager that is part of a larger ISO certified company. Until this year IT was not required to be certified. Now that we are I need some help with a few questions on work instructions.

There are several processes that our help desk or related support staff performs that are part of a process or work instruction written by the software manufacturer.

E.g. 1. A new employee is hired. That employee needs email. We set their account up as per Microsoft Exchange's instructions. The process is defined in the Exchange manual on how to create an account. Do I need to create a separate work instruction and control it?

E.g. 2. We install anti virus software on all of our machines. We install per the manufactures instructions, but make some modifications like do not scan network drives from this desktop, or do not check floppy disks each time one is inserted in the drive for viruses. There is no deviation in the "process" yet a few modifications do exist. Do I need to control a work instruction that would call out the entire process?

I know those are lengthy questions and appreciate your time. Thanks very much,
Elsmar Forum Sponsor

Craig H.


Welcome to the Cove!

I am not an IT person, but let me take a shot at one of your questions.

The manuals you have can take the place of an internal document, but I would look at 2 things first.

1. Are the documents well-written and easy to use? Some software manuals seem to have been written in Chinese a century ago. If so, consider creating something easy to use.

2. Are they available? Do we have enough copies, in the right places, so that when they are needed they are readily available?

If the answers are "yes", by all means reference the OEM document in a master document of your creation and go on to more productive tasks!

Hope this helps


Randy Stewart

Good Idea

I agree with Craig. When you set up a doc system you need to take a look at what happens during a particular situation. Take the "New Hire" situation. There probably are a number of things you have to set up other than email, i.e. access, passwords etc., you can incorporate the reference to the OEM manuals in a governing procedure for New Hires. Map how you are notified as to the persons needs, hire date, etc. Our people have to be scheduled for orientation training, some it takes 3 days others it is only 1, but all of this is described in our overall procedure governing the new hire process.
Hope I haven't gotten to wordy on you. I guess what I'm trying to say is 2 fold. 1) You hire people with skills, determine what level that is at and then how much detail you need in the procedures/work instructions. 2) If procedures are needed, determine if they can be combined with other procedures to eliminate duplication.

Paul Simpson

Trusted Information Resource
Do nothing!

Hi, Jim.

The good news is that the latest version of ISO doesn't have any more implications than the previous one for IT. There are additional requirements to manage resources but the standard has taken a step back in documentation. So taking your first example:
- If the internal or 3rd party auditor can see there is a process in place that picks up new people joining and the records show that they are getting on to the system ok then they don't need to see a procedure / instruction.
- Similarly if there is a process for virus checking in place (undocumented) and there are records showing the process is working effectively - then no need for a procedure.

All of the above assume that YOU don't think your people need documentation and you are happy they are competent doing what they do.
Further support for what Paul says:

See ISO9001:2000 clause 4.2.1, Note 2:

The extent of the quality management system documentation can differ from one organization to another due to

a) the size of organization and type of activities,
b) the complexityof processes and their interactions, and
c) the competence of personnel.

This is one of my favourite quotes in the standard, because it allows companies to build reasonable systems tailored to their actual needs.




Is your group getting a NEW ISO certification or becoming more involved in the system with the rest of the company? I am guessing the later.

As the others have stated there are no requirements for which documented instructions are required. If you see value in adding an instruction, do so. If not, don't. Don't duplicate manufacturers manuals - but you may want to have short instructions for the custom settings you use.

I would expect that IT would be most involved with document and record control. If you are using electronic documents and keeping records on a server, your department will figure into those areas the most. You may want to focus on backup, data security, etc. first.



First off, let me say thank you to all that have replied. You've all given me some great advice.

Tom, we're considered support as is our Finance and HR departments. The support functions haven't sought certification until this point.

In looking at what is available to us, I couldn't see me writing anything further to what I already have. We have competent people, manuals as well as the F1 key available if needed.

Claes, I'm going to print out what you said and tape it to the side of my machine. During the audit I may even carry it with me. Rolling it up and popping the auditor on the head if he get's out of line (J/K)

Thanks again everyone.

This is one of my favourite quotes in the standard, because it allows companies to build reasonable systems tailored to their actual needs.
I cringe when I see companies building monsters they can't feed! Build the simplist system you can that works for you. Claes, I like that word "reasonable". If everyone followed your advice, life would be som much easier.

Randy Stewart

I agree

Posted in my area and the first page of our evidence book is this saying:

QS and ISO does not prohibit the use of reason.

I make sure that any new auditor, external or internal, knows that this is the basis for our business system.:agree:
Thread starter Similar threads Forum Replies Date
D What are the IATF rules regarding doing internal audits remotely? IATF 16949 - Automotive Quality Systems Standard 5
qualprod What do CB´s change when doing a partial moving ? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 1
M What to be careful about/focus on when doing a Technical File review EU Medical Device Regulations 4
K The correct way of doing a 2 Sample T test Reliability Analysis - Predictions, Testing and Standards 7
V CE Mark under MDD or IVDR - IVD company doing Virtual Manufacturing Other Medical Device Regulations World-Wide 3
Sidney Vianna Are the Accreditation Bodies doing their job? Keeping CB's accountable? Registrars and Notified Bodies 0
GreatNate QMS in SharePoint - Is anyone doing this? Manufacturing and Related Processes 10
D Doing both a top-down and a bottom-up risk assessment - How to combine ISO 14971 - Medical Device Risk Management 30
D Do I need part variation while doing Destructive Variable Gage R&R MSA study Gage R&R (GR&R) and MSA (Measurement Systems Analysis) 19
A True purpose of doing EST (Electrical Safety Test) on medical device Other Medical Device Related Standards 3
supadrai d/b/a doing business as and the FDA US Food and Drug Administration (FDA) 1
Raffy What is the first step in doing PIA (Privacy Impact Assessment)? IEC 27001 - Information Security Management Systems (ISMS) 3
I AS9100D - Interview Request - I'm doing research Misc. Quality Assurance and Business Systems Related Topics 1
Q Doing an MSA on a Climatic Chamber Gage R&R (GR&R) and MSA (Measurement Systems Analysis) 3
N Explanation - Quality means doing it right when no one is looking ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 5
R CMDCAS and dba's (Doing Business As) Canada Medical Device Regulations 2
Sidney Vianna As a profession we, auditors, are not doing enough - Simon Feary speech Registrars and Notified Bodies 36
B Doing MSA Variables Data Study on Threads Gage R&R (GR&R) and MSA (Measurement Systems Analysis) 3
D Are we doing enough to meet Identification and Traceability 7.5.3 Requirements? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 1
S Who is doing BGA cross sectional analysis in assembled PCBA in INDIA? Reliability Analysis - Predictions, Testing and Standards 1
G Thoughts on Audit Finding for not doing Gage R and R for Visual Inspection Gage R&R (GR&R) and MSA (Measurement Systems Analysis) 8
AnaMariaVR2 What the Internet is Doing to Our Brains Coffee Break and Water Cooler Discussions 5
J Doing a "yearly" mass calibration of gages over the weekend. Any advice? General Measurement Device and Calibration Topics 4
P Root Cause for not doing Management Review ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 6
P Testing Standards - Regulatory agency doing Enforcement Testing of Medical Devices EU Medical Device Regulations 5
T DOE Multi level Taguchi - I am doing a Capstone Project Using Minitab Software 10
M Requirement to complete an MSA when doing Comparative Tests Gage R&R (GR&R) and MSA (Measurement Systems Analysis) 2
G Dealing with Excessive Within-Part Variation when doing MSA and Cpk studies Gage R&R (GR&R) and MSA (Measurement Systems Analysis) 3
M To find the Optimum Parameter Setting using Minitab (Doing DOEs) Using Minitab Software 18
O NET-INSPECT is it worth it? Small Machine Shop doing AS9100 Quality Manager and Management Related Issues 9
R First Pass Yield - Am I doing correct the First Pass Yield Metric Quality Tools, Improvement and Analysis 2
P Environmental Aspects and Impacts while doing Software Development ISO 14001:2015 Specific Discussions 6
L Must Calibration Labs have IEC 17025 before doing Calibration Jobs for Customers ISO 17025 related Discussions 13
F Regulatory Affairs Certification (RAC) April/May EU Exam - Anyone doing it? Professional Certifications and Degrees 10
D Is anyone familiar with doing a DVI (Dossier de Validation Industrielle) for Snecma AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 5
E Should FDA implement 3rd party (PMAs) reviews? What are the pros and cons of doing so Other US Medical Device Regulations 2
Q Methods for doing Production Process Risk Analysis ISO 14971 - Medical Device Risk Management 4
V Help doing 6sigma Green Belt Professional Certifications and Degrees 6
Anerol C What activities are you doing daily as QMS Coordinator? Career and Occupation Discussions 3
C Setting Up Part Masters in ERP Systems - How are others doing it? Document Control Systems, Procedures, Forms and Templates 1
C Handling Repeated Non-Conformities when doing Layered Process Audits Process Audits and Layered Process Audits 11
A MR (Management Representative) also doing Internal Audits? Internal Auditing 27
J Registrars Doing Synchronized (Combined) Audits to AS9100 and ISO 13485 Registrars and Notified Bodies 8
C Volkswagen Quality System - Is Volkswagen doing anything different? Customer and Company Specific Requirements 1
Marc What are Toyota's idled U.S. workers doing? World News 4
M FOC (3 lots) - First of Code - Are you still doing 3 lots for FOC? Other Medical Device and Orthopedic Related Topics 1
D Greening of Standard Specifications - What is your company/ organization doing Sustainability, Green Initiatives and Ecology 10
S Please tell me how to start doing an FMEA FMEA and Control Plans 6
D Currently doing battle with IT - IT Help Desk procedure wanted Service Industry Specific Topics 5
B 'Doing Quality' - But calling it something else Quality Manager and Management Related Issues 12

Similar threads

Top Bottom