Am I doing to much documentation?

[Fudog1138]

I'm an IT manager that is part of a larger ISO certified company. Until this year IT was not required to be certified. Now that we are I need some help with a few questions on work instructions.

There are several processes that our help desk or related support staff performs that are part of a process or work instruction written by the software manufacturer.

E.g. 1. A new employee is hired. That employee needs email. We set their account up as per Microsoft Exchange's instructions. The process is defined in the Exchange manual on how to create an account. Do I need to create a separate work instruction and control it?

E.g. 2. We install anti virus software on all of our machines. We install per the manufactures instructions, but make some modifications like do not scan network drives from this desktop, or do not check floppy disks each time one is inserted in the drive for viruses. There is no deviation in the "process" yet a few modifications do exist. Do I need to control a work instruction that would call out the entire process?

I know those are lengthy questions and appreciate your time. Thanks very much,
Jim

 

[Craig H.]

Jim:

Welcome to the Cove!

I am not an IT person, but let me take a shot at one of your questions.

The manuals you have can take the place of an internal document, but I would look at 2 things first.

1. Are the documents well-written and easy to use? Some software manuals seem to have been written in Chinese a century ago. If so, consider creating something easy to use.

2. Are they available? Do we have enough copies, in the right places, so that when they are needed they are readily available?

If the answers are "yes", by all means reference the OEM document in a master document of your creation and go on to more productive tasks!

Hope this helps

Craig

 

[Randy Stewart]

Good Idea

I agree with Craig. When you set up a doc system you need to take a look at what happens during a particular situation. Take the "New Hire" situation. There probably are a number of things you have to set up other than email, i.e. access, passwords etc., you can incorporate the reference to the OEM manuals in a governing procedure for New Hires. Map how you are notified as to the persons needs, hire date, etc. Our people have to be scheduled for orientation training, some it takes 3 days others it is only 1, but all of this is described in our overall procedure governing the new hire process.
Hope I haven't gotten to wordy on you. I guess what I'm trying to say is 2 fold. 1) You hire people with skills, determine what level that is at and then how much detail you need in the procedures/work instructions. 2) If procedures are needed, determine if they can be combined with other procedures to eliminate duplication.

 

[Paul Simpson]

Do nothing!

Hi, Jim.

The good news is that the latest version of ISO doesn't have any more implications than the previous one for IT. There are additional requirements to manage resources but the standard has taken a step back in documentation. So taking your first example:
- If the internal or 3rd party auditor can see there is a process in place that picks up new people joining and the records show that they are getting on to the system ok then they don't need to see a procedure / instruction.
- Similarly if there is a process for virus checking in place (undocumented) and there are records showing the process is working effectively - then no need for a procedure.

All of the above assume that YOU don't think your people need documentation and you are happy they are competent doing what they do.

 

[Claes Gefvenberg]

Further support for what Paul says:

See ISO9001:2000 clause 4.2.1, Note 2:

The extent of the quality management system documentation can differ from one organization to another due to

a) the size of organization and type of activities,
b) the complexityof processes and their interactions, and
c) the competence of personnel.

This is one of my favourite quotes in the standard, because it allows companies to build reasonable systems tailored to their actual needs.

/Claes

 

[tomvehoski]

Jim,

Is your group getting a NEW ISO certification or becoming more involved in the system with the rest of the company? I am guessing the later.

As the others have stated there are no requirements for which documented instructions are required. If you see value in adding an instruction, do so. If not, don't. Don't duplicate manufacturers manuals - but you may want to have short instructions for the custom settings you use.

I would expect that IT would be most involved with document and record control. If you are using electronic documents and keeping records on a server, your department will figure into those areas the most. You may want to focus on backup, data security, etc. first.

Tom

 

[Fudog1138]

First off, let me say thank you to all that have replied. You've all given me some great advice.

Tom, we're considered support as is our Finance and HR departments. The support functions haven't sought certification until this point.

In looking at what is available to us, I couldn't see me writing anything further to what I already have. We have competent people, manuals as well as the F1 key available if needed.

Claes, I'm going to print out what you said and tape it to the side of my machine. During the audit I may even carry it with me. Rolling it up and popping the auditor on the head if he get's out of line (J/K)

Thanks again everyone.

Jim

 

[db]

This is one of my favourite quotes in the standard, because it allows companies to build reasonable systems tailored to their actual needs.

I cringe when I see companies building monsters they can't feed! Build the simplist system you can that works for you. Claes, I like that word "reasonable". If everyone followed your advice, life would be som much easier.

 

[Randy Stewart]

I agree

Posted in my area and the first page of our evidence book is this saying:

QS and ISO does not prohibit the use of reason.

I make sure that any new auditor, external or internal, knows that this is the basis for our business system.

 

[Claes Gefvenberg]

You know, Stew, that's not half bad as a summary... Right on the button, I'd call it. Good one.

/Claes