Control of Documents or Control of Records?

[Lucasmf]

Another simple rule for 4.2 vs 4.3.
Documents specify requirements (SOPs, WIs, Forms). They require approval prior to release (for most folks this means a signature on the cover page or via their change control process).

Records demonstrate conformance to the requirements in the documents. They only require signature when specified by your documents or in certain cases (more limited than most people think) by the standard or regulation (e.g. nonconformance reports are records that require approval (i.e. signature), same with acceptance records). Many records require identification of the individual but this does not mean legal signature, just printed name is sufficient.

 

[kensonic_qmr]

Thanks for your reply guys! Well, our problem with records and documents having no signature is a systematic problem. Purchase Orders, Engineering Designs, and other important documents and records are being approved but no signature to prove that it is approved prior to use (This is I think clear to violate 4.2.3 a of the standard). I'd just use the time card as a sample because it is a record (since the time of the employees are recorded there) and we have confusions if what clause we can call it. Time card is stated in our Quality Manual as an Input to our Human Resource management process.

Our Internal Audit Findings Report has a slot to fill-up what clause in the standard we will call the NC. My boss is a little meticulous and as much as possible, he wants our report to be accurate.

 

[kensonic_qmr]

Is there a documented requirement in your own QMS for timecards (or other records) to be signed? If so, use that as your NC citation. If not, how are people supposed to know about the requirement? ISO 9001-2008 has no requirements regarding signatures on records or forms.

I just read your reply for the second time and I've think you have a great point there. Thanks a lot! Just in case that it is written in our Quality Manual, what clause can I call it?

 

[Jim Wynne]

I just read your reply for the second time and I've think you have a great point there. Thanks a lot! Just in case that it is written in our Quality Manual, what clause can I call it?

Could you clarify the question? If it's written in your QM, why do you need a clause reference?

 

[qusys]

I just read your reply for the second time and I've think you have a great point there. Thanks a lot! Just in case that it is written in our Quality Manual, what clause can I call it?

Hi kensonic.
In my previous post in response to original question, I highlighted that you could have written a ncn versus your documented internal procedure if the violeted requirement had been reported. This is the same for Quality manual. In fact , when you performed internal audit, you set criteria and applicable reference standards.
I think that you audit vs your QM, Corporate procedures,internal procedures and ISO standard applicable to your organization and agreed with mgmt.
ISO 9001 standard mentions only "records" as a word, you as organization shall establish what the records are for the effectiveness of your QMS.
On my personal point of view, I think that some records are mandatory where it is clearly reported in the standard. Clearly you can establish other records too.
Not knowing your QMS, I would like also suggest to consider the electronic signature where applicable.

 

[somashekar]

Thanks for your reply guys! Well, our problem with records and documents having no signature is a systematic problem. Purchase Orders, Engineering Designs, and other important documents and records are being approved but no signature to prove that it is approved prior to use (This is I think clear to violate 4.2.3 a of the standard). I'd just use the time card as a sample because it is a record (since the time of the employees are recorded there) and we have confusions if what clause we can call it. Time card is stated in our Quality Manual as an Input to our Human Resource management process.

Our Internal Audit Findings Report has a slot to fill-up what clause in the standard we will call the NC. My boss is a little meticulous and as much as possible, he wants our report to be accurate.

If signature by authorized person is the way of your document approval and record authorization, then you are violating your own set procedure. As it is systematic problem, please address this with a deep down root cause analysis and bring in a corrective action in place that is effective.
If your Internal audit report has a cell for the standard clause number, make an amendment to it and get rid of that cell.
I am happy your boss is a little meticulous, and wants reports accurate. Removal of clause number cell will make your job and his more easy in being accurate, as the purpose of internal audit is not to find a clause reference and then a CA, but to study and implement a CA suitable and adequate to the finding in the audit.
You know .... "when rome was burning nero was fiddling" .. ?
When your approval method for documents and records is burning as you explain., do not fiddle about which clause they fit into well.

 

[x-files]

Sorry for pop up-ing this thread.

Today, during (outsourced) internal audit, I "learned" from an auditor that blank form is a record, and it has to be controlled within "control of records".

When I said that it's just a document like any other document in our IMS (manual, procedure, wi, ...), and that we control blank forms within "Document control", the auditor said: "No, no... it should be controlled withinh Record control!".

 

[AndyN]

Sorry for pop up-ing this thread.

Today, during (outsourced) internal audit, I "learned" from an auditor that blank form is a record, and it has to be controlled within "control of records".

When I said that it's just a document like any other document in our IMS (manual, procedure, wi, ...), and that we control blank forms within "Document control", the auditor said: "No, no... it should be controlled withinh Record control!".

They have it wrong and you are correct! Fire your outsourced auditor for incompetence! Something this basic shouldn't even be a discussion for them...

 

[John Broomfield]

Sorry for pop up-ing this thread.

Today, during (outsourced) internal audit, I "learned" from an auditor that blank form is a record, and it has to be controlled within "control of records".

When I said that it's just a document like any other document in our IMS (manual, procedure, wi, ...), and that we control blank forms within "Document control", the auditor said: "No, no... it should be controlled withinh Record control!".

x-files,

You may need a new auditor unless he or she was talking about superseded forms.

As you say, blank forms start out as documents. Their design and format may be controlled (according to their importance to the success of your management system) to ensure the fields collect the required data.

Completed forms (more correctly, the content of completed forms) are, of course, records. And superseded forms are records.

An example of this is a database that is fed with data from users completing on screen forms. The screen form and the database are documents that are subject to revision control. The data themselves and the database at the time of storing the data are the records.

John

 

[qusys]

Sorry for pop up-ing this thread.

Today, during (outsourced) internal audit, I "learned" from an auditor that blank form is a record, and it has to be controlled within "control of records".

When I said that it's just a document like any other document in our IMS (manual, procedure, wi, ...), and that we control blank forms within "Document control", the auditor said: "No, no... it should be controlled withinh Record control!".

He is wrong..
A blank form to be compiled is clearly a mere "document", while when it is completed it becomes a "record" because there is reported what has been done and cannot be changed or modified.
Two different things...it could be useful to understand the dynamic of the audit and the eventual non conformity raised.