Control of Records - Is a List of Records Required by ISO 9001?

[Pat McGhie]

Re: Control of Records!

Here's where you started to go south....Making a list of applicable records....That's a self inflicted wound

A different method could have been --- "Examples of records will be those required by the standard or those needed to demostrate conformity to our requirments such as......."

I've seen the above more than once....Here's the catch, it isn't foolproof nor is any other method. Why? Because some fool will always come along.

Thanks Randy.. That is part of what I suspected... we did a shot or two into our own foot with the pseudo listing after stating "All Required by the Standard"

I like your suggestion and it was something similar to that we were bouncing back and forth here....

Pat in NH

 

[Pat McGhie]

Re: Control of Records!

Regardless, it's a petty write-up. You don't need a list & the justification given is bogus based on what you have provided as an example of your procedure.

Thanks Jason! I will look over the suggestions here and attempt an easy way out of the writeup and then likely look for a more permanent fix fro the future (like a re-write of sections of the procedure...)

Pat in NH

 

[Pat McGhie]

Re: Control of Records!

I'm thinking it's more of an incomplete finding...

It should have been easy for the auditor to visit the maintenance department ask about what records they keep, where, how long etc to see if they had a consistent story...rather than simply issuing an arbitrary findings for a coupe of categories of records, which is now controversial...

Andy, he basically did all that... he visited maint, saw the records and how they are kept looked at the procedure (obviously more than what I quoted) which stated how they are ID'd, stored, how long etc.... He found nothing wrong with what we are doing, only that Maintenance was not on that "List" and controversial we are... In the long run, if I choose to re-do the procedure.. I may conceed and just add to the list for now to close this out.. Then I can take my time and attempt to do it in a better manner...

Pat in NH

Pat in NH

 

[Pat McGhie]

I would suggest you have a 8 column documented procedure for control of records. These columns may have the following titles.
The process
The type of record or record name (Ex: process validation records, purchase orders, etc)
How identified
How stored
How protected
Who retrieves
How long retained
How disposed
...so that across the organization there is a clear understanding and no contentions.
The processes listed can be the processes in your process and interaction mapping as in your quality manual.

Somashekar, thank you for both reply's... I have seen some done in the manner in which you describe... My only issue is agin, this then is a list. Should a record be found that is not on the list, we could get written up again.. How long should the list be??? I am really wanting to get away from a lost though the matrix you suggest has plenty of other merits regarding classes of records...

Pat in NH

 

[Pat McGhie]

Suitable control over records is required. A list is not.

The specific requirements for management of records are in 4.2.4, which you've already quoted.

I don't like the finding for a number of reasons, already pretty well commented upon by others. Pinging you for not specifically listing maintenance records is a bit petty, I think. But I'm also thinking you've made a rod for your own back with the list of records, which gives that kind of auditor always scope to say 'but you've left out X'.

By the same token, you do want to know what kinds of records you have and how you manage them.

Consider listing records by category, with some examples, rather than being quite so specific. Lord save me from those 'masterlists'. I'd put in an icon for 'keep them away from me' but it doesn't exist.

Jane, Thank you very much for the thoughtful and complete response. I think that may be the way we go in the future... Since we "opened" the door on this one, we may just add the 2 items to the List to close that CAR and audit.. then review and re-structure the entire procedure along the lines that you have suggested!

Pat in NH

 

[Pat McGhie]

Always on the lookout for a better way of doing things so I took up Somashekar's suggestion and came up with the attached.

A little rushed (my employers time) but I think I have covered most bases. One could add finance but as awe know they are a secret society.

Please review and comment.
thanks

KGott,

Thanks for the quick Matrix setup... your efforts are aprpeciated.

Pat in NH

 

[JaneB]

Since we "opened" the door on this one, we may just add the 2 items to the List to close that CAR and audit.. then review and re-structure the entire procedure along the lines that you have suggested!
Pat in NH

Sounds like a feasible plan.

That noise in the background you hear is me, by the way. Something along the lines of "Grumble, grumble, ruddy nitpitcky auditors, grumble, grumble... those types give 'audit' and 'quality' a bad name. Grumble, grumble. Surely there's more useful things to look at... etc "

 

[Pat McGhie]

Sounds like a feasible plan.

That noise in the background you hear is me, by the way. Something along the lines of "Grumble, grumble, ruddy nitpitcky auditors, grumble, grumble... those types give 'audit' and 'quality' a bad name. Grumble, grumble. Surely there's more useful things to look at... etc "

Jane, thanks for sharing "the noise in the background.." It made my morning as I agree so much with that!

Pat in NH

 

[ChrissieO]

Jane, thanks for sharing "the noise in the background.." It made my morning as I agree so much with that!

Pat in NH

We no longer keep a list of records or documents apart from the ones required for the QMS, (Manual, Policy, Required Procedures etc).

In an organisation the size of ours ( 3 Administrative Offices, 16 manufactng sites) , it would be an horrendous task. We however, have a good robust procedures at each site for document and record control , backed up by the corporate document retention policy.

We came a little unstuck, recently while submitting our AEO (Authorised Economic Operator) application with Her Majesties Revenue and Customs. They expected to see a full list of all documents for every department and site within the UK operation. In their auditing guidelines it says as per ISO9001:2008 4.2.3.& 4.2.4. I did point out that it was NOT a requirement of 9001 to have such lists and we hadn't done this since ISO9000:1994. They also couldn't grasp that we no longer have detailed work instructions/SOPs for every tidly little task.

While I admit they know what they are talking about when it comes to import and export matters and the requirements for CFSP (Customs Frontier Simplified Procedures) and auditing it, they do a 2 day training course for the requirements of the rest of AEO which is about 52 pages. I think their training documents/trainer must be prehistoric. Neither of the Auditors seemed to grasp the conception of Process auditing and didn't quite get the fact that tick box compliance auditing was a thing of the past in our company and were quite suprised to see our audit schedule (90% process audits) and not the listed requriements of the standard, also the same with our Quality Manual, she questiones why I hadn't listed every clause of 9001 and addressed it in the quality manual by clause!!!!!!

I did compromise and produced a list for all import and export documentation, she wasn’t that happy and was quite put out when I told her there was no way we would ever obtain this for our head office operation as they are not in scope of any of the standards and did not have such a thing.

I've got better things to do with my time, other than maintain lists of documents and expect internal auditors to troll through them Resources are tight these days and their's and mine and the other internal auditors time is better spent looking at broken processes and how to improve processes and ensuring that these processes meet the requirements within the process.

Chrissie

 

[JaneB]

Sounds like it's not just their trainers and training that's outdated

Yes, such stuff makes it 'easy' to audit in the sense of tick-the-box-yes/no stuff. It's harder - but infinitely more practical - to do the learning and thinking required to make a more robust system and - even more important in my view - a system that is practical and can keep up with a rapidly changing world.

... she questions why I hadn't listed every clause of 9001 and addressed it in the quality manual by clause!!!!!!

Sigh.

Resources are tight these days and their's and mine and the other internal auditors time is better spent looking at broken processes and how to improve processes and ensuring that these processes meet the requirements within the process.

Just so. Chrissie, you make, as you so often do, for a voice of good, practical and sound common business sense (not always that common alas!)