Document Control - Need to control EVERYTHING?

[Wes Bucey]

I believe that the OP no doubt believes that he is controlling all his forms. It appears that the auditor believes that he did not recognize and thusly did not control some of them. Without seeing the actual situation I cannot answer with full certainty, but it appears highly likely that this is the case. The OP simply missed some.

At least some of the things listed appear to be BOTH documents and records. As docments, the template or form must be controlled. The data collected on them are records and need to be controlled as records. The blank form probably needs to be on the Master List of Documents, or however their procedures says they control documents. The populated or completed forms must be controlled as records, and again within whatever their procedeures says, properly filed so they are retreivable and are protected and stored according to whatever retention times are specified.

May I emphasize that some things are BOTH documents and records.

I think the point some of us with a "slightly" opposing view to yours would like to see is a SPECIFIC instance of lack of control, rather than some generic phrase "not controlled." The lack of specificity may be the single biggest bone of contention any of us have. I alluded to this in my post earlier when I wrote

Before running to the appeal process (not a bad suggestion by Sidney), I'd like to know the basis for the auditor claiming a nonconformance. There is a very slim possibility he noticed something about regulations or customer contracts which previous auditors did not.

Not controlled how? Which of my laundry list or the one you cite from the Standard was absent or violated in some way? One item? All items pertaining to "control"? Auditors cannot be vague. They MUST be specific, pointing to an actual nonconformance on a document or group of documents or citing a specific lapse in the SYSTEM which carries to ALL documents. I think you agree that ALL documents in any organization are not necessarily accessible to ALL employees, visitors, customers, or suppliers. To my knowledge, the only outsiders who have that access are regulators, usually armed with a warrant or the power of a regulation.

 

[Big Jim]

I think the point some of us with a "slightly" opposing view to yours would like to see is a SPECIFIC instance of lack of control, rather than some generic phrase "not controlled." The lack of specificity may be the single biggest bone of contention any of us have. I alluded to this in my post earlier when I wrote

Not controlled how? Which of my laundry list or the one you cite from the Standard was absent or violated in some way? One item? All items pertaining to "control"? Auditors cannot be vague. They MUST be specific, pointing to an actual nonconformance on a document or group of documents or citing a specific lapse in the SYSTEM which carries to ALL documents. I think you agree that ALL documents in any organization are not necessarily accessible to ALL employees, visitors, customers, or suppliers. To my knowledge, the only outsiders who have that access are regulators, usually armed with a warrant or the power of a regulation.

Perhaps the OP can provide more details. It is pointless to try to point out all the potentials. The OP and the auditor were on site. We are not. It is a shame that the two of them did not come to a better understanding before the auditor left. Personally, I try very hard not to let that happen.

 

[Sidney Vianna]

This thread exemplifies very well my long term belief that people who come here to PROVIDE ADVICE AND ANSWER QUESTIONS IN SOME AUTHORITATIVE FASHION should fully disclose who they are and their professional affiliation(s). So, posters know where each consultant, advisor, auditor, etc. stand on the issues and avoid engaging with professionals they have a strong disagreement with.

Just my opinion.

 

[Big Jim]

This thread exemplifies very well my long term belief that people who come here to PROVIDE ADVICE AND ANSWER QUESTIONS IN SOME AUTHORITATIVE FASHION should fully disclose who they are and their professional affiliation(s). So, posters know where each consultant, advisor, auditor, etc. stand on the issues and avoid engaging with professionals they have a strong disagreement with.

Just my opinion.

So those of us that wish to remain anonymous shouldn't participate? I don't think so. My responses are solid enough to stand on their own without any credentials attached.

The credentials that matter here are those of the ISO 9001:2008 standard.

 

[Sidney Vianna]

The credentials that matter here are those of the ISO 9001:2008 standard.

ISO 9001 does not interpret itself, does not consult nor audits. People do. As exemplified in this thread, organizations and people suffer the consequences of incompetence, lack of knowledge and (dare I say?) stupidity.

If I stand by my positions, I have no problem making my identity and affiliation public.

There are good reasons to remain anonymous in communities such as this, if you are concerned that exposing certain beliefs can hurt you, professionally; but, if I stand by the soundness of what I post, I see no reason for me to hide who I am.

Once again, just my opinion.

 

[Big Jim]

ISO 9001 does not interpret itself, does not consult nor audits. People do. As exemplified in this thread, organizations and people suffer the consequences of incompetence, lack of knowledge and (dare I say?) stupidity.

If I stand by my positions, I have no problem making my identity and affiliation public.

There are good reasons to remain anonymous in communities such as this, if you are concerned that exposing certain beliefs can hurt you, professionally; but, if I stand by the soundness of what I post, I see no reason for me to hide who I am.

Once again, just my opinion.

People also forget to read the standard or go off into left field about what it means. Where the standard is clear it needs no intrepretation. Much of the time I step in is where it is painfully obvious that people are moving away from the core of the standard.

 

[Jim Wynne]

People also forget to read the standard or go off into left field about what it means. Where the standard is clear it needs no intrepretation.

Where the standard is clear to you it needs no interpretation, but if this whole place is indicative of anything, it's that interpretation often changes with vantage points.

Much of the time I step in is where it is painfully obvious that people are moving away from the core of the standard.

You would be hard-pressed to find a certified company anywhere on earth that hasn't, in one way or another, moved away from the intent of the standard.

In the present case, we can't see what the auditor saw, and can only guess as to what the problem might be. Nonetheless, there's significant evidence that the auditor is conflating control of documents with control of records, and there's also (as I suggested in an earlier post) a widespread misbegotten belief that all forms must be controlled.

The problem is that too few people (including many who complain that the intent of the standard is being abused) are concerned with what actually happens day-to-day, and are more concerned with satisfying their own pedantic, legalistic impulses. If there's a feeling that some form of control is missing, the sensible thing is to try to understand the implications of control (or lack thereof) in a given situation, and resist urges to enforce mandates that serve no useful purpose.

 

[Stijloor]

Friends,

I always emphasize to my Clients that their very first concern must be about what's good for the Customer and the organization; then, only then look at the Standard.

In an effort from ISO/TC 176 to make the Standard more inclusive and generic; its interpretation has become more challenging.

Witness this thread and other posts every day...

Stijloor.

 

[Sidney Vianna]

The problem is that too few people (including many who complain that the intent of the standard is being abused) are concerned with what actually happens day-to-day, and are more concerned with satisfying their own pedantic, legalistic impulses. If there's a feeling that some form of control is missing, the sensible thing is to try to understand the implications of control (or lack thereof) in a given situation, and resist urges to enforce mandates that serve no useful purpose.

 

[Wes Bucey]

Where the standard is clear to you it needs no interpretation, but if this whole place is indicative of anything, it's that interpretation often changes with vantage points.



You would be hard-pressed to find a certified company anywhere on earth that hasn't, in one way or another, moved away from the intent of the standard.

In the present case, we can't see what the auditor saw, and can only guess as to what the problem might be. Nonetheless, there's significant evidence that the auditor is conflating control of documents with control of records, and there's also (as I suggested in an earlier post) a widespread misbegotten belief that all forms must be controlled.

The problem is that too few people (including many who complain that the intent of the standard is being abused) are concerned with what actually happens day-to-day, and are more concerned with satisfying their own pedantic, legalistic impulses. If there's a feeling that some form of control is missing, the sensible thing is to try to understand the implications of control (or lack thereof) in a given situation, and resist urges to enforce mandates that serve no useful purpose.

Friends,

I always emphasize to my Clients that their very first concern must be about what's good for the Customer and the organization; then, only then look at the Standard.

In an effort from ISO/TC 176 to make the Standard more inclusive and generic; its interpretation has become more challenging.

Witness this thread and other posts every day...

Stijloor.

For approximately 25 years (since the intrusion of ISO's 1994 edition), I have been "soapboxing" against the Kwality Kop (KK) mentality which was and continues to be so prevalent, almost always preceded by some variation of "ISO says . . ." while then going on to invent some spurious interpretation of the Standard to justify that KK's misunderstanding of a key point in ALL the QMS Standards - they are meant to help organizations be efficient and effective, NOT saddle them with minutiae and bottlenecks and funnel points to keep some corporate satrap in power.

Witness this excerpt from my ASQ Profile, posted in 1992:

I believe an effective Quality Management System (QMS) is a profit center, NOT a "cost item."

My entire career has been centered on the concept "Quality should be involved in every aspect of a company - including executive planning, administration, marketing, purchasing, design, production, shipping, and service."

This concept holds true whether the company is a manufacturer or service company (banking, insurance, communications, transportation, construction, janitorial, etc.) The major emphasis is on pleasing or delighting the customer while maintaining or increasing organizational profitability. (In the case of non-profits, does the organization's performance delight both recipients and the contributors? If so, the organization will continue to thrive.)

I put more emphasis on "big picture" and "company culture" than on metrics. If all the members of the organization are indeed working together, metrics are a natural function of identifying areas to improve. If the organization is NOT working together, the imposition of metrics can be draconian and serve to divide the culture even more.
​

[Emphasis in bold blue added] The point being metrics are important in looking for ways to implement continual improvement. Too often, I see organizations which use metrics as "gotcha" weapons or worse, merely collecting metrics as a delaying tactic instead of making a bold move forward, meanwhile falling further and further behind the vanguard of change.

Just as meaningless metrics can bog down a system, so, too, can the imposition of unnecessary "controls" implemented more to demonstrate one person's or one department's power and "control" over another than as a meaningful addition to the efficiency or profitability of the organization.

Jim Wynne has capsulized this with the phrase:
more concerned with satisfying their own pedantic, legalistic impulses

Yes. Kudos, indeed.