Document Identification Question

[CSullivan6]

Good Afternoon, This might be an oddball question, but I haven't really gotten a clear answer in researching so I thought I would ask here.

Process background: My corrective action system is part of a larger MS Access database and the entire database is revision controlled and changes well documented. This database is internal only, the supplier cannot log in and fill out things. So, if I issue a supplier CA, I fill out basic information and export the info into an MS Excel workbook template. The supplier fills out restricted cells with the required information and returns it to me with supporting evidence. Once I review and approve the workbook, I then import into the Access database.

The workbook contains various worksheets, including 8D, fishbone, and 5why.

The question is more geared to those that use an online corrective action system such as ETQ, Reliance, etc, and or a database I suppose. If the workbook is an integral part of the database process, does the workbook and or each worksheet in the workbook template require a form ID and revision number? Keep in mind, this is an output of the database and revisions to all parts of the database are controlled and documented. When a change is made, the entire database is up revved. The functionality of the export and import processes is dependent on the workbook remaining unchanged. Is the workbook considered a part of the database application or its own form?

Second question if the answer to the above question is yes: If I create and format a workbook on the fly... meaning I code it all into the database application, and document changes to the workbook the same manner, do I still need a form number?

Third question: if the answer to the first question is no. Can I identify the workbook noting if is a "part of the Quality DB?" I think it needs something to note it is controlled in the database.

I am probably WAY overthinking this, but the workbook template is NOT available in our standard forms library. It is only available through the application.
Opinions and past experiences are certainly welcome.

 

[Tagin]

ISO 9001 does not have a stated requirement for form ID and/or revision number.

As the structure and content of the form is presumably programmatically controlled, I see no need to assign it a form ID/rev. in the sense that it is controlled by other means.

That said, a formID can be a handy (and precise) way to reference the form in your procedures. So, for that purpose, I would assign it a form ID.

The revision seems to me only relevant with respect to any updates you make to the Access entry, not the structure of the workbook per se. If you have an exported workbook, how can you tell if it was exported before or after the changes were made? That to me is a reason to include some identifier - e.g., 'datetime_exported' as a field in the workbook which could be compared to the timestamp of the latest DB entry revision for comparison.

 

[CSullivan6]

ISO 9001 does not have a stated requirement for form ID and/or revision number.

Yes I am aware. It was general to quality management systems. Most places have form numbers, etc as part of their structure, we are no different.

As the structure and content of the form is presumably programmatically controlled, I see no need to assign it a form ID/rev. in the sense that it is controlled by other means.

This is where I have been leaning.

That said, a formID can be a handy (and precise) way to reference the form in your procedures. So, for that purpose, I would assign it a form ID.

I see what you mean, but this defeats the purpose of your previous answer. and is how I have been going in circles with this. I don't reference ANY form number, or revision in procedures as it gets to cumbersome to update. In this procedure, I simply say "problem solving workbook from the database."

The revision seems to me only relevant with respect to any updates you make to the Access entry, not the structure of the workbook per se. If you have an exported workbook, how can you tell if it was exported before or after the changes were made? That to me is a reason to include some identifier - e.g., 'datetime_exported' as a field in the workbook which could be compared to the timestamp of the latest DB entry revision for comparison.

I don't particularly care when it was exported because if changes are made, I check each cell name and match it to the applicable database field before importing and that prevents any issues from changes not being properly exported or imported. If that makes sense. if there isn't a match, the data doesn't get imported and the user is instructed to either manually enter or see the dba. It's all done in code.

In my reports, which are extracted from the database, I simply identify them as "Quality DB." That way an auditor knows where to look to find the information. They are not forms, or data entry, or records. Even though sometimes a partial report gets printed and a person may pencil in information to be entered into the database, it is not an official form/record. More like scratch paper. The records are all secure online. I am leaning toward adopting this schema for the workbook, but my dilemma is that the workbook is actually a tool and if needed can be kept as supporting evidence to show how a person arrived at a root cause. But.... the information in the actual record.... is pulled into the database.

 

[Tagin]

Yes I am aware. It was general to quality management systems. Most places have form numbers, etc as part of their structure, we are no different.


This is where I have been leaning.


I see what you mean, but this defeats the purpose of your previous answer. and is how I have been going in circles with this. I don't reference ANY form number, or revision in procedures as it gets to cumbersome to update. In this procedure, I simply say "problem solving workbook from the database."


I don't particularly care when it was exported because if changes are made, I check each cell name and match it to the applicable database field before importing and that prevents any issues from changes not being properly exported or imported. If that makes sense. if there isn't a match, the data doesn't get imported and the user is instructed to either manually enter or see the dba. It's all done in code.

In my reports, which are extracted from the database, I simply identify them as "Quality DB." That way an auditor knows where to look to find the information. They are not forms, or data entry, or records. Even though sometimes a report gets printed and a person may pencil in information to be entered into the database, it is not an official form/record. More like scratch paper. The records are all secure online. I am leaning toward adopting this schema for the workbook, but by dilemma is that the workbook is actually a tool and if needed can be kept as supporting evidence to show how a person arrived at a root cause. But.... the information in the actual record.... is pulled into the database.

Yes, I wanted to argue for both sides. But as you have shown, you have viable reasons to not label/rev control the form, yet still are able to demonstrate no impact to compliance for document control to an auditor.

 

[indubioush]

ISO 9001 only requires that you retain the appropriate documented information.
All requirements regarding documented information need to be followed.
Are the content (form fields) and structure of the database reviewed and approved for each revision? Is this review and approval documented? Has the database been validated? No need to have a form number if you say yes to those questions. The workbook is only a tool, not a record, which is found only in the database.
If I were auditing you, I would focus on how you control those records and document relevant info when a record is revised or amended--audit trails.

 

[CSullivan6]

Is the database structure reviewed? Is it approved? Yes. Changes are reviewed by me and approved or the revision does not get released. Is that documented? In the revision history. One could argue similarities when a purchased software has an update released by the company, two things happen.... one the company programmers have reviewed, tested, and approved changes or it wouldn't be released, and two, most companies will simply complete the update and use the software as it is released. Like any other software it is reviewed as it is used.

If I were auditing you, I would focus on how you control those records and document relevant info when a record is revised or amended--audit trails.

This is an easy one to answer. In any DB I have ever written as it relates to a QMS, contains an audit trail for every data entry form (whether its a record or not). So let's use my example of corrective actions. Once the record has been initially saved, all changes to that record are documented and recorded, along with date and time stamp, username, and what PC they were using. It doesn't matter if someone goes in and fixes one letter of a typo.... It's all recorded. Any changes to a record can be seen by entering that record and clicking a button to review an audit trail. Servers are backed up by IT. Do I pass this audit question?

 

[indubioush]

In any DB I have ever written as it relates to a QMS, contains an audit trail for every data entry form (whether its a record or not). So let's use my example of corrective actions. Once the record has been initially saved, all changes to that record are documented and recorded, along with date and time stamp, username, and what PC they were using. It doesn't matter if someone goes in and fixes one letter of a typo.... It's all recorded. Any changes to a record can be seen by entering that record and clicking a button to review an audit trail. Servers are backed up by IT. Do I pass this audit question?

Good job!
Does 21 CFR part 11 play any part in this?

 

[CSullivan6]

Does 21 CFR part 11 play any part in this?

No...

 

[indubioush]

Pretty sure you are good then.