Documentation Out of Control - What classifies as a Controlled Document?


Andy Bassett

I have just started on the Documentation clear-up for a company preparing for ISO. This subject is new to them, and after a three hour meeting we did not reach a consensus. They really taxed my patience and to be honest knoweledge with some of their questions.

Im not sure if they genuinely have a complex company, or if they are making it more complex than necessary. A couple of phone calls during the meeting to our planned Certification Body did not help the situation, they managed to persuade my client that a Customer Order is a Quality Record instead of a Document. Who's going mad here, me or them?

Here are a sample of some of the issues.

1. What classifies as a document? If you take the definition 'anything that has the potential to impinge on the quality of the product' this CAN be absolutely anything from Delivery Notes to Personnel Holiday Requests.

2. Why differentiate between a Document and a Quality Record?, basically they have to be handled in the same way.

3. Does it make sense to vary the retention age from document to document? Is it not simply easier to set one age, say 12 years for all documents.

4. Nowadays most documents seem to start life as a Mask before becoming a Document and then maybe eventually a Quality Record. A confusion exists about displaying the revision status for the Mask itself and for the content. Currently the mask status is stated in the middle at the bottom of the sheet, and the content status is diplayed at the top. Employees do not understand the difference.

6. The whole issues seems unmanageable, alone the task of trying to maintain a Master List for external supplied documents appears to be a job for a full-time person. External documents of varying importance are scattered all over the company.

7. E Mails are merrily going back and forwards to all and sundry without any form of control. I cannot honestly say that this is a problem.

8. This company is essentially a prototype company operating between 6 and 11 projects simultaneously. They have over 400 templates/masks, i dread the thought of trying to create and maintain a Master List. In this instance i see no way round it. How else could you show who for example is responsible to approve certain types of documents?

Any insights would be gratefully accepted, possibly most helpful would be suggestions as to the general approach to documentation clean-ups.

I started by laying out a matrix that lists across the top the issues that have to be covered ie Creation, Checking, Release, Rework, Distribution, Availability and Archiving. Along the left-hand side i tried to list the GENERAL type of documents. The feeling is that there are so many different types and uses of documents, it is impossible to set up any general rules.

At the moment its looking like a 10 page Matrix is the only solution.


Andy B


Here's the official line on documents:

From ISO 9001:2000 FDIS

"4.2.3 Control of documents

Documents required by the quality management system shall be controlled. Quality records are a special type of document and shall be controlled according to the requirements given in 4.2.4."

ISO 9000:2000 FDIS

"2.7.2 Types of document used in quality management systems

The following types of document are used in quality management systems:

a) documents that provide consistent information, both internally and externally, about the organization's quality management system; such documents are referred to as quality manuals;
b) documents that describe how the quality management system is applied to a specific product, project or contract; such documents are referred to as quality plans;
c) documents stating requirements; such documents are referred to as specifications;
d) documents stating recommendations or suggestions; such documents are referred to as guidelines;
e) documents that provide information about how to perform activities and processes consistently; such documents can include documented procedures, work instructions and drawings;
f) documents that provide objective evidence of activities performed or results achieved; such documents are referred to as records."

I have used a basic differentiation as follows:

A document is anything (procedure, specification, form) you need to fulfill a work order.
A quality record is anything that provides evidence of how a work order was fulfilled.
Example: a blank form is required for use. It is controlled under document control requirements. A completed form is a quality record and is controlled under those requirements.

I'm not sure I understand the structure of your client organization. Your comments about the multiple projects leads me to offer a potential approach. If the documents can be segregated against the projects, you might consider several mini document control mechanisms linked to a company wide document control mechanism. One simple way to accomplish is thru an intranet. Each project maintains its own control process and master list electronically (the control process can be identical across projects - you just have multiple document handlers). At the company level, you hyper-link your document control to the individual projects and monitor the mini control areas. In this way you have decentralized control and centralized monitoring.
This approach was used by the North Carolina Department of Labor in managing document control of 19 divisions offering services under 17 industrial classification codes. Hope this helps - or at least sparks some ideas.


Alf Gulford

I'd like to reply to just one of your questions.

#3 asks about retention times. Presumably, you aren't faced with the medical device considerations that I am, but even so a company might want to define different periods just because of space requirements. We are required to keep our (4.16) Quality Records for several years. Even if we weren't, it makes good business sense; this is how we can prove we final-tested the product before it went out the door (e.g.; prove in court).

On the other hand, most in-process records are only kept for three months. This allows us to look back and see what happened if there's a problem with recent parts/sub-assemblies that needs to be corrected or quantified and allows us to see who may need some additional training. If we were to keep these records for the same amount of time as the 'Quality Records,' we'd need several more buildings just for storage.

I'd say to categorize the documents and set retention times that make sense for legal and business reasons.

Good luck on this project.



One question, I've always understood that employee training records remain as long as the employee does. Does anyone regularly turn out old training records for current employees?

Training records are quality records, but I've always seen them as having flexible retention times based on employee retention.


Alf Gulford

Agreed. Training records are a very important exception to my very general statements. Others might be Equipment Maintenance records, Design Project Folders and probably more that I didn't think of.

Thanks for the reminder.


Andy Bassett

Thanks for your comments Curtis, they have indeed sparked some thoughts. Your differentiation between a Document and a Record would echo my onw thoughts, (where do you place a Customer Order in this case).

Your listing of the different types of documents seems to indicate that a Record is one of only 5/6 types of documents, i must admit that this thinking is new to me, and i wander why so much emphasis is placed on just the records side of documents.

I will think about the Intranet Solution, my inital thoughts are that they are not developed far enough to implement and maintain such a solution, the last attempt at Hyperlinking, from a parts list to digital photos ended in disaster.


Andy B



Imho, a customer order becomes a record immediately upon receipt.

It is also an instruction and should be protected as such for as long as it is used in fulfilling the order. If the organization transfers the requirements to its own internal document and uses this new document for the production process, then the customer order is no longer an instruction.

Please note that the list I sent you was a direct quote from the final draft of ISO 9000.

Good luck with the structural design work!



Fully vaccinated are you?
In regard to the original post, the following may help simplify things: - Look for Doc_Matrix.pdf

If you look under 4.1 you will see Management Review Form (Original) - a 'controlled document' (a form, but none the less a controlled document). Next you will see (in RED) Management Review Form (post meeting) as a quality record. Same document - just one is used (evidence is entered).

The fact that controlled documents and quality records are 'handled the same way' doesn't say anything. You can say every quality record is a controlled document but you cannot say every controlled document is a quality record. Quality records are typically nothing more than completed (used) forms. Forms must be controlled so - the forms are conmtrolled documents.

Controlled FORM -----data added----> Quality Record

There is no retention time requirement for controlled documents. You just have to be able to show history of at least 1 revision. Quality records must have defined retention times. You vary times if you see a need to in your specific situation. Or you can blanket with 12 years. I have seen small companies 40 years old which have all records - they throw nothing away.

My quality records retention requirements comments are based on ISO 9001, not FDA which has specific requirements for certain quality records as was pointed out in an earlier post.

If you're contemplating a single master list -- think again. There is no requirement for a master listing. It is an option. You can choose alturnatives. A directory listing (or listings of multiple directories) can also serve as 'master lists' either for the company or by department. Don't over complicate the issue in your mind.

E-mail may be more of a 'problem' than you realize. Many do in fact have significant content. I would look closely at e-mail control.

> 4. Nowadays most documents seem to start life as a Mask before
> becoming a Document...

By mask do you mean template?

> ...6. The whole issues seems unmanageable,...

As does life at times.

> ...alone the task of trying to maintain a Master List for external
> supplied documents appears to be a job for a full-time person.

This may in fact prove to be a resource issue for you.

[This message has been edited by Marc Smith (edited 12 October 2000).]


Fully vaccinated are you?
Originally posted by Andy Bassett:

...i wonder why so much emphasis is placed on just the records side of documents.
Because they are E-V-I-D-E-N-C-E.

Andy Bassett

And the story roles on after another one and a half hour meeting. Just a few of the giblets.

My client has understood that when creating EDP Documentation it should be done in such a way that prevents the content from being changed and saved with the same name.

Fair comment, but the QC person jumped out of the seat to protest that this is over the top, it would mean renaming her QC Statistic Database 10 times per day.

I told her that this is not the case, that a database can retain its saved name, so long as it can be seen inside the Database when info was added. Not so, says the client, it should be PHYSICALLY IMPOSSIBLE for anyone to change the contents of the database, without being forced to change the file name.

I guess that this will also apply to a lot of other databases ie None-Conformance Databases, Parts Lists etc.

Any comments.


Andy B
Top Bottom