Employee Access to various Documents of our QMS System

[TJC1015]

I have a question about employee access to the QMS. We are currently implementing ISO 9001:2008 at a small manufacturer and though we are in two separate buildings, there is no network. The product we are using is meant to run on a network, but can also be purchased as a single user. The single user license is meant to give companies a platform on which to develop until the system is ready to be deployed thus saving the cost of a network version throughout the implementation and writing process.

There is some resistance to to putting in a network-perhaps over security concerns or the possibility of people accessing the internet. However, employee access to the manual seems to be a requirement of ISO. I suppose we can print it out, but that seems to defeat the purpose of having an electronic quality manual, not to mention creating a paperwork headache. Others insist that changes to procedures are so rare that it would not be a problem. But isn't a QMS supposed to be dynamic even if it is tracking only minor changes? Isn't continual improvement part of the equation? I thought a compromise position might be to post it on a workstation computer in each building as a PDF file and updating the PDF version as it changes, but the product that we have allows for any employee to access the system directly to suggest corrective actions. In electronic form, changes are automatic and there is no need to update multiple PC's. It is also easy to navigate and find exactly what you are looking for, whereas a PDF is just a big file that you would need to scroll through to find what you are seeking.

Any thoughts on how to make the case for deploying this the way it was meant to be?

 

[Randy]

Employee access to the manual is not a requirement and neither is access to any document that is not relevant to their personal/individual responsibilities and roles.

There is no such thing as right to know, there is only need to know.

 

[Helmut Jilling]

I have a question about employee access to the QMS. We are currently implementing ISO 9001:2008 at a small manufacturer and though we are in two separate buildings, there is no network. The product we are using is meant to run on a network, but can also be purchased as a single user. The single user license is meant to give companies a platform on which to develop until the system is ready to be deployed thus saving the cost of a network version throughout the implementation and writing process.

There is some resistance to to putting in a network-perhaps over security concerns or the possibility of people accessing the internet. However, employee access to the manual seems to be a requirement of ISO. I suppose we can print it out, but that seems to defeat the purpose of having an electronic quality manual, not to mention creating a paperwork headache. Others insist that changes to procedures are so rare that it would not be a problem. But isn't a QMS supposed to be dynamic even if it is tracking only minor changes? Isn't continual improvement part of the equation? I thought a compromise position might be to post it on a workstation computer in each building as a PDF file and updating the PDF version as it changes, but the product that we have allows for any employee to access the system directly to suggest corrective actions. In electronic form, changes are automatic and there is no need to update multiple PC's. It is also easy to navigate and find exactly what you are looking for, whereas a PDF is just a big file that you would need to scroll through to find what you are seeking.

Any thoughts on how to make the case for deploying this the way it was meant to be?

A decent IT person could probably set up a simple network to tie the two plants together. It does not have to access the internet, but even that should not be a security problem unless your documents are very sensitive. The cost of setting up a network would seem to be a bigger issue than the security aspect.

On the other hand, if your needs are not too complicated, maybe simply having read only PDF files would be a simpler solution than a formal database. Unlike Randy, I would be more comfortable if a copy of the manual were accessible. The standard does not specifically say that, but it does indicate that documents should be accessible were applicable.

But, I think you can come up with something that will get the job done. Give a little consideration to the ISO requirements. But, focus more on your needs, and meet that need. That is the intent. Don't make the system for your auditor.

 

[Jen Kirley]

Great responses so far.

Very often, process level employees have no need, and do not care to have access to, or read the Quality Manual. It is a high-level document. The QMS often contains many types of documents besides the QA Manual.

Employees do not need to have access to everything, they need to have access to what they need, when they need it and where they need it.

Other requirements, both of standards and good sense, robust management systems, generally state that the QMS documents/instructions are:

• Maintained up-to-date,
• Legible and identifiable,
• Employees can tell they are looking at the latest revision,
• Changes are identified during revisions,
• Changes are approved for adequacy before use, and
• Obsolete documents are somehow prevented from being used unintentionally.

None of this requires a network or internet/intranet. Many people use "hard copy" documents, though arguably with less overall success than document systems managed with computer. Sometimes people use flow charts or flip charts at their work stations. This is okay as long as they conform to the above listed requirements and are kept up-to-date, that is they match the overall or "parent" process document and Quality Manual.

I hope this helps!

 

[Wes Bucey]

I agree there is no requirement in the Standard for each and every employee to have access to the top level Quality Manual, but it is "nice to have."

I also agree the Standard only requires employees to have access to documents which are connected with meeting customer requirements for product or service and then only for the processes in which the employee is directly involved.

I further agree with Helmut there are multiple IT solutions to make any documents available to employees in two separate facilities without using the internet and a number of ways to do so using the internet, but still secured by a password system with each individual having a unique password, allowing an audit trail of who accessed a document and when. There are also a number of security systems which can grant each individual different rights on each document involving reading, printing, copying, editing, or deleting an existing document in the system, always under perpetual audit with the ability to retrieve any accidentally [or purposely] altered or deleted document in its original form.

I have discussed electronic document management systems a number of times over the past eight years here in the Cove. There are literally hundreds of consultants who do such IT work full time versus part-time like me. Perhaps the company budget could be stretched to hire one?

 

[Sardokar]

[*]Obsolete documents are somehow prevented from being used unintentionally

Question :

We put our procedures/forms on a shared network in the company

our employees are trained on how to recognise which is the latest version of a document (code on forms/procedure) , and old procedure/forms are Removed from the server and employees are told (by email) to use the new ones

However ,as per your quote , how can i absolutely prevent an employee to save a file on his desktop computer then forget to check if it is the latest one ,print it and hand it to other employees ?

Is the fact that other employees will DETECT that he filled the old version and ask him to fill the new one enough ??

please advise

 

[Bonhomme]

Interested as well.

Having a diffusion list people must sign whenever they're given a new version (and visual inspection of giving back/destroying the old one) works, but it's really lots of efforts.

 

[Sidney Vianna]

how can i absolutely prevent an employee to save a file on his desktop computer then forget to check if it is the latest one ,print it and hand it to other employees ?

It is impossible very difficult to make a cost effective 100% assured system, but you can make it difficult for people to have their own copies of documents, such as electronically blocking downloading of documents from the server to their local computers (which is the e-version of people making a copy of a document and stashing it in the drawer at their desk).

Discipline, via communication of the risks associated with the potential use of wrong versions of documents, is still the best route.

 

[TJC1015]

Thanks Randy. For some reason I was under the impression that access was part of the requirement.

 

[TJC1015]

Thanks Jennifer-that is helpful!