External Document Control

[Crodge]

How do I need to show that our externally generated documents are controlled? We are a high-level aviation security company and the documents in question include highly confidential directives from various agencies. These directives are passed on to us via airlines and then disseminated amongst the relevant members of staff by the GM. None of these documents can be shown to auditors, how should we control them??? Any ideas will be gratefully received.
Thanks in advance..

 

[Claes Gefvenberg]

Hello Crodge, and welcome to the Cove.

We discussed something similar recently, in the thread Defining Customer Property.

Anyway, besides document control, you also need to consider clause 7.5.4, Customer property. (In this case intellectual property - business secrets).

Concerning the documents: Having a procedure for how to handle secret information does not necessarily mean that you have to let the auditors see the concerned documents. You will however have to convince them that you control them...

/Claes

 

[ccochran]

External docs

Crodge,

Howdy. Strictly speaking, the only things you must do with external documents is identify them and control their distribution. This comes directly from 4.2.3-f. The other requirements of document control do not apply (unless you want them to apply).

To identify them, you could simply list them on some kind of master listing. To control their distribution, you could also indicate where copies of these are been distributed. If you're going to set up a master list, I would also indicate the revision level/date of the external document, just as an additional control measure.

It's worth noting that this is the only place in 4.2.3 where it requires you to control distribution. The reality is, however, that if you have hardcopy internal documents, distribution control is a very good idea. Not a requirement, but a *very* good idea.

For more information on document control from my perspective, check this article of mine from Quality Digest (June 2002): https://www.qualitydigest.com/june02/html/doccontrol.html. I'd enjoy hearing your feedback on it, positive or negative, after you've had a chance to give it a look. And, of course, feedback is welcome from everybody else, too.

Talk to you soon,
CC

~~~~~~~~~~~~~~~~~~~~~~~~~
Craig Cochran
Economic Development Institute
Georgia Institute of Technology
craig.cochran@edi.gatech.edu