From paper to Electronic (records) in the QMS

[qualprod]

Hi everybody

I´m in the phase to migrate a QMS from paper based records to an ERP system,, all the procedures, forms,etc., are maintained in
PDF formats.
For the release of products, authorization of work orders, etc., we printout forms and on papers the approvals are handwritten signatures, then
such documents are scanned out and saved in the network.
The idea is that all records that currently are stored in scanned PDF be managed into the ERP with just applying approvals commands, with
check marks into the ERP.
When someone need to check an approval of something, just enters in a log file (text or graphic file) where
will appear name of operator, date , time and the activity.
All the requirements for records according to 7.5 are considered, (time retention, backup, etc.)
Question for all of you.
Will I face a problem, objection of an ISO, IAF , CB or some other standard for having all records in electronic
way? or are there some guidelines to do this?

Thanks in advance

 

[John Broomfield]

There’s a standard for that:

ISO 14641:2018

Provide the necessary training and equipment to continue making, filing, archiving and using the required records.

Check the indexing, retrievability and legibility of scans of hardcopy records.

The main long-term risk may be maintaining the ability to retrieve records given changes in combinations of hardware and software.

Of course, you’ll be completing your own risk assessment.

Please let us know how it goes.

 

[qualprod]

There’s a standard for that:

ISO 14641:2018

Provide the necessary training and equipment to continue making, filing, archiving and using the required records.

Check the indexing, retrievability and legibility of scans of hardcopy records.

The main long-term risk may be maintaining the ability to retrieve records given changes in combinations of hardware and software.

Of course, you’ll be completing your own risk assessment.

Please let us know how it goes.

Thanks, John
Maybe I was misunderstood.
My idea is to change the current approach, which is not to use signed papers anymore.
Current approach:
Now we use papers with signatures, then scanned out such records (evidences) and stored somewhere.
If need the evidence of something, just open the pdf file and see who did such approval, time,date, action, etc.
Future approach:
To enter into the ERP system, and apply approvals on screens (mouse clicks on boxes)
such actions will save such evidences in log files.
If need to have the evidence of such approvals, open into the ERP system such log file
and can be seen who did an action, date, time, etc.
I think at this level is enough in order to comply with the ISO standard which does not require signatures.
Although I could try to add the option to write with an electronic pen the signature into the application.
But I´m entering in other zone.......
When is it needed the electronic signature?.....

Please share your thoughts

 

[John Broomfield]

Sorry about that.

Three questions illustrate my concerns:

1. So, every user of the ERP system has their own log-in?
2. And the login credentials include each user's approval authorities?
3. And how long before the ERP system logs off a user for inactivity?

You may have more.

Bottom line, could unauthorized users change the status of draft, approved or superseded docs and what would be the consequences?

 

[Tagin]

think at this level is enough in order to comply with the ISO standard which does not require signatures.
Although I could try to add the option to write with an electronic pen the signature into the application.
But I´m entering in other zone.......
When is it needed the electronic signature?.....

Requirements for signatures would come from customers, or perhaps regulatory/statutory requirements. As you say, ISO 9001 does not require signatures.

We scan in filled-out forms and save them as PDFs in the ERP system, and we use ERP log files as records of approvals within the ERP system; we've never had a problem with an ISO auditor.

 

[qualprod]

Sorry about that.

Three questions illustrate my concerns:

My question in italic blue

1. So, every user of the ERP system has their own log-in?
Yes, and each user has its own profile, according the authorities and responsibilities

2. And the login credentials include each user's approval authorities?
YES

3. And how long before the ERP system logs off a user for inactivity?
After 15 minutes of inactivity, the system logs off the user.

You may have more.

Bottom line, could unauthorized users change the status of draft, approved or superseded docs and what would be the consequences?

No, because only authorized users can change status of documents.
Although this is not my case, because now I´m focused in my ERP system, and what you mention would apply to change procedures
of a QMS, which is planned to be migrated in short to a software App.
In here, I have to take care of this issue.
Clearing up, my original question, is the way to change my paper signed ISO records to be included in my ERP.
Now my QMS is still manual/electronic, we manage all the QMS in electronic format (say in PDF in the network)
but the management is still manual.
Hope is clear

 

[qualprod]

Requirements for signatures would come from customers, or perhaps regulatory/statutory requirements. As you say, ISO 9001 does not require signatures.

We scan in filled-out forms and save them as PDFs in the ERP system, and we use ERP log files as records of approvals within the ERP system; we've never had a problem with an ISO auditor.

Thanks Tagin
2 comments.
1- Why the filled-out forms, are not filled-out into the ERP system?, imagine the form in the screen and just using the mouse or maybe a barcode scanner to input data in the electronic form fields? because I suppose currently you fill out forms by hand.
2- In order to keep evidences of actions, log files are very usual.
Regards

 

[Tagin]

Thanks Tagin
2 comments.
1- Why the filled-out forms, are not filled-out into the ERP system?, imagine the form in the screen and just using the mouse or maybe a barcode scanner to input data in the electronic form fields? because I suppose currently you fill out forms by hand.
2- In order to keep evidences of actions, log files are very usual.
Regards

Forms: 1) customer requirements for handwritten signatures on some of those forms, 2) creating a form in our ERP is not possible, 3) not all locations have a device that would be easy to fill out forms electronically.

 

[qualprod]

Forms: 1) customer requirements for handwritten signatures on some of those forms, 2) creating a form in our ERP is not possible, 3) not all locations have a device that would be easy to fill out forms electronically.

Thanks Tagin

One more last opinion.
In your point of view or other cove members.
In what do you trust more?
1 A log file, simple text, how to be sure that person mentioned in the file, is really who approved the document?
2 In a signed paper by hand, how to be sure that person name who signed the form, really is the mentioned.
It is clear that for these cases the two ways are enough for some purposes (ISO systems or customer requirement)
When that is not enough, well, we have to go with fingerprints face reader,etc.
Are you agree?
What do you have to say about the two options?

Thanks