ISO 9001, Fourth edition, 2008-11-15 - Do I have the most current standard?

[sjd1201]

Hi, folks. I'm new around here. After 20+ years of technical writing for startup software companies, I I have now been tasked with setting up a Doc Control system and helping to move the company toward ISO 9001 certification.

We are in the very early stages of setting up doc control. We might have 20 docs currently under control.

One of our customers has audited us, even though we are not certified, and I now must respond to their comments. They dinged us on an item that they attribute to ISO 9001, 4.2.3 (...defining retention and storage periods for documents...). I don't see anything in that section about retention and storage periods.

I am reading ISO 9001, Fourth edition, 2008-11-15. Is this the most current standard?

Sally

 

[Colin]

Re: Do I have the most current standard?

Yes, the current version of ISO 9001 is the 2008 issue. It sounds like your auditor has got his/her clauses confused. 4.2.3 is all about having properly authorised documents at the right place and making sure they are legible, etc.

Records are what we keep to demonstrate what happened and as such, they need to be retrievable, etc. This is addressed in clause 4.2.4.

 

[mguilbert]

Re: Do I have the most current standard?

Yes, you have the most current revision.

Check Clause 4.2.4 Paragraph 2 "The organization shall establish a documented procedure to define the controls needed for the identification, storage, protection, retrieval, retention and disposition of records.

 

[sjd1201]

Re: Do I have the most current standard?

They have a separate ding for retention of records, which they correctly attributed to 4.2.4. However, about 4 out of 12 of their items I see no basis for in the doc I have. It made me wonder if I had the right doc.

Thank you for the quick response. I'm SURE I'll be back again.

Sally

 

[Colin]

Don't be afraid to ask the auditor for clarification. You will notice a question asked regularly on this forum which is - 'where does it say that in the standard?'

 

[howste]

Re: Do I have the most current standard?

They have a separate ding for retention of records, which they correctly attributed to 4.2.4. However, about 4 out of 12 of their items I see no basis for in the doc I have. It made me wonder if I had the right doc.

Thank you for the quick response. I'm SURE I'll be back again.

Sally

Hi Sally, welcome to the Cove forums.

I agree with Colin. Without a requirement, there is no nonconformity. Ask them, tactfully of course, to show you where the standard requires what they're asking for.

If you'd like you can post the "dings" here and we can help to interpret them in the context of ISO 9001.


By the way, you didn't mention what industry you're in other than software. FYI, the ISO 13485 standard, which is based on ISO 9001 but is for medical device manufacturers does add this in 4.2.3:

The organization shall define the period for which at least one copy of obsolete controlled documents shall be retained.

 

[qusys]

Re: Do I have the most current standard?

They have a separate ding for retention of records, which they correctly attributed to 4.2.4. However, about 4 out of 12 of their items I see no basis for in the doc I have. It made me wonder if I had the right doc.

Thank you for the quick response. I'm SURE I'll be back again.

Sally

Only a suggestion.
Consider that the standard does not say how to do , I mean to have a process in place or an activity.It is up to the organization the setting of how to proceed to meet the requirement.
ISO 9001 requests for six mandatory documented procedures ( Document control, record control, control of non conforming product, corrective actions, preventive actions, internal audit) , eventual other procedure could be determined by the organization to manage its own Quality Management System processes.
hope this helps

 

[AndyN]

The thought occurs to me that this situation looks like the 'end result' (or auditees' view of audits) where the auditor came here to ask about checklist questions for auditing a supplier, without knowing what the requirements really mean or have no knowledge of how to audit etc....