Procedures Required by ISO 9001:2008

[Antonio Vieira]

Re: ISO 9001:2008 Required Procedures

The best way is to write all the procedures you need (and of course those 6 areas required by ISO 9001). In time you’ll see those that are superfluous or not.

 

[snappy]

Re: ISO 9001:2008 Required Procedures

Hi,

I found this info under a very old post about 9001:2000. Can someone please tell me if these are still valid for 2008?

Note: there are only six "required" procedures:

* Document Control (clause 5.5.6)?
* Control of Quality Records (clause 5.5.7)?
* Internal Audit (clause 8.2.2)?
* Control of Nonconformity (clause 8.3)?
* Corrective Action (clause 8.5.2)?
* Preventive Action (clause 8.5.3)?

If/as appropriate, procedures may also be "needed" for:

* Planning (5.4, 7.1, 8.1, 8.5.1)
* Communications (5.5.4)
* Management Review (5.6)
* Resource Management (6)
* Training (6.2.2)
* Customer Processes (7.2)
* Design and Development (7.3)
* Purchasing(7.4)
* Operations Control (7.5.1)
* Product ID/Traceability ( 7.5.2)
* Customer Property (7.5.3)
* Preservation of Product (7.5.4)
* Validation of Processes (7.5.5)
* Process Measurement/Monitoring (8.2.3)
* Product Measurement/Monitoring (8.2.4)
* Analysis/ Improvement (8.4, 8.5)

Thanks!
Deb

While six procedures are required of the 2000/2008, this does not mean that six separate documents are required. "Documented procedures" means that it is documented in QMS procedures somewhere.

In 1994, many thought that 20 procedures were required of the standard. This was not true, in fact it illustrates an element-by-element approach--which is a bad idea from the perspective of quality assurance.

Now that the 2000/2008 standard explicitly requires six procedures, many think that six is the clever/magic number of procedures. Same mistake.

The number of procedures depends upon how many processes are in operation that impact quality. Don't confuse activities with processes here, and you'll be okay. (Focus on major processes--processes at their highest level, maybe.)

A procedure simply describes how a process is carried out. If you have a process, you have a procedure. The standard does not, and never has, identified companies' "quality system processes" (with the exception of the required support processes). So the number of procedures (beyond the required six) depends on the organization--not upon the standard.

Don't write procedures to address the requirements you sited, write procedures to describe the processes. Then review them to make sure that conformity to the sited requirements is clear, as applicable.

 

[AndyN]

Re: ISO 9001:2008 Required Procedures

Why are procedures required? Can't an organization rely on spoken process descriptions? Even the ISO audit working group recognize undocumented processes exist...

 

[JaneB]

Re: ISO 9001:2008 Required Procedures

Snappy,
I thought most of your advice was sound, but I'm completely in agreement with Andy that processes can very definitely exist without a procedure.

An example: many of my clients at the smaller end of the spectrum don't have any written procedure for purchasing. Yes, there's a process. But no, they do not have a procedure and they do not need one.

I disagree with you when you say:

The number of procedures depends upon how many processes are in operation that impact quality.

and particularly:

If you have a process, you have a procedure.

Totally agree with you that the number of procedures (or flowcharts/ maps/ instructions/whatever) is up to the organisation. But there is not a 1:1 relationship between processes and procedures.

Processes can exist without any procedure whatsoever. See, for example, 4.2.1c) which refers to the need to determine 'criteria and methods' to ensure effectiveness of processes. If they meant 'you must have at least one documented procedure per process', it would have been stated explicitly. It wasn't and isn't.

 

[Jim Wynne]

Re: ISO 9001:2008 Required Procedures

While six procedures are required of the 2000/2008, this does not mean that six separate documents are required. "Documented procedures" means that it is documented in QMS procedures somewhere.

In 1994, many thought that 20 procedures were required of the standard. This was not true, in fact it illustrates an element-by-element approach--which is a bad idea from the perspective of quality assurance.

Now that the 2000/2008 standard explicitly requires six procedures, many think that six is the clever/magic number of procedures. Same mistake.

The number of procedures depends upon how many processes are in operation that impact quality. Don't confuse activities with processes here, and you'll be okay. (Focus on major processes--processes at their highest level, maybe.)

A procedure simply describes how a process is carried out. If you have a process, you have a procedure. The standard does not, and never has, identified companies' "quality system processes" (with the exception of the required support processes). So the number of procedures (beyond the required six) depends on the organization--not upon the standard.

Don't write procedures to address the requirements you sited, write procedures to describe the processes. Then review them to make sure that conformity to the sited requirements is clear, as applicable.

Why are procedures required? Can't an organization rely on spoken process descriptions? Even the ISO audit working group recognize undocumented processes exist...

Snappy,
I thought most of your advice was sound, but I'm completely in agreement with Andy that processes can very definitely exist without a procedure.

An example: many of my clients at the smaller end of the spectrum don't have any written procedure for purchasing. Yes, there's a process. But no, they do not have a procedure and they do not need one.

I disagree with you when you say:


and particularly:


Totally agree with you that the number of procedures (or flowcharts/ maps/ instructions/whatever) is up to the organisation. But there is not a 1:1 relationship between processes and procedures.

Processes can exist without any procedure whatsoever. See, for example, 4.2.1c) which refers to the need to determine 'criteria and methods' to ensure effectiveness of processes. If they meant 'you must have at least one documented procedure per process', it would have been stated explicitly. It wasn't and isn't.

There is a lot unclear thinking when it comes to "procedure" and "process" and part of it is due to the standard, I think. ISO 9001 refers to "documented procedures" which is either a redundancy or intended to differentiate between documents and procedures. In other words, the way the standard is worded, "procedure" and "process" are synonymous, and the question is whether or not a document is needed in a given situation.

Documents should exist when there's a useful purpose for their existence. If a document can be eliminated without losing something, it should almost always be eliminated, or not written to begin with.

 

[treesei]

Re: ISO 9001:2008 Required Procedures

ISO 9001 refers to "documented procedures" which is either a redundancy or intended to differentiate between documents and procedures. In other words, the way the standard is worded, "procedure" and "process" are synonymous, and the question is whether or not a document is needed in a given situation.

.

Jim hit the point.

The definition of "procedure" by Webster,

https://www.merriam-webster.com/dictionary/procedure

implies that a procedure may not be in written form. Therefore, when there is a process, there is a procedure that tells one how to implement the process. This procedure may not be in written form unless the ISO requires so or the company wants to. There are pros and cons for each written procedure NOT required. It is the company's call to reach the optimal balance.

 

[snappy]

Re: ISO 9001:2008 Required Procedures

Snappy,
I thought most of your advice was sound, but I'm completely in agreement with Andy that processes can very definitely exist without a procedure.

An example: many of my clients at the smaller end of the spectrum don't have any written procedure for purchasing. Yes, there's a process. But no, they do not have a procedure and they do not need one.

I disagree with you when you say:


and particularly:


Totally agree with you that the number of procedures (or flowcharts/ maps/ instructions/whatever) is up to the organisation. But there is not a 1:1 relationship between processes and procedures.

Processes can exist without any procedure whatsoever. See, for example, 4.2.1c) which refers to the need to determine 'criteria and methods' to ensure effectiveness of processes. If they meant 'you must have at least one documented procedure per process', it would have been stated explicitly. It wasn't and isn't.

The purpose of a procedure is to describe how a process is carried out--to ensure that process performance is carried out as required. If there is no specified way to perform a process, then there is no procedure. If there is a proper way to perform the process, there is a procedure--whether it is documented or not.

 

[Sidney Vianna]

Re: ISO 9001:2008 Required Procedures

If there is a proper way to perform the process, there is a procedure--whether it is documented or not.

Despite the fact that you are using the definition of ISO 9000 for procedure, let's not be dogmatic.

I can make scrambled eggs in 20+ different ways. Each way will give me slightly different results, but at the end of the process, I will have scrambled eggs to eat. So, what is the "proper way" to scramble eggs? The way I feel like that day....

 

[Jim Wynne]

Re: ISO 9001:2008 Required Procedures

The purpose of a procedure is to describe how a process is carried out--to ensure that process performance is carried out as required.

Here you're referring to "procedure" as a document.

If there is no specified way to perform a process, then there is no procedure. If there is a proper way to perform the process, there is a procedure--whether it is documented or not.

Here you're referring to "procedure" as a set of steps or operations--not necessarily documented--to follow in operating a process.

This is exactly the sort of confusion I alluded to in my earlier post. "Procedure" is given more than one meaning. It would have made life a lot simpler if the standard referred to documented processes instead of documented procedures.

In any event, there can be processes/procedures that have a prescribed order and method of operations but don't need to be documented. 4.2.1(d) of ISO 9001:2008 says that we must have "...documents, including records, determined by the organization to be necessary to ensure the effective planning, operation and control of its processes." (My emphasis)

The organization gets to decide when documentation is necessary.

 

[snappy]

Re: ISO 9001:2008 Required Procedures

Despite the fact that you are using the definition of ISO 9000 for procedure, let's not be dogmatic.

I can make scrambled eggs in 20+ different ways. Each way will give me slightly different results, but at the end of the process, I will have scrambled eggs to eat. So, what is the "proper way" to scramble eggs? The way I feel like that day....

Is there a difference between making scrambled eggs for yourself and making a complicated product for your customer? Do you think there is a proper way to achieve hard chrome plating of .001" thick, or do you just plate them how you feel that day?