Sorry I misunderstood your comment. It appeared that you were focusing on the words "as required" and "as necessary" without addressing the "controls necessary".
Why would I separate those two things?
Here are the 4 sections of the Standard that I believe impact on the original question posed:
1) 4.2.3 Control of Documents:
A documented procedure shall be established to define the controls needed:
b) to review and update as necessary and re-approve documentsI think we agree, you must identify the controls that ensures that System Documents (including SOPs) are reviewed and updated as necessary.
Yes, except that I don't think that the designation "SOP" is particularly helpful in these matters. It's an ugly old military term that I think we can do without. In any case, yes, the controls "shall" be identified.
2) 5.4.2 Quality Management System Planning
Top management shall ensure that:
b) the integrity of the quality management system is maintained when changes to the quality management system are planned and implemented.This process is triggered by activities of the Management Review process (see attachment of "Management Review Meeting Minutes", pg 2, for how this "might be" accomplished...not necessarily the only way...)
No disagreement, and as you say, there are different ways to accomplish it.
3) 5.6.1 General
Top management shall review the organization's quality management system, at planned intervals, to ensure its continuing suitability, adequacy and effectiveness Yes, I believe Top Management does review the QMS, since they are collectively the owners of the 12 SOPs (in our system), and they are the ones who maintain and ensure these documents for accuracy and suitability. This is not necessarily accomplished in a "group meeting". Of course, I agree, review of the QMS also refers to "performance review".
I'm not sure what you mean by "our system" or what 12 "SOPs" you're referring to. If what you're saying is that in
your system top management does the reviewing, that's fine, but that's not the way it has ever been in
my systems, and there's never been an issue with it either in terms of how well it works or in the eyes of customer and CB auditors.
4) 5.6.2 Review input
The input to management review shall include information on:
f) changes that could affect the quality management system, ...Typically, the "control" or "trigger" for changes to the QMS are output of the Management Review Process (again, see attachment, pg 2). An auditor who sees the sample minutes could then verify that this "control" was implemented by checking to see if documentation was reviewed and edited as required. In a similar way, he could follow the trail to see if Training (if identified as an output) was implemented.
I don't agree with your "typically" in the first sentence. In my experience, changes emanate from a variety of sources, including internal audit or just a perceived need to improve something, or changes in processes necessitated by things like new technology. While these changes should be reviewed by management, the output may be something as simple as tacit approval. A person says "We changed process
x because of the new machine, and the documentation has been updated," and management might say, "OK, good job," and that's the end of it.
Again, I think this discussion has been fueled more by the "semantics" of the terminology employed by those posting responses. Management Review needn't be a formalized gathering of the organization's Management Team (in my opinion).
I agree that management review may take some form other than a formal, scheduled meeting.
The other point that I think is important is that we understand and demonstrate the "links" between system processes as is required in this instance where "Management Review" and the "Control of Documents and Records" are shown to "interface with each other". The "output of Management Review" can be one of triggers for the "Control of Documents and Records" (as well as for the "Training Process").
It can be
one of the triggers, but as I said, it's one of the less likely outputs in my own experience. It isn't just document control that "interfaces" with management review; it's the system as a whole, and the requirement as I see it is for top management to (a) establish the top-level requirements, (b) assign responsibility and authority for meeting the requirements and (c) be aware of the functioning of the system and provide help and resources when necessary. Direct intervention by top management in the day-to-day operation of the quality system isn't necessary or even desirable (imo) unless the company is relatively small. So long as top management has provided the necessary infrastructure and has thoughtfully delegated responsibility
and authority, ongoing intervention is likely to become micromanagement, which is not a good thing.