Should software be controlled in the same manner as documents?

[New Kid]

When we became ISO9001:2000 certified , our consultant told us that software used within the company needed to be put under document control. We subsequently did this. I am now being asked by our IT department if we still need to do this and would like some advice on what I should do.

My thinking is that all the software we use to run our business should be part of our business management system......am I wrong?

 

[chergh - 2008]

Re: should software be a controlled document?

Software should be controlled but the extent of the control should depend on it's function.

We operate change control similar to a document control system for the software that my company produces as a product but thats very different to the software used to run a business.

Your IT department should ensure that patches, upgrades etc. are carried out in a controlled manner but which version of software you are using doesn't matter a great deal as file formats can often be read by many different applications, MS Office for example is generally comptabile between Office 2000 - Office 2007 and alternative products such as Open Office can also read ms office formats, so here which version of software you are using doesn't matter a great deal unless people are going to be using the very newest features.

I suppose what I am trying to say is that if you use an old version of a document, internal or external, you could be in real trouble where as if you use an old version of a software product it's unlikely to matter, or even be noticed.

The main reason I wouldn't include software application in document control is that THEY ARE NOT DOCUMENTS

I would see sections 6.1 provision of resources, 6.3 Infrastructure and 6.4 Work Environment as the relevant sections for software.

 

[Stijloor]

Re: should software be a controlled document?

When we became ISO 9001:2000 certified , our consultant told us that software used within the company needed to be put under document control. We subsequently did this. I am now being asked by our IT department if we still need to do this and would like some advice on what I should do.

My thinking is that all the software we use to run our business should be part of our business management system......am I wrong?

Hello New Kid,

From ISO 9001:2000....

6.3 Infrastructure
The organization shall determine, provide and maintain the infrastructure needed to achieve conformity to product requirements. Infrastructure includes, as applicable
a) buildings, workspace and associated utilities,
b) process equipment (both hardware and software), and
c) supporting services (such as transport or communication).

Software is part of your quality management system and is expected to be managed and maintained like any other provision within the system. I do not view software as "documents." Just make sure that the software is "capable" and doing what it is supposed to do. By the way, IT is smart enough to know that software is identified within the system because it is an asset and is likely to be subject to regular updates.

Hope this helps. Stijloor.

 

[Peter Fraser]

Re: should software be a controlled document?

I do not view software as "documents."

Stijloor.

Stijloor

Neither do I, but I do wonder how anyone can make sense of:

ISO9000:2000
A "product" is the "result of a process" (3.4.1) NOTE 1 There are four generic product categories (including) software (e.g. ... dictionary)

For example the offered product “automobile” consists of ... software (e.g. ... driver's manual)...

Not in real life, I don't think!

 

[Stijloor]

Re: should software be a controlled document?

Stijloor

Neither do I, but I do wonder how anyone can make sense of:

ISO 9000:2000
A "product" is the "result of a process" (3.4.1) NOTE 1 There are four generic product categories (including) software (e.g. ... dictionary)

For example the offered product “automobile” consists of ... software (e.g. ... driver's manual)...

Not in real life, I don't think!

Hello Peter,

The software that the OP was referring to is used as a "tool."
The software that you mentioned is a "product."

Stijloor.

P.S. Please note that the current version of ISO 9000 is 2005.

 

[CliffK]

Re: Should software be controlled like documents?

If you have mission-critical software, as in a process control or SCADA system, you need to control it so tightly that it squeaks.

But it's still not a document.

 

[James Gutherson]

Re: Should software be controlled like documents?

Try to think of the reason behind document control. The intent is to ensure that people are using the correct process documents, forms, work instructions, etc. These are all tools that people use to complete the relevant process. The question of controlling software will depend on what it is and how it is used.

Something like MS Office is used to access the tools, the documents, spreadsheets, databases, etc. You do not need to control this in the sence of a register of version numbers, documentation of changes between versions etc. The control you need in this situation is to ensure that the people who need the tools have the software to access them.
(It is the actual documents, spreadsheets etc that need to be controlled in this case)

Software that is something like a custom designed application with decision support features however does need to be controlled and looks alot more like traditional document control.

I'm starting to ramble a bit here so I'm off for more coffee.

 

[vanputten]

Re: Should software be controlled like documents?

I don't know if software should be controlled "like a document" becasue I don't know what you controls you have implemented for your documents.

But I do know that software versions need to be controlled. If not, then why would Microsoft label different version of software? Just call it all the same thing. Or Adobe Reader is another great example. If software didn't need some types of controls, then software makers would not give it revisions and different names.

I bet your IT deparment cares very much about being able to identify different versions of software. Ask them if they could do their job where all versions of software were not uniquely identified.

Regards,

Dirk

 

[potdar]

A software may be a

• 
  *Tool (infrastructure) - For a manager using MS Office / Adobe Acrobat
  *Process - For a service provider processing data using a third party developed software
  *Product - For MS selling MS Office
  *Document - Source code for a software developer
  *Record - Inventory database.
  *or a combination of any of these.

Whatever clause relares closest, sometimes multiple clauses will need to be applied.

In your specific case, it will depend on what you are using your software for.

I bet your IT deparment cares very much about being able to identify different versions of software. Ask them if they could do their job where all versions of software were not uniquely identified.

I tend to agree with you. But need for unique identification is a necessary but not sufficient criterion for deciding whether something is a document.

Ford puts out different versions of their vehicles every once in a while. All carry separate version name. That doesn't make each version a document. Going further, each of these cars will carry a separate number on its chassis. Traceability requirements! Each car a document?

 

[James Gutherson]

Re: Should software be controlled like documents?

If not, then why would Microsoft label different version of software? Just call it all the same thing.Dirk

This was sarcasm right

It wouldn't be a marketing ploy to make you feel like you need a new version each year would it

Seriously, for the case mentioned here the issue is more can the software open and read the document? You don't need to have the latest version of say, MS Word to open a standard doc file that was created anytime since 2000. You need to have a tool that lets those who need to read the document (or in some cases modify and save) - that is all the control required. And in these days of open document standards, SAAS, etc this is becoming even less important.