The 6 documented procedures required by ISO 9001:2008

[JaneB]

Shearwater,
I empathise. Your document ought not to be an 'ISO 9001' document, but something that's useful to your organisation - and will thus be more likely to be used.

Regurgi-9001 is a waste of time.

Am I the only one who thinks that trying to use this type of document in a production environment is madness. I can barely understand it and I deal with dense documents all the time.

No - not in ANY environment.

So.... How aggressively can I wield the editors marker?

Very.

I would like to cut this down to the six required clauses, the detailed work instructions, and clear instructions on how to comply with our quality and test expectations.

Huh? You lost me with the 'six required clauses' - there's more than that in 9001! If you're referring to the minimum mandatory procedures, please do NOT forget the all important things you need first: those YOU need to run your organisation. You're remembering (half of) clause 4.2.1c but ignoring 4.2.1d

Do we really need paragraphs like this in the document?

Nope.

Would we still be compliant if we were to substitute something more along the lines of this:
"Our goal is to produce quality products and back them with the customer service that people want. In addition, we want those products, and that service to get better.

In order to do that, we use a process of auditing and measurement to assess our quality, and then use the information collected to improve our performance.

Two tools that we use assess quality are audits and non-conformance records. Management reviews these records and then uses it to direct corrective action."

Great! I applaud such clarity and simplicity. If no one can read it or understand it, it's just gobbledegook, and no one's got time.

But... sorry, you need to be clearer about what 'quality products' are.

I would love to hear comments on this before I spend days wasting my time.

You won't be (wasting your time that is).

 

[Bill Goss]

ISO 9001:2008 requires 6 documented procedures, 1 quality manual, a documented quality policy, documented quality objectives and records in every place that references 4.2.4.

The documented procedures are quite simple. You need to have a written, approved, issued and understood be applicable personnel procedure for document control, record control, nonconforming product, internal audit, corrective action and preventive action. Typically the corrective action and preventive action procedures are together in 1 procedure.

The procedures need to define the processes and responsibilities for the areas they cover in sufficient detail to ensure consistency and conforming activities by all personnel performing the work. Like all documents, you need to write it to the audience that may need to read and follow it. In other words, figure out the lowest level of reading and comprehension ability in your workforce that may need to understand the procedure and be sure to write it with this in mind.

I do not know if I helped you because the question was somewhat vague to me, so if I am missing something please let me know and I would be happy to respond according to your needs.

Bill Goss

 

[Bill Goss]

Covering continual improvement of the QMS and compling with requirements (customer and regulatory) are important in the policy. I like what you wrote ... sounds like all employees could understand it and know how the processes within the QMS contribute to the success of the policy. Good.

 

[Jim Wynne]

ISO 9001:2008 requires 6 documented procedures, 1 quality manual, a documented quality policy, documented quality objectives and records in every place that references 4.2.4.

The standard requires, beyond the Big Six, "...documents needed by the organization to ensure the effective planning, operation and control of its processes..." So the standard requires as many documented procedures are are necessary, not just the six that are specified. Also, there is no requirement for the quality policy an objectives to be documented. It would be difficult to establish and communicate those things without writing them down, but there's no "shall" that requires it.

ETA: Thanks to Sidney for pointing out that 4.2.1(a) does require the policy and objectives to be documented.

 

[Sidney Vianna]

Also, there is no requirement for the quality policy an objectives to be documented. It would be difficult to establish and communicate those things without writing them down, but there's no "shall" that requires it.

Jim, in this case, there is: ISO 9001:2008 4.2.1a).

 

[Jim Wynne]

Jim, in this case, there is: ISO 9001:2008 4.2.1a).

Thanks. Asleep at the wheel again.

 

[Bill Goss]

Yes, every organization will need to determine what "they" require in addition to the "requirements" of the standard. In the ecent that an organization is so small and simple that "tribal knowledge" is sufficient is all areas, then in fact the 6 required procedures as stated by ISO 9001 would in fact be all that is needed. However, having said that, I have never worked with such a small and simple organization to date, but that's not to say there aren't any out there.

 

[DrM2u]

Yes, every organization will need to determine what "they" require in addition to the "requirements" of the standard. In the ecent that an organization is so small and simple that "tribal knowledge" is sufficient is all areas, then in fact the 6 required procedures as stated by ISO 9001 would in fact be all that is needed. However, having said that, I have never worked with such a small and simple organization to date, but that's not to say there aren't any out there.

I second that the organization needs to identify what it needs for itself and not to try to apease some wrong perceptions from auditors or customers.

As a clarification: there are (6) procedures that are required to be documented per ISO 9001:2008. One document can cover more than one procedure. A company has more that six procedures, whether they call them procedures or processes (the terms are often interchangeable). I worked with a few one-man-companies in the past and there were only (4) documented procedures: document and record control, non-conforming product, internal audits and improvement actions (corrective & preventive).

 

[Bill Goss]

So in the case you mention, "tribal knowledge" was quite satisfactory and if procedures or processes were documented, they would simply "collect dust" due to no need for their use. I cannot tell you how many companies have had documented procedures that were never looked at and in fact did not ever have to be looked at. So my position is to obsolete them if they show no value.

 

[JaneB]

ISO 9001:2008 requires 6 documented procedures...

I think this misses the point, puts the cart before the horse and contains two errors:
1. Major error: the 9001 Standard requires, as Jim also points out, an organisation to have the documents it decides are needed "to ensure the effective planning, operation and control of its processes..." ie, as many documented procedures (OR other documents, not necessarily just procedures!) are necessary- 4.2.1 d. The misbelief in 'just 6 procedures' is focussing on clause c of 4.2.1 but overlooks or ignores d

Yes, certain mandatory procedures are required, and yes the Standard specifically identifies those , but the belief that '9001 only requires 6 procedures' misses understanding part of its requirements.

2. Minor error: regarding the mandated ones, you don't have to have six individual procedures. You do have to have procedures that meet the requirements in 6 separate clauses. This can be done is as many or as few procedures as the organisation chooses.

This always was the case (eg, you might combine Doc Control and Records Management, if you choose, or CA and PA) but to make it crystal clear, these two new sentences were added to NOTE1 in the 2008 version (after clause 4.2.1)

A single document may address the requirements for one or more procedures. A requirement for a documented procedure may be covered by more than one document.

I cannot tell you how many companies have had documented procedures that were never looked at and in fact did not ever have to be looked at.

I think many if not most quality professionals have had some experience of this, unfortunately.

If companies have documented procedures they've 'never looked at' and 'did not ever have to be looked at' it's a fairly sure thing that they didn't know what they were doing, didn't get their documentation requirements clear and/or perhaps were badly advised, very possibly by an inept so-called 'consultant'. Companies who do do those things (or engage a good consultant) don't have procedures they never look at - on the contrary, they find their documentation useful and use it.