ISO 9001:2015 Clause 7.5 Documented Information - PRETESH BISWAS (2024)

ISO 9001:2015 Clause 7.5 Documented Information

Definition:

ISO 9001:2015 defines documented information as meaningful data that is required to be controlled and maintained by the organization and the medium on which it is contained. Notes to this definition indicate that documented information can refer to the Quality Management System (QMS) and its processes, documentation, and records.

Documented information replaces the requirement for procedures, records and other items of documentation in ISO 9001:2015. Documented information can be of two types:

1. Documented information that needs to bemaintained. This will cover procedures, policies, etc. that would have been referred to as “documented procedures” or just “documents” in ISO 9001:2008
2. Documented information that needs to beretained. This will cover what ISO 9001:2008 called “records”.

Introduction:

A particular support requirement is now documented information. Gone are the terms documents, documented procedures, and records; everything is now known as documented information whether that’s records, procedures, processes, etc. and in whatever form e.g. paper, electronic, etc. Documented information can be used to communicate a message, provide evidence of what was planned has actually been done, or knowledge sharing. Documentation Information is the information required to be controlled and maintained by an organization and the medium on which it is contained. It can be in any format and media and from any source such as paper, magnetic, electronic, or optical computer disc, photograph, master sample, etc. It can refer to:

• quality management system, including related processes;
• information created in order for the organization to operate (documentation);
• evidence of results achieved (records).

One of the important objectives in the revision of the ISO 9001 series of the standard had been that the amount and detail of documentation required by the organization have to be more relevant to the desired results of the organization’s process activities. ISO 9001:2015 allows an organization flexibility in the way it chooses to document its quality management system (QMS). This enables each individual organization to determine the correct amount of documented information needed in order to demonstrate the effective planning, operation, and control of its processes and the implementation and continual improvement of the effectiveness of its QMS. It is stressed that ISO 9001 requires (and always has required) a “Documented quality management system”, and not a “system of documents”.

The QMS needs to include documented information required by the ISO 9001 standard as well as documented information determined by the organization necessary for the effectiveness of the QMS. The organization must determine what documented information is necessary for the effectiveness of the management system. The extent of documented information for a management system can differ from one organization to another due to the size of the organization and its type of activities, processes, products, and services, the complexity of processes and their interactions, and the competence of persons. Auditors will need to understand the term ‘documented information’, however organizations are still free to use whatever terms suit their own requirements.

The following are some of the main objectives of an organization’s documented information:

1. Communication of Information:As a tool for information transmission and communication. The type and extent of thedocumented information will depend on the nature of the organization’s products andprocesses, the degree of formality of communication systems and the level ofcommunication skills within the organization, and the organizational culture.
2. Evidence of conformity:Provision of evidence that what was planned has actually been done.
3. Knowledge sharing
4. To disseminate and preserve the organization’s experiences. A typical example would be a technical specification, which can be used as a base for the design and development of a new product or service.

Documented Information has the following sub-clauses:

7.5.1 General
7.5.2 Creating and Updating
7.5.3 Control of Documented Information

7.5.1 General

The Organization’s QMS must include all documented information required by ISO 9001 and thedocumented information determined by the organization as being necessary for the effectiveness of the QMS.The extent of documented information can differ from one organization to another due to the size of the organization and its type of activities, processes, products, and services;complexity of processes and their interactions;competence of persons.

The requirement of this clause is linked to clause 4.4 (Quality management systems and its processes) which requires an organization to “maintain documented information to the extent necessary to support the operation of processes and retain documented information to the extent necessary to have confidence that the processes are being carried out as planned.”Clause 7.5.1 specifies all the different types of documentation needed for your QMS. The need to have additional documentation beyond those specified in this standard may depend upon – customer; regulatory and your own organizational requirements. Other factors to consider may include the complexity of products/Services and processes, type of activities, the effect on quality, the risk of customer dissatisfaction, economic risk, effectiveness and efficiency, the competence of personnel. Clause 7.5.1b requires you to have documents needed to ensure the effectiveness of the QMS. Each organization must determine what documentation is needed to achieve this based upon the complexity of products/services and processes, type of activities, effect on quality, the risk of customer dissatisfaction, economic risk, effectiveness and efficiency, the competence of personnel. There is no need for a Quality manual and six mandatory procedures in ISO 9001:2015. A document is an information that is written or recorded on some medium such as paper or computer. A document may specify requirements for e.g. a drawing or technical specification, may provide direction for e.g. quality plan, or show results or evidence of activities performed for e.g. records. The term “Documented Information” is used for all document requirements in ISO 9001:2015. For specific terminology used in ISO 9001:2008 such as “document” or “documented procedures”, “quality manual” or “quality plan”, ISO 9001:2015 defines requirements to “maintain documented information”. In ISO 9001:2008 the term “records” was used to denote documents needed to provide evidence of conformity with requirements. In 9001:2015 this is now expressed as a requirement to “retain documented information”. The organization is responsible for determining what documented information needs to be retained, the period of time for which it is to be retained and the media to be used for its retention. The requirement to “maintain” documented information may also include the possibility that the organization can “retain” that same documented information for a particular purpose, for e.g. to retain previous versions of it. When the term “information” rather than “documented information” is used, the organization may choose not to document the” information”. (e.g. in clause 4.1 states: “The organization shall monitor and review the information about these external and internal issues”). The organization can decide whether or not it is necessary or appropriate to maintain documented information.

Documented information needed to be maintained by the organization for the purposes ofestablishing a QMS (high-level transversal documents) includes:

• The scope of the quality management system (clause 4.3).
• Documented information necessary to support the operation of processes (clause 4.4).
• The quality policy (clause 5.).
• Quality objectives (clause 6.2).
• This documented information is subject to the requirements of clause 7.5.

Documented information maintained by the organization for the purpose of communicatingthe information necessary for the organization to operate may include and not limited to(clause 4.4)

• Organization charts
• Process maps, process flow charts and/or process descriptions
• Procedures
• Work and/or test instructions
• Specifications
• Documents containing internal communications
• Production schedules
• Approved supplier lists
• Test and inspection plans
• Quality plans
• Quality manuals
• Strategic plans
• Forms

These are low-level specific documents and ISO 9001:2015 does not specifically require any of them. But in case such documents are part of QMS, they are subjected to all the controls given in clause 7.5.2 (creating and Updating) and clause 7.5.3(Control of documented information).

Documented information needed to be retained by the organization for the purpose ofproviding evidence of result achieved (records) includes:

• Documented information to the extent necessary to have confidence that theprocesses are being carried out as planned (clause 4.4).
• Evidence of fitness for the purpose of monitoring and measuring resources (clause 7.1.5.1).
• Evidence of the basis used for calibration of the monitoring and measurementresources (when no international or national standards exist) (clause 7.1.5.2).
• Evidence of competence of the person(s) doing work under the control of the organizationthat affects the performance and effectiveness of the QMS (clause 7.2).
• Results of the review and new requirements for the products and services (clause8.2.3).
• Records needed to demonstrate that design and development requirements have beenmet (clause 8.3.2)
• Records on design and development inputs (clause 8.3.3).
• Records of the activities of design and development controls (clause 8.3.4).
• Records of design and development outputs (clause 8.3.5).
• Design and development changes, including the results of the review and theauthorization of the changes and necessary actions (clause 8.3.6).
• Records of the evaluation, selection, monitoring of performance and re‐evaluation ofexternal providers and any and actions arising from these activities (clause 8.4.1)
• Evidence of the unique identification of the outputs when traceability is a requirement(clause 8.5.2).
• Records of the property of the customer or external provider that is lost, damaged orotherwise found to be unsuitable for use and of its communication to the owner(clause 8.5.3).
• Results of the review of changes for production or service provision, the personsauthorizing the change, and necessary actions taken (clause 8.5.6).
• Records of the authorized release of products and services for delivery to the customerincluding acceptance criteria and traceability to the authorizing person(s) (clause 8.6).
• Records of nonconformities, the actions are taken, concessions obtained and the identification of the authority deciding the action in respect of the nonconformity (clause 8.7).
• Results of the evaluation of the performance and the effectiveness of the QMS (clause9.1.1)
• Evidence of the implementation of the audit programme and the audit results (clause9.2.2).
• Evidence of the results of management reviews (clause 9.3.3).
• Evidence of the nature of the nonconformities and any subsequent actions taken(clause 10.2.2).
• Results of any corrective action (clause 10.2.2).

In addition, Organizations may develop other records that are be needed to demonstrate the conformity of their processes, products and services, and quality management system, and in case such document is part of QMS, they are subjected to all the controls given in clause 7.5.2 (creating and Updating) and clause 7.5.3(Control of documented information).

7.5.2 Creating and Updating

When creating and updating documented information the organization must ensure appropriate identification and description (e.g., a title, date, author, or reference number); format (e.g., language, software version, graphics), and media (e.g., paper, electronic); review and approval for suitability and adequacy.

While ISO 9001:2015 does not require a documented procedure for creating, updating, and control of documented information, still we need a procedure for creating, updating, and ultimately control of documented information. Your system for managing documented information doesn’t itself have to be documented, which is a big change from ISO 9001:2008, which required documented procedures for both document control and control of records, documenting them will act as evidence that adequate organization knowledge is available with the organization regarding creation, updating, and control of documented information. ISO 9001:2015 doesn’t require you to write a procedure for how you control documented information. Should you do it anyway? Yes! It’s a potentially complicated topic that should be communicated in a consistent manner. Describe your system within maintained documented information (i.e., a documented procedure) and you’ll have much less confusion.

You have to ensure the following practices are in place whenyou create and update documented information:

• Identification:Documents and records must-have titles, document numbers, or something that indicatestheir identity. As long as you can differentiate between different documented information, knowingwhich ones address which topics, then you’ve met this requirement.
• Format: The documents must be usable for their purpose. The format must be appropriate to thepurpose and users, and the media must be accessible and understandable. For example, if the mediumis electronic, then users would need to have access to a computer or other interface that can display theelectronic media. Another example might relate to a company that has a high percentage of employeeswho speak Marathi their documentation would need to be graphically formatted (to makelanguage irrelevant) or translated into Marathi, the language predominantly spoken by the employees.
• Review and approval for suitability and adequacy:Somebody must review and approve the documented information before it’sused. Who performs this function is completely up to you. There are many ways to signifyreview and approval: signatures, initials, email approval, electronic signatures, meeting minutes, orclick-box approval within a document control program. Review and approval do have to betraceable, meaning it must be clear who performed it. It should also be secure, which means theorganization has prevented imposters from making reviews/approvals under somebody else’s name.

7.5.3 Control of Documented Information

7.5.3.1

Documented information required by Your QMS and by ISO 9001 must be controlled to ensure it is available and suitable for use, where and when it is needed; It must is adequately protected from loss of confidentiality, improper use, or loss of integrity.

7.5.3.2

For the control of documented information, the organization must address, as applicable: distribution, access, retrieval, and use;storage and preservation, including preservation of legibility; control of changes (e.g., version control); retention and disposition. Documented information of external origin determined by the organization to be necessary for the planning and operation of the system must be identified as appropriate, and controlled. Access can imply a decision regarding the permission to view the documented information only, or the permission and authority to view and change the documented information.

Once the documented information exists, the next logical step is controlled. Here are the control requirements from ISO 9001:2015:

• Availability:The documented information exists where it’s supposed to exist. The organization hasdedicated the resources to create the documented information and the information is suitable for theneed it was intended to fill.
• Protection: The documented information is protected from tampering, unauthorized changes, anddamage. People who shouldn’t see the documented information are prevented from seeing it.Appropriate safeguards put in place by the organization to ensure information isn’t misused in anyway. System passwords and employee training are two ways to accomplish this.
• Distribution:You can assess the documented information. Employees don’t struggle to find it, and theyunderstand how to interpret its meaning. If a computer or program is necessary to access thedocumented information intended for employees, then employees can operate it. In the case of retainedinformation (e.g., records), they can be retrieved within a reasonable amount of time.
• Storage: The organization specifies where the documented information is located. This applies toretained documented information (records) and maintained documented information (documents). Thelocation is accurate and verifiable, and there are controls to preserve the information.
• Preservationcould include periodic backups of computer files and periodic monitoring to ensure continuedlegibility. The controls for “preservation” are very similar to the controls for “protection,” describedabove.
• Change control: The organization is able to ensure that the correct versions of documented informationare available. When documented information is revised, the revisions are incorporated into theinformation in use (after review and approval). There are safeguards in place to prevent employeesfrom incorrectly accessing and using obsolete information.
• Retention:We say how long we retain documented information. Remember, the term “retain” refers torecords, so this is the requirement for establishing a retention time. Every record in your system couldconceivably have a different retention time, and ISO 9001:2015 provides no guidance on theappropriate retention times of records. This is completely up to the organization and its needs.
• Disposition refers to what happens to the record after the retention times have elapsed. Typicaldispositions include archive, shred, or recycle.

Finally, ISO 9001:2015 addresses external documents and preventing unintended alterations of retained information. An external document is published outside the organization and used within the scope of the management system. Examples of external documents possibly requiring control include:

• Troubleshooting and/or calibration manuals published by equipment manufacturers
• Test procedures, specifications, and/or engineering drawings published by customers or other bodies
• Instructions, specifications, and/or procedures published by suppliers
• Standards published by industrial organizations applicable to the organization
• International standards such as ISO 9001

Once external documents have been determined, they must be identified, and they must be controlled. Like internal documents, there must be a title, document number, or another unique identifier. Such identification typically comes from the source that publishes the document, and the organization simply adopts it. Make sure that all the other aspects of “control” are applied to external documents.

The last requirement provided by ISO 9001:2015 concerns retained documented information thatprovides evidence of conformity. In other words, records that prove you met requirements.The organization must ensure that people can’t makeunauthorized changes to records. This is a restatement of the protection and preservation requirementsalready discussed.

What to control?

“Do I need to control this?” is one of the most frequently asked questions in organizations workingtoward, or maintaining, a formal management system. Given the universe of documented informationpossibly requiring control, the question is understandable. Besides, most people would rather not controlsomething if they don’t have to. Here are some questions to ask when determining whether a documentshould be controlled:

• Does the documented information guide the production of products (i.e., goods or services) provided bythe organization?
• Does the documented information guide the verification, inspection, or testing of products provided bythe organization?
• Does the documented information definecustomer and/or product requirements?
• Is the documented information used for controlling processes?
• Is the documented information used for decision-making by production personnel?
• Is the documented information used for collecting data that could be used later for decision-makingwithin the scope of the management system (e.g., a form)?
• Is the information so critical that failure to keep it updated would pose a risk to the organization or itscustomers?
• Does the documented information address or relate to a requirement from ISO 9001?

If the answer to one or more of these questions is yes, then the documented information shouldprobably be controlled. For illustration purposes, consider the following scenarios:

1. An interoffice memo is posted on a wall in the fabrication department. The memo gives a number of functional and packaging requirements for a product that’s fabricated there. Because of where the document has been posted and the information it contains, the memo should be controlled. Ignore the fact that memos are rarely controlled; in this case, it provides customer requirements, guides decision making, and relates directly to ISO 9001 requirements. Even if the memo duplicates information contained elsewhere in controlled specifications, the uncontrolled memo would still be a problem. Eventually, there will be a discrepancy between the information on the memo and the information contained in the controlled specifications. The organization should either control the posted memo or get rid of it.
2. A training department develops videos to train employees on the proper setup and operation ofproduction lines. The videos are included in the training program for new hires and existingemployees. In this case, document control is required because the videos define process control, guidethe production of products, and relate to the training requirements of IS0 9001.
3. Product defect samples are displayed in a lighted glass cabinet in the visual inspection area, The samples illustrate the limits of various defects that can be considered acceptable to customers, and they’re used when inspectors aren’t certain of the criteria. Currently, the display cabinet is labelled “for reference only.” Despite this declaration. the samples should be controlled because they define customer requirements.
4. An organization develops a checklist that’s used to record the results of product inspection.The blank checklist defines exactly what’s to be inspected as indicated by the spaces that inspectorsmust complete. These blank forms need to be controlled as documents and then as records once they’recompleted.

These scenarios highlight the fact that documented information needn’t be limited to traditional procedures, work instructions, and the like. The term “documented information” can encompass a wide range of things, all of which might require control, depending on the information they contain. Some examples includeDatabases, Photos, Drawings, diagrams, sketches, audio, video, Product samples, and defect samples, Paint swatches for color matching,Checklists, Flow diagrams,Blank forms, etc

Organizations preparing to implement a QMS

For organizations that are in the process of implementing a QMS, and wish to meet the requirementsof ISO 9001:2015, the following comments may be useful.

1. For organizations that are in the process of implementing or have yet to implement a QMS, ISO 9001:2015 emphasizes a process approach. This includes:

• determining the processes necessary for the effective implementation of the quality management system determining the interactions between these processes.
• documenting the processes to the extent necessary to assure their effectiveoperation and control. (It may be appropriate to document the processes usingprocess mapping tools. It is emphasized, however, that documented processmapping tools are not a requirement of ISO 9001:2015).

2. Analysis of the processes should be the driving force for defining the amount of documented information needed for the quality management system, taking into account the requirements of ISO 9001:2015. It should not be the documented information that drives the processes.

Organizations wishing to adopt an existing QMS

For organizations that currently have a QMS the following comments are intended to assist inunderstanding the changes to documented information that may be required or facilitated by thetransition to ISO 9001:2015:

• An organization with an existing QMS should not need to rewrite all of its documentedinformation in order to meet the requirements of ISO 9001:2015. This is particularlytrue if an organization has structured its QMS based on the way it effectively operates,using a process approach.
• An organization may be able to carry out some simplification and/or consolidation ofexisting documented information in order to simplify its QMS.

Demonstrating conformity with ISO 9001:2015

For organizations wishing to demonstrate conformity with the requirements of ISO 9001:2015, forthe purposes of certification/registration, contractual, or other reasons, it is important to rememberthe need to provide evidence of the effective implementation of the QMS.

• Organizations may be able to demonstrate conformity without the need for extensivedocumented information
• To claim conformity with ISO 9001:2015, the organization has to be able to provideobjective evidence of the effectiveness of its processes and its quality managementsystem. Clause 3.8.3 of ISO 9000:2015 defines “objective evidence” as “data supporting
  the existence or verity of something” and notes that “objective evidence may beobtained through observation, measurement, test, or other means.”
• Objective evidence does not necessarily depend on the existence of documentedinformation, except where specifically mentioned in ISO 9001:2015. In some cases, (forexample, in clause 8.1 (e) Operational planning and control, it is up to the organizationto determine what documented information is necessary in order to provide thisobjective evidence.
• Where the organization has no specific documented information for a particularactivity, and this is not required by the standard, it is acceptable for this activity to beconducted using as a basis the relevant clause of ISO 9001:2015. In these situations,both internal and external audits may use the text of ISO 9001:2015 for conformityassessment purposes.

Documentation requirements in tabular form

From the text, it is normally evident when “documented information” relates to “records” as evidence of performed activity/process and when “documents information” relates to how to perform an activity/ process. Normally the standard refers to “shall maintain documented information” when the meaning is how to perform an activity/process and “shall retain documented information” when the meaning is to keep evidence of performed activity/process.
These are the minimum documentation requirements. Organizations themselves can decide that they need additional documented information.

Furthermore, in ISO 9001:2015 in several places uses the wording “shall determine”. The word “determine” implies a discovery process that results in knowledge. There is no explicit “documentation” requirement, but where “determine” is used the organization should at least be able to demonstrate and give confidence of completeness and control of such activities/processes.

Related

PublishedMay 11, 2019August 10, 2023