At the conclusion of Part One of this article we left you with the following information:
The organization’s management system shall include:
Documented information required by the International Standard
Documented information determined by the organization as being necessary for the effectiveness of the management system
So, to respond to a) above:
Documented information required by the International Standard
As per clause 7.5.1 in the High-Level Structure, the organizations management system shall include documented information required by the International Standard. It is a requirement to document every clause that states that documented information is to be maintained or retained (or sometimes both). We have listed these requirements in the table below from the High-Level Structure document. These may vary slightly for individual Standards such as ISO 9001, ISO 14001 or ISO 45001.
|
Maintain (documented procedures, statements) |
Retain (evidence, records) |
|
4.3 Determining the scope |
7.2 Competence |
|
5.2 Policy |
|
|
6.2 Objectives and planning to achieve them |
|
|
8.1 Operational planning and control |
8.1 Operational planning and control |
|
|
9.1 Monitoring, measurement, analysis and evaluation |
|
|
9.2 Internal audit |
|
|
9.3 Management review |
|
|
10.1 Nonconformity and corrective action |
And again, as per clause 7.5.1 in the High-Level Structure, the organizations management system shall include documented information determined by the organization as being necessary for the effectiveness of the management system.
And to respond to b) above:
Documented information determined by the organization as being necessary for the effectiveness of the management system
So, now it is up to the organization to determine and decide whether it is necessary or appropriate to maintain documented information.
An example might be from clause 5.3 Organizational roles, responsibilities and authorities – this clause states that Top management shall ensure that the responsibilities and authorities for relevant roles are assigned and communicated within the organization. There is no requirement that the assignment and communication of these roles, responsibilities and authorities are to be documented, however we would normally see evidence of this in documentation that may already exist within an organization, such as:
Organizational charts
Job descriptions
Duty statements
Responsibility matrix
Documented procedures
These may be communicated through such forums as listed below where there may already be evidence documented:
Induction
Training
Employee files
Meetings
Keep it simple
Determine what is a requirement of the International Standard for documented information
Look at what you might already be documenting that meets the documentation requirements.
Look at what you might already be documenting that assists in the control and management of all of the other clauses that do not specifically state that documented information is required.
DON’T create documents just for the sake of it! Documents are a form of ‘control measure’ to manage risk within a business. Use them wisely, efficiently and effectively.