ISO 9001 What Records Does My Business Need To Keep?

Which documents must I keep for ISO 9001?

In addition to the legislative requirement for your business to keep certain records ISO 9001 2000 requires your business to retain other records to demonstrate compliance with its various clauses.

From an ISO 9001 2000 viewpoint records are documents generated whilst operating your Quality Management System. Typical examples are records of management reviews, purchase orders, sales orders, test results and internal quality system audits.

An ISO 9001 2000 consultant can be very helpful to your business in deciding which records are required and those that are not.

The standard is not specific about how long your business must retain each record but in order not to fall foul of your own Quality Management System, or the law, you might like to consider the following.

If your business offers a period of (x) years guarantee with its product you must keep associated records for at least (x) years.

If your business sells products that have legislative requirements for product testing you must keep associated records for the life of the product and sometimes longer.

Any legislative requirement for you to keep records associated with your product or service.

Records can be in many formats including computer generated records such as those maintained by the Easy ISO 9001 2000® software package.

It would be wise to remember when keeping computer based records for long periods (say 10 - 30 years) the medium upon which the data is stored will deteriorate and therefore you must periodically validate its integrity. Another factor to consider with long term data storage is will a device still be available in 30 years time to read the media upon which the data is stored? I still have computer programs on punch tape but I no longer have a punch tape reader! If you do not know what I am talking about here take it as validation of this advice. (Punch tape was a medium for storing computer programs and data in the 1960's and 1970's)

The following table identifies the specific records required by ISO 9001 2000. The list does not include records that your business might choose to retain voluntarily or those required by legislative requirements for your product or service.

Clause Document to retain, (Record)

5.6.1 Minutes from your Quality Management Review meetings, including any actions raised.

6.2.2 Education, training, skills and experience.(Sub clause-e)

7.1 Evidence that the realization processes and resulting product fulfill requirements. (Sub clause-d)

7.2.2 Results of the review of the requirements relating to the product and actions arising from the review.

7.3.2 Design and development inputs.

7.3.4 Results of design and development reviews and any necessary action.

7.3.5 Results of design and development verification and any necessary action.

7.3.6 Results of design and development validation and any necessary action.

7.3.7 Results of the review of design and development changes and any necessary action.

7.4.1 Results of supplier evaluations and actions arising from evaluations.

7.5.2 As required by the organization to demonstrate the validation of processes where the resulting output cannot be verified by subsequent monitoring and measurement. (Sub clause-d)

7.5.3 The unique identification of the product, where traceability is a requirement.

7.5.4 Customer property that is lost, damaged or otherwise found to be unsuitable for use.

7.6 Standards used for calibration or verification of measuring equipment where no international or national measurement standards exist. (Sub clause-a)

7.6 Validity of previous results when measuring equipment is found not to conform with its requirements.

7.6 Results of calibration or verification of measuring equipment.

8.2.2 Internal audit results.

8.2.4 Evidence of product conformity with the acceptance criteria and indication of the authority responsible for the release of the product.

8.3 Nature of the product non-conformities and any subsequent actions taken, including concessions obtained.

8.5.2 Results of corrective actions.

8.5.3 Results of preventive actions.

Driso provide ISO 9001 2000 consultancy, auditing, software, and training Services. They also supply Easy ISO 9001 2000® software for initially setting up an ISO 9001 2000 compliant Quality Management System or improving upon an existing one. To contact Driso Consultancy Services visit the web site below and see what they can do for you and your business. Contact: http://www.driso.co.uk for more details.

ISO 9001 the Process Approach to Quality Assurance

What is the Process Approach to Quality?

The ISO 9001 2000 standard is designed to manage and improve organizations processes. There is a great deal of misunderstanding and misinterpretation of the meaning of the process approach to Quality.

If you have at all been involved with quality assurance I am sure that you will at least heard of the "process approach" to Quality Assurance even if you are not fully aware of its meaning. The process approach to Quality Assurance is based on the idea that an organization is a system of interlinked processes.

If an organization does not define how its individual activities work together and the order in which the activities are performed it cannot deliver a quality product to its customers.

The process approach to quality involves analysing and then documenting the actual activities and links between those activities within an organization using simple process flowcharts. This technique is typically used by an auditor when conducting a gap analysis on a business. If you are unsure about your ability to identify your processes then you can employ a consultant to assist you.

Once the process and their interactions have been identified a framework of procedures and work instructions can be built around them.

It can often be the case that the output from one process in an organization is the input for another process within the same organization. As can be seen in the diagram below where the output for activity one is the input for activity two and similarly the output of activity two is the input for activity three.

When analysing the processes within your organization it should be remembered that processes may link to processes outside of your organization. A typical example of this might be the product design interface between you and your customer.

Your organization sends a design concept to the customer (the Process input).

The customer approves the design (the Process activity).

You receive back the approved concept design (Process output)

In many organizations it may be possible to break down each process still further into their individual sub-process components, (please forgive the simplistic example).

For example: The posting of a letter might be broken down into.

Process 1: Selection of the envelope type. E.g. Padded, anti static, brown, white, anti-static.

Process 2: Selection of postal method. E.g. Courier, air-freight, secure, insecure.

Process 3: Selection of first or second class postage, same day, seven day.

Each of these processes can then be broken down into sub-processes. E.g. The closure of the envelope. Should it be the type you lick, self adhesive, secured with sticky tape, security fastener or wax seal?

One always has to look at the common sense approach as to how far you should break each process down into sub-processes. For example: If the customer does not specify the method of envelope seal to be used then any type of seal may be used as long as it is fit for purpose. However, if the customer specifies a particular type of seal for certain products the process becomes more important to both you and your customer and therefore the process is worthy of documentation.

If you have difficulty documenting your processes, especially regarding the amount of detail required then it may be worth employing a consultant to guide you through the process. If your procedures are too prescriptive you will end up with unmanageable documents which serve no real purpose. A consultant will be able to minimise your documentation while ensuring compliance with ISO 9001 2000.

Many organizations already have documented instructions in the form of standard operating procedures (SOP's) and work instructions (WI's) that define how individual activities are performed. However, it is often the case that the interfaces between these instructions are misaligned. In some cases the interfaces are not even considered let alone documented. Misaligned process interfaces within an organisaton often leads to process fragmentation and eventually to break down of the organizations processes.

The ISO 9001 2000 standard has adopted the process approach to Quality management systems which is designed to improve an organizations processes.

The following rules may be used to implement a process approach to your Organizations Quality Management System.

Identify your Organizations key processes.

Define Quality Assurance levels for those processes.

Decide how process quality will be measured.

Document your approach to achieving the desired quality.

Evaluate your quality level and continuously improve it.

The following example will help guide you through the methology of identifying process inputs, activities and outputs.

As an example, let us consider the Purchasing Process:

1. The Input to the Purchasing process is a requirement to purchase materials, components or services.

2. The Purchasing Activity involves selecting a supplier from our approved supplier list and preparing a purchase order. We will interact with - The supplier: to place the order. - Receiving: to notify them of the material ordered. We may interact with - Engineering: if Purchasing specifications are needed. - Quality Assurance: if Receiving inspection is needed and to disposition the product if it is non-conforming when received.

3. The Output of the purchasing process is an approved purchase order released to the supplier.

A typical manufacturing company will have the following product realization processes:

Customer Enquiry.

Review and Quote.

Receive Order

Prepare Process Control Documentation

Purchase Materials

Receive Materials

Production

Pack

Label and Ship

In addition, we have the following support processes:

Management Review

Training

Document Control

Internal Auditing

Corrective and Preventive Action

Summary: As you develop your quality system, you must define the sequence and interaction of your processes in your quality manual as required in Section 4.2.2 of the new standard.

As you define your processes and prepare the accompanying documentation, be sure that the inputs, activities, interactions and outputs are fully defined so your quality system is effective.

Driso provide ISO 9001 2000 consultancy, auditing, software, and training Services. They also supply Easy ISO 9001 2000® software for initially setting up an ISO 9001 2000 compliant Quality Management System or improving upon an existing one. To contact Driso Consultancy Services visit the web site below and see what they can do for you and your business. Contact: http://www.driso.co.uk for more details.