Control the right documents

Q: In my organization, we have about 9,000 controlled documents for eight business units. We think it is too much and are discussing what really should be a controlled document. For example, we have a controlled document for each standard analytical procedure for each product. What are the fundamental concepts that define when a document should be controlled?

Vlamir Kanashiro
Paulinia, São Paulo, Brazil

A: For a business to operate efficiently, information must be shared. That information may be captured in work instructions, procedures, policies, diagrams or other documents. The information must be correct and distributed in a timely manner to the people who use it. If the information changes or is updated, users must receive the updated information.

Therefore, the fundamental elements of controlled documents are that they are correct, current and have a defined distribution. The necessary controls include review and approval of the documents by qualified personnel and timely distribution to a defined list of recipients. If there are any documents that do not require these controls, it is likely they do not need to be controlled documents.

The burden of maintaining 9,000 controlled documents must be considerable.  Reviewing those documents to reduce the burden will be a monumental task. There is an old adage, "How do you eat an elephant? One bite at a time." Here are some suggestions to get through it:

Within each business unit, select a team to review the documents on an established schedule.

Set a productivity goal for reviewing the documents (X documents per month) and evaluate progress toward the goal.

Reduce the document control administrative burden by following these steps to evaluate each document:

  1. Determine if the document refers to current products and processes. If the process or product is obsolete, the document will not be updated in the future. Therefore, it may not need to be controlled. Contact your legal department to determine how long it should be archived.
  2. Determine if the information in the document establishes requirements that must be followed or if the information is for guidance or reference. Guidelines and reference documents may not need controls.
  3. Review the revision history to determine how often the information in the document is updated. If your document system requires periodic review of each document, you may be able to extend the review cycle for documents that are not updated often. If the document will never be updated, it may not need controls.
  4. Determine if the distribution list is current. You may be able to remove recipients from the list who no longer need it.
  5. Evaluate whether individual documents can be combined into a single document. For example, does it make sense to create a book of analytical procedures instead of maintaining individual ones? Note that this idea is more practical for electronic documents than for printed ones.

The overall objective of the review should be to do no harm to the organization or to customers. Changing the status of a document from controlled to uncontrolled should have no negative impacts.

Ken Cogan
Principal analyst
Nielsen Co.
Columbia, MD

Showing the resources

Q: For an ISO 9001:2008 audit: How can I audit Clause 1—Provision of resources and Clause 2—Quality policy? For the provision of resources, must the auditee show evidence that he or she has enough resources, and what examples of evidence can the auditee show?

Amr Mohamed

A: ISO 9001:2008, Clause 1—Provision of resources cannot be effectively audited by itself. While an auditee may show you evidence of provision of resources in terms of budgetary allocations, provision of resources will be evident one way or another while auditing various elements of a quality management system (QMS).

Budgetary allocations to various elements of a QMS in and of themselves are not effective evidence of adequate resources because they do not effectively show where budgetary allocations were spent and if they achieved desired results. Therefore, the best way to audit clause 1 is to audit the entire QMS. For example:

  • During the audit, if it is established that the calibration of test equipment is not regularly carried out at the required interval, it may indicate that the auditee is not providing enough money for this purpose.
  • Proper operation of the test lab—for example, maintaining a specific temperature and humidity, or appropriate cleanliness—indicates that enough resources are provided for this purpose and vice versa.
  • If some of the QMS staff is required to obtain and maintain one or more professional certifications—such as certified quality auditor or engineer—and if the organization is reimbursing staff for the expenses associated with obtaining and maintaining such certifications, that’s an indication or evidence that the organization is allocating resources to maintain professionalism of the QMS staff.
  • If customer satisfaction data are not collected and analyzed at regular intervals, it may be that adequate resources are not made available.
  • If there is no quality improvement trend during a period of time, chances are that not enough resources are allocated in one or more areas of the QMS.

As you audit the QMS and find ineffectiveness in any area, one of the reasons for that ineffectiveness could be nonallocation of adequate resources.

Overall, the effectiveness of the QMS is the clearest evidence of whether adequate resources have been allocated.

Remember that quality policy, according to ISO 9001, is "the overall intention and direction for quality within an organization, which is formally expressed by top management."1

Therefore, auditing quality policy is simply finding out management’s intentions and directions as far as quality is concerned, and verifying that the directions are followed and intentions are accomplished.

Quality policy can simply be audited following these steps:

  1. Check if the organization has a quality policy.
  2. If a quality policy exists, determine whether it is too vague or it is fairly precise.
  3. Determine whether the quality policy is relevant to the organization’s activities and business.
  4. Check if there is a relationship between quality policy and quality objectives.
  5. Check if employees know what the quality policy is and if they understand what it means to how they perform their jobs every day.
  6. Verify how the quality policy’s intentions are accomplished. In this step, it will be quite evident if adequate resources are allocated or not.
  7. Verify how the organization determines whether it is operating in accordance to quality policy and whether it is meeting quality policy.

Pradip Mehta
Mehta Consulting LLC
Coppell, TX


  1. International Organization for Standardization, ISO 9001:2008—Quality management systems—Requirements, 2008.

Average Rating


Out of 0 Ratings
Rate this article

Add Comments

View comments
Comments FAQ

Featured advertisers