Using Document Control Software to Meet ISO Document Control Requirements
Two ISO quality system standards, ISO Q9001:2000 and ISO/TS 16949:2002,
have recently been released. The ISO 9001:2000 "Quality Management
Systems – Requirements" standard is an update of the ISO 9000 series
last revised in 1994. ISO/TS 16949 is a new international standard for
"automotive production and relevant service part organizations"
incorporating the new ISO 9001:2000 requirements with existing QS-9000
requirements. Document control has been and continues to be a key element
in the new ISO quality management system (QMS) standards. Without reliable
control of procedures and records, a company’s QMS integrity will fail
– as a practical business matter and as an auditable compliant system.
An increasing number of software options are available that help companies
meet document control requirements. This article will review general document
control principles updated in the new standards and the potential of using
document control software solutions to help meet the new requirements.
WHAT DOCUMENTATION IS REQUIRED?
The updated ISO 9001:2000 standard specifically requires a Quality Policy
and Quality Objectives, a Quality Manual, and Documented Procedures. Documented
procedures include specific documents identified in the ISO 9001:2000
standard and other documents needed to ensure effective Process Planning,
Operation and Control (Element 4.2.1).
The "minimum" procedures specifically required by the updated
ISO 9001:2000 standard include the following:
- Document Control Procedure (4.2.3).
- Records Control Procedure (4.2.4).
- Internal Audit Procedure (8.2.2).
- Control of Nonconforming Product Procedure (8.3).
- Corrective Action Procedure (8.5.2)
- Preventive Action Procedure (8.5.3).
To determine what additional documents are needed, the new standard emphasizes
a "process approach" and a "system approach" to documenting
and managing the QMS. A company must identify and document "needed"
individual and system processes (activities with inputs and outputs) including
linked inter-departmental activities and interactions. The quality management
principles underlying the requirements in the new standard imply that
control and synergy can only be achieved by understanding, monitoring,
and improving system-wide processes with their inherent cross-functional
interdependencies and linkages. The ISO 9004:2000 "Guideline"
standard describes these and other quality management principles that
are "integrated in the contents" of the requirements.
"Needed" QMS documentation should be appropriate for the size
and type of the organization, the complexity and interaction of processes,
and the competence of personnel.
|EXAMPLES OF NEEDED ISO 9001:2001
|Examples of other specific ISO 9001:2000 requirements
that may require appropriate documentation include:
- Planning (5.4)
- Communications (5.5.3)
- Management Review (5.6)
- Resource Management (6)
- Training (6.2.2)
- Infrastructure (6.3)
- Customer-related Processes (7.2)
- Design and Development (7.3)
- Purchasing (7.4)
- Production and Service Control (7.5.1)
- Validation of Processes (7.5.2)
- Identification and Traceability (7.5.3)
- Customer Property (7.5.4), Preservation of Product (7.5.5)
- Customer Satisfaction Measurement (8.2.1)
- Internal Audit (8.2.2), Process/Product Monitoring and Measurement
- Control of Nonconforming Product (8.3)
- Continuous Improvement (8.5.2).
- Other applicable standards and statutory/regulatory requirement
|EXAMPLES OF ADDITIONAL ISO/TS
16949:2002 DOCUMENTATION REQUIREMENTS
| The new
ISO/TS 16949:2002 Quality Management System (QMS) standard for the
automotive industry includes the requirements of ISO 9001:2000. The
following are examples of additional ISO/TS 16949:2002 documentation
requirements beyond ISO 9001:2000:
- Method of "timely review" (2 weeks min) of customer
Engineering Specs (184.108.40.206)
- Quality objectives and measurements in the Business Plan (220.127.116.11)
- Training needs and competence (18.104.22.168)
- Plant Layout evaluations (6.3.1)
- Contingency Plans in the event of emergencies (6.3.2)
- Change Control documentation (7.1.4)
- Special Characteristics identification and usage (22.214.171.124)
- Specifications and drawings, reliability results, process flowchart/layout,
FMEAs, Control Plans (126.96.36.199), work instructions (188.8.131.52), process
approval acceptance criteria, quality data, error-proofing activities
(184.108.40.206), methods of nonconformity detection and feedback (220.127.116.11,
- Customer product and mfg process approval (ie. PPAP) (18.104.22.168)
- Incoming product quality assurance method (22.214.171.124)
- Supplier performance monitoring (126.96.36.199)
- Verification of Job set-up (188.8.131.52)
- Measurement system analysis (e.g. Gage R&R) (7.6.1)
- Calibration/verification records (7.6.2)
- Customer satisfaction data including quality and delivery (184.108.40.206)
- Manufacturing process and product audit (220.127.116.11, 18.104.22.168)
- Internal audit annual plan and auditor qualification (22.214.171.124,
- Layout inspection and functional testing (126.96.36.199)
- Appearance masters and evaluation equipment (188.8.131.52)
- Re-work instructions (8.3.2)
- Customer waivers (8.3.4)
- Quality and operational trend review, prioritization, and reporting
- Methods to control and reduce variation (e.g. SPC) in product
and mfg processes (184.108.40.206)
- Problem solving process (220.127.116.11)
- Corrective action impact and rejected product test/analysis
|WHAT RECORDS ARE REQUIRED?
|Records are objective evidence of the completion of
a requirement. Examples of "records" include completed forms
or meeting minutes. Records are required to be legible, readily identifiable,
and retrievable. The methods of identification, storage, retrieval,
retention time, and disposition are to be defined in the required
records procedure. Records specifically required by the ISO 9001:2000
QMS standard include the following:
- Management Review Records (5.6.1).
- Training Records (6.2.2).
- Product Planning and Approval Records (7.1)
- Contract Review Records (7.2.2)
- Design Input Records and Design Output Review Records (7.3.2,
- Design Verification and Validation Records (7.3.5, 7.3.6).
- Design Change Records (7.3.7).
- Supplier Evaluation Records (7.3.8).
- "Special Process" Validation Records (7.5.2).
- Unique Traceability Identification Records (7.5.3).
- Customer Property Report (7.5.4).
- Calibration Records (7.6).
- Internal Audit Records (8.2.2).
- Product Approval Criteria/Release Records (8.2.4).
- Nonconforming Product Records (8.3).
- Corrective Action and Preventive Action Records (8.5.2, 8.5.3).
BASIC ELECTRONIC SYSTEMS
Most companies begin developing basic electronic document control systems
using network locations and email systems. A hard-copy document control
system will usually begin to become "electronic" by establishing
directories or folders of documents usually by Department (Quality, Manufacturing,
Engineering, etc.) or Document Type (Procedures, Work Instructions, Forms,
Drawings, etc.). Network administrators will often control access and
security to documents by defining network location "rights"
such as "write" and "read-only" to specified employees.
Companies may even begin "routing" documents as attachments
in emails to reviewers and approvers. However, electronic storage and
sending documents through email does not necessarily mean documents are
controlled and routed effectively.
A company will soon find that storing files in network directories and
sending emails with attachments as a "routing" to reviewers
and approvers in basic electronic document control system has many limitations.
Network security categories are broad in the areas of access control and
rights. For example, a user will usually have "all or nothing"
in terms of access to documents and rights to change documents. Also,
a limited number of users, usually document control personnel, will have
the broad right to "write" or change documents. Network storage
still means that document control is a manually intensive funnel through
which all changes must be initiated and tracked.
In a basic electronic system, Document Control administrators may send
files electronically to reviewers and approvers through a email system.
However, the sequence of review/approval still has to be monitored manually.
Also, electronic signoff can only be used by assuming that signoff through
email is allowable and secure. The FDA has released a standard for electronic
signatures (21CFR Part 11).
Tracking of documents sent, comments made by reviewers/approvers, and
the final approval history are not automatically accessible in a manual
email routing system. Even if documents are sent through email, system
administrators must manually track, update, and communicate the review
and approval feedback they receive (open loop system). Also, there are
no automatic notifications to reviewers/approvers in an open loop email
system. Administrators must still manually remind the "bottlenecks"
to signoff and notify change initiators of the approval status and notify
those affected when the change becomes effective - the routing of documents
continues to be a manually intensive process in a basic electronic system.
ADVANCED ELECTRONIC DOCUMENT CONTROL
There are many general and dedicated software packages available for
document control solutions. Most of the software that is available for
document control has been an added option to an existing software program
designed for another purpose. For example, many current document control
software programs were broadly designed for Enterprise Resource Planning
(ERP), Work Flow Management, or Email communications and added "document
control" capabilities. Some packages were originally designed to
help a company comply with quality standards like ISO 9000 and added options
for document control, calibration, corrective action, etc. Of course,
there are even software options specifically designed for document control
that offer a variety of document storage, routing, and approval options.
Most of the document control solutions available, whether add-on options
or dedicated solutions, will have some form of electronic document routing
and email notification capability.
A variety of system architectures and requirements accompany advanced
electronic document control options that will affect resulting functionality,
costing and ease of implementation. The higher-end document control packages
will most likely be part of a program that has potentially been integrated
with other areas of the company’s data driven systems like inventory management,
MRP, production control, etc. These higher-end packages may require substantial
investment in additional server hardware and database resources. The higher-end
systems offer the complete integration of a company’s document and data
control but with resulting complexity and cost. The system cost will also
be based on such things as how much hardware/database resources must be
added to the existing system, the number of users that will be concurrently
accessing the system, and the desired performance level of the system.
The lower-end options include document control programs that help administer
the existing basic electronic system by simply developing a "links"
to the locations where the documents are stored on the network and helping
track revision levels and approval status. Lower-end systems may be solely
located on an administrator’s computer requiring only a single installation,
but may not have automatic routing, approval, and communication capabilities.
In the middle of the road electronic document control options are systems
that offer "client/server architecture" with automatic routing
and notifications. The main document control program may be located on
a central server with users accessing through their local networked computers.
Many document control software packages increase document access control
and security by storing documents in a database located on a server. In
this method, a master copy of the document is compressed and stored in
the database and the document control program is an interface between
the user and the master copy. These software packages will usually be
compatible with the most common databases that are being used (ie. SQL,
Oracle, etc.). Although not directly integrated with other company systems,
middle-of-the road packages may offer automatic routing and email notifications.
Many middle and higher-end packages are now offering internet access
for document control users. Remote users without network access can be
included in electronic access to documents including routing, approvals,
and notifications. Instead of a client/server access to stored documents,
users access the company’s document control software and database located
on the server through their web browser. Advanced electronic document
control packages with web capability allow secure access to documents
through document control software that automatically publishes the most
current revision of a document and removes obsolete versions. Electronic
routing to supply chain partners with electronic signature capability
is a powerful tool that document control software packages may provide.
HOW DOES DOCUMENT CONTROL SOFTWARE HELP?
|- SECURE STORAGE and CONTROLLED
Document control software can be used to store QMS documents like
the Quality Manual, Procedures, Drawings, Work Instructions, Forms,
Records, etc. QMS documentation can be securely stored and controlled
in a document control software. Electronic document control software
programs often use a secure, access-controlled database to store
files as opposed to hard-copy storage or network directories. Systems
can be purchased that allow storage of all file formats. Native
or alternate viewing options can be selected and controlled by the
administrator based on the file format, viewing program availability,
licensing, and security needs.
|WHAT THE REQUIREMENTS FOR DOCUMENT
|The new standards require a company to define the following
in their Document Control procedure (4.2.3):
- How documents are approved prior to issue.
- How documents are reviewed, updated, and re-approved.
- How changes and revision status are identified.
- How the correct version is made available.
- How documents are made legible and identifiable.
- How external documents are identified and controlled.
- How obsolete documents are identified and controlled.
TRADITIONAL DOCUMENT CONTROL PROCESSES
In paper and even basic electronic systems, Document Control and/or Engineering
Change administrators typically receive change information in redlined
hard-copy form. Many companies have a Document Change or Engineering Change
Forms that may accompany the redlined documents. If Engineering personnel
are required to initiate their own Engineering Change Form, they are usually
required to contact Engineering Change administrators to get the next
sequential Document or Engineering Change Number. At some point, Document
Control or Engineering Change administrators become involved in creating
a "change package" that contains the changed document/s, any
required form/s, and the "routing" information.
"Routes" are the pre-defined steps and people that the "change
package" will be sent or given to for review and approval. If the
company is ISO 9001 or ISO/TS 16949 certified or compliant, it will usually
have a matrix of types of documents and which functions/positions are
required to review and approve new issues or changes to the various document
types. Companies that do not use electronic means usually have "serial
steps" in their routes, meaning they are sent or hand-carried to
reviewers/approvers one after another until complete. If more than one
person is to receive information at a time (a "parallel step"),
Doc Control personnel must make copies of the change package in a manual
process. Serial steps in a manual process are usually used to allow each
reviewer/approver to make changes or comments that subsequent reviewers/approvers
can read. Significant time and resources are spent in preparing and routing
the change documents for review and approval. Bottlenecks include the
time spent copying and distributing change packages, manually tracking
and reporting status, waiting for key personnel to sign-off especially
if they are not in the originating facility, and manually re-distributing,
communicating changes, and ensuring training is performed after approvals
Besides basic Document and Engineering Change processes, other processes
require routing of documents or information. For example, if a company
has a Corrective Action process, they need to have the ability to initiate
and assign Corrective Action Requests (CAR’s) to responsible individuals
or departments. In ISO-based companies, the Corrective Action process
will include a review step at the completion of corrective actions to
verify the effectiveness of the actions documented in the CAR. Internal
or external auditors may perform the corrective action review function.
Routing of the CAR information from initiators to responsible parties
and reviewers usually requires a Corrective Action administrator that
ensures corrective actions are being assigned, performed, reviewed, and
closed in a timely manner. Again, similar to Doc Control and Engineering
Change processes, the administration of the Corrective Action process
is typically manually intensive and requires constant review and updating
to ensure all activities are being completed.
Other processes that require routing of documentation relate to Supply
Chain Management. In a total quality system, there is a need for strong
customer and supplier communications including review and approval of
initial requirements and when changes are made to products/processes.
An example of this in the automotive industry is the QS-9000 Production
Part Approval Process (PPAP). Suppliers are required to submit a change
package to their customer/s when a product/process is started or revised
after approval. The supplier cannot implement any changes until the "submission"
and a "warrant form" has been reviewed and approved by the customer.
A PPAP process or equivalent requires significant investment in time and
resources. Again, the process could be improved by reducing some of the
time-consuming aspects associated with the manual process of hard-copy
documentation preparation, distribution, and manual status tracking, notification,
|HOW DOES A DOCUMENT CONTROL SOFTWARE
- ELECTRONIC APPROVAL, DISTRIBUTION, REVISION,
Document control software can be used for electronic approval of
documents. Documents can be electronically sent for approval in
pre-defined and approved sequences in accordance with a company’s
approval matrix. Reviewers and approvers on the approval sequences
can be set-up in both serial and parallel steps.
Approvers can receive email notification that documents are waiting
for their review and approval. During and after the approval process,
notifications can be sent to affected employees. Escalation rules
can be established that move the document to another person after
a specified time period has expired to ensure documents keep flowing
if someone is not available. Document control procedures can be
written using a "process approach" that describe the electronic
activities to initiate, review, approve, and update controlled documents.
If hardcopies are still needed at point of use, a company can either
maintain "controlled copy" locations that can be tracked
in the document control software or allow controlled printing within
pre-defined restrictions. For example, many companies use watermarking,
date/time stamping, or other hard-copy stamping to control hard-copy
distribution and usage. Many companies enforce a policy of electronic
"sole authority" where employees have to access documents
maintained in the document control software to find the current
- CONTROL OF USER RIGHTS
Rights-based electronic systems can control access and user rights.
Basic users may only have view rights to released documents related
to their area. Advanced users can be given appropriate rights to
create new documents and initiate changes. In old paper systems,
all changes were sent through document control personnel who were
often an overloaded bottleneck in the process. In rights-based document
control software, advanced users can be given appropriate access
and rights to create new documents or make a new revision in draft
areas only. An advanced user can send a new document or revision
for approval and document control personnel can be included in the
review and release process to ensure process integrity. After approval,
the document is moved into a released environment where basic users
can view the new or updated document. Older versions can be automatically
"archived" for historical purposes.
-AUTOMATIC NOTIFICATION AND TRAINING
Most electronic systems have the capability to send email notifications
to reviewers and approvers. Users affected by document changes can
be included in routing sequences for training purposes prior to
or after release of a document. Electronic records are kept of the
approval process and any additional training or notification events
by user id and date/time.
Basic electronic documents control systems carry out most of the
review of documents outside of the system and only use "approval
routes" for processing documents from Draft to Released phases.
In these systems, a document is entered into the system after external
collaboration of reviewers. An electronic copy is created after
reviewing and compiling the redlines of a hardcopy that has been
hand-routed in a serial process. After external review, the document
is entered into the system and routed electronically for approval.
During the approval route, the document is "locked" down
so that the first approver sees the same document as the final approver.
Approval routes are usually pre-defined based on the company’s document
approval matrix and cannot be modified during the approval process.
Advanced electronic document control systems allow documents
to be electronically sent on a "collaboration route" where collaborators
can review a document, make proposed changes, redlines, or add their versions
prior to being sent for approval. Advanced document control systems have
the flexibility to add collaborators and even change the sequence of steps
on a collaboration route while in process. A final collaborator can review
the redlined document/s, compile a final version, and send the new/revised
document on an "approval route" where approvers can add their
comments and electronically approve or reject.
During this process, email notifications can be automatically sent to
those on the route and to the originator as the document flows through
the route steps. Management and system users can monitor the status of
the document along the collaboration and approval process. Route participants
can receive daily reminders of pending tasks. Automatic notification,
escalation, and tracking visibility can significantly decrease collaboration
and approval process cycle time.
- CONTROLLED WEB ACCESS
Advanced document control systems are now including controlled web access
to documents. Users can be given controlled access to the document control
system over the Internet with document searching and viewing capabilities.
In addition, remote users can participate in collaboration and approval
processes. This allows traveling or off-site employees to stay involved
and keep the document control and change management process moving effectively.
Many companies have taken advantage of controlled web access to improve
supply chain and customer involvement in their change management process.
Do you wish you had a record of your suppliers being notified and reviewing
changes to relevant supplier documents? Would you like to electronically
send change requests to your customer/s for approval? With controlled
web access to documents, suppliers and customers can be added to route
steps for review and/or approval during a change process. An example of
the advantage of customer/supplier web access to documents can be found
in the automotive industry where suppliers are required to submit Production
Part Approval Process (PPAP) documents to their customer for change approval.
Documents like Drawings, Reports, Test Results, Control Plans, Flow Charts,
Capability Studies, etc. can be compiled in a cross-functional collaboration
route and then electronically routed internally and externally for review
and approval in accordance with customer requirements.
BENEFITS OF DOCUMENT CONTROL SOFTWARE SOLUTIONS
There are many benefits that can be achieved by implementing an electronic
document control and change management system. Mary Retcher, Corporate
QA Administrator, at Defiance Metals in Defiance, Ohio, outlines the following
benefits her company has received:
"There are so many positive things that have happened from this!
- Cut down on labor hours
- Reduced supply costs
- ROI in less than 6 months
- No QS 9000 assessment audit findings for four plants since we installed
- Allowed us to benchmark between our sister plants without leaving
- I now do not have to travel as often due to being able to monitor
document control, etc. from Corporate headquarters.
- Now have corporate control plans, forms, etc.
- No more long Core Team meetings to approve document changes. Time
- Everyone knows when to change the master documents in their department
with the document approval E-mail notice."
Reducing Cycle Time
Cycle time reduction is just one of the many benefits companies are experiencing
when implementing an electronic document control solution, according to
Russ Garrison, Senior Vice President, Operations, at the Seattle-based
medical device manufacturer, Diagnostic Ultrasound Corporation. "Prior
to [implementing an Electronic Document Control System] we had (2) full
time administrators focusing on the change control process. Although
our goal was to maintain a 3-day approval cycle -- we rarely attained
this goal. The document control process was a major source of employee
contention and management attention. There were less than 5 people
that could successfully implement a change using the old system.
The document control process was a major bottleneck for the introduction
of new products. In January 2000, we implemented [an Electronic Document
Control System], and realized immediate improvement in our overall processes.
In addition to [implementing an Electronic Document Control System], the
company also trained more people on the change process. Every functional
department has a person capable of changing a document and launching it
through [the Electronic Document Control System]. We are now able
to maintain three times the volume of document changes with only five
hours a week of document control support. Our approval cycle has
been reduced to 24 hours. [The Electronic Document Control System]
has enabled us to slay the dragon of cycle time which is the killer of
most document control processes. It feels good to be able to empower
our employees by giving them the power to make a change and access to
the documentation they need to do their jobs."
Process cycle times can be improved dramatically, according to Ray Goulet,
Quality Assurance Engineer at Marchi Systems, Inc., a thermal systems
manufacturer in Redwood City, CA. "Within three weeks of implementing
an electronic document control solution, I was able to report to our management
staff that the ECO cycle had been cut from several days to just a couple
Document control software can be used as a tool to help meet the requirements
of ISO 9001:2000 and ISO/TS 16949:2002. While companies can meet these
requirements using paper-based systems, an increasing number of companies
are moving from hard-copy and basic electronic systems to advanced document
control software solutions.
Some of the advantages of using document control software may include
increased security and rights-based access, improved searchability of
current and historical documents/records including approvals and change
history, reduced hardcopy storage requirements, reduced change process
cycle-time, and automatic electronic distribution of current documents
and removal of obsolete documents. Web-based systems also offer the advantage
of remote access and platform independence.
Potential issues include the cost of purchase and implementation including
software, hardware, and training expenses. A company may be able to offset
these costs by quantifying the reduction in paper-based resources with
increased control and efficiency.
About the author
Roger Crist, CQM, CQE, CQA, has been a quality engineer, quality manager,
quality auditor and quality trainer/consultant. He has also been an assistant
professor at Weber State University and an ISO 9000/QS-9000 auditor. Crist
has a master's degree in technology management and a bachelor's degree
in manufacturing. He is currently employed as the professional services
director at Document Control Systems Inc., in Salt Lake City, Utah. E-mail
him at firstname.lastname@example.org