Guidance on Clause 4.2 of ISO 9001:2008

The following comments are intended to assist users of ISO 9001:2008 in understanding the intent of the general documentation requirements of the International Standard.

a) Documented statements of a quality policy and objectives:

Requirements for the quality policy are defined in clause 5.3 of ISO 9001:2008. The documented quality policy has to be controlled according to the requirements of clause 4.2.3.

Note: Organizations that are revising their quality policy for the first time, or in order to meet the amended requirements in ISO 9001:2008, should pay particular attention to clause 4.2.3 (c), (d) and (g).

Requirements for quality objectives are defined in clause 5.4.1 of ISO 9001:2008. These documented quality objectives are also subject to the document control requirements of clause 4.2.3.

b) Quality Manual:

Clause 4.2.2 of ISO 9001:2008 specifies the minimum content for a quality manual. The format and structure of the manual is a decision for each organization, and will depend on the organization’s size, culture and complexity. Some organizations may choose to use the quality manual for other purposes besides that of simply documenting the QMS

A small organization may find it appropriate to include the description of its entire QMS within a single manual, including all the documented procedures required by the standard.

Large, multi-national organizations may need several manuals at the global, national or regional level, and a more complex hierarchy of documentation.

The quality manual is a document that has to be controlled in accordance with the requirements of clause 4.2.3.

c) Documented procedures:

ISO 9001:2008 specifically requires the organization to have “documented procedures” for the following six activities:

4.2.3 Control of documents

4.2.4 Control of records

8.2.2 Internal audit

8.3 Control of nonconforming product

8.5.2 Corrective action

8.5.3 Preventive action

These documented procedures have to be controlled in accordance with the requirements of clause 4.2.3 Some organizations may find it convenient to combine the procedure for several activities into a single documented procedure (for example, corrective action and preventive action). Others may choose to document a given activity by using more than one documented procedure (for example, internal audits). Both are acceptable.

Some organizations (particularly larger organizations, or those with more complex processes) may require additional documented procedures (particularly those relating to product realization processes) to implement an effective QMS.

Other organizations may require additional procedures, but the size and/or culture of the organization could enable these to be effectively implemented without necessarily being documented. However, in order to demonstrate compliance with ISO 9001:2008, the organization has to be able to provide objective evidence (not necessarily documented) that its QMS has been effectively implemented.

d) Documents needed by the organization to ensure the effective planning, operation and control of its processes:

In order for an organization to demonstrate the effective implementation of its QMS, it may be necessary to develop documents other than documented procedures. However, the only documents specifically mentioned in ISO 9001:2008 are:

- Quality policy (clause 4.2.1.a)

- Quality objectives (clause 4.2.1.a)

- Quality manual (clause 4.2.1.b)

There are several requirements of ISO 9001:2008 where an organization could add value to its QMS and demonstrate conformity by the preparation of other documents, even though the standard does not specifically require them. Examples

may include:

- Process maps, process flow charts and/or process descriptions

- Organization charts

- Specifications

- Work and/or test instructions

- Documents containing internal communications

- Production schedules

- Approved supplier lists

- Test and inspection plans

- Quality plans

All such documents have to be controlled in accordance with the requirements of clause 4.2.3 and/or 4.2.4, as applicable

e) Records:

Examples of records specifically required by ISO 9001:2008 are presented in Annex B.

Organizations are free to develop other records that may be needed to demonstrate conformity of their processes, products and quality management system.

Requirements for the control of records are different from those for other documents, and all records have to be controlled according to those of clause 4.2.4 of ISO 9001:2008.

Change In ISO 14001:2004 – Documentation

This clause has been updated to align it with ISO 19001:2004, but has not changed in intent. The listed EMS documentation now includes:

• the environmental policy,

• objectives and targets,

• a description of the scope of the EMS,

• a description of the main elements of the EMS and their interaction and reference to related documents, documents and records

• required by the standard, • documents and records determined by the organisation as necessary to ensure the effective planning, operation and control of processes that relate to the significant environmental aspects.

Formatting changes help align Clause 4.4.5 of ISO 14001:2004 with ISO 9001:2000. An additional clarification has been made to define records as a special type of document requiring control under Clause 4.5.4. A new addition to the requirements aims to ensure documents of external origin, (i.e. MSDS, permits) that are necessary to the system, are identified and their distribution is controlled.

Formatting changes help align Clause 4.4.5 of ISO 14001:2004 with ISO 9001:2000. An additional clarification has been made to define records as a special type of document requiring control under Clause 4.5.4. A new addition to the requirements aims to ensure documents of external origin, (i.e. MSDS, permits) that are necessary to the system, are identified and their distribution is controlled.

The revised standard requires documents required by the EMS and the standard to be controlled documents.

Note that “document” is included in the definitions, and includes its supporting medium which can be paper, magnetic, electronic or optical computer disc, photograph or master sample, or a combination thereof.

ISO 14001:2004 Evaluation of compliance

This clause has been separated from 4.5.1 and includes two sub-clauses, as well as clarification and an addition to the ISO 14001:1996 standard. Included in Clause 4.5.1 of ISO 14001:1996 was a requirement for the organisation to periodically evaluate compliance with relevant (now applicable) environmental legislation and regulations. This requirement has been retained in Clause 4.5.2.1 of the revised standard. In Clause 4.5.2.2, ISO 14001:2004 includes evaluation of compliance with other requirements to which the organisation subscribes, which was not specifically required by ISO 14001:1996. This clarification also includes a requirement for records of periodic evaluations of compliance to be kept.

The UK-based Institute of Environmental Management and Assessment (IEMA) has published an opinion that this means that compliance against each and every piece of legislation / regulation relating to an organisation’s environmental aspects will need to be evaluated before it can be considered to be in conformity with ISO 14001: 2004; it will not be acceptable for organisations to claim that the periodic evaluation will be covered by their internal EMS audit program at some future date.

This has always been one of the most difficult issues in ISO 14001:2004, and organisations will need to review and revise their compliance procedures to ensure that they meet these new requirements.