subject: Controlling Forms For Iso 9001 Qms [print this page] Auditing hundreds of companies of different sizes in various industries, I found that control of forms is one of the notorious issues with maintenance of ISO 9001:2008 QMS. Various companies, by a strange reason, treat forms differently than other instructions. This leaves forms not controlled. ISO 9001, element 4.2.3, requires: "Documents required by the quality management system shall be controlled." Now let's find out if a form is the same as a "document"
Organizations use forms and tables as lower-level documents. Often, there is no need to prepare a traditional "human language" instruction or a procedure with all its sections, such as scope, purpose and instructions if a simple table can result in the same output. Frequently auditors leave companies with nonconformities during audits of their QMS because forms are not controlled.
Repeatedly I discuss this issue with my clients. Regularly I hear the same answer "This is just a form." Honestly, I do not understand this! Why should a form be different from any other instruction or a procedure? How would one know that we need a form if it is not referenced in our ISO 9001 quality management structure? If forms are not controlled by your documentation system, and you decide to modify them, how can you be confident that you make changes to the latest revision? That will be difficult! Anyway what is a form? A quick exercise will help answer this question. If we have a list of directions telling us to:
- use a 2-column table
- enter your company name into the first column
- enter your company's URL into the second column
Most likely, we all would call this three-line guidance an instruction. So, since this is an instruction, it shall be controlled.
Here as another look at the same form. What if we were given a two-column table where the first column was called "You company name" and the second "Business URL" and we were asked to complete the form. Easy to imagine, we would enter our company's name and our URL in the table. It means that we interpreted this table as an "instruction".
If we concur that the 1st three-line instruction written in English was a "real" instruction that needs to be controlled, the other, blank form, resulting in the same output, must also be an instruction! Shouldn't this type of an instruction be controlled as well?
It appears that the puzzlement about forms and their control comes from the fact that forms serve 2 purposes. Blank forms are instructions in tabular language. After a form is filled out, it becomes a record. Records, as a rule, do not have a part or document number or a revision level. Records are controlled by different processes. Remember this and treat your forms as instructions controlled by your documentation procedure. There are a couple of tests you may take when you are thinking about not controlling your form.
- If you created a form within your ISO 9001 QMS and found it had been changed, would you like to know who did it and why?
- If you changed your form, would you like your employees use the most resent revision?
- If you were on vacation, would you like folks to be able to find your form just by using a reference to it?
Just one "Yes" answer to these questions shows that your form perhaps is a good candidate for a document control.
