Using Document Control Software to Meet ISO Document Control Requirements

Two ISO quality system standards, ISO Q9001:2000 and ISO/TS 16949:2002, have recently been released. The ISO 9001:2000 "Quality Management Systems – Requirements" standard is an update of the ISO 9000 series last revised in 1994. ISO/TS 16949 is a new international standard for "automotive production and relevant service part organizations" incorporating the new ISO 9001:2000 requirements with existing QS-9000 requirements. Document control has been and continues to be a key element in the new ISO quality management system (QMS) standards. Without reliable control of procedures and records, a company’s QMS integrity will fail – as a practical business matter and as an auditable compliant system.

An increasing number of software options are available that help companies meet document control requirements. This article will review general document control principles updated in the new standards and the potential of using document control software solutions to help meet the new requirements.

WHAT DOCUMENTATION IS REQUIRED?

The updated ISO 9001:2000 standard specifically requires a Quality Policy and Quality Objectives, a Quality Manual, and Documented Procedures. Documented procedures include specific documents identified in the ISO 9001:2000 standard and other documents needed to ensure effective Process Planning, Operation and Control (Element 4.2.1).

The "minimum" procedures specifically required by the updated ISO 9001:2000 standard include the following:

• Document Control Procedure (4.2.3).
• Records Control Procedure (4.2.4).
• Internal Audit Procedure (8.2.2).
• Control of Nonconforming Product Procedure (8.3).
• Corrective Action Procedure (8.5.2)
• Preventive Action Procedure (8.5.3).

To determine what additional documents are needed, the new standard emphasizes a "process approach" and a "system approach" to documenting and managing the QMS. A company must identify and document "needed" individual and system processes (activities with inputs and outputs) including linked inter-departmental activities and interactions. The quality management principles underlying the requirements in the new standard imply that control and synergy can only be achieved by understanding, monitoring, and improving system-wide processes with their inherent cross-functional interdependencies and linkages. The ISO 9004:2000 "Guideline" standard describes these and other quality management principles that are "integrated in the contents" of the requirements.

"Needed" QMS documentation should be appropriate for the size and type of the organization, the complexity and interaction of processes, and the competence of personnel.

BASIC ELECTRONIC SYSTEMS

Most companies begin developing basic electronic document control systems using network locations and email systems. A hard-copy document control system will usually begin to become "electronic" by establishing directories or folders of documents usually by Department (Quality, Manufacturing, Engineering, etc.) or Document Type (Procedures, Work Instructions, Forms, Drawings, etc.). Network administrators will often control access and security to documents by defining network location "rights" such as "write" and "read-only" to specified employees. Companies may even begin "routing" documents as attachments in emails to reviewers and approvers. However, electronic storage and sending documents through email does not necessarily mean documents are controlled and routed effectively.

A company will soon find that storing files in network directories and sending emails with attachments as a "routing" to reviewers and approvers in basic electronic document control system has many limitations. Network security categories are broad in the areas of access control and rights. For example, a user will usually have "all or nothing" in terms of access to documents and rights to change documents. Also, a limited number of users, usually document control personnel, will have the broad right to "write" or change documents. Network storage still means that document control is a manually intensive funnel through which all changes must be initiated and tracked.

In a basic electronic system, Document Control administrators may send files electronically to reviewers and approvers through a email system. However, the sequence of review/approval still has to be monitored manually. Also, electronic signoff can only be used by assuming that signoff through email is allowable and secure. The FDA has released a standard for electronic signatures (21CFR Part 11).

Tracking of documents sent, comments made by reviewers/approvers, and the final approval history are not automatically accessible in a manual email routing system. Even if documents are sent through email, system administrators must manually track, update, and communicate the review and approval feedback they receive (open loop system). Also, there are no automatic notifications to reviewers/approvers in an open loop email system. Administrators must still manually remind the "bottlenecks" to signoff and notify change initiators of the approval status and notify those affected when the change becomes effective - the routing of documents continues to be a manually intensive process in a basic electronic system.

ADVANCED ELECTRONIC DOCUMENT CONTROL

There are many general and dedicated software packages available for document control solutions. Most of the software that is available for document control has been an added option to an existing software program designed for another purpose. For example, many current document control software programs were broadly designed for Enterprise Resource Planning (ERP), Work Flow Management, or Email communications and added "document control" capabilities. Some packages were originally designed to help a company comply with quality standards like ISO 9000 and added options for document control, calibration, corrective action, etc. Of course, there are even software options specifically designed for document control that offer a variety of document storage, routing, and approval options. Most of the document control solutions available, whether add-on options or dedicated solutions, will have some form of electronic document routing and email notification capability.

A variety of system architectures and requirements accompany advanced electronic document control options that will affect resulting functionality, costing and ease of implementation. The higher-end document control packages will most likely be part of a program that has potentially been integrated with other areas of the company’s data driven systems like inventory management, MRP, production control, etc. These higher-end packages may require substantial investment in additional server hardware and database resources. The higher-end systems offer the complete integration of a company’s document and data control but with resulting complexity and cost. The system cost will also be based on such things as how much hardware/database resources must be added to the existing system, the number of users that will be concurrently accessing the system, and the desired performance level of the system.

The lower-end options include document control programs that help administer the existing basic electronic system by simply developing a "links" to the locations where the documents are stored on the network and helping track revision levels and approval status. Lower-end systems may be solely located on an administrator’s computer requiring only a single installation, but may not have automatic routing, approval, and communication capabilities.

In the middle of the road electronic document control options are systems that offer "client/server architecture" with automatic routing and notifications. The main document control program may be located on a central server with users accessing through their local networked computers. Many document control software packages increase document access control and security by storing documents in a database located on a server. In this method, a master copy of the document is compressed and stored in the database and the document control program is an interface between the user and the master copy. These software packages will usually be compatible with the most common databases that are being used (ie. SQL, Oracle, etc.). Although not directly integrated with other company systems, middle-of-the road packages may offer automatic routing and email notifications.

Many middle and higher-end packages are now offering internet access for document control users. Remote users without network access can be included in electronic access to documents including routing, approvals, and notifications. Instead of a client/server access to stored documents, users access the company’s document control software and database located on the server through their web browser. Advanced electronic document control packages with web capability allow secure access to documents through document control software that automatically publishes the most current revision of a document and removes obsolete versions. Electronic routing to supply chain partners with electronic signature capability is a powerful tool that document control software packages may provide.

TRADITIONAL DOCUMENT CONTROL PROCESSES

In paper and even basic electronic systems, Document Control and/or Engineering Change administrators typically receive change information in redlined hard-copy form. Many companies have a Document Change or Engineering Change Forms that may accompany the redlined documents. If Engineering personnel are required to initiate their own Engineering Change Form, they are usually required to contact Engineering Change administrators to get the next sequential Document or Engineering Change Number. At some point, Document Control or Engineering Change administrators become involved in creating a "change package" that contains the changed document/s, any required form/s, and the "routing" information.

"Routes" are the pre-defined steps and people that the "change package" will be sent or given to for review and approval. If the company is ISO 9001 or ISO/TS 16949 certified or compliant, it will usually have a matrix of types of documents and which functions/positions are required to review and approve new issues or changes to the various document types. Companies that do not use electronic means usually have "serial steps" in their routes, meaning they are sent or hand-carried to reviewers/approvers one after another until complete. If more than one person is to receive information at a time (a "parallel step"), Doc Control personnel must make copies of the change package in a manual process. Serial steps in a manual process are usually used to allow each reviewer/approver to make changes or comments that subsequent reviewers/approvers can read. Significant time and resources are spent in preparing and routing the change documents for review and approval. Bottlenecks include the time spent copying and distributing change packages, manually tracking and reporting status, waiting for key personnel to sign-off especially if they are not in the originating facility, and manually re-distributing, communicating changes, and ensuring training is performed after approvals are received.

Besides basic Document and Engineering Change processes, other processes require routing of documents or information. For example, if a company has a Corrective Action process, they need to have the ability to initiate and assign Corrective Action Requests (CAR’s) to responsible individuals or departments. In ISO-based companies, the Corrective Action process will include a review step at the completion of corrective actions to verify the effectiveness of the actions documented in the CAR. Internal or external auditors may perform the corrective action review function. Routing of the CAR information from initiators to responsible parties and reviewers usually requires a Corrective Action administrator that ensures corrective actions are being assigned, performed, reviewed, and closed in a timely manner. Again, similar to Doc Control and Engineering Change processes, the administration of the Corrective Action process is typically manually intensive and requires constant review and updating to ensure all activities are being completed.

Other processes that require routing of documentation relate to Supply Chain Management. In a total quality system, there is a need for strong customer and supplier communications including review and approval of initial requirements and when changes are made to products/processes. An example of this in the automotive industry is the QS-9000 Production Part Approval Process (PPAP). Suppliers are required to submit a change package to their customer/s when a product/process is started or revised after approval. The supplier cannot implement any changes until the "submission" and a "warrant form" has been reviewed and approved by the customer. A PPAP process or equivalent requires significant investment in time and resources. Again, the process could be improved by reducing some of the time-consuming aspects associated with the manual process of hard-copy documentation preparation, distribution, and manual status tracking, notification, and reporting.

Advanced electronic document control systems allow documents to be electronically sent on a "collaboration route" where collaborators can review a document, make proposed changes, redlines, or add their versions prior to being sent for approval. Advanced document control systems have the flexibility to add collaborators and even change the sequence of steps on a collaboration route while in process. A final collaborator can review the redlined document/s, compile a final version, and send the new/revised document on an "approval route" where approvers can add their comments and electronically approve or reject.

During this process, email notifications can be automatically sent to those on the route and to the originator as the document flows through the route steps. Management and system users can monitor the status of the document along the collaboration and approval process. Route participants can receive daily reminders of pending tasks. Automatic notification, escalation, and tracking visibility can significantly decrease collaboration and approval process cycle time.

- CONTROLLED WEB ACCESS

Advanced document control systems are now including controlled web access to documents. Users can be given controlled access to the document control system over the Internet with document searching and viewing capabilities. In addition, remote users can participate in collaboration and approval processes. This allows traveling or off-site employees to stay involved and keep the document control and change management process moving effectively.

Many companies have taken advantage of controlled web access to improve supply chain and customer involvement in their change management process. Do you wish you had a record of your suppliers being notified and reviewing changes to relevant supplier documents? Would you like to electronically send change requests to your customer/s for approval? With controlled web access to documents, suppliers and customers can be added to route steps for review and/or approval during a change process. An example of the advantage of customer/supplier web access to documents can be found in the automotive industry where suppliers are required to submit Production Part Approval Process (PPAP) documents to their customer for change approval. Documents like Drawings, Reports, Test Results, Control Plans, Flow Charts, Capability Studies, etc. can be compiled in a cross-functional collaboration route and then electronically routed internally and externally for review and approval in accordance with customer requirements.

BENEFITS OF DOCUMENT CONTROL SOFTWARE SOLUTIONS

There are many benefits that can be achieved by implementing an electronic document control and change management system. Mary Retcher, Corporate QA Administrator, at Defiance Metals in Defiance, Ohio, outlines the following benefits her company has received:

"There are so many positive things that have happened from this!

1. Cut down on labor hours
2. Reduced supply costs
3. ROI in less than 6 months
4. No QS 9000 assessment audit findings for four plants since we installed this software.
5. Allowed us to benchmark between our sister plants without leaving our desks.
6. I now do not have to travel as often due to being able to monitor document control, etc. from Corporate headquarters.
7. Now have corporate control plans, forms, etc.
8. No more long Core Team meetings to approve document changes. Time is money.
9. Everyone knows when to change the master documents in their department with the document approval E-mail notice."

Reducing Cycle Time

Cycle time reduction is just one of the many benefits companies are experiencing when implementing an electronic document control solution, according to Russ Garrison, Senior Vice President, Operations, at the Seattle-based medical device manufacturer, Diagnostic Ultrasound Corporation. "Prior to [implementing an Electronic Document Control System] we had (2) full time administrators focusing on the change control process.  Although our goal was to maintain a 3-day approval cycle -- we rarely attained this goal.  The document control process was a major source of employee contention and management attention.  There were less than 5 people that could successfully implement a change using the old system.  The document control process was a major bottleneck for the introduction of new products. In January 2000, we implemented [an Electronic Document Control System], and realized immediate improvement in our overall processes.  In addition to [implementing an Electronic Document Control System], the company also trained more people on the change process.  Every functional department has a person capable of changing a document and launching it through [the Electronic Document Control System].  We are now able to maintain three times the volume of document changes with only five hours a week of document control support.  Our approval cycle has been reduced to 24 hours.  [The Electronic Document Control System] has enabled us to slay the dragon of cycle time which is the killer of most document control processes.  It feels good to be able to empower our employees by giving them the power to make a change and access to the documentation they need to do their jobs."

Process cycle times can be improved dramatically, according to Ray Goulet, Quality Assurance Engineer at Marchi Systems, Inc., a thermal systems manufacturer in Redwood City, CA. "Within three weeks of implementing an electronic document control solution, I was able to report to our management staff that the ECO cycle had been cut from several days to just a couple hours."

SUMMARY

Document control software can be used as a tool to help meet the requirements of ISO 9001:2000 and ISO/TS 16949:2002. While companies can meet these requirements using paper-based systems, an increasing number of companies are moving from hard-copy and basic electronic systems to advanced document control software solutions.

Some of the advantages of using document control software may include increased security and rights-based access, improved searchability of current and historical documents/records including approvals and change history, reduced hardcopy storage requirements, reduced change process cycle-time, and automatic electronic distribution of current documents and removal of obsolete documents. Web-based systems also offer the advantage of remote access and platform independence.

Potential issues include the cost of purchase and implementation including software, hardware, and training expenses. A company may be able to offset these costs by quantifying the reduction in paper-based resources with increased control and efficiency.

About the author

Roger Crist, CQM, CQE, CQA, has been a quality engineer, quality manager, quality auditor and quality trainer/consultant. He has also been an assistant professor at Weber State University and an ISO 9000/QS-9000 auditor. Crist has a master's degree in technology management and a bachelor's degree in manufacturing. He is currently employed as the professional services director at Document Control Systems Inc., in Salt Lake City, Utah. E-mail him at [email protected] .