Deciding how to control your documents can be difficult. ISO 9001, the quality management system (QMS) standard from the International Organization for Standardization (ISO), requires you maintain accurate and up-to-date procedures, but doesn’t give a lot of guidance on how to get there. Between the requirements and the implementation lie grey areas and confusion. Let’s take a look at the difference between what is required and what is a good idea in the world of document review.

When I say procedures, what does that include?

A procedure is a way of carrying out an activity; it explains who does what, where, and when; it’s a document that defines a process. ISO requires that your procedures, work instructions, etc. are always accurate and truly represent the steps to completing a process. How you ensure that accuracy is up to you.

A procedure could describe the process for obtaining customer feedback (e.g., using scheduled customer surveys, or calling customers and saying specific scripts). Review procedures to ensure workers have the most current, complete, and accurate information to do their job.

Do you have to review your procedures once a year?

As per ISO 9001, you do not have to review procedures once a year. How often you review procedures depends on the complexity of your business activities. Some people may decide to review their documents every two years and others every three years. In a company where processes are dynamic and procedures are constantly being revised, there may not even be a need for a formal review, since the procedures are probably being reviewed every time they are updated.

So, do I really need to review procedures periodically?

If your organization doesn’t update procedures very often or isn’t well-disciplined about updating procedures every time a process changes, then it may benefit from implementing a set review time.

I once audited an organization whose procedures were 3 years old. Basically it changed its processes and never went back to update its procedures. That was not good. A lot of the information wasn’t applicable anymore. It decided to implement a set review date every year. 

On the other hand, I audited a company with procedures that were 7 years old and still accurate because its business was not dynamic. In this case, even though everything was fine, the company decided to implement a review date of every three years; perhaps this would force it to consider better ways to do things, given that technology is always changing.

Periodically conduct employee surveys regarding the usability of procedures, and schedule times to monitor and review processes to measure the performance and effectiveness of the processes to identify opportunities for improvement.

What is the final word?

Hopefully you get the idea that there isn’t a right or wrong way to do document review. Remember that ensuring that your procedures, work instructions, and forms are true to what your company actually does is the ultimate goal; your organization must decide how to accomplish that goal.