4.2.4 Control of records

There is a difference between documents and records. Essentially, documents are used to describe or control how things are to be done and are capable of being revised to reflect changing circumstances. Records are generated as a result of some activity and are statements of facts existing at the time. Records can not be revised. For example: a form which is used for ordering products and /or services from vendors (purchase order) is a document. A completed document, say purchase order stating what has been ordered from the vendor is a record.

Other examples of records are minutes of management reviews, inspection records, quotations, customer orders, audit reports, training records, minutes of design review reports, completed nonconformity reports, corrective action records, preventive action reports etc.

Each organization should identify which records are used and a documented procedure should define how these records are identified, where they are stored, how they are retrieved, how they are protected, what their retention time is, and how they are disposed of. Organizations need to have a documented procedure for control of quality records.
You can use a suitable Enterprise Resource Planning software and reduce or even eliminate the need to prepare paper records. This will control all aspects of requirements of IO 9001 such as identification, storage, retrieval, protection and retention time.

Records are generated every minute, every day. You can not keep all of them forever and hence standard requires defining retention time. The retention time should take consideration of legal requirement, contractual requirement, warranty requirement etc. 

For example if a product caries a warranty of one year from date of sale, then records of production, quality etc. must be kept for at least (even more depending of type of product) two years as product may not be sold for one year from date of production or inspection.

A waiter at hotel takes customer order (waiter himself/herself records it), a turn key project manufacturer also takes order from its customer. Both these orders are records. Hotel can set retention period of one day for order (it can destroy after verification of total sale, total order, total billing and total deliveries from canteen at day end) but retention period of customer order in case of turn key projects may go over 10 years depending on contractual requirement (Take case of Suppliers' of Enron Power Corporation Project, Maharashtra, India, even after 20 years they have to keep records because of legal battles and other reasons).

Because the retention time could be very long, preserving records becomes important, so define preservation measures in a documented procedure.

Think of a record generated on 12th November of a year and its retention period if one year, technically 12th November next year record can be destroyed. But records are generated every day and it is not possible to take some records out of file and destroy them. So, define in a documented procedure, how records will be disposed.

Standard requires records to be legible, readily identifiable and retrievable. Here I would like you to give attention to term legible. Like in case of documented procedures to be legible, records should also be legible, meaning one should be able to read (if in words)/ view (if pictorial live video film) the contents and understand during its retention period.

When you read the standard, you will find reference to clause 4.2.4 within bracket at many places. These requirements call for recorded evidence.

Records required by the standard

Where clause number (4.2.4) appears in the bracket in the text of the ISO 9001: 2000 standard shall mean that the standard requires a record to demonstrate the compliance with this requirement and these records should be maintained as per the requirement of the clause 4.2.4 given above.

Following records are required by the standard. Though an organization may require additional records to demonstrate product conformity and enhance customer satisfaction.

This symbol  on the page below the clause number and heading at the top indicates that the clause requires a record to be maintained for audit purpose.

• 5.6.1 Management reviews
• 6.2.2 (e) Education, training, skills and experience
• 7.1 (d) Evidence that the realization processes and resulting product fulfill requirements
• 7.2.2 Results of the review of requirements relating to the product and actions arising from the review
• 7.3.2 Design and development inputs
• 7.3.4 Results of design and development reviews and any necessary actions
• 7.3.5 Results of design and development verification and any necessary actions
• 7.3.6 Results of design and development validation and any necessary action
• 7.3.7 Results of the review of design and development changes and any necessary actions
• 7.4.1 Results of supplier evaluations and actions arising from the evaluations
• 7.5.2 (d)  As required by the organization to demonstrate the validation of processes where the resulting output cannot be verified by subsequent monitoring or measurement
• 7.5.3 The unique identification of the product, where traceability is a requirement
• 7.5.4 Customer property that is lost, damaged or otherwise found to be unsuitable for use
• 7.6 (a) Standards used for calibration or verification of measuring equipment where no international or national measurement standards exist
• 7.6 Validity of previous results when measuring equipment is found not to conform with its requirements
• 7.6 Results of calibration and verification of measuring equipment
• 8.2.2 Internal audit results
• 8.2.4 Evidence of product conformity with the acceptance criteria and indication of the authority responsible for the release of the product
• 8.3 Nature of the product nonconformities and any subsequent actions taken, including concessions obtained
• 8.5.2 Results of corrective action
• 8.5.3 Results of preventive action

External Document Reference: Documentation Kit

Procedure for Control of records