In many standards that exist there are often statements such as “there must be a procedure to control training records”. Whilst I am sure that none of you will disagree with a statement such as this there is an element of unclarity in the statement itself. It surrounds the use of the word “procedure“ and what is meant by a procedure. There is a difference between having a “procedure” and having a “documented procedure“. If there is a documented procedure then the procedure needs to be described in a controlled document – normally called a Standard Operating Procedure or SOP. However, a procedure may not necessarily need to be controlled by an SOP. For example, everyone has a procedure for getting in the car in the morning (unlock the car, open the door, adjust the seat, turn the key, and so on) yet this is not subject to a documented procedure. Here it can be seen that it is not always necessary to have a documented procedure for individuals to be able to perform a task properly. In all my working life I have never had someone report late for work because they didn’t know how to start the car in the morning! Hundreds of millions of people successfully complete this task or procedure every morning – without the need for a documented procedure.
Generally in standards if an activity this critical then the standard requires the activity to be subject to a documented procedure. For example, in ISO 9001, there are 6 instances where a documented procedure is required (control of documents, control of records, internal audit, control of non-conforming product, corrective action and preventive action). This does not mean that you don’t need to have any other procedures, as of course an organisation can choose to have additional documented procedures to control their activities as it sees fit.
The reason for highlighting this is that if you are ever involved in writing standards or corporate policies then you need to be clear in the difference between the use of the words “procedure” and “documented procedure”. Why is this important you may ask? Well supposing you are auditing an organisation and you are looking at training records. You look at your standard or corporate policy that you are auditing against and it states “there must be a procedure to control training records”. What do you want to see? Do you want to see the SOP for controlling training records? If you do – and they say that they do not have one – then you may be tempted to raise a non-conformity. In this case you cannot, because it does not say “there must be a documented procedure to control training records”. If it did, then they must have an SOP to describe how they control training records. If they do not have an SOP, then it is not automatically a non-conformity. The auditor now needs to see how, in this case, training records are controlled. They may be controlled very well by a number of ways – a small number of highly trained staff, process flow charts, diagrams, etc. The important thing to consider here is are training records controlled properly.
So, in summary, if you are involved in writing standards, policies and guidelines be careful with your wording of them. If there are certain activities that you want to be subject to an SOP then use the words “documented procedure”. If you simply want there to be a mechanism in place to control an activity then use the word “procedure”, or even better (and to aid clarity) use the words “process”, “system” or “mechanism”. In other words, it is better to say “there must be a process (or system or mechanism) to control training records”. You can, if you like, follow this up with an additional statement to really make it clear: “there must be a process (or system or mechanism) to control training records and this must be detailed in a documented procedure”.