ISO 9000 Documentation

By Todd Vesty

One of the most daunting aspects of an ISO 9000 project is the documentation. Many managers stay awake nights with visions of ream upon ream of bureaucratic paperwork. Often, people are forced to re-visit old fears from high school English class, where their papers were not well received. While it is possible that these fears will be realized, it is not really necessary. There are several techniques that can make the process of creating a documented quality system easier, more effective and less intimidating.

These techniques range from simply using the appropriate tools, and applying the appropriate structure, to using the right personnel. As always, proper planning, clearly defining responsibilities, and controlling the process are imperative in its success. There are five areas that must be addressed in order to develop a quality system with the least headaches. These are process definition, structure, tools, format/grammar and flexibility.

Process Definition

Many pundits will tell you that each person at the company must write their own procedures in order for them to be effective and appropriate. They argue that no one knows the process better than the person who performs it every day and that if they are not the one’s to document it, they will have no ownership. While this argument has some merit, it only works well if everyone at your company is a capable writer with a proper word processor and has the time and inclination to write procedures.

The reality is probably that much of the staff, even those at management level, aren’t capable writers and don’t have access to or sufficient practice on word processors. Involving many people in the construction of a set of documentation will yield different styles, levels of detail, formats, etc. creating considerable problems for the person responsible for pulling it all together. This person has probably already invested considerable time and effort in the training and support of people who will likely never write another document for the organization. In addition, few people have the time to devote to procedure writing. Because of this, everyone’s involvement is a goal that is unachievable at most organizations.

Who then, should write the procedures? The company should designate a person who is responsible for the generation of procedures. That person should decide format and structure for the procedures and will do most, if not all of the writing. Designating a single person assures that the procedures are written in a timely manner without excuses and without people shirking their responsibilities. It also enables the company to assign a capable writer with the appropriate skills to determine the processes involved, identify the right level of detail, and document them in such a way as to avoid the “ownership” issue. Finally, having a single person write the procedures ensures that there is a consistent format and structure. This is one area where considerable benefit can be achieved with the use of an outside consultant. This frees up internal resources to focus on the key purposes of the business and ensures an expert job.

The remaining problem is how to write the procedures. The person writing the procedures must ensure that the process is accurately depicted. This is typically done by interviewing the staff in the area for which the procedure is being written. The interview is used to gather needed information about the process and to determine how compliant the process is. It also allows the staff to have input into the procedure, so they don’t feel “out of the loop” and can feel “ownership” of the documents once created. From the information gathered in the interviews, the writer writes the procedure, reviews and edits it with the staff.


Before writing the documentation, it is important to determine the structure. It is a very common mistake to get the structure wrong and usually occurs in two ways. The first is having too many, too few or improperly structured levels of documentation. The second is structuring the documentation around the standard as opposed to the business.

A proper ISO 9000 quality system is written in three levels. Level one consists of the Quality Policies. This usually takes the form of a Quality Manual. Level two consists of the standard operating procedures. Level three refers to the work instructions, checklists, forms, and other task specific documentation. This is the structure which has proven successful the world over and is alluded to in ISO 100013. Some consider that records are the fourth level, but this is not the case. Records are evidence of facts and history; they are not documents that are maintained up to date. Once a form is filled and filed away it is not pulled out a year later because the format of the form has changed. The format of the form is a level three document but once filled in, it becomes a record. Yes, records are part of the “documentation” of the system but it is a mistake to assign them a level and assigning them a level serves to confuse the important difference between and procedure and a record.

There is often some confusion about what a quality manual is. Often, the company will bundle its entire quality system including procedures and forms into one manual and call it the Quality Manual. Although this is one possible definition, it does not help an organized structure. A Quality Manual is a document that describes the policies for quality, defines the structure of the quality system and defines the structure of the organization and responsibilities for employees. It does not include detail of operations and should avoid the specifics of procedures.

A typical Quality Manual would include several sections. First, it would define the structure of the organization. It might do this by including and organizational chart and by defining the responsibilities of key personnel. It would also describe the structure of the documentation used in the quality system. Finally it would reiterate each requirement of the standards and state briefly how they will be addressed. In many cases, simple acknowledging the requirement and stating that they will be met is enough. Again, the Quality Manual is not the place to describe specific procedures.

This brings us to level two. Level two refers to the procedures. These describe how the company operates on a department by department basis. Procedures typically do not include detailed task specific, or order specific instructions but focus on the management level information. How is the department organized? What information is received? What happens with that information? What tasks are performed? What reviews take place? And where does information go or get filed?

When writing procedures, it is important to structure them around your business, not around the standard. Too many organizations take the easy route by generating one procedure for each element of the standard. If you don’t have a product identification and traceability department, then you shouldn’t have a product identification and traceability procedure. This requirement of the standard should be included in your other procedures where it applies. Consequently it is clear that when procedures have been structured around the standard, the system has been designed to gain compliance, not to add value to the way the company is organized and managed.

Level three refers to the detail oriented, lower level documentation. This might include checklists, blank forms, task instructions, blueprints, drawings or order specific documentation. It does not include completed forms or other records.


Documenting an entire system is a sizable task. Before embarking on such a task, it is helpful to gather the appropriate tools. First, this means a current word processor. Having a modern computer and word processor will pay for itself in cost savings and avoided frustration. The modern word processor includes automated spell checking, grammar checking, and many formatting features.

Before diving into procedure writing, it is important to know how to use these features on your word processor. Before starting, experiment until you are comfortable using the word processor’s features. By doing this, you will be able to incorporate these features into your first documents, rather than having to incorporate them later.

A variety of software tools are available to help generate and manage ISO 9000 documentation and systems. Generation software suffers the danger of leaving you with a boiler plate system, twenty procedures and focussing on compliance. Management software can be useful as the sophistication of the requirement increases. Managing large numbers of instruments internally might warrant calibration control software, for instance. However, considerable sophistication already exists in current word processors, spreadsheets and databases that come with your computer. These tools are often expensive, sometimes complicated and do not always yield the promise.


When writing procedures, there’s no need to be Ernest Hemmingway. Writing procedures does not require creativity or a huge vocabulary. In fact, all of these things can hurt the process more than help it. The best procedures are simple, clear and concise. All you need to remember is to avoid passive voice and avoid excessive wordiness.

Passive voice makes procedures difficult to read, and should be avoided when possible. For example:

The Packing List will be signed by the Receiver and entered into the system. (passive voice)

The Receiver will sign the Packing List and enter it into the system. (active voice)

As you can see, the passive voice sentence is less clear and is longer.

Excessive wordiness or the use of complex words also makes procedures difficult to read. It is important to keep procedures simple and appropriate for their audience.

The Receiver will be cognizant of any discrepancy in the materials prior to signing the Packing List. (difficult to understand)

The Receiver will note any damage or defect in the materials before signing the Packing List. (easier to understand)


Another common mistake when creating documentation is to create rigid procedures that are difficult to follow and maintain. Procedures should be written in a manner that they are flexible and don’t paint you into a corner. Also, they should avoid hard references, complex numbering schemes and other unnecessary bureaucracy.

Several hard references are shown below:

If a nonconformance is found, the employee will document it according to SOP 4.14. rev 5

If a nonconformance is found, the employee will document it according to SOP 4.14

If a nonconformance is found, the employee will document it according to section 5.5 of this procedure.

All of these references pose problems. The first one references a procedure by number and references a revision. That means that every time the referenced procedure is updated, this procedure would have to change also. This is difficult to maintain and likely to be forgotten. The second one references the procedure by number only. This eliminates the revision problem, but is still subject to number changes. It is also difficult for the reader to follow. The third one may seem simple enough, but it may still pose a problem. If a section was added to the procedure before section 5.5, then the number would change and the reference would be wrong.

A more appropriate method follows:

If a nonconformance is found, the employee will document it according to the Corrective Action Procedures.

This is clear to the reader and is unlikely to require changes.

Many companies number their procedures. This practice is not necessarily a problem. It does, however, have the potential for problems. The most common problem is the use of ISO 9000 section numbers (“SOP 4.5 – Document Control”, “SOP 4.18 – Training”). This may deem logical, but there may be instances where there are several different procedures that address a single ISO clause. There may also be instances where a single procedure addresses several ISO clauses. How would these be numbered? In addition, the year 2000 revision of the ISO 9000 standard does away with the 4.X numbering system. This will make 4.X numbering systems obsolete. If your document numbering system is cumbersome, eliminate it. ISO doesn’t require document numbering.

Finally, it is important to write procedures in a flexible manner so that they don’t restrict your employees unnecessarily. In short, don’t make a rule unless it’s necessary.

The employee will retrieve the document and will stamp it in the upper left corner with a red “obsolete” stamp.

The employee will retrieve the document and will clearly mark it as obsolete.

The first statement would mean that you would have to train all of your employees to stamp in red in the upper left corner. You would also have to ensure that the employees have access to red ink and a stamp. Even after taking these steps, it is likely that the procedure often isn’t followed. The second statement provides the same protection, but does not restrict the manner in which the employee complies. It is just easier to follow.


ISO 9000 documentation is an involved task – it has to be! Done properly it will add value to your business. Before embarking on your own documentation investigate the situation thoroughly and ensure you have expertise in the subject and time and resources to see the project through. It will save you a lot of time and effort.

Finally, do not make the mistake of starting with the work instruction documentation. This is the most common and wasteful mistake of ISO 9000 projects. ISO 9000 does not call for any level three, work instruction documentation, unless it is necessary – and if its necessary, it already exists. This type of documentation may add value by better defining processes or enhancing training, but you are not doing it for ISO 9000 compliance. Make sure you want it.