Clause 8.5.6 Control of Changes (explained)

Table of Contents

• Reasons for Making Changes
• The Clause Requirements
• The Need for Review
• For auditors:

Controlling changes, does that sound familiar? It should, because you’ve met a very similar phrase back in clause 6.3 entitled ‘Planning of Changes’. The requirements for change back in clause 6.3 are for planned, proactive changes whereas the requirements for this clause are more concentrated specifically on production and service delivery. These changes are more reactive in nature and often occur in real-time.

These changes deal with situations as they occur and are required to ensure that production or service delivery can progress uninterrupted if possible. Although they are reactive, that does not mean that they are not planned, considered and controlled. It would be very unwise to implement snap decisions during real-time production or service delivery in most circumstances. Let’s not forget, that you have already made strategic details plans for production or service delivery according to the requirements of clause 8.5.1; Control of production and service provision. You can think of the requirements of clause 8.5.6 as small ‘tweaks’ that might be required to iron out any unforeseen problems with the plans made at clause 8.5.1.

Reasons for Making Changes

The reasons for making changes during production or service delivery can be many and might include, but are not limited to:

• Changes in requirements from the customer.
• Changes in requirements from statutory or regulatory bodies.
• Delivery dates and times.
• Changes in material type or availability.
• Machine failures or adaptability problems.
• Changes in software requirements.
• Environmental conditions such as the weather.
• The availability of trained staff.
• Supply chain failures.
  
  

Changes implemented at this stage might result in modifications and changes to the initial design and development plans that were made as per the requirements of clause 8.3.6 Design and Development Changes. If changes are revised, authorised and implemented then the management system should be updated to reflect the change. Of course, this whole concept fits into the ethos that is the lifeblood of the management system known as continual improvement. It’s also worth mentioning that change can often be the result of your PESTLE analysis activities.

This clause does require the retention of documented information specifically for:

The Clause Requirements

• A review of the changes; did the change produce the expected result? Could you consider the result of the change an improvement or just a necessity that ensured the integrity of production or service delivery? For example, you might have made a ‘running repair’ to a machine just so that the current production activity could complete before making a permanent repair or machine replacement after the current production run has finished. Or, you might have to use some temporary emergency staff because your permanent staff are off work due to illness. After reviewing the changes during a management review, does the change then become permanent and considered a corrective action that resulted in continual improvement? Or, after a test print of packaging, you have identified that the correct Pantone ink reference colour is incorrect and you need to make a change to the design plans etc.
  
  
• Change authorisation; here is where the concept of a risk-based approach is relevant again. If the consequences of the proposed change have high levels of risk attached to it then the person authorising the change needs to be in a position of high authority. For example, if the prosed change might result in hundreds of thousands of nonconforming products due to a design fault, that could be very costly indeed, especially for high-value products such as cars etc. Conversely, if the required change is a low risk by nature such as the use of an alternative cleaning product for use in a service cleaning contract, then the shift manager would authorise the change. Roles, responsibilities and authorities need to be clearly established and communicated concerning change management activities.
  
  
• Actions arising from review; this is where a revision of the change is conducted to decide if the change was for the better and contributed towards continual improvement, should further change be required or should we go back to the old way? Detailed analysis might be required to review the consequences of the change in both the short and long term. The benefits (or not) of a change in the short term are easily identifiable but not so simple in the long term. Looking into the future is full of uncertainties that might affect the change such as changes to regulations, interest rates, customer requirements, availability of materials, environmental conditions, skilled staff and competitors etc.
  
  

The Need for Review

Important decisions require formal reviews involving top management at a management review meeting. Permanent changes should be incorporated into the management system and documented appropriately. The change should then go through a timely audit process to test if it has been implemented, documented, communicated and trained out effectively during a 9001:2015 training course. One can see how building a management system is a dynamic, iterative process. One of planning (6.1), implementing (8.1), supporting (7.1), monitoring (9.1), testing (9.2), correcting (10.2), and improving (10.3) are all supported by effective leadership (5.1). Of course, that was the long-hand way of describing the PDCA process.

The required documentation for the change does not need to be overly complicated. To complement the three points listed above, I would also retain records of auditing, monitoring, communication, training and any changes to roles, responsibilities and authorities as a result of the change.

For auditors:

• Review any records relating to change.
• Check authorities related to the change.
• For permanent changes, check if the management system was updated.
• Check that the change was communicated, monitored and trained out if necessary.
• If the change was the result of corrective actions, check the process through to continual improvement etc.
• Check documentation records for change review, authorisation and actions arising from post-change review meetings.
  
  

Other questions that I will answer in future articles:

• What is change management in ISO 9001?
• What is work instruction in ISO?
• Is the change control part of QMS?
• What is the purpose of change control?
• How do you handle planned changes with QMS?
• What is the management of change procedure?
• What are the external factors responsible for the change?