How to build a documented ISO management system 

What is a documented management system? 

A management system brings together the policies, objectives, processes, responsibilities, resources and controls you use to achieve a particular result. It might focus on quality (ISO 9001), environmental performance (ISO 14001), occupational health and safety (ISO 45001) or several areas at once. 

You’ll create and control two broad types of documented information. The first tells people what should happen through policies, process maps, procedures, instructions, checklists and specifications. ISO standards often call this information you ‘maintain’, because you need to keep it current. The second provides evidence of what happened, such as completed forms, approvals, inspection results, meeting minutes, audit findings and system logs. This is information you ‘retain’ as a record. 

Documented information doesn’t have to be a Word file, although it certainly can be. It could be a controlled software workflow, video, photograph, dashboard or approved physical sample. What matters is that the right people can use it and that you can control, protect and retrieve it.  

Why build a documented management system? 

A good management system reduces the amount of work that depends on memory or one experienced employee. It gives people a shared methodology, clarifies who makes decisions and supports training, auditing and consistent delivery. 

It also gives you a clear basis for checking performance and improving how you work. Here are some of the things you need to consider when creating, and documenting, a management system:   

#1 Define the purpose and scope of your management system 

First, decide what you want the management system to achieve. If you’re working towards certification, identify the standard and edition you need to meet. If you’re working towards more than one standard, identify which requirements you can cover through the same processes and documents. 

Next, define your scope. State which products, services, activities, sites and teams the system covers. Consider applicable customer, legal, regulatory and contractual requirements, along with the needs of other relevant people and organisations, such as employees, owners and key suppliers. ISO standards call these ‘interested parties’. 

If a site, department or service sits outside your system, make that clear, too. And if a standard allows you to treat a requirement as inapplicable, record why it doesn’t apply. Don’t narrow the scope simply to keep a difficult process away from an auditor. Your scope should still accurately represent the activities that could affect the results your system is intended to achieve. 

You can now complete a gap analysis or requirements matrix. Work through each applicable requirement and record how you currently meet it, which process covers it, what evidence exists and what still needs to change. Assign an owner and deadline to every gap. 

Use this matrix to check coverage, but don’t use it as the structure of your management system. People shouldn’t have to translate clause numbers before they can work out what to do. Instead, it’s much better to build the system around your specific processes.  

#2 Map your organisation’s existing processes 

You aren’t starting from nothing. If your organisation already serves customers, manages employees, buys materials or delivers projects, it already has a management system. It’s just that some of it may be informal, inconsistent, not written down or poorly connected. 

Start by creating a high-level map of the processes within your scope. Include leadership processes such as setting objectives and management review. Then, add the operational processes that produce your product or service and support processes such as recruitment, training, purchasing, equipment maintenance, internal audit and corrective action. 

Then examine each process with the people who perform it. Don’t rely only on how a manager thinks it works. Observe the activity, follow a recent job or transaction and inspect the spreadsheets, emails, forms or software records. For each process, establish:  

• what the process should achieve, what starts it, what it needs and what it should produce 
• the main activities, decisions and handovers 
• who owns the process and who’s responsible for each stage 
• how people decide whether to accept, reject, approve or escalate something 
• the main risks and the controls used to manage them 
• the information, skills, equipment and other resources people need 
• the records created and the measures used to check performance 
• which processes supply what it needs and which depend on its result

Map the process as it works, including any unofficial variations and workarounds. You can then decide what works, what needs to be standardised and what fails to meet a requirement. If you document an idealised version, people will return to the real process once the implementation project ends.  

#3 Decide what documented information you need 

Once you’ve mapped your processes, decide what needs to be documented. Begin with the information required by your chosen standard, legislation, regulators, customers or contracts. Then add what people need to carry out the work consistently and show that the right controls were in place. 

Use risk to decide how much detail you need. An experienced employee completing a simple, stable task may only need a checklist or software prompt. You’ll usually need more detailed instructions and records when several people are involved, the work differs between sites or the task happens infrequently. 

Add more detail when an error could cause harm, non-compliance, data loss or an unacceptable product or service. Staff turnover, previous incidents and the need for formal approvals or traceability may also justify more documentation. 

Every document should have a clear purpose. It might guide someone through a task, support a decision, define an acceptable result or capture evidence. If it doesn’t do any of those things, it’s probably unnecessary paperwork. 

Choose a format that suits the job. A process map can show how work moves between roles, while a procedure can explain responsibilities and decisions. Use work instructions or checklists for specific tasks and specifications to define acceptable results. A flowchart may work better when a process has several possible routes. 

Keep the system easy to navigate. You don’t have to create a hefty management system manual, but a short one page guide can provide a useful starting point. It might bring together your scope, policy, objectives, overall process map and main responsibilities, with links to the relevant process information, instructions, forms and records.  

#4 Create practical management system documents 

Create each document with the process owner and the people who’ll use it, so it reflects both the intended result and how the work happens in practice. If a process needs a procedure, use what you established during process mapping to explain how it works, concentrating on the responsibilities, decisions and unusual situations users need to understand. 

Follow the order in which people perform the work and use language they’ll understand. Avoid vague instructions such as ‘check the order’. Explain what the person needs to check, what an acceptable result looks like and what to do if there’s a problem. Focus most of the detail on decisions, handovers, exceptions and important controls rather than describing every obvious step. 

Create any related forms or software workflows at the same time. For example, if someone must approve a supplier, make sure the form or workflow records the criteria considered, the decision, the approver’s name and the date. Don’t require evidence without giving people a practical way to capture it. 

Before approving the document, ask someone other than the author to use it for a real task. Notice where they hesitate, need help or look elsewhere for information, then revise the document before you release it.  

#5 Control your management system documents and records 

Many ISO management system standards follow the same core structure. In these standards, Clause 7.5 covers documented information, although your chosen standard may add further requirements. Make sure you:  

• clearly label each document with details such as its title, owner, date and version 
• have it reviewed and approved by someone with the right knowledge before use 
• make the current version easy for the right people to find 
• protect it from loss, damage, unauthorised access or accidental changes 
• approve updates and remove old versions from use 
• decide how long to keep records and how to dispose of them securely 
• control important external information, such as laws, standards, customer specifications, drawings and safety data sheets  

A simple document register can help you keep track of your controlled documents, their owners, current versions, locations and review arrangements. You can also use a retention schedule to record how long you need to keep different types of records. 

Base your review arrangements on risk and change. You might need to review a critical procedure at regular intervals, while only reviewing a stable document when something changes. Changes to legislation, equipment, software or customer requirements should trigger a review if they affect the process. So should incidents, complaints, nonconformities and audit findings that reveal a problem with the process. 

Finally, remember that you should update a procedure when the process changes, but a record should continue to show what happened at the time. If someone needs to correct a record, make the correction clear and preserve the original information or audit trail.  

#6 Implement your documented management system 

Approving a document doesn’t mean you’ve implemented the process. Before introducing the process, make sure people have the forms, software access, equipment and other resources they need to follow it. 

Roll out the system in manageable stages, starting with high-risk processes and those involving several teams or handovers. Tell people what’s changed, why it’s changed and when they need to start using the new process. Provide any necessary training, then check that they can apply what they’ve learned. 

Pay close attention to how the process works during the first few weeks. Look for unclear responsibilities, missing steps, repeated data entry and records that nobody uses. If something isn’t working, improve the process or its documentation. 

Most importantly, don’t create a separate ‘ISO process’ that people use only before an audit. Build the controls into the software and systems they already use, such as your CRM, helpdesk or project management platform. The workflows, approvals and audit trails within these systems can all form part of your documented information.  

#7 Audit, review and improve your management system 

Once the system has been running long enough to produce useful evidence, use internal audits to trace real examples from beginning to end. You might follow a customer enquiry from the first contact through to delivery, invoicing and feedback. Check whether people followed the agreed process, applied the required controls, kept the necessary records, achieved the intended result and managed each handover correctly. Focus more attention on high-risk areas, recent changes and processes with a history of problems. 

If you find a nonconformity (a requirement that hasn’t been met) deal with the immediate issue and any consequences. Then find out why it happened, check whether the same problem exists or could occur elsewhere and take proportionate corrective action. Confirm that the action worked and keep a record of the issue, what you did and the result. 

Finally, your leadership team should carry out a management review at planned intervals. The exact topics will depend on your chosen standard, but they commonly include progress towards objectives, process performance, audit findings, feedback, nonconformities, relevant changes, resources, previous actions and opportunities for improvement. Record the decisions, the person responsible for each action and the deadline.  

Need help building an ISO management system? 

ISO QSL can work with you to develop and implement a management system that fits your organisation, then help you maintain and improve it over time. Our ISO consultancy services cover gap analysis, documentation and audit preparation. We also provide ISO certification and training, so you can choose the right service for your needs. 

We have more than 20 years’ experience and have worked with hundreds of clients worldwide. Our assessors operate across the UK and beyond, bringing practical knowledge of how management systems work in real organisations. 

Contact our friendly team to request a quote and talk about the right next step for you.