Not every ISO gap requires another procedure. Decide whether written guidance, system controls, competence or operational evidence is the real missing element.
When an ISO gap is identified, asking someone to write a procedure often feels like decisive action. It is visible, easy to assign and straightforward to mark complete. But a new document can add bureaucracy without changing the business outcome. The correct decision depends on the applicable requirement, the complexity of work, the risk of inconsistent decisions and the existing controls employees already use. The purpose of documentation is to support control, not create a second, fictional version of the process.
01Check the actual documented information criterion first
A standard may require particular documented information to be maintained or retained, while allowing organizations discretion about the form of other instructions. Customer contracts, laws and sector requirements may create additional mandatory records or procedures. The assessor must identify which source applies.
Quote or reference the applicable publication and edition in the internal criteria register without reproducing protected standard text. Separate an explicit requirement from a consultant’s favourite template or organizational preference.
Decision test: Ask what record would contradict this statement.
02Define the control outcome before choosing its format
A procedure only has value if it helps people produce a required result reliably. The desired result could be a correct design approval, safe machine isolation, appropriate supplier selection or traceable disposition. Writing should follow understanding of the real decision path.
State the risk being controlled, inputs, required checks, decision authority, timing, exceptions and evidence. If these elements are already embedded reliably in a business system, another stand alone document may be unnecessary.
03Assess variability, turnover and task complexity
Some routine tasks are simple enough for competent staff and clear system prompts. Others involve variable hazards, interdepartmental choices or infrequent exceptions, making written guidance valuable for consistency. A one size fits all document policy ignores these differences.
Examine operator experience, error history, shift variation, handoffs and regulatory needs. Ask whether two competent workers would reach the same acceptable decision without a new written instruction.
04Use the lightest control that addresses the failure
Alternatives include embedded workflow fields, system permissions, visual work aids, escalation matrices, training, checklists or revision of an existing combined procedure. The correct solution depends on the mechanism of failure. An additional document may not be the simplest or strongest safeguard.
Compare options against effectiveness, usability, maintenance burden and auditability. Prefer integration with tools employees already use when that provides better preventive control and traceability.
Operating test: Check the latest routine case and one abnormal event.
Decision Matrix: Evidence and Consequence
Use this comparative matrix as an editorial decision aid, not an automatic severity rule. Select and adapt the criteria for the organization’s real processes and obligations.
| Observed gap | Likely first option | Closure test |
|---|---|---|
| Explicitly required record missing | Create reliable capture and retention | Genuine record available |
| Unclear recurring decision | Work instruction or decision aid | Consistent choices in samples |
| System allows unauthorized release | Workflow permission control | Bypass test fails as designed |
| Outdated duplicated procedures | Consolidate and retire versions | Users access current guidance |
05Do not confuse missing records with missing instructions
A procedure explains how something should be performed; a retained record provides evidence of what happened. If an audit trail is missing, another instruction may not solve the record capture issue. The system may need logging, access controls or clear retention ownership.
Determine whether the issue concerns decision guidance, result recording or both. Define which transactions require evidence, who creates it and how it is protected against accidental change or retrospective invention.
- Check the actual documented information criterion first
- Define the control outcome before choosing its format
- Assess variability, turnover and task complexity
- Use the lightest control that addresses the failure
- Do not confuse missing records with missing instructions
06Prototype the new method before publishing
Procedures written in isolation often describe ideal flows that cannot be executed under real workload or system constraints. A small operational trial reveals ambiguous language, impractical approvals and missing interfaces.
Test the draft using one ordinary transaction and one realistic exception, with operators and decision owners present. Revise the control and instruction together before wide rollout. Retain evidence of the test and decisions.
07Set closure criteria beyond document approval
If the original finding was merely an explicit missing document, approval and access may be sufficient for that portion. If it involved operational failure, effective deployment requires competence, control use and observed results. Combining these criteria avoids premature closure.
Record release date, access, training or communication, first use and a later sample of actual performance. Retire obsolete instructions so staff are not faced with conflicting versions. Monitor whether the new material improves consistency rather than simply increasing file count.
Closure check: Confirm the result in subsequent normal work.
Practical Decision Method: Applying the Assessment
Compare design options using a practical decision matrix
List possible responses: Revise an existing instruction, embed a software control, add a visual checklist, clarify authority, develop competence or create a new procedure. Consider the applicable criterion, failure consequences, user effort, maintainability and evidence generation. A new procedure may be the right answer for variable, hazardous or infrequent work, especially when continuity across sites depends on explicit knowledge. It should not be the default merely because a document gap is easy to demonstrate.
Test whether people can follow the proposed control
Bring an operator and an accountable owner through a realistic ordinary case and an exception. Identify where they need a decision rule, an approval or a record and whether the proposed procedure fits the actual system. Observe delays, duplicate entries and ambiguous terms. Correct the design before formal release and set a consistent revision process. The goal is to prevent errors and provide evidence while minimizing parallel paperwork that staff will bypass under pressure.
Demonstrate the value of the new guidance
After deployment, measure whether the relevant decisions became more consistent, errors were intercepted earlier or unauthorized deviations became easier to detect. Confirm that obsolete versions are retired and that people can retrieve the current rule at the point of use. When the purpose is improved operation, approval signatures alone do not establish success. A later sample of genuine work is stronger evidence, and if it does not show improvement, revisit whether the procedure was the correct intervention.
A last test before authorizing new documentation
Ask the intended users to perform one normal and one unusual task using the current controls. Identify where they become uncertain, where authorization is ambiguous and what records are missing. If the failure can be prevented through a robust system rule or clarification of authority, compare that option with writing a new procedure. If work varies substantially or is hazardous, written decision guidance may offer necessary consistency across shifts and sites.
Approve documentation only with a named purpose and owner. Define how it will be maintained, integrated with live workflow and retired when obsolete. Test later transactions for consistent decisions and correct records. This avoids an audit oriented collection of documents that looks complete but offers little protection against operational failure.
Illustrative Case: From Observation to Decision
Illustrative scenario: A repair services business lacked a stand alone customer change procedure. Its ticketing platform already enforced customer authorization for routine changes, but special after hours changes could bypass the rule. The right remedy was a permission change and clear escalation path, supported by a short embedded work aid. A lengthy new procedure would have left the system bypass untouched. The team verified later urgent tickets before closing the control gap.
Write guidance only when it will improve control
The question is not whether the document library would look more complete with another procedure. The question is whether people need additional maintained guidance, required records or stronger technical and organizational controls to produce the intended result reliably.
Choose the lightest defensible solution, test it with actual users and then verify subsequent normal transactions. Retire contradictory old instructions and maintain the new decision rule as the process changes. Documentation has value when it improves repeatability, accountability and evidence; it has little value when it becomes an independent paperwork project.