A missing procedure and an ineffective operational control demand different responses. Use a practical classification method before adding documents to an ISO gap register.
A team discovers that a process lacks a formally approved procedure and immediately requests a new document. In another department, a complete instruction is available, yet employees repeatedly bypass a critical verification. Treating both situations as “documentation gaps” creates false progress: The first may not need a new document, while the second certainly needs more than one. Management system assessments should diagnose the condition of the control first and decide what documented information is necessary afterward.
01Three diagnostic states: Not one generic gap
The first state is genuinely missing or inadequate documented information required by an applicable criterion or needed for reliable operation. The second is an operational control failure in which execution, competence, authority or monitoring does not work. The third is an evidence deficit: The control may operate, but retained information is insufficient to support a conclusion. They can overlap, but should not be collapsed into one action.
For every finding record the criterion, the observed process behaviour, the status of documented information and confidence in the evidence. State whether the corrective work changes a document, a decision pathway, actual execution or several of these elements.
Decision test: Ask what record would contradict this statement.
02Begin with the transaction, not the document register
A document audit asks whether a procedure exists; a process audit asks whether a required outcome is achieved under controlled conditions. A delivery note, design change, service ticket or maintenance intervention can show how the control actually functions. The first approach is useful for inventory but insufficient for conformity claims.
Choose a recent completed transaction and reconstruct inputs, approvals, handoffs, outcomes and exception handling. Interview the operator and accountable manager separately. Only after mapping the real route should the reviewer decide whether missing guidance contributed to the problem.
03Decide what documented information is actually necessary
Standards requirements for documented information are not universal instructions to create a stand alone procedure for each clause. Scale, complexity, competence and risk matter. Some activities are reliably controlled through system configuration, visual controls, embedded workflow rules or competence; others need explicit written detail and retained evidence.
Distinguish a required retained record from an instruction used to operate a process. Consider whether the control can be demonstrated without the proposed document. Avoid a new procedure if a short role clarification, system rule or work instruction integrated with the live tool resolves the failure.
04Trace the cause of apparent noncompliance
Poor execution can result from unclear ownership, competing production incentives, unavailable equipment, contradictory IT permissions or ineffective training. Editing language will not remove those causes. Likewise, genuine documentation ambiguity can produce inconsistent decisions even among competent employees.
Conduct a focused cause review using an actual deviation and compare expected versus observed behaviour. Test whether the proposed change addresses the mechanism that caused the failure. Record counter evidence, especially cases where the control already worked.
Operating test: Check the latest routine case and one abnormal event.
Decision Matrix: Evidence and Consequence
Use this comparative matrix as an editorial decision aid, not an automatic severity rule. Select and adapt the criteria for the organization’s real processes and obligations.
| Finding signal | Likely category | Evidence to request |
|---|---|---|
| Absent approved specification | Documented information issue | Applicable requirement and approved version |
| Approved procedure routinely bypassed | Operating control failure | Exception log and transaction samples |
| Activity described but records unavailable | Evidence uncertainty | System logs and retention controls |
| Conflicting instructions across sites | Control design and documentation | Current workflow, revision and training |
05Test design and operating effectiveness separately
A well designed control may be newly deployed and not yet supported by a stable record of use. A poorly designed control may appear to work in a tiny sample through individual heroics. Conflating design adequacy with ongoing effectiveness creates premature closure.
Evaluate design through criteria, roles, timing and error prevention. Then sample operation across normal conditions and exceptions. When records are sparse, state a follow up observation period rather than awarding an unsupported mature compliance grade.
06Avoid manufacturing evidence to close the file
Backdating forms or recreating approvals from memory creates a second control failure. An assessor should not request retrospective records as though they prove that historical control occurred. A corrective action can introduce a better evidence trail prospectively while retaining honest descriptions of the earlier gap.
Document containment, effective date, training and first genuine transactions under the new method. Mark reconstructed information clearly if used for investigation, and do not present it as contemporaneous proof. Verification should use records actually generated during work.
07Close on demonstrated control, not approved wording
A revised procedure may be an appropriate deliverable, but it cannot be the sole acceptance criterion if the original risk was an uncontrolled business outcome. Conversely, a pure documentation gap may be resolved without an elaborate audit campaign when the criterion clearly asks for specific information.
Set closure evidence proportional to the category: Approval and accessibility for genuine document defects; observed transactions and results for operational failures; targeted collection for evidence gaps. Give management an explicit residual risk view.
Closure check: Confirm the result in subsequent normal work.
Practical Decision Method: Applying the Assessment
Choose a response proportional to the failure
For a genuine required document that is absent, define approval, availability and control of changes. For a control design defect, specify the authorization, verification or preventive barrier that must be introduced. For a failed operating control, focus on competence, capacity, incentives and real use under workload. For an evidence only weakness, improve record capture and retention without claiming historical execution that was not recorded. Many cases need a combination, but the team should articulate why each intervention is necessary.
Write two different acceptance criteria
A documentation action can be accepted when the correct, current information is approved and accessible where needed. An operational action should require demonstrated output: For example, a specified sample of change requests shows competent approval before implementation and exceptions were routed correctly. Neither criterion can substitute automatically for the other. Management should track both when the failure involves guidance and execution, so paperwork completion cannot conceal a still uncontrolled process.
Review the cost of unnecessary documentation
Extra procedures create maintenance duties, training load, search friction and conflicting instructions. A document that does not correspond to actual workflow may make conformity harder to demonstrate. Before adding a stand alone file, ask whether an existing procedure can be amended, a software field can enforce the rule, or a visual prompt can provide the necessary support. The best system is not the one with the most pages; it is the one that makes required decisions and records consistent across changing work conditions.
A short decision tree before assigning actions
Ask first whether the applicable criterion demands a maintained or retained item of documented information. If yes, determine whether it exists, is controlled and is accessible. Next ask whether the relevant control operates in a sampled transaction. If no, diagnose decision authority, competence, resources, workflow and exception handling. Finally ask whether the available record proves the claim being made. The answers can produce one action or several distinct actions.
Review closure in the same order: Documentary adequacy, operating execution and evidence sufficiency. Avoid declaring an operational failure solved simply because someone uploaded a revised file. For a genuinely documentation only requirement, do not invent unnecessary operating tests that add cost without clarifying conformity.
Illustrative Case: From Observation to Decision
Illustrative scenario: A maintenance team had no separate “calibration procedure,” but scheduling software, equipment status labels and trained technicians consistently prevented use of overdue instruments. Elsewhere, an approved calibration instruction existed but production supervisors could override equipment lockouts. The first issue required checking the applicable documented information criterion; the second required changing authorization and system controls before documentation polish. The same checkbox label would have concealed opposite priorities.
Treat the cause, not the easiest deliverable
A missing instruction, a failed business control and insufficient evidence are different diagnoses. They may coexist, but each needs its own correction and acceptance criterion. Before assigning another document, verify whether the process performs the required decision under ordinary and exceptional conditions.
Use the smallest effective combination of documented guidance, workflow design, competence, monitoring and record retention. A revised document closes an information defect; a representative successful transaction helps close an operating defect. Keeping those conclusions separate allows leadership to see genuine progress and prevents an attractive document register from hiding unresolved exposure.