ISO 9001 clause 8.2.3.2: preserve the evidence behind accepted work

What clause 8.2.3.2 requires in practice

Clause 8.2.3.2 is the evidence provision for the requirements review. It asks that documented information be available, as applicable, for two matters. The first is the results of the review carried out before commitment. The second is any requirements that are new or have changed for what is being offered, arising from the review or afterwards.

The words as applicable matter. A routine, repeat order may need only a light trace, while a novel or high-value project may need a fuller explanation of conditions, limits or resolved differences. The clause does not state what the information must look like, so a signed form, a system status, a quotation with annotations or a record of customer confirmation could each serve, if it shows what was reviewed and what was decided. It also does not replace the review itself. A record cannot make up for a review that was not carried out. The practical output is that, later on, the organisation and the customer can both understand what was agreed, what was changed and why, without relying on memory.

Preserve the result, not just the presence of a review

A checkbox stating “reviewed” may be insufficient when the important outcome was a resolved conflict, a limitation or a condition attached to acceptance. Consider what information the organisation needs to explain the result and enable subsequent work. The detail should match the significance and complexity of the commitment.

These are practical considerations, not mandatory fields for a universal form. A standard transaction may need less explanation than a novel project. The evidence should nevertheless make relevant review results and new or changed requirements available rather than leave them dependent on one person's memory.

Why preserving the evidence behind accepted work matters

Disputes about what was promised nearly always depend on records. If the organisation can show what was reviewed, which limitations were agreed and how differences were settled, it can respond calmly and fairly. If not, the argument becomes one person's recollection against another's. Good records also help delivery teams, who inherit the commitment and need to know the exact conditions accepted. They support learning, because patterns in resolved differences show where the offering or the sales process needs attention. For auditors, the record is the proof that the review was real and not assumed, and it allows them to trace a delivered result back to the agreement behind it.

How to implement clause 8.2.3.2

Decide what a future reader would need to understand the commitment, then capture exactly that. One way Sterling's teams do this is to read a past dispute file and note what was missing.

1. Identify which orders or projects need more than a basic trace, based on complexity, risk and value.
2. Define what the record should show: the decision, any conditions or limits, resolved differences and confirmed customer requirements.
3. Use existing systems, such as the order system or the quotation tool, to hold the information instead of a separate form.
4. Make sure the person who reviewed is identifiable and the date and version of the requirement are clear.
5. Record new or changed requirements as they arise and link them to the order they affect.
6. Make the information accessible to the delivery team, and protect it from unintended alteration.
7. Test the arrangement by asking a delivery colleague to explain, from the record alone, what was accepted and under which conditions.

Illustrative software example: an accepted limitation

Illustrative manufacturing example: a changed delivery condition

A hypothetical manufacturer receives a customer order that changes a packaging and delivery condition from the quotation. The organisation reviews the change and confirms that a suitable arrangement is available. The agreement is held in one account manager's email, while production and dispatch use the earlier order information.

The business connects the changed requirement and review result with the operational order record. Relevant teams receive the accepted basis, and the information remains retrievable if the account manager is absent. A copy of every email is not the essential outcome; the useful evidence is an accessible, coherent account of what changed and what was agreed.

Use existing systems where they work

Contract systems, order records, project approvals and customer correspondence can all contribute. The standard does not require a separate document called a contract-review form. Evaluate whether the chosen arrangement preserves the relevant information and can be retrieved by people who need it.

Where evidence is distributed across systems, make the relationship understandable. A review result that points to an unavailable attachment or an overwritten specification may no longer support the decision. Apply appropriate documented-information controls to protect the evidence and its context.

Keep changes distinguishable

New or changed requirements can alter the basis of work. The organisation should be able to distinguish the relevant accepted position from earlier proposals or superseded statements. Otherwise, an apparently complete record set may contain contradictory commitments without a clear resolution.

The level of traceability should fit the work and applicable requirements. An ordinary version history may be sufficient in one setting; a more explicit decision record may be needed in another. Do not assume that storing a final document alone always explains a significant change, or that retaining every draft automatically makes the position clear.

Evaluate the evidence through a real handover

Common nonconformities with clause 8.2.3.2

Findings in this area concern records that are missing, thin or disconnected from the work.

• No information shows that a review took place before an accepted order.
• A record says reviewed but does not show the decision, conditions or resolved differences.
• New or changed requirements agreed with the customer are not recorded anywhere the delivery team can see.
• Review records are held by individuals and cannot be retrieved when the contact has left.
• Records were altered after delivery so they no longer show what was accepted at the time.