ISO 9001 clause 8.5.6: control production and service changes

What clause 8.5.6 requires in practice

Production and service processes change: new equipment, different materials, revised methods, a replacement subcontractor, a new software release. The clause expects the organisation to review and control such changes as far as necessary so that conformity to requirements continues.

Documented information must be available as evidence of three things: the outcome of the review of changes, the person or persons who authorised the change, and any actions that came out of the review.

This is the operational counterpart to design change control in 8.3.6. The question is not whether to allow change, but whether the effect on conformity was thought through, a responsible person approved it, and necessary protective steps such as trial runs, retraining or updated instructions were completed before output reached customers. Unplanned changes, such as a forced material switch, still need review once they occur.

Review the effect before accepting the new arrangement

Describe what will change and which requirements or controls could be affected. Consider the people, instructions, equipment, environment, external support and verification arrangements involved. A small operational alteration can have a substantial effect if it removes the only check that detects an error before delivery.

Ask whether the changed process can still produce the required result and what evidence supports that conclusion. Necessary actions might include checking a trial output, revising an instruction, briefing affected workers or changing a release check. These are practical options rather than a mandatory checklist imposed by the clause.

Identify who can authorise the change and what the authorisation covers. A temporary arrangement should remain distinguishable from a permanent revision. Where a change affects agreed customer requirements, review the relevant contractual and communication implications rather than assuming that internal approval is sufficient for every consequence.

Why control of production and service changes matters to the business

Many incidents trace back to a recent change that looked harmless. A new shift pattern, a different cleaning agent or a modified service script can alter results in ways nobody planned for. Controlled change protects customers from surprise and spares the organisation from investigating mysteries after the fact. It also lets improvements proceed faster, because staff trust that the review route is reliable. Customers in many sectors expect to be told of changes that affect them. Auditors sampling recent changes can quickly judge whether the organisation manages its processes or merely reacts to them.

How to implement clause 8.5.6

Give people a clear, light route for raising changes so that nothing important is made informally. Keep the route proportionate: a minor wording tweak should not need the same scrutiny as a new machine or a replacement provider. Involve operators, who often foresee practical difficulties. Revisit the route after any incident. Keep it practical and brief.

1. Define what counts as a change to production or service provision, such as methods, equipment, materials, locations, people or providers.
2. Provide one way to propose and describe a change, naming who is affected.
3. Review the likely effect on conformity, including monitoring, competence, documentation, customer commitments and legal requirements.
4. Name who may authorise changes of various significance, and make approval a condition of starting.
5. Identify protective actions, such as trials, extra inspection, training or customer notification, and confirm completion before full use.
6. Handle unplanned changes by reviewing consequences quickly, then keep records of the review, authoriser and actions.

Evidence an auditor expects for clause 8.5.6

Auditors will normally choose a recent change and follow it from request to implementation. Comparing dates on the request, approval and first use often shows quickly whether the control works as designed.

• Records of the review of the change and its expected effect on conformity.
• Evidence of who authorised it and when, compared with when it was introduced.
• Records of follow-up actions such as trial results, training or updated instructions.
• Interview with a process owner about how unplanned changes are recognised and handled.

Common nonconformities with clause 8.5.6

Audits commonly reveal the following problems with process change control. They suggest that change is treated as an operational convenience rather than something that can affect conformity. Several of these appear together in one finding.

• Equipment, method or provider changes happen informally and no review record exists.
• Approval is given after the change has already been put into use.
• Reviews look at cost or schedule but ignore the effect on conformity and monitoring.
• Actions agreed at review, such as retraining, are not tracked to completion.

Illustrative manufacturing example: a revised assembly sequence

Illustrative BPO example: a temporary processing team

A BPO provider transfers part of a customer onboarding workload to another trained team during a capacity shortage. The customer still requires the same identity checks and turnaround commitments. The review examines access, competence, current instructions and the route for resolving incomplete cases before the transfer begins.

The service owner approves a bounded transfer with an additional sample review during the initial period. Evidence records the review outcome, authoriser and actions taken, including the briefing and sample findings. When the temporary arrangement ends, the provider checks that ownership and access reflect the restored allocation. This avoids an informal workaround becoming an uncontrolled permanent process.

Use the right change-control connection

Clause 8.5.6 concerns changes in production and service provision. Clause 6.3 addresses planning changes to the QMS, while clause 8.3.6 addresses design and development changes. A single real-world change can engage more than one provision. Link the relevant reviews instead of forcing the event into an artificial category.

For example, changing a delivery process may leave the designed product unchanged, whereas altering its functional requirements may need design review as well. A broad organisational restructure could affect the QMS and several delivery processes. The classification should help people identify the necessary decisions, not create duplicate paperwork that obscures ownership.

Required evidence should show the review results, who authorised the change and necessary actions arising from that review. A controlled workflow, work-order record or other reliable information can meet this need; the standard does not name a compulsory form. Preserve enough context to distinguish what was considered from what actually happened.

Typical failures include retrospective approval after an uncontrolled change, records that say only “approved,” and missing follow-up on conditions attached to approval. Another is assuming that a trial was successful without defining what result would demonstrate success. Check that the changed arrangement remains suitable after implementation, particularly where the review identified uncertainty.