Auditing numerous companies of different sizes in various industries, I found that control of forms is one of the notorious issues with maintenance of ISO 14001:2004 EMS. Various businesses, by odd reasons, treat forms in a different way than other instructions, leaving them not controlled.
Clause 4.4.5 of 14001:2004 Standard requires: "Documents required by the environmental management system shall be controlled." Now, let's investigate if a form qualifies to be a "document" that "shall" be controlled per the requirement of the standard.
Organizations use forms and tables within their environmental, quality, H&S and other management systems. Often, instead of preparing a traditional instruction or a procedure with all the sections, such as scope, purpose and process description, a simple form can provide this information. Frequently registrars issue companies non-conformities for their not controlled forms of their EMS.
Often, being asked about not controlled forms, my clients reply: "We do not control forms, why?" I always wonder why a table form should be treated differently than any other instruction or a procedure. If a form is not controlled, how would we know that we need it for our EMS? If it is not controlled, it cannot be referenced within one's management system. If your forms are not controlled, how would you know that you use the latest revision of it? I guess all these questions lead us to a point where we should consider controlled forms! Let's see is a form qualifies to be a real document. A short test will help answer this question.
1 - draw a two-column table
2 - note your organization's name in the first column
3 - write down your organization's Website address into the second column
Hardly anybody will argue that this three-line writing is in fact an instruction to make and complete this form. So if this is an instruction, it "shall" be controlled, right? The standard said so.
Let's look at another example. Somebody gave us a two-column table and asked us to fill it out. The first column has a title of "Your business name" and the other column "Business URL". I bet most of us would enter our business name in the 1st column and our URL in the second one. Does it mean that we treated the blank table as an "instruction"? I'll tell you a secret: we did!
If we agree that our first three-line instruction in English was a "real" instruction, or a document that needs to be controlled, the second, blank form, resulting in the same output, must also be an instruction and then shall also be controlled!
It seams to me that misunderstanding concerning blank tables and forms is because forms serve two purposes. Blank forms are short directions written in tabular language, but when a form is completed, it becomes a record. Procedures and other documents are controlled differently than records. Let's realize this difference and treat not completed forms as any other procedure or instruction controlled by our documentation management procedure. If you want to have a not controlled form with in your EMS, consider answering three questions:
- Let's say that somebody changed your favorite form. Would you want to know why?
- If you revised one of your ISO 14001 forms, would you like your users use the latest revision?
- If you were on vacation in Japan, would you like folks to be able to find your EMS form just by finding a reference to it within your Environmental management system?
If there was at least a one "yes", your form should be controlled as required by the environmental standard.