ISO 9001:2008 General Requirements

4.1 General requirements
The organization shall establish, document, implement and maintain a quality management system and continually improve its effectiveness in accordance with the requirements of this International Standards. The organization
shall determine the processes needed for the quality management system and their application throughout the organizations,
determine the sequence and interaction of these processes,
determine criteria and methods needed to ensure that both the operation and control of these processes are effective,
ensure the availability of resources and information necessary to support the operation and monitoring of these processes,
monitor, measure (where applicable) and analyze these processes, and
implement actions necessary to achieve planned results and continual improvement of these processes.
These processes shall be managed by the organization in accordance with the requirements of this International Standard.
Where an organization chooses to outsource any process that affects product conformity to requirements, the organization shall ensure control over such processes. The type and extent of control to be applied to these outsourced processes shall be defined within the quality management system.
NOTE 1: Processes needed for the quality management system referred to above include processes for management activities, provision of resources, product realization and measurement, analysis and improvement.
NOTE 2: An outsourced process is identified as one being needed for the organization’s quality management system, but chosen to be performed by a party external to the organization.
NOTE 3: Ensuring control over outsourced processes does not absolve the organization of the responsibility of conformity to all customer, statutory, and regulatory requirements. The type and extent of control to be applied to the outsourced process can be influenced by factors such asa) the potential impact of the outsourced process on the organization’s capability to provide product that conforms to requirements,b) the degree to which the control for the process is shared;c) the capability of achieving the necessary control through the application of clause 7.4.
Clause 4.2 Documentation requirements
4.2.1 General
The quality management system documentation shall includedocumented statements of a quality policy and quality objectives,
a quality manual,
documented procedures and records required by this International Standard,
documents including records, needed determined by the organization to be necessary to ensure the effective planning, operation and control of its processes
NOTE 1: Where the term “documented procedure” appears within this International Standard, this means that the procedure is established, documented, implemented and maintained. A single document may include the requirements for one or more procedures. A requirement for a documented procedure may be covered by more than one document.
NOTE 2: The extent of the quality management system documentation can differ from one organization to another due to the size of organization and type of activities, the complexity of processes and their interactions, and the competence of personnel.
NOTE 3: The documentation can be in any form or type of medium.
4.2.2 Quality Manual
The organization shall establish and maintain a quality manual that includes the scope of the quality management system, including details of and justification for any exclusions (see 1.2), the documented procedures established for the quality management system, or reference to them, and a description of the interaction between the processes of the quality management.
4.2.3 Control of documents
Documents required by the quality management system shall be controlled. Records are a special type of document and shall be controlled according to the requirements given in 4.2.4.
A documented procedure shall be established to define the controls needed
to approve documents for adequacy prior to issue,
to review and update as necessary and re-approve documents,
to ensure that the changes and the current revision status of documents are identified,
to ensure that relevant versions of applicable documents are available at points of use,
to ensure that documents of external origin are identified and their distribution controlled, and
to prevent the unintended use of obsolete documents, and to apply suitable identification to them if they are retained for any purpose.
4.2.4 Control of records
Records established to provide evidence of conformity to requirements and of the effective operation of the quality management system shall be controlled. The organization shall establish a documented procedure to define the controls needed for the identification, storage, protection, retrieval, retention, and disposition of records. Records shall remain legible, readily identifiable, and retrievable.