There are specific references in the standard where it prescribes that the food safety management system will need to have documents. The following is a list of the documents required:

1 Food Safety Policy
2 Food Safety Objectives
3 Identification and Control of Outsourced Processes
4 Document control
5 Record control
6 Documents that specify how prerequisite programme activities are managed
7 Information required to conduct the hazard analysis
8 Descriptions of raw materials to the extent needed to conduct the hazard analysis
9 Descriptions of Ingredients to the extent needed to conduct the hazard analysis
10 Descriptions of product-contact materials to the extent needed to conduct the hazard analysis
11 The characteristics of end products
12 Descriptions of the intended use to the extent needed to conduct the hazard analysis
13 Descriptions of the reasonably expected handling of the end product to the extent needed to conduct the hazard analysis
14 Descriptions of any possible unintended but reasonably expected mishandling and misuse of the end product to the extent needed to conduct the hazard analysis
15 Descriptions of the methodology and parameters used for the categorization of control measures as belonging to the HACCP plan or Operational prerequisite programmes
16 The food safety hazard or hazards to be controlled by each operational prerequisite programme
17 The food safety hazard or hazards to be controlled by each operational prerequisite programme
18 The control measures used by each operational prerequisite programme
19 The monitoring procedures used in each operational prerequisite programme
20 The corrections and corrective actions for each operational prerequisite programme
21 The responsibilities and authorities for each operational prerequisite programme
22 Records for each operational prerequisite programme
23 The HACCP plan and identified critical control points (CCPs)
24 The food safety hazards to be controlled at each critical control point
25 The control measures used at each critical control point
26 The monitoring procedures used at each critical control point
27 The critical limits applied at each critical control point
28 The rationale for the chosen critical limits
29 The corrections and corrective action to be taken if critical limits are exceeded for each critical control point
30 The responsibilities and authorities for each aspect of the critical control point
31 Critical control point monitoring records
32 Procedures for the handling of potentially unsafe products, including the controls, methods and authorization levels.
33 Procedures for withdrawing products including notification to relevant interested parties, handling of withdrawn products as well as affected products in stock and the sequence of actions to be taken.
34 Procedure for Corrections including the identification and assessment of affected end products
35 Records of the review of corrections carried out
36 Procedure for Corrective Action that specifies the appropriate actions to identify and eliminate the cause of detected nonconformities, to prevent recurrence, and to bring the process or system back into control after nonconformity is encountered.
37 The corrective action procedure must include a review of non-conformances including customer complaints
38 The corrective action procedure must include a review of trends in monitoring results that may indicate development towards loss of control
39 The corrective action procedure must include a review to determine the causes of non-conformances
40 The corrective action procedure must include an evaluation of the need for action to ensure that nonconformities do not recur
41 The corrective action procedure must include a how the actions needed are determined
42 The corrective action procedure must include a how the actions needed are implemented
43 Records of corrective actions
44 Records of the review of corrective actions taken to ensure that they are effective
45 Procedure for Internal Auditing including responsibilities and requirements for planning and conducting audits, for reporting results and maintaining records.
46 Internal Audit records
47 External documents relevant for the food safety activities including statutory, regulatory and customer requirements.

The extent of the food safety management system documentation will differ from one organization to another depending on the size and complexity of the operation and the competence of personnel.

Senior management should decide which markets the company quality management system should address and develop relevant policies.

Based on these policies, management should then establish objectives for the company products, environmental performance, occupational health and safety performance

Example Quality Policy

The company’s quality policy is to provide competitive products and services of the highest standards of performance and reliability, satisfy the needs and expectations of its customers and achieve business success.This level of quality is achieved through adoption of a quality management system that reflects the competence of the Company to existing customers, potential customers, and independent authorities.

The next step is to determine the quality management system processes needed for achieving the policies and objectives. The Senior Management Team determines all the quality management system processes needed including Management Team Resources, Training & Competence Product Realization Design and Development Sales, Planning, Measurement, Analysis, Improvement, Suppliers, 
Audits, Management System and Customer Service

The Senior Management Team should use flowcharts to support the development of the quality management system process sequences and their interactions.

Senior Management should define individual roles and responsibilities for ensuring the implementation, maintenance and improvement of each quality management system process and its interactions. Establish a Process Management team that has an overview across all the quality management system processes, and which includes representatives (Process Owners) from each of the interacting processes.  

Determine the activities needed to achieve the objectives of the quality management system process. For example Product Realisation may require the following activities:
Planning, Processing, Production, Packing, Final Inspection and Storage

Assess each quality management system process and determine and the most appropriate way of managing them and if they are to be documented. Documentation is to enable the consistent and stable operation of the quality management system processes. Determine which quality management system processes are to be documented, on the basis of the: 

- size of your company and your activities
- complexity of the processes and their interactions
- criticality of the process
- availability of competent personnel

Different methods of documentation can be used. Decide which is best to represent and comprehend the quality management system process. Suitable documents include graphical representations, written instructions, checklists, flow charts, visual media and electronic methods

Determine the resources including Human resources, Infrastructure, Work environment, Information, Natural resources, Materials and Financial resources that are needed for the effective operation of each quality management system process.

For example for product realization resources required may be:
Human resources – Production Staff, Training & Competence
Infrastructure – buildings, workspace layout, process equipment, tools, supporting services and information systems
Work environment – layout of facilities, plant equipment, pest control, waste control, work wear, noise, temperature, humidity, lighting and weather.

Determine where and how monitoring and measuring should be applied both for control and improvement of the quality management system processes.
Develop a project for implementation that includes Communication, Awareness, Training, Change management, Management involvement, Review activities

Implement the quality management system processes and their activities as planned.

Measure or monitor to determine the effectiveness and efficiency of the quality management system process, taking into account such factors as Conformity with requirements, Customer satisfaction, Supplier performance, On time delivery, Waste, Process costs, Incident frequency, determine the need to record results

For example measurement criteria for measurement of customer satisfaction could be Complaint levels, % on time Deliveries, % Order Completion

Regularly analyze and evaluate quality management system information obtained from monitoring and measuring data in order to check your performance. Management Review is an ideal tool for this. 

Key Areas for Business and quality management system improvement should be identified during Management Review and could include: Complaint Levels, Production Efficiency, Process Simplification, Waste Reduction, Delivery Performance and Order Lead Time

Our Small Business ISO 9001 Manual contains the basic requirements of a quality management system and comes with implementation guides and implementation checklists.

It was my first day in my new role and I was shown to the Technical Manager’s office. “Oh, there seems to be a lot of quality manuals in here” I said. “Yes” the Technical Secretary said, “That’s our Quality Management System, ISO 9001 certification has created a monster”

I spent several hours, no days or even maybe weeks looking through my new library, the Quality Management System consisted of Policies, a Quality Manual, Production Procedures, Laboratory Manual, Laboratory Procedures, Process Specifications, and Testing Schedules etc.

The Quality Management System was fairly standard, however, every single document used a thousand words when one would suffice. I was in big trouble, there was no way I was going to be able to manage all this paperwork and maintain our ISO 9001 certification, so we had major work to do and hopefully would save a rain forest in the process!

The Quality Management System contained a Process Specification for every single one of our 200 products and each one was 90 pages long! So by my maths the manual contained 18,000 pages! I was ruthless and condensed the Process Specifications to a one page quality process summary. As you can imagine on the next ISO 9001 surveillance visit I was more than a bit apprehensive! The Lead Assessor was almost as relieved as I was. Here in plain and simple English or with a flow diagram we had outlined exactly what we did. It was simple it was basic but it reflected what we did, how we did it and the control points in our process.” I can confidently say you have made your quality management system significantly more efficient” said the Lead Assessor.

Flushed with the positive review from our Lead Assessor, I continued my war on paper and condensed our quality management system documentation. It was a case of keep it simple, document what you do, don’t document something just for the sake of trying to create paperwork.

As a department we were able to free up time and resource to concentrate on improving our quality management system effectiveness and efficiency. This is turn was reflected in other departments in the factory. We were able to extend the scope of our ISO 9001 certification to a new production facility with relative ease. That was in 1994 and now the ISO 9001:2008 standard is far more practical and user friendly, it generates a focus and disciplines that are invaluable to any business. The standard is a quality management system tool that is now my friend rather than my enemy.