4.4 Clause 8.5 — Production and Service Provision

8.5.1 Control of Production and Service Provision

The organization must implement production and service provision under controlled conditions, which include, as applicable: availability of documented information defining the characteristics of the products and services and the results to be achieved; availability and use of suitable monitoring and measuring resources; implementation of monitoring and measurement activities at appropriate stages to verify that criteria for control of processes or outputs, and acceptance criteria for products and services, have been met; use of suitable infrastructure and environment for the operation of processes, linking directly back to Clauses 7.1.3 and 7.1.4; appointment of competent persons, including any required qualification; validation and periodic revalidation of the ability to achieve planned results of processes for production and service provision, where the resulting output cannot be verified by subsequent monitoring or measurement; implementation of actions to prevent human error; and implementation of release, delivery, and post-delivery activities.

The validation requirement covers what practitioners call "special processes" - welding, heat treatment, sterilization, adhesive curing - where the finished output cannot be fully inspected after the fact and the only way to have confidence in the result is to validate the process itself: qualified procedures, qualified operators, and defined revalidation triggers such as an equipment change, a material change, or a process interruption.

8.5.2 Identification and Traceability

The organization must use suitable means to identify outputs when necessary to ensure the conformity of products and services. It must identify the status of outputs with respect to monitoring and measurement requirements throughout production and service provision. Where traceability is a requirement, the organization must control the unique identification of outputs and retain the documented information necessary to enable traceability - batch and lot numbers, serial numbers, and production travelers.

Auditor test: pick a finished unit or completed service record at random and trace it backward to raw-material batch or lot, the operator, the equipment used, and the inspection results, then trace a raw-material lot forward to every finished unit it went into. Both directions must hold together if traceability is genuinely claimed by the organization's own procedures.

8.5.3 Property Belonging to Customers or External Providers

The organization must exercise care with customer or external-provider property while it is under the organization's control or being used by the organization. It must identify, verify, protect, and safeguard property provided for use or incorporation into the products or services, and must report to the customer or external provider if that property is lost, damaged, or otherwise found to be unsuitable for use, retaining documented information on what occurred. This extends beyond physical goods: customer-supplied intellectual property, personal data, and confidential drawings all count as "property" under this clause.

8.5.4 Preservation

Outputs must be preserved during production and service provision to the extent necessary to ensure conformity to requirements. Preservation typically addresses:

8.5.5 Post-Delivery Activities

The organization must meet requirements for post-delivery activities associated with the products and services, including warranty provisions, contractual obligations such as maintenance, and supplementary services such as recycling or final disposal. In determining the extent of post-delivery activities required, the organization considers statutory and regulatory requirements, the potential undesired consequences associated with its products and services, the nature, use, and intended lifetime of its products and services, customer requirements, and customer feedback.

8.5.6 Control of Changes

The organization must review and control changes for production or service provision to the extent necessary to ensure continuing conformity with requirements. Documented information must describe the results of the review of changes, the person or persons authorizing the change, and any necessary actions arising from that review.

Common Audit Findings in 8.5

A special process such as welding running on an expired procedure qualification; traceability records that break at one stage of the process, such as a batch merge with no cross-reference maintained; customer-supplied tooling stored with no condition check recorded on receipt; and a process change - a new machine, a new supplier for a consumable material - implemented on the shop floor with no documented review of impact on conformity beforehand. Each of these is a defensible nonconformity because the sub-clause specifies exactly what documented evidence should exist, and its absence is directly traceable to a named requirement rather than a matter of auditor opinion.

Reading 8.5 as an Auditor, Not Just a Checklist

Clause 8.5 rewards auditors who watch the actual process run rather than only reading procedures in a meeting room. A documented preservation procedure can look complete on paper while the shop floor tells a different story - product staged on the floor rather than in the specified rack, a status label that has fallen off and not been replaced, or an operator who cannot explain why a particular handling step exists. Observation of the process in operation, combined with a sample-based document trail, is what distinguishes a lead auditor's conclusion from a simple document review. This is also where the seven audit principles from ISO 19011 - particularly the evidence-based approach - become concrete: a single verbal assurance that "we always follow the procedure" is not objective evidence; a dated, signed, retrievable record is.