What the clause requires
Clause 8.5.6 deals with the changes that are unplanned or part of daily routine in production and service provision: a change of material, of external provider, of machine, of process parameter, of method, or of the person working at a critical station. The organization reviews and controls those changes to the extent necessary to ensure continuing conformity with requirements, which means the review happens before the change goes live, not after the first complaint arrives.
The record required here is unusually specific. The organization retains documented information describing the results of the review of the changes, the persons authorizing the change, and any necessary actions arising from the review. A change made with no record of who authorized it is a direct nonconformity, and it is one of the easiest findings for an auditor to raise, because the evidence is missing rather than merely weak.
The logic behind the clause is to prevent the silent change: a buyer switches the resin supplier to save money and nobody assesses the effect on the finished product; an operator raises the line speed to hit the daily target; a supervisor moves an untrained employee into a critical station to cover an absence. Many organizations handle this with a simple change request form carrying an impact assessment, a decision on whether validation is needed, and an approval signature before the change is implemented.
When the change affects a special process or a critical characteristic, the review normally has to require validation before normal production resumes: first article approval, a laboratory test, or a pilot batch run under the new condition. Recording that result together with the authorization closes the loop the auditor expects to see, and it also gives the organization a defensible answer if the customer later asks when and why the process was altered.
What the auditor asks to see
- Records of the changes made to production or to service provision, with their dates
- Assessment of the impact of each change on conformity of the product or service
- Clear identification of the person who authorized each change
- Actions arising from the review, such as validation, first article approval or customer notification
Where companies most often get it wrong
- Change of external provider or of material made with no assessment of the impact
- Machine parameter altered by the operator with no record of the change
- Change that required customer approval implemented without telling the customer
- Change record kept, but with no identification of who authorized it
Example of a nonconformity
- Requirement
- ISO 9001, 8.5.6: retain documented information describing the results of the review of changes and the persons authorizing the change.
- Evidence
- In March 2026 the finish coating was switched to a different manufacturer; there is no record of any review of that change and no record of who authorized it. Since then, 5 customers have complained about the coating peeling.
- Finding
- A change to production was made without review and without any record of authorization.
How to comply using PrismaBiz
Ready-made templates for this clause
Frequently asked questions
What is the difference between 8.5.6 and 6.3?
Clause 6.3 deals with planned changes to the quality management system itself. Clause 8.5.6 deals with changes to production or service provision, which are often unplanned and driven by day-to-day events.
Does every change need formal approval?
Every change needs review and authorization to the extent necessary. Changes that can affect conformity deserve a record; adjustments already foreseen and bounded by the procedure do not.
Do I have to notify the customer?
Whenever the contract or the customer requires it. Sectors such as automotive and medical devices normally require prior approval of changes affecting the product or the process.