Establish procedures
A measure without a procedure is only an intention.
What the published 2016 guidance says
A measure without a procedure is only an intention. The people involved need to know what the activity is for, and the tools for collecting and analysing the data may need to be adapted. The guidance asks for procedures covering collection, storage, verification, analysis and reporting. Verification can be simple: a range check, a comparison with an expected value, and a note of when and in what context the data was gathered. Reporting methods can range from a scorecard to a dashboard, a written report, a rolling summary or a gauge with an alert.
What it means in practice
A measure without a procedure is an intention. Write how the data is collected, stored, verified and reported; who does it; how often; and in what format. Verification can be simple: range checks, comparison with an expected value, and a record of when and in what context the data was collected.
Status of this record. For 8.4, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Write the procedure for collection, storage, verification, analysis and reporting. Name the verification technique and the context to record. Test the procedure with one collector who did not write it.
Evidence an assessor asks for
- Process managementDocumented collection, verification, analysis and reporting procedures
- Data qualityVerification rules (ranges, expected values, context capture) applied to collected data
- Process managementDefined report formats per audience
The question an assessor will ask
An assessor will ask for documented collection, verification, analysis and reporting procedures. The test for 8.4 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Data taken from tools with no verification step
- One report format for every audience
- Collection procedures that exist only as a script nobody has documented
Before the next review
Before the next review, test this against one live record: data taken from tools with no verification step.
What to check when the revision publishes
When DIS 27004 is published, compare the 8.4 Establish procedures record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.