Retain and communicate documented information
The requirement is to keep records that show the results of monitoring and measurement.
What the published 2016 guidance says
The requirement is to keep records that show the results of monitoring and measurement. The organization decides what form those records take. It may document the process and the analysis and evaluation methods, for example. Reports need an appropriate format, and the conclusions should be reviewed by the people who understand the context. The communicator decides which results go to which audience, internally and externally, and how feedback will show whether the report was useful and whether the measurement itself is working.
What it means in practice
The duty is to keep a record that shows what the monitoring and measurement found. The organisation chooses the form. Keep the measure definition, the raw or verified data, the analysis and the evaluation, with dates and owners. Reports need a named audience and a route for feedback on whether they were useful.
Status of this record. For 8.9, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Retain the measure definition, the data, the analysis and the evaluation with dates and owners. Give each report a named audience and a feedback route. Check that the evidence can be produced for a live sample, not only described.
Evidence an assessor asks for
- DocumentationRetained monitoring and measurement results as documented information
- CommunicationA distribution list of measures per interested party, internal and external
- DocumentationFeedback channel on the usefulness of measurement reports
The question an assessor will ask
An assessor will ask for retained monitoring and measurement results as documented information. The test for 8.9 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Results kept only in a live dashboard with no retained record
- External reporting decided ad hoc per request
- No feedback loop on whether reports are useful
Before the next review
Before the next review, test this against one live record: results kept only in a live dashboard with no retained record.
What to check when the revision publishes
When DIS 27004 is published, compare the 8.9 Retain and communicate documented information record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.