b) the approval of:
1) products and services;
2) methods, processes and equipment;
3) the release of products and services;
c) competence, including any required qualification of persons;
d) the external providers’ interactions with the organization;
e) control and monitoring of the external providers’ performance to be applied by the organization;
f) verification or validation activities that the organization, or its customer, intends to perform at the
external providers’ premises.
8.5 Production and service provision
8.5.1 Control of production and service provision
The organization shall implement production and service provision under controlled conditions.
Controlled conditions shall include, as applicable:
a) the availability of documented information that defines:
1) the characteristics of the products to be produced, the services to be provided, or the activities
to be performed;
2) the results to be achieved;
b) the availability and use of suitable monitoring and measuring resources;
c) the implementation of monitoring and measurement activities at appropriate stages to verify that
criteria for control of processes or outputs, and acceptance criteria for products and services,
have been met;
d) the use of suitable infrastructure and environment for the operation of processes;
e) the appointment of competent persons, including any required qualification;
f) the validation, and periodic revalidation, of the ability to achieve planned results of the processes
for production and service provision, where the resulting output cannot be verified by subsequent
monitoring or measurement;
g) the implementation of actions to prevent human error;
h) the implementation of release, delivery and post-delivery activities.
8.5.2 Identification and traceability
The organization shall use suitable means to identify outputs when it is necessary to ensure the
conformity of products and services.
The organization shall identify the status of outputs with respect to monitoring and measurement
requirements throughout production and service provision.
The organization shall control the unique identification of the outputs when traceability is a
requirement, and shall retain the documented information necessary to enable traceability.