Can unwritten, or informal procedures be used?

Usually with a quality system we will require documented procedures so that we can clearly establish compliance agains the requirements from the specific regulation or directive that we are auditing against. 

However the nature of EU legislation is that companies of all sizes can participate, including startups and micro-enterprises. EU Regulation must at all times be proportional and sometimes such small companies do not have the same degree of documentation as larger companies. Within Module D/D1, whilst key procedures must be documented the regulation also leaves the door open for different ways to show compliance. 

Especially in case of small companies we can at times accept procedures that are proven to be present in the company or those that are informal. This is generally not possible for larger companies. To make this determination we start with the EU definition of an SME. Any company that can be categorised as a 'micro-enterprise' can have unwritten procedures. 

Companies that are not categorised as small or micro (headcount of over 250) cannot opt to use unwritten procedures for major operational obligations (such as training procedures). 

An example of informal procedures may be Mission Statements and the formal high-level quality policy required by Module D1. Such a statement will be a formal requirement for larger companies, however in case of smaller companies the policy might just be the website or an informal agreement. 

In all cases the auditor will make a written report of what the procedure is and what it covers. In future audits the auditor may ask to see continous follow up evidence in this regard to ensure ongoing compliance, or may make a recommendation to consider documenting specific parts. Questions about this, always feel free to reach out!