4.2.4 of ISO 9001says (in part):
Records shall be established and maintained to provide evidence of conformity to requirements and of the effective operation of the quality management system. (My emphasis)
4.2.3 of ISO 22000 says (in part):
Records shall be established and maintained to provide evidence of conformity to requirements and of the effective operation of the FSMS. (My emphasis)
First, go through the standard and look for any reference to 4.2.4 or 4.2.3. Where you are required to keep records you will find (4.2.4 or 4.2.3). That tells you which records need to be "established and maintained." This should be considered a minimum list.
Second approach, go to each manager/department/process owner and find out the following key points:
1. What kinds of records you have
2. Who's responsible for them
3. That they're appropriately stored and managed, including kept confidential where needed, and protected etc
4. That you can get them when you need them
5. When you no longer need them, you dispose of them suitably. (hence, retention periods and disposal methods).
And yes, it includes electronic records, backups etc, not just hardcopy.
Prepare your records list by department, so it becomes easy to use and update by your personnel.
Edited by mind over matter, 05 September 2011 - 10:44 AM.