how-to
How to Control Documents in ISO 9001: 7 Steps
Last Updated: October 31, 2026
Quick Summary
To control documents in ISO 9001, keep quality documents accurate, current and available to the people who need them. Clause 7.5 requires each document to be identified, reviewed and approved before use, version-controlled, protected, and retained for as long as needed. A short procedure, a document register and a clear revision history usually satisfy this.
- Documents describe how work is done and must be controlled, reviewed and kept current.
- Records show what happened and must be protected and retained, but are not revised the same way.
- Each controlled document should carry a reference, title, version, issue date, owner and approver.
- Remove superseded versions from use straight away and move them to a clearly labelled archive.
- A document register showing the current version of each document is the fastest way to prove control.
Table of Contents
- What Document Control Means in ISO 9001
- ISO 9001 Document Control Requirements Explained
- Step-by-Step: Building a Document Control Procedure
- Building a Document Register That Works
- Managing Obsolete Documents, External Documents and Retention
- Choosing Paper or Digital Control and When Software Helps
- Your Next Step: Set Up Your Document Control Pathway
- Frequently Asked Questions
What Document Control Means in ISO 9001
Document control is the process that keeps your quality documents accurate, current and available to the people who need them. In ISO 9001:2015 this sits under documented information, mainly Clause 7.5.
Without it, teams work from old procedures, forms get lost, and auditors find conflicting instructions. The standard does not require a particular system. It requires that documents are controlled in a way that suits your organisation.
Documented information versus records
ISO 9001 uses the term "documented information" for both documents and records. The distinction matters because the rules differ.
- Documents describe how things should be done, such as procedures, work instructions, policies and forms. They must be controlled, reviewed and kept current.
- Records show what happened, such as completed inspection sheets, training logs and audit reports. They must be protected and retained, but they are not revised in the same way.
Treating a completed checklist as a living procedure, or a procedure as a one-off record, is a common source of confusion.
ISO 9001 Document Control Requirements Explained
Clause 7.5 sets out the essentials. In plain terms, your documented information needs to be:
- Created and identified consistently, with a title, date, author or version number, and a reference.
- Reviewed and approved by someone authorised to do so before use.
- Available where and when it is needed, in a usable form.
Clause 7.5 also covers external documented information, documents from outside sources your quality system depends on, such as supplier specifications or customer requirements. Identify them and control their distribution in the same way.
Separate what the standard requires from what you choose to maintain. ISO 9001 requires documented information in specific places and leaves the detail to you. A small team does not need a 40-page manual, just enough control to run its processes reliably and show an auditor that it does.
Step-by-Step: Building a Document Control Procedure
A document control procedure is the rulebook for how your control documents are managed. It does not need to be long: most small and mid-sized organisations can cover the requirement in two to four pages. Follow these steps, then adapt the worked example below.
- Inventory your documents. List every quality-related document and record you use and where each lives. Check shared drives and ask each team what they actually refer to, you will usually find duplicates and orphaned forms.
- Set a naming and numbering convention. Use a consistent format, such as QP-01 for a quality procedure, WI-04 for a work instruction and FM-07 for a form. Keep it short enough that people use it.
- Define roles. Name a document owner (accountable for content) and an approver (authorised to release it) for each document. In a small business these may sometimes be the same person.
- Set a review frequency. Annual review is common for stable procedures; review sooner when a process, supplier, customer requirement or piece of equipment changes.
- Describe the change process. Explain how a change is requested, reviewed, approved and communicated. A one-page flowchart is often clearer than prose.
- Set access and storage rules. Decide who can edit, who can view, and where the controlled master copy sits. State clearly that the master is the only controlled version.
- Define retention and disposal. Record how long each record type is kept and how obsolete items are removed.
- Train the people who use the system. A short toolbox talk or induction briefing is usually enough.
A worked example: revising a goods-inspection procedure
Suppose a manufacturing business must change its goods-inspection procedure because a new customer requires additional dimensional checks. Here is a simple, auditable path that satisfies Clause 7.5 without software:
- Request. The warehouse supervisor raises a change request (a short form or an email is fine) explaining what needs to change and why.
- Draft. The document owner updates the procedure, adds the new checks, and records the change in the revision history table.
- Review. The quality manager reviews the draft against the customer's specification and confirms the checks are practical on the line.
- Approve. The operations manager signs and dates the approval block. The version moves from, say, Rev 3 to Rev 4, and the issue date is updated.
- Distribute. The controlled master is replaced on the shared drive. Printed copies on the line are collected and replaced. The register is updated with the new version, issue date and next review date.
- Communicate and train. The supervisor briefs the inspection team on the new checks and records attendance.
- Retain. The superseded Rev 3 is moved to an archive folder marked obsolete, kept only for traceability of past inspections.
That is the whole cycle, deliberately modest, but every step leaves evidence an auditor can follow.
Creating, identifying and approving documents
Every controlled document should carry a unique reference, title, version number, issue date, document owner and approver, placed at the top of each page or in a standard header.
Approval should be recorded, not assumed. A simple approval block with a name, role and date is usually enough for a small organisation, and the approver should have the authority and knowledge to judge the document.
Version control, distribution and access
Version control prevents people working on out-of-date material. Increase the version number whenever a document changes and note what changed in a short revision history table: version, date, summary of change and who approved it.
Distribution needs the same discipline.
Access should match responsibility. Give editing rights to document owners and approvers only, and protect the master copy so changes are traceable.
What auditors typically check
When an auditor reviews your document control, they look for evidence the procedure is operating, not just written. Common checks include:
- Can a user at the point of use produce the current version of a document they rely on?
- Does the document show a version, issue date and approval?
- Does the register match what is actually in use?
A quick self-check before an audit: pick three documents at random, ask the person who uses them to find the current version, and confirm it matches the register. If that works, your control is probably sound.
Building a Document Register That Works
A document register is a single list of your controlled documents, showing what exists, which version is current, who owns each document and when it was last reviewed.
Get Your Free ISO Starter Pack →
A workable register usually includes:
- Document reference and title
- Current version and issue date
- Document owner and approver
Keep the register simple enough that someone will update it. A spreadsheet is often enough for a small organisation. The key is that the register is the one place people check to confirm which version is live.
Managing Obsolete Documents, External Documents and Retention
Obsolete documents cause more problems than most people expect. When a procedure is replaced, remove the old version from use straight away. Common approaches include:
- Moving superseded files to a clearly labelled archive that users cannot open by default.
- Marking printed copies as obsolete and collecting them.
- Recording the disposal in the register.
Keep an archive copy only where you need it, and label it so nobody mistakes it for the current version. A folder named "Superseded, do not use" is enough for most organisations.
Controlling external documents
External documents are documents from outside your organisation that your quality system depends on. Common examples include:
- Supplier specifications and certificates of conformity.
- Customer drawings, specifications and purchase-order requirements.
- Standards and regulatory references your processes rely on.
ISO 9001 requires you to identify these documents and control their distribution where they affect your ability to meet requirements. In practice, know which external documents you rely on, which version you hold and when you last checked for updates.
Changes to external documents can affect your processes, so include them in your review cycle. If a customer issues a revised drawing, your inspection procedure and any work instructions referencing it may need updating too.
Setting retention periods and disposing securely
Retention means deciding how long records are kept and then disposing of them securely once that period ends. ISO 9001 does not set specific retention periods.
Set retention periods for each record type by considering:
- Legal requirements. Some records may need to be kept for set periods under legislation. These can vary by jurisdiction and industry, so check the relevant regulator and your legal adviser rather than assuming.
- Contractual requirements. Customer contracts and tender conditions often specify how long records must be retained.
- Business needs. Warranty periods, product liability considerations and the practical need to trace past work all influence retention.
Write the retention period for each record type into your procedure or a retention schedule, and apply it consistently.
A simple retention schedule might look like this:
| Record type | Retention period | Basis | Disposal method |
|---|---|---|---|
| Completed inspection records | 7 years | Customer contract | Secure shredding / deletion |
| Internal audit reports | 3 years | Business need | Secure deletion |
| Training records | Duration of employment plus 7 years | Business and legal need | Secure deletion |
| Supplier certificates | Current version plus 1 previous | Traceability | Secure deletion |
Treat the periods above as illustrative only. Your own periods must reflect your legal, contractual and business obligations, and you should confirm them with your legal adviser where relevant.
Choosing Paper or Digital Control and When Software Helps
ISO 9001 does not require digital systems. A well-run paper system can meet the standard, especially for a small team in one location with few documents, little change and staff comfortable with physical filing.
Digital control becomes more useful as the system grows. It makes version control easier, restricts editing to authorised users, keeps an automatic revision history and makes documents available on the shop floor or on site.
A dedicated ISO platform can also reduce the effort of building the system from scratch.
Your Next Step: Set Up Your Document Control Pathway
Start with the basics. Inventory your documents, agree a naming convention, name an owner for each document and write a short document control procedure. Then build your register and set a review date for every document.
Your team can do this without outside help. If you want a structured starting point, IntegriSURE offers a free ISO Starter Pack (https://integrisure.com.au/iso-starter-pack) to help you get going.
Frequently Asked Questions
What does ISO 9001 require for document control?
ISO 9001:2015 Clause 7.5 requires documented information that the quality management system needs to be controlled. Organisations must make sure documents are available and suitable for use where needed, and adequately protected from loss, unauthorised changes or improper use. Documents need to be identified, reviewed and approved before release, and their version status kept current. The standard sets the requirements but does not prescribe one method, so organisations choose a practical approach that suits their size and operations. Certification bodies will look for evidence that these controls work in practice, not just that documents exist.
Does ISO 9001 require a document control procedure?
ISO 9001 requires that documented information is controlled, but it does not explicitly require a document control procedure as a standalone document. Many organisations write one anyway because it sets out who creates, approves, updates and withdraws documents in a consistent way. A short procedure, often a few pages, is usually enough for a small business. Treat it as a tool that helps you meet the requirements, rather than a mandatory form to fill in for its own sake.
What is the difference between documented information and records in ISO 9001?
Documented information is the umbrella term for information that must be controlled and maintained, including procedures, policies, work instructions and forms. Records are a type of documented information that provide evidence that activities were carried out, such as completed inspection sheets, training attendance or audit results. Records are typically retained rather than revised. Understanding this distinction helps you decide which items need version control and approval, and which simply need to be retained and kept retrievable.
How can a small business manage ISO 9001 documents without unnecessary paperwork?
Start by listing the processes that actually affect quality in your business, then document only what is needed to run them consistently and demonstrate control. Reuse existing documents where they are suitable, and keep templates simple. Use one document register to track status and ownership, and combine related instructions where practical. Review your document set against your operations regularly so it reflects what you actually do, rather than creating new documents for every requirement.
