What the clause requires
ISO 9001 uses the term documented information for everything that used to be called a document (a procedure, a work instruction, a blank form) and everything that used to be called a record (the completed form, proving that something happened). Clause 7.5 asks for two things: that the company holds the documented information the standard itself requires, plus whatever it decides is necessary for the system to work, and that all of it is controlled. The change of vocabulary caused a great deal of confusion; the underlying obligations did not really change.
Controlling means, when creating and updating, that the document has an identification and description such as a title, a code, a date or a revision number, an appropriate format, and that it is reviewed and approved before use. In use, it means the right version is available where it is needed, protected against loss of confidentiality, improper use or uncontrolled change, with rules for distribution, access, storage, control of changes, retention and disposition. Documented information of external origin, such as technical standards and customer specifications, also has to be identified and controlled.
The amount of documentation is not fixed: it depends on the size of the company, the complexity of the processes and the competence of the people. A ten-person company with an experienced team can run on a handful of procedures; a factory with shift work and high turnover probably needs detailed instructions at each workstation. Excess paper is a problem too. A document nobody reads controls nothing, and a system with two hundred procedures is usually a system where the real method lives somewhere else entirely.
What the auditor asks to see
- A master list, or a system, showing each document, its current revision and its owner
- Evidence of the review and approval carried out before issue or revision
- The current version available at the point of use, with no obsolete copies circulating
- A retention rule for records: how long to keep them and how to dispose of them
- Control of external documents: technical standards, drawings and customer specifications
Where companies most often get it wrong
- An obsolete printed copy still in use at the workstation
- A procedure revised with no record of what actually changed
- A reference standard withdrawn or superseded and never updated in the system
- Records kept in personal spreadsheets, with no backup and no protection against editing
- Documenting everything in excess, with procedures describing the obvious that nobody consults
Example of a nonconformity
- Requirement
- ISO 9001, 7.5.3.2: control of changes and prevention of the unintended use of obsolete documented information.
- Evidence
- In the dispatch area, work instruction IT-EXP-03 in use was at revision 02; the master list shows revision 04, effective since 02/2026, which changed the packing check.
- Finding
- Obsolete documented information was in use at the point of use.
How to comply using PrismaBiz
Ready-made templates for this clause
Frequently asked questions
Does ISO 9001 still require a quality manual?
No. The manual stopped being mandatory in the 2015 version. A company can keep one if it finds it useful, but the standard only requires the documented information it names plus whatever the company decides it needs.
Which documents does ISO 9001 explicitly require?
Among others: the scope of the system, the quality policy, the quality objectives and, as records, evidence of competence, of calibration, of the review of requirements, of product release, of nonconformities, of internal audit and of management review.
Do electronic documents count?
They do, and they are usually easier to control: the current revision sits in one place, the history is automatic and access can be restricted. The care needed is with backup and with controlling who can change what.