Control of external documents under ISO 9001

What counts as an external document under ISO 9001?

An external document is any piece of documented information your quality system relies on that someone outside your organisation wrote and controls. You did not author it, and you cannot change its content. You can only decide how you receive it, store it and keep it current inside your own system.

The most common categories a quality manager deals with are:

• Published standards you work to, such as ISO 9001 itself, a national standard, or an industry code of practice.
• Customer specifications, drawings and purchase-order terms that define what you must deliver.
• Laws and regulations relevant to your product, sector or export markets.
• Supplier certificates and statements: certificates of analysis (COA), certificates of conformance (COC), safety data sheets (SDS), halal or kosher certificates, and allergen or GMO statements.
• Calibration certificates issued by an external laboratory for your measuring equipment.
• Accreditation and certification body documents, such as your own ISO 9001 certificate from a SANAS-accredited body.

Documents you write yourself, such as standard operating procedures, policies, work instructions and forms, are not external documents. Those fall under internal document control instead, which is a separate discipline from what's covered here.

What does ISO 9001 clause 7.5.3.2 require?

Clause 7.5.3 sets out the general controls your organisation must apply to all documented information. It must be available and suitable where and when it's needed, adequately protected, and properly managed for distribution, storage, version control and retention. Sub-clause 7.5.3.2 extends those same controls specifically to documents of external origin that your organisation has determined are necessary for planning and operating the quality system.

In plain terms, once you decide a customer specification or a supplier's certificate matters to your quality system, you must identify it, control how it's distributed and used, and make sure nobody works from a version that's been superseded or has lapsed. The standard doesn't prescribe a specific tool for this. A register is the most practical way most SMEs meet it.

External documents also connect to clause 8.4, control of externally provided processes, products and services, the clause that governs supplier management more broadly. A certificate you hold on a supplier is both an external document under 7.5.3.2 and evidence you're meeting 8.4's requirement to verify what a supplier provides. Our guide to tracking supplier certificates covers that side of the process in more detail.

None of this requires a particular piece of software. A small company with two suppliers can meet clause 7.5.3.2 with a well-kept spreadsheet and some discipline about who checks it and when. What the clause does require, whatever tool you use, is that the current version is the one people work from, that you can show when each document was last checked, and that nobody can point to an expired certificate and say no one owned it.

Clause 7.5 keeps the same numbering and the same intent in both the 2015 and the 2026 editions of the standard, so this guidance applies whichever one your organisation is certified to. Certificates issued to ISO 9001:2015 stay valid during the transition to ISO 9001:2026, so you don't need to change how you control external documents just because the standard has a new edition.

What should an external document register include?

A register is the simplest tool for this: one row per document, naming what it is, who issued it, when it was issued, when it needs to be reviewed or renewed, who owns it, and where the current version is held. That's usually enough to answer every question an auditor will ask about a specific document in seconds rather than minutes.

Copy the columns above into a spreadsheet to get started, or see how External Document Control builds and keeps this register current for you without anyone typing a row by hand.

How do you decide when to review or replace an external document?

Use the expiry date the issuer gives you wherever one exists. Most supplier certificates, halal and kosher certifications, and calibration certificates carry an explicit date. Where no expiry date is printed on the document itself, such as most safety data sheets, set a periodic review date instead, commonly annually, so someone still checks it hasn't been superseded by a newer revision.

Customer specifications and drawings change on their own schedule, usually tied to a revision number rather than a date. The trigger to review is a new revision landing in your inbox rather than a calendar reminder. Your own ISO 9001 certificate is reviewed on the cycle your certification body sets, typically an annual surveillance audit with recertification every three years.

Regulations and published standards are the hardest to keep current, because nobody sends you a notification when one changes. You have to go looking. Assign a named owner to each regulation or standard you rely on, and set a routine review date, even if it's only once a year, so checking for an update is somebody's job rather than an accident.

What do auditors check about external document control?

Auditors testing clause 7.5.3.2 usually ask to see specific documents and trace them through your system, rather than reading a procedure. The most common checks are:

• Can you produce the current version of a named external document, and show it's the one in use on the floor or in the file?
• Can you show that a superseded or expired version isn't still sitting in a shared folder someone might open by mistake?
• Do you have evidence, such as a register entry, a reminder or an approval, that someone reviewed the document before its expiry date?
• Is there a named owner for each document, so it's clear whose job it is to notice when something lapses?

The most common finding is a missing owner or a missing review date, which leaves a certificate to expire quietly until an audit or a customer complaint surfaces it.

What does Obel-MS External Document Control automate?

Obel-MS is built around ISO 9001 clause 7.5.3.2, and its External Document Control module removes the manual work of keeping a register like the one above up to date:

• AI Suggestions. Upload a certificate once and the document type, supplier, manufacturer, product and dates come back as suggestions you Accept, Edit or Dismiss before approving.
• Auto-filing by Supplier, Manufacturer and Product. Approved documents land in the right folder on their own, built from the document's own metadata, with nobody dragging a file into a tree by hand.
• Document Status computed for you. Every document shows as Active, Expiring soon, Expired or No expiry set, calculated from its own dates rather than tracked in a separate spreadsheet.
• Expiry digest by email and Teams. Before anything lapses, the people who need to know get a digest, instead of finding out at an audit.

Obel-MS itself is not "ISO 9001 certified". No software can be, since certification applies to an organisation's quality system, assessed by an accredited body. What Obel-MS gives you is the document control structure clause 7.5.3.2 expects, built and maintained for you. See the full ISO 9001 clause map for how each part of the standard maps to the product, or check pricing to see what's included from the Starter plan.