ISO 9001 document control procedure: a worked example
Updated , 9 minute read. By Obel AI & Quality.
In short
Neither ISO 9001:2015 nor ISO 9001:2026 requires a documented procedure for document control, but most organisations write a short one anyway. Below is a complete worked example for a small company, covering purpose, responsibilities, a numbering scheme, creation, approval, issue, revision, external and obsolete documents, and retention, that you can adapt to your own business.
Do you need a documented procedure for document control?
No. ISO 9001:2015 dropped "control of documents" from its list of mandatory documented procedures, and ISO 9001:2026, the standard’s sixth edition published in September 2026, carries this forward unchanged, so nothing in either current edition forces you to write one. What clause 7.5.3 does require is the outcome: documented information that’s properly identified, reviewed, approved, controlled and eventually disposed of. Most small and mid-sized companies write a short procedure anyway. It’s the fastest way to get everyone doing document control the same way, and the easiest thing to hand an auditor who asks how it works.
A written procedure also protects you from the most common failure mode in a small company: one person knowing how document control works, and nobody else being sure. If that person is out sick during an audit, or leaves the business altogether, a short procedure means the next person can pick it up without reverse-engineering it from memory.
What should a document control procedure include?
A complete procedure answers a small, fixed set of questions: who’s responsible, how documents are identified, how they move from draft to approved, how people access the current version, how changes happen, how you handle documents you didn’t write yourself, what happens to old versions, and how long records are kept. The worked example below covers each of those in order, written for a fictional small manufacturer. Adapt the names, numbers and reviewers to your own business, but the structure will fit most companies preparing for a first ISO 9001 certification or tidying up before an audit.
A worked example: document control procedure
This is an example. Replace the job titles, numbering scheme and retention periods with your own before you use it.
1. Purpose
This procedure describes how [Company Name] creates, reviews, approves, issues, revises and retires the documented information used in its quality management system, and how it controls documents of external origin.
2. Scope
This procedure applies to all quality procedures, work instructions, forms, registers and external documents used within the QMS. It does not apply to general correspondence, marketing material or documents outside the scope of ISO 9001.
3. Responsibilities
- Document owner: drafts and maintains the document, and initiates any revision.
- Reviewer: a person competent in the subject matter, checks the document is technically correct and workable before approval.
- Approver: typically the quality manager or department head, signs off the document before release.
- Quality manager: maintains the document register, the numbering scheme and the external document list, and confirms obsolete versions are withdrawn.
4. Definitions
- Controlled document: a document managed through this procedure, with one current, approved version.
- Uncontrolled copy: a copy, such as a printout, that is not automatically updated when the source document changes.
- External document: documented information [Company Name] relies on but did not author, such as a standard, a customer specification or a supplier certificate.
- Obsolete document: a document or version that has been superseded and is no longer valid for use.
5. Document identification and numbering
Every controlled document gets a unique reference made up of a two- or three-letter type prefix, a three-digit sequence number, and a revision number, for example QP-001 Rev 3: quality procedure number one, third revision.
| Prefix | Document type | Example |
|---|---|---|
| QP | Quality procedure | QP-001 Rev 3 |
| WI | Work instruction | WI-014 Rev 1 |
| FRM | Form or template | FRM-022 Rev 2 |
| REG | Register or log | REG-003 Rev 1 |
| EXT | External document, logged but not authored by you | EXT-047 (supplier issue no.) |
The quality manager assigns the next available sequence number when a new document is created, and keeps a register mapping each reference to its title, owner, current revision and approval date.
Keep the scheme small enough that people can read a reference and understand it without looking anything up. A five-person company rarely needs more than three or four prefixes. Adding a new one for every department or process usually creates more confusion than it solves. If you already run a numbering scheme, whatever it is, this procedure only needs to describe it accurately. There’s no requirement to match the example above.
6. Creation and review
The document owner drafts the document using the standard template for its type, and gives it a working title and a provisional reference number. Before it goes for approval, a reviewer with relevant competence checks it for technical accuracy, clarity and fit with how the work is done. A procedure nobody can follow in practice is a finding waiting to happen.
7. Approval
The approver named for that document type reviews it for suitability and adequacy and signs off, recording their name and the date. A document has no standing under this procedure until it has been approved. Draft versions are marked "Draft" and are not issued for use.
8. Issue and access
Once approved, the quality manager issues the current version to the people who need it and updates the register. Where documents are held in a shared system, access is controlled by role so that only the document owner and quality manager can edit the source, while everyone who needs it can view the current version. Printed copies are marked "uncontrolled when printed" so nobody mistakes one for the current version by default.
9. Changes and revisions
Anyone can request a change, but only the document owner initiates a revision. A revised document goes through the same review and approval steps as a new one, and its revision number increases by one. The previous version is retained on file, marked obsolete, and withdrawn from anywhere it was in active use.
10. Documents of external origin
Standards, customer specifications, regulations and supplier certificates such as certificates of analysis or safety data sheets are logged on a separate external document register, with the supplier or issuing body, the current issue or expiry date, and an owner responsible for checking it’s still current. [Company Name] does not edit external documents, but controls which version is in use and when it needs replacing, the same way it controls its own documents.
11. Obsolete documents
When a document is superseded, the previous version is removed from active use immediately and either archived with a clear "obsolete" marking or, where it’s retained purely for legal or knowledge purposes, filed separately from current documents so it cannot be mistaken for one.
12. Records retention
Records created under this procedure, such as the document register and approval history, are retained for [state period, for example three years or the life of the product] and are then disposed of securely. External documents such as expired supplier certificates are retained for [state period] after they lapse, to show what was in effect at the time.
13. Related documents
- Nonconformance and corrective action procedure
- Internal audit procedure
- Management review procedure
- Document register / external document register
How do you adapt this example for your own company?
Replace every bracketed placeholder with your own detail, keep the section order (an auditor who has seen dozens of these procedures will recognise the shape), and cut anything that doesn’t apply to how you work. A five-person company rarely needs a separate reviewer and approver for every document type. The one thing worth keeping no matter how you trim it is a clear answer to the two questions an audit always comes back to: how do you know this is the current version, and how do you know the old one is out of use. See our guide to ISO 9001 document control requirements for how each section above maps back to clause 7.5.
It’s worth reviewing the procedure itself once a year, or whenever it stops matching how you work. A procedure that describes a process nobody follows any more is its own kind of nonconformance. Treat that review the same way you’d treat a revision to any other document: someone owns it, someone checks it, and the change goes through approval before it becomes the new current version.
If keeping a numbering scheme, register and approval history current in a spreadsheet has started to feel like a second job,External Document Control runs the identification, approval, issue and version-control steps above for documents of external origin automatically. The same discipline for your own procedures and forms is coming with Internal Document Control. Join the waitlist there, orsee what's available today.
Frequently asked questions
How do I write an ISO 9001 document control procedure?
Start from the outcome clause 7.5.3 asks for: decide how documents are identified and numbered, who reviews and approves them, how they’re issued and revised, and how obsolete versions are removed from use. The worked example on this page covers each of those sections in plain language you can adapt.
What should an ISO 9001 document control procedure example include?
A complete example covers purpose and scope, who’s responsible for what, a numbering scheme, how documents are created, reviewed and approved, how they’re issued and accessed, how changes and revisions are handled, how external documents and obsolete documents are controlled, and how long records are retained.
Do I need to number every document?
You need a way to uniquely identify each document and tell its current version from a previous one. A numbering and revision scheme is the simplest way to do that consistently. It doesn’t need to be elaborate. A short prefix by document type plus a sequence number and a revision number, like QP-001 Rev 3, is enough for most small companies.
How do you prevent unintended use of obsolete documents?
Remove the previous version from anywhere it’s actively used as soon as the new one is issued. Take down the printed copy, replace the file on the shared drive, or, in a system like Obel-MS, let approval automatically supersede the old version. Keep the obsolete version on file for your retention period, but mark it clearly as no longer current.
Do supplier certificates count as external documents under ISO 9001?
Yes. A supplier certificate of analysis, safety data sheet or accreditation certificate is documented information you didn’t create yourself, so it falls under clause 7.5.3.2’s control of documents of external origin. Log it, know its current version, and track when it needs renewing, the same as any document you wrote in-house.
How long should you keep superseded document versions?
ISO 9001 doesn’t set a fixed retention period, in either the 2015 or 2026 edition. It asks you to decide one and follow it. Many small companies keep at least the previous two or three revisions, or the last few years, whichever is more useful for tracing what was in effect when something happened. State the period in your procedure and apply it consistently.