ISO 9001 document control: what clause 7.5 asks for
Updated , 10 minute read. By Obel AI & Quality.
In short
ISO 9001 controls documented information under clause 7.5: creating and updating it with proper identification and approval (7.5.2), then controlling its availability, protection, storage, changes and retention (7.5.3). This covers documents you follow and records that prove what happened, including external documents such as supplier certificates. Clause 7.5 keeps this shape in both ISO 9001:2015 and ISO 9001:2026.
What is documented information, and how is it different from a record?
Documented information is ISO 9001:2015’s single term for anything you write down and control so your quality management system (QMS) works. It covers two things people used to talk about separately: documents and records. Adocument tells people what to do, such as a procedure, a specification or a drawing. A record proves what happened, such as a completed inspection form, a signed-off approval or a calibration certificate.
ISO 9001:2015 uses two different verbs on purpose. You maintain a document: you keep it current, and you expect it to change as your process changes. You retain a record: once it’s created, it shouldn’t change, because it’s evidence of a point in time. Mixing the two up causes real problems. Editing a record after the fact is a finding waiting to happen. Never updating a document that everyone has quietly stopped following is another. ISO 9001:2026 keeps the same underlying idea but drops the two separate verbs. It uses one phrase throughout the standard instead: documented information being "available" as the document or the evidence needs. It’s a wording change. You still keep documents current and records unaltered. The standard now describes both with one term.
What does clause 7.5 require?
Clause 7.5 has three parts, and each asks for something distinct. Read together, they describe a full lifecycle: decide what you need, create and approve it properly, then keep it under control for as long as it’s in use. Clause 7.5 keeps its numbering and this same three-part shape in both ISO 9001:2015 and ISO 9001:2026, so everything below applies to whichever edition your organisation is certified to.
7.5.1: general
You must maintain the documented information the standard explicitly asks for, plus whatever documented information your own organisation decides it needs for the QMS to be effective. How much that is scales with your size, the complexity of your processes and the competence of your people. A five-person business and a 200-person one will land on different amounts of paperwork, and that’s by design.
7.5.2: creating and updating
When you create or change a document, identify it properly with a title, a reference number, a date or revision, and an author, and put it in a suitable format, whether that’s a PDF, a printed sheet on a wall, or a page in a system. Then review and approve it for suitability and adequacy before anyone relies on it. Skipping the approval step is one of the most common shortcuts small teams take, and one of the easiest for an auditor to catch.
7.5.3: control of documented information
Once a document exists, you have to keep controlling it. Make sure it’s available and suitable for use where and when it’s needed, and adequately protected from loss of confidentiality, improper use or loss of integrity. Clause 7.5.3.2 lists the specific activities this covers: distribution, access, retrieval and use, and storage and preservation, including keeping it legible. It also covers control of changes, such as version control, and retention and disposition, meaning how long you keep it and what happens to it after that.
What’s the difference between a controlled and an uncontrolled document?
A controlled document is managed through a defined process from creation to retirement: someone owns it, changes go through review and approval, and there is always one current version that people can point to. An uncontrolled document is a copy that has stepped outside that process (most often a printout, a saved PDF on someone’s desktop, or an email attachment) and can go out of date without anyone knowing, because nothing links it back to the controlled original.
You don’t have to ban printing. Many organisations mark printed copies "uncontrolled when printed" so it’s clear they may not reflect the current version. What matters to an auditor is whether people are working from something current.
What does the document lifecycle look like in practice?
Clause 7.5 doesn’t hand you a named lifecycle, but almost every working document control system runs the same sequence of stages.
- Create: someone drafts the document and gives it an identity: title, number, revision.
- Review: a competent person checks it’s technically correct and fit for its purpose.
- Approve: an authorised person signs it off before it goes live.
- Issue: the approved version is made available to the people who need it, and any old version is withdrawn from active use.
- Revise: when something changes, the document goes back through review and approval as a new version, with the previous one kept on file.
- Archive: once a document is no longer in use, it’s retained for whatever period you’ve set, then disposed of.
Most document control failures happen at the joins between these stages: a revision that skips review, or an old version that never gets withdrawn from a shared drive. A system that enforces the sequence, rather than relying on someone remembering it, removes most of that risk.
How do you control documents of external origin?
Clause 7.5.3.2 specifically extends control to documented information of external origin that your organisation determines is necessary for planning and operating the QMS. In practice, that’s anything you rely on but didn’t write yourself: the ISO 9001 standard, industry standards, customer drawings and specifications, regulatory requirements, and supplier certificates such as certificates of analysis, safety data sheets and statements.
The control principle is the same as for your own documents: know which version you’re relying on, and know when it changes. The mechanism is different, because you don’t control the source. In practice that usually means a register of external documents, an owner for each one, and a way of noticing when a certificate is about to expire or a standard is revised. See our guide on building a document control procedurefor a worked example that covers external documents specifically.
Is a document control procedure mandatory in ISO 9001:2015?
No. Unlike the 2008 version of the standard, ISO 9001:2015 doesn’t name "control of documents" as one of the mandatory documented procedures, and ISO 9001:2026 carries this forward unchanged. What’s mandatory is the outcome in clause 7.5.3. Most organisations write a short procedure anyway, because it’s the easiest way to make sure everyone follows the same steps and to answer an auditor’s questions consistently.
What do auditors typically check, and where do findings come from?
An auditor working through clause 7.5 usually samples a handful of documents and follows them end to end: is the version in use the approved one, is it legible and accessible to the people who need it, was it properly reviewed, and are old versions out of circulation. They’ll also ask how you handle documents of external origin, and whether records are retained for as long as your own rules say they should be.
The table below maps the core requirements to a practical control and the kind of evidence an auditor typically asks to see.
| Requirement | Practical control | Evidence an auditor asks for |
|---|---|---|
| 7.5.2 (creating and updating) | Give every document a title, a unique reference number, a revision or date, and an author. Route it for review and approval before anyone uses it. | A document register or log showing who wrote it, who approved it, and when. |
| 7.5.3.1 (availability and suitability) | Keep the current, approved version where the people who need it can reach it, in a format they can open. | A sample staff member finding the right document at their workstation in under a minute. |
| 7.5.3.1 (protection) | Restrict who can edit or delete a document, and keep a record of changes. | User permissions or access records, plus a change history for a sampled document. |
| 7.5.3.2 (control of changes) | Keep the previous version on file when you issue a new one, so nobody can point to a superseded copy as current. | Version history for a document that has been revised, with the old version marked as no longer current. |
| 7.5.3.2 (retention and disposition) | Decide, and follow, how long you keep each type of document and record, and what happens to it afterwards. | A retention rule you can point to, and a document or record whose age matches it. |
| 7.5.3.2 (documents of external origin) | Identify documents you did not write, such as standards, supplier certificates and customer specifications, and control them the same way as your own. | A list of external documents in use, each with a current version and an owner. |
The most common findings come from the gap between what a procedure says and what happens: a printed copy on a wall that’s two revisions behind the system, a supplier certificate nobody noticed had expired, or a document that was changed without going back through approval. None of these need a bigger system to fix. They need the lifecycle above to run the same way every time, for every document.
Does this still apply now that ISO 9001:2026 is out?
Yes. ISO published the sixth edition, ISO 9001:2026, on 16 September 2026, and clause 7.5 keeps the same numbering and the same substance in the new edition, with the maintain/retain wording unified as described above. ISO 9001:2015 remains a valid, currently auditable standard through a three-year transition period, with 2015 certificates staying valid until around 30 September 2029, so nothing on this page stops applying because a new edition exists.
If your organisation is already certified to ISO 9001:2015, you don’t need to act immediately. Certification bodies will confirm their own transition timelines as they become accredited to audit the 2026 edition. If you’re starting your first certification now, ask your certification body which edition they’re auditing against, since both are current at the same time during the transition window.
How does Obel-MS support document control today?
External Document Control is built directly around clause 7.5.3.2: you upload a supplier certificate or standard, accept, edit or dismiss the AI-suggested metadata, then approve it, which moves it into the Register with status Validated. Every document is auto-filed into a Supplier → Manufacturer → Product folder, and its status (Active, Expiring soon, Expired, or No expiry set) is worked out automatically, so an expired certificate doesn’t sit unnoticed until an audit finds it. Every upload, approval and new version is recorded in a full audit trail.
Internal Document Control, for the SOPs, policies and work instructions you write yourself, is coming soon. Today, that part of your document lifecycle still needs to live somewhere else. See theInternal Document Control page to join the waitlist, orcheck pricing for what’s available now.
Frequently asked questions
What is document control in ISO 9001?
Document control is the set of practices that keep the documented information your quality management system needs correct, current and available to the right people. ISO 9001:2015 covers it under clause 7.5, which asks you to create, approve, distribute, protect, revise and eventually retire documents in a consistent way.
What is documented information in ISO 9001:2015?
Documented information is the standard’s term for both documents (instructions you follow, such as procedures and specifications) and records (evidence of what happened, such as inspection results). ISO 9001:2015 replaced the older terms "documents" and "records" with this single term, but the distinction between the two still matters in practice. ISO 9001:2026 keeps the same term.
Is a document control procedure mandatory in ISO 9001:2015?
No, and this hasn’t changed in ISO 9001:2026 either. Neither edition lists a documented procedure for document control among its mandatory documents. Clause 7.5.3 still requires you to control documented information. Most organisations write a short procedure anyway because it makes that control easier to run consistently and easier to show an auditor.
What is a controlled document?
A controlled document is one that is managed through a defined process: identified, reviewed, approved, issued in a known current version, and withdrawn from use once superseded. An uncontrolled document is a copy taken outside that process, such as a printout, which can quietly go out of date without anyone noticing.
What documents does ISO 9001:2015 require?
The standard requires far fewer named documents than older versions. It asks for a documented scope, a quality policy and objectives, and a handful of specific records such as evidence of monitoring and measurement, internal audits, and management review, plus whatever else your organisation determines it needs to run the QMS effectively.
What do auditors check during a document control audit?
Auditors typically pick a sample of documents and trace them from creation to current use: is the version on the shop floor the approved one, is it legible and available, was it reviewed by someone competent, and are superseded copies out of circulation. They also check that external documents, like standards and supplier certificates, are on a list and up to date.