ISO 9001 Document Control — Clause 7.5 and the Control of Documented Information
ISO 9001:2015 replaced the old “documents and records” split with a single concept — documented information — governed by Clause 7.5. This page covers what must be controlled, how version and approval rules work, and the practical controls that keep a QMS audit-ready.
Clause 7.5 — the control framework
Clause 7.5.1 requires documented information to be adequate and suitable. Clause 7.5.2 covers creation and updating — it must be reviewed and approved by authorized personnel. Clause 7.5.3 is the operational control: availability at points of use, suitability, identification, legibility, and control of external and obsolete documents.
Approval, versioning and obsolescence
Every controlled document needs a version, an approval sign-off, and a way to retire the old version. The most common failure is obsolete copies still in use at the shop floor (Clause 7.5.3 c). A document register with effective dates and a distribution list is the minimum control auditors accept.
Documents vs records
The 2008 distinction was explicit; 2015 merges them. In practice, a procedure is controlled while in force, and once it records an activity it becomes evidence — still controlled, but its retention period (Clause 7.5.3 d) is what matters. Define retention periods for each record type.
Frequently asked questions
Do we need a document-control procedure?
ISO 9001:2015 does not prescribe a procedure by name, but Clause 7.5.2 and 7.5.3 require controlled creation, approval and distribution. Most organizations keep a procedure because it is the clearest way to demonstrate control.
What is the difference between a controlled and uncontrolled copy?
A controlled copy is the current approved version, tracked in a register, with changes managed. An uncontrolled copy is any version not maintained — typically marked “uncontrolled when printed” and not relied upon for the QMS.
How long must records be retained?
The standard requires retention periods to be established (Clause 7.5.3.2 d) but does not set fixed durations. Set periods based on legal, customer and standard requirements, and state them in your procedure.