Maybe the instruction taped to the machine is two revisions old. Maybe the inspection record for yesterday's lot is missing a signature. Maybe the document exists, looks correct, but nobody can show it was ever reviewed before it went live. These gaps are where audits go sideways.
ISO 9001 Clause 7.5 isn't a mandate to generate paperwork for its own sake. It requires you to manage the information your quality management system actually needs to run and to prove it's working. This article breaks down the mandatory documented information, the difference between "maintain" and "retain," and exactly what auditors look for when they test your documents and records against real practice.
Key Takeaways
- "Documented information" covers both maintained guidance documents and retained evidence records
- You control the format and volume, but information must stay current, accessible, and traceable
- Auditors verify documents by sampling work, interviewing staff, and tracing records to requirements
- A solid evidence trail links approval, revision history, access controls, and completed records
- Gaps found during self-checks should trigger corrective action, not just a document edit
What ISO 9001 Clause 7.5 Means
ISO 9000:2015 defines documented information as information your organization needs to control and maintain, along with the medium that contains it. That medium can be paper, a PDF, a database, a drawing, or even a photograph. The format isn't fixed. The requirement to control it is.
Documents vs. Records
The practical distinction matters more than the terminology:
- Documents describe how work should be planned or performed, such as a work instruction or a specification
- Records provide evidence that work actually happened or that a requirement was met, such as a completed inspection form
Clause 7.5 governs both, but it governs them differently.
The Three Parts of 7.5
- 7.5.1 General: establishes what documented information your QMS needs
- 7.5.2 Creating and Updating: sets expectations for format, identification, and review before release
- 7.5.3 Control of Documented Information: covers access, protection, retention, and disposal
How Much Documentation Is Enough
There's no fixed page count or document list. According to ISO's official guidance, the appropriate extent depends on your organization's size, the complexity of your processes, and the competence of your people. A five-person machine shop and a 400-employee aerospace supplier will land in very different places, and both can be compliant.
ISO 9001:2015 does not universally require a quality manual or a fixed set of procedures. It does require the documented information the standard explicitly names, plus whatever else your organization needs to run an effective QMS.
What Documented Information ISO 9001 Requires
Two categories matter here, and mixing them up causes real confusion during audits.
Maintain means information you keep current to describe or support how the QMS operates. Retain means you keep evidence showing a requirement was actually met.
According to NQA's implementation guide, the quality policy and objectives are classic examples of maintained information, while retained records exist specifically to prove a requirement was satisfied.
Information You Typically Maintain
- QMS scope
- Information supporting process operation (work instructions, process maps)
- Quality policy
- Quality objectives
Records You Typically Retain
Organized by business function, not as a random checklist:
| Process Area | Example Retained Records |
|---|---|
| Leadership & Planning | Management review outputs |
| Resources & Competence | Training records, calibration basis |
| Operations & Suppliers | Supplier evaluations, product release approvals, traceability records |
| Performance Evaluation | Internal audit results, monitoring and measurement data |
| Improvement | Nonconformity records, corrective action results |
If design and development applies to your organization, add input, output, review, and change records to the operations list.
Before you finalize any internal checklist, verify the current clause references against the full standard text. Wording shifts between related clauses more often than people expect.
The standard rarely prescribes an exact form or software for any of these. What matters is that the chosen record is complete, legible, retrievable, and relevant to the requirement it's proving.
What Auditors Check Under Clause 7.5
Auditors don't read every document in your system. They sample, and they trace. Here's what that looks like in practice.
Availability and Suitability
Expect an auditor to walk to the point of use and ask an employee to produce the current work instruction, drawing, or inspection criteria right there at the workstation.
If the person has to go searching, or pulls up a version that doesn't match what's posted, that's a finding waiting to happen.
Creation, Updating, and Version Control
Under 7.5.2, auditors inspect:
- Titles and unique identifiers
- Dates and revision status
- Authorship or ownership
- Evidence of review and approval by an authorized person
A controlled electronic record might look like "SOP-QC-001 Receiving Inspection Procedure," mapped to multiple applicable standards, with a visible revision history showing who approved each change and when.
A paper equivalent needs the same information: a stamped revision date, a signature block, and a way to confirm the copy in hand isn't superseded.
Document Control and Protection
Per ASQ's process analyst handbook, the standard requires information to be available and suitable where it's needed, and adequately protected against loss of confidentiality, improper use, or loss of integrity. Auditors translate that into practical checks:
- Who has edit access versus read-only access?
- Are backups tested, not just scheduled?
- How is a physical record protected from damage or loss?
- How do you handle secure disposal once retention periods end?
External-Origin Documents
Customer drawings, contracts, regulatory requirements, and supplier specifications all count as documented information too. Auditors want to see how you confirm you're working from the current version, not an email attachment from eighteen months ago.
The Audit Trail an Auditor Expects
When an auditor samples a single record, they expect to see:
- The activity the record covers
- Who performed it and when
- The applicable criteria or result
- Any follow-up action if something didn't meet spec
Missing any one of those elements weakens the record's value as evidence.
How to Make Documented Information Audit-Ready
Getting ready for an auditor means proving the system you already have actually works, not generating more paper.
1. Build a documented-information inventory. Map every controlled document and retained record to its process owner, the applicable clause, its storage location, who can access it, and its revision or retention rule.
2. Test retrieval with real employees. Ask someone on the floor to find the current document and explain how they know it's current. Then ask what happens when a document gets revised: do they know where the old copy goes?
3. Sample completed records in high-risk processes. Training files, calibration records, supplier evaluations, nonconforming output logs, and corrective action files are where auditors spend the most time.
4. Compare what's written against what's done. If the documented procedure and actual practice have drifted apart, fix whichever one is wrong. Don't just pile on more documentation to paper over an undocumented process change.
This is where a platform built around the problem helps rather than just storing files. QMS Learning's Document Management System keeps every controlled document in one place, with append-only revision history so nobody can quietly edit the past.
Documents link directly to the clause, training record, or related corrective action they support. When a document changes, the system flags anything downstream that needs review. At audit time, controlled documents, revisions, and read-and-understand acknowledgments export as one indexed Audit-Evidence Package.
It is still an organizing tool: your team has to keep the underlying content accurate.
Final pre-audit sequence:
- Confirm document ownership
- Verify current revisions are in place
- Test access and retrieval at the point of use
- Review protection measures and backups
- Check external documents for currency
- Sample records across high-risk processes
- Close any gaps with documented corrective action
Common Clause 7.5 Gaps and How to Fix Them
A few patterns show up repeatedly during internal reviews and external audits alike.
Obsolete documents at the point of use. Remove superseded copies from workstations, clearly mark archived versions as non-current, and confirm affected staff know where to find the live version.
Incomplete or untraceable records. A record missing the measurement result, the inspector's identity, or the date can't serve as evidence of anything.
One useful habit: when investigating a gap, document the affected lots, the dates, the actual measurements, and whether the measurement system itself was checked, not just the corrective action taken. A few good parts right after an adjustment don't prove the fix holds; you need data over time to show that.
Approved documents nobody follows. Interview process owners and watch the work before revising anything. Sometimes the document is right and the practice drifted. Sometimes it's the opposite.
Uncontrolled external information and unclear ownership. Weak backup habits, overly broad access permissions, and documents with no clear owner all raise risk. Prioritize fixes based on how much each gap could affect product or service conformity, not just how easy the fix is.
For any gap you find, track it the same way:
- Source requirement
- Current process
- Evidence available
- The gap itself
- Owner
- Target completion date
That structure turns a one-time audit finding into something you can actually manage to closure.
Frequently Asked Questions
What are the mandatory documented information requirements for ISO 9001:2015?
The standard explicitly requires certain items, like the QMS scope and quality policy, plus whatever additional documented information your organization determines is necessary to run its processes effectively. Verify clause-specific requirements against the current standard text before finalizing your list.
What does documented information mean?
It's information your organization must control and maintain, together with the medium it's stored on, whether that's a PDF, a database entry, or a paper form. The term covers both documents that direct work and records retained as evidence.
Which clause of ISO 9001:2015 includes requirements for documented information?
Clause 7.5, split into three subclauses: 7.5.1 General, 7.5.2 Creating and Updating, and 7.5.3 Control of Documented Information.
What is the difference between maintain and retain documented information?
Maintained information describes or supports how the QMS currently operates, like a procedure or policy. Retained information serves as evidence that an activity happened or a requirement was met, like a completed inspection record.
What will an ISO 9001 auditor check under Clause 7.5?
Expect checks on current revisions, approval evidence, availability at the point of use, retrieval speed, protection measures, change control, external document currency, and records demonstrating conformity.
Does ISO 9001 require a quality manual or documented procedures?
No. ISO 9001:2015 doesn't universally mandate a quality manual or a specific procedure format. Organizations still need enough documented information to run their processes effectively and demonstrate conformity to an auditor.