A machinist builds a batch of parts to revision C of a drawing. The customer changed the design two weeks ago, and revision D is sitting in the engineer's inbox. The parts are scrapped, the delivery is late and nobody did anything unusual. That is what a failure of document control looks like: ordinary people, doing their jobs carefully, from the wrong information.
Document control has a reputation as the dullest part of ISO 9001, a matter of headers, signatures and revision letters. Its purpose is simple and important: everyone who does the work uses the right, current information, and you can show what was done afterwards. This article explains what the standard requires, how to set up revision control that people follow, and how to keep it light enough for a small business.
Documents and records: two different jobs
ISO 9001 uses one term, documented information, for both, but it asks for two different kinds of control. The 2015 edition expressed the difference with two verbs, and the summaries of the 2026 edition report no substantive change to clause 7.
| Documents ("maintain") | Records ("retain") | |
|---|---|---|
| What they are | Instructions for what to do: procedures, work instructions, drawings, specifications, forms, the quality policy | Evidence of what was done: inspection results, calibration certificates, training records, audit reports, signed-off forms |
| Do they change? | Yes. They are revised as the work changes. | No. A record is a fact about the past and must be protected from alteration. |
| Main risk | Someone uses an out-of-date version | A record is lost, unreadable, altered or discarded too soon |
| Main control | Approval, revision control, withdrawal of obsolete versions | Storage, protection, retention period, disposal |
A blank inspection form is a document. The same form filled in and signed is a record. Keeping that distinction clear removes most of the confusion about what needs a revision number.
What clause 7.5 requires
The requirements fit on one page. The summary below follows the 2015 wording; check the exact text in your copy of ISO 9001:2026.
| Requirement | In practice |
|---|---|
| Keep the documented information the standard requires, and whatever else you decide is needed for the system to work (7.5.1) | You choose what to write down, based on your size, the complexity of your processes and the competence of your people |
| Identify and describe it (7.5.2) | Title, reference number, revision, date, owner |
| Use a suitable format and medium (7.5.2) | Language people read, a file type they can open, paper or electronic as suits the workplace |
| Review and approve it for suitability and adequacy (7.5.2) | Someone competent checks it before release, and the approval is visible |
| Make it available and suitable for use where and when needed (7.5.3) | The current version is at the point of use, not only in the office |
| Protect it (7.5.3) | Against loss, improper use, loss of confidentiality and loss of integrity |
| Control distribution, access, retrieval and use (7.5.3) | Who can see it, who can change it, and how people find it |
| Control storage and preservation, including legibility (7.5.3) | Files that still open, paper that is still readable |
| Control changes, for example by version control (7.5.3) | Revision identifiers, a record of what changed, withdrawal of old versions |
| Control retention and disposition (7.5.3) | How long records are kept, and how they are disposed of |
| Identify and control documents of external origin (7.5.3) | Customer drawings, standards, regulations, supplier data sheets |
| Protect records from unintended alteration (7.5.3) | Read-only storage, signed PDFs, audit trails |
Notice what is absent: there is no requirement for a document control procedure, a master list in a particular format, wet-ink signatures or a numbering scheme. You design the method. The auditor checks that it works.
The life of a controlled document
Every controlled document has an owner, usually the manager of the process it describes. The owner decides when it needs changing, makes sure it is reviewed by people who know the work, and arranges approval. Anyone may propose a change; only the owner and the approver may make one.
A revision scheme people understand
Choose one scheme and use it everywhere. Two are common.
| Scheme | Example | Suits |
|---|---|---|
| Letters for released revisions | Rev A, B, C … with drafts shown as A1, A2 before release | Drawings and specifications, especially where customers use the same convention |
| Numbers | Rev 1, 2, 3 … with drafts as 1.1, 1.2 | Procedures, work instructions and forms |
Whatever the scheme, three rules keep it reliable.
- Every released change raises the revision. No "minor" edits to a released document without a new revision, or two different documents will exist with the same identifier.
- The revision appears on every page, or on every sheet of a drawing, with the effective date.
- Each document carries a short revision history: revision, date, what changed and why, and who approved it. "Updated" is not a description. "Torque for M8 bolts changed from 22 to 25 N·m per customer ECN 1142" is.
Marking the changed text with a bar in the margin or a highlight in the first release of a new revision helps people see what is different, which is the first thing they need to know.
One master copy
Most document control failures come from copies. A procedure is printed, emailed, saved to a desktop or photographed on a phone, and from then on the copy no longer changes when the master does. The control is to have one master location for current documents, make it easy to reach from where people work, and treat everything else as uncontrolled.
- Electronic master: a single shared library with version history and permissions, where most people can read and only owners can edit. Link to documents rather than attaching them to emails.
- Paper at the point of use: if instructions must be on paper at a machine or in a vehicle, keep a list of where each controlled copy is, replace them all on revision and collect the old ones. Mark printouts that are not on the list "uncontrolled when printed", with the print date.
- Obsolete versions: remove them from use. If you keep them for reference, mark them clearly as superseded and store them apart from current documents.
Documents from outside
Customer drawings and specifications, industry standards, regulations and supplier data sheets are documents you did not write but must work to. The standard requires you to identify and control them. Keep a register listing each one, its current revision or edition, where the master copy is, who is responsible for watching for updates, and how often they check. Customer drawings deserve the most care, because a revision issued by the customer must reach the shop floor before the next job starts. A drawing revision mix-up is one of the example risks in our article on risk-based thinking.
Records: how long, and how protected
For records, set a retention period by type and write it down. The period should reflect what customers require by contract, what regulation requires and what you need to answer a complaint or a warranty claim. Examples for a small manufacturer might look like this; the right periods for you depend on your contracts and the law that applies to you.
| Record | Example retention | Reason |
|---|---|---|
| Inspection and test results | Product life plus warranty period, or as the customer requires | Evidence of conformity if a claim arises |
| Calibration records | At least as long as the inspection results that relied on the instrument | To show measurements were valid |
| Training and competence records | Duration of employment plus a set period | Evidence that people were competent |
| Internal audits, management reviews, corrective actions | At least one full certification cycle | Certification audits look back across the cycle |
| Supplier evaluations | While the supplier is approved, plus a set period | Evidence of supplier control |
Protect records from change. Store completed forms as read-only files or signed PDFs, keep the audit trail switched on in electronic systems, and back them up. When the retention period ends, dispose of them deliberately, and securely if they contain personal or customer information.
A minimum setup for a small business
- One shared folder or library for current controlled documents, with version history on and edit rights limited to owners.
- A master list: reference, title, current revision, effective date, owner. A spreadsheet is enough.
- A standard header or footer on every document showing reference, revision, date and approver.
- A revision history table at the end of each document.
- A separate archive folder for superseded revisions, read-only.
- A register of external documents with a named person for each.
- A one-page retention schedule for records.
This can be set up in a few days with tools you already have. Specialized document management software helps as volume grows, particularly for approval workflows and electronic signatures, but it is not a requirement.
What an auditor will check
Auditors rarely start in the document library. They start at the workstation. Expect them to:
- pick up the instruction or drawing in use and compare its revision with the master list;
- look for unofficial copies, handwritten notes and photographs of instructions;
- ask an operator how they would know if the instruction had changed;
- trace a recent change from the request, through approval, to the revised document in use;
- check that a customer's latest drawing revision has reached production;
- ask for a record from two years ago and see how long it takes to find.
Our article on internal audits that find real problems shows how to run the same checks yourself first.
Common failures
- Silent edits: a released document changed without raising the revision.
- Copies everywhere: printouts and email attachments that outlive the master.
- Customer revisions stuck in an inbox: no defined route from the customer to the shop floor.
- Over-documentation: procedures for tasks that trained people do reliably, which then go out of date because nobody reads them.
- Records that cannot be found: kept, but in personal folders and inboxes.
AI tools can help with document control: drafting revisions, comparing versions and checking cross-references. Their output must still be reviewed and approved like any other draft. See ISO 9001 and AI for the controls.
Key points
- Documents tell people what to do and are revised. Records show what was done and are protected from change.
- Clause 7.5 sets outcomes, not a method: the right version where it is needed, approved, protected, and traceable through its changes.
- One master location, one owner per document, and a revision raised on every released change prevent most failures.
- Control documents from customers and other outside sources as carefully as your own.
Want a second pair of eyes? Chmltech helps Canadian organizations build, simplify and audit quality management systems. Book a strategy call or ask a question.
