If an operator has ever worked from an instruction that was no longer current, you know what document control costs when it breaks. It is rarely a visible disaster. It is revision 3 printed on the line while revision 4 sits in someone’s inbox, or a procedure updated in a folder without anyone being told. In an audit it shows up as the easiest nonconformity to raise.
The good news is that ISO 9001 does not ask for a complicated system. It asks that every document has an owner, a revision, an approval and one place where the right version lives. This guide covers exactly what clause 7.5 requires, a 7-step document control procedure you can put in place, a sample master list, and the evidence to show when the auditor asks.
In short: ISO 9001 document control needs a master document list, a unique numbering scheme, a prepare-review-approve workflow, a way to withdraw obsolete copies, control of external documents and periodic review with change control. Further down you will find a sample master list and the structure of the procedure. If you want editable versions, the free guide includes the document structure in Excel and a procedure template in Word.
Table of Contents
What ISO 9001 requires for document control (clause 7.5)
Since the 2015 revision the standard no longer talks about “documents” and “records” separately. Both fall under documented information. The requirement sits in ISO 9001 clause 7 (Support) and has two parts:
- 7.5.2 Creating and updating: each document needs identification and description (title, date, author or reference number), a suitable format and media, and review and approval for suitability and adequacy.
- 7.5.3 Control: the document must be available where it is needed, protected from loss or improper use, and controlled for distribution, access, storage, version changes, retention and disposition. This also covers documents of external origin you need to operate.
Notice what the standard does not say: it does not require a quality manual, it does not set a number of procedures and it does not mandate paper or software. You decide how much documentation you need based on your size and how complex your processes are. That is an advantage if you use it: fewer documents, better controlled.
A document is not a record
This mix-up causes more findings than you would expect. A document tells people how to do the work and changes over time: a procedure, a work instruction, a blank form, the quality policy. A record is evidence that something already happened: the completed form, an audit report, meeting minutes. Documents get revised; records are never edited, only protected and retained.
This guide is about documents. For the other half (what to keep, for how long and how to prove it) see our guide to ISO 9001 records control with a retention table.
The document control procedure in 7 steps
1. Take inventory and build the master list
Before you control anything, you need to know what you have. Walk through each process and list the documents people actually use: procedures, instructions, forms, drawings, specifications. That becomes your master document list, the single table where every document lives with its number, title, current revision, approval date, owner and process. It is the first thing an auditor asks for and the fastest proof that the system is under control.
A tip that saves months: during the inventory, ask whether anyone uses each document. What nobody reads does not get controlled. It gets deleted.
2. Use a numbering scheme that explains itself
The document number lets anyone identify a document without opening it. A simple scheme beats a perfect one: document type, process and a sequential number. For example, PR-PUR-03 for the third Purchasing procedure or WI-PRD-12 for a Production work instruction. Write the scheme down once and apply it the same way every time.
3. Define who prepares, who reviews and who approves
Every document needs three clear roles. The person who knows the process prepares it; someone else checks that it is clear and consistent with the system; the person with authority over the process approves it. In a small business review and approval can sit with the same person, as long as it is not the author. What matters is that the approval leaves evidence: date, name and approved revision.
4. Control distribution: one current revision at hand
Clause 7.5.3 asks for documents to be available where they are needed. In practice that means two things: the operator finds the right revision without searching, and there are no loose copies that nobody updates. If you print, mark controlled copies and keep track of where they are. If you work digitally, keep one single point of access instead of files copied onto desktops and into emails.
5. Withdraw obsolete documents (and flag the ones you keep)
When a new revision is released, the old one should disappear from every point of use the same day. If you need to keep it for history or legal reasons, mark it clearly as obsolete and store it out of circulation. An obsolete document on the shop floor is one of the most common findings in any audit.
6. Control documents of external origin
Technical standards, customer specifications, equipment manuals, legal requirements: you did not write them, but you work from them. The standard asks you to identify them and control their distribution. Adding them to the master list with their source, the revision you use and who checks they are still current is enough.
7. Schedule reviews and control changes
ISO 9001 does not set a review frequency, but it does expect documents to stay fit for purpose. A practical rule: review critical documents once a year and the rest every two years, plus any time the process changes, a related nonconformity appears or an audit calls for it. Every change bumps the revision and records what changed and why. That history is what gives you document traceability when the auditor asks why a procedure says what it says.
Example: what a master document list looks like
This is the minimum format that works. Each row is a current document; obsolete ones leave the list or move to a separate tab marked as history.
| Number | Title | Type | Process | Revision | Approved by | Approved on | Next review |
|---|---|---|---|---|---|---|---|
| PR-QUA-01 | Document control | Procedure | Quality | 3 | Quality manager | 2026-03-12 | 2027-03 |
| PR-PUR-03 | Supplier evaluation | Procedure | Purchasing | 2 | Operations director | 2025-11-04 | 2026-11 |
| WI-PRD-12 | Line 2 setup | Work instruction | Production | 5 | Production manager | 2026-06-20 | 2027-06 |
| FM-PRD-07 | Final inspection record | Form | Production | 1 | Production manager | 2025-09-15 | 2027-09 |
| EXT-02 | Customer packaging specification | External | Sales | Rev. D (customer’s) | Not applicable (external origin) | 2026-01-08 (received) | When a change arrives |
This table answers half of the auditor’s questions without opening a single document. The other half is the procedure itself, and it fits on two pages if it follows this structure:
- Purpose and scope: which documents it covers and which it does not (records have their own procedure).
- Responsibilities: who prepares, reviews, approves and maintains the master list.
- Numbering: the scheme from step 2, with two or three examples.
- Preparation, review and approval: how the evidence of each approval is kept.
- Distribution and access: where the current revision is consulted and how copies are controlled.
- Changes and revisions: what triggers a review and how changes are recorded.
- Obsolete and external documents: how the first are withdrawn and the second kept current.
What the auditor checks and what evidence to show
| What the auditor asks | The evidence that answers it |
|---|---|
| How do I know which revision is current? | The master list with the revision and approval date of each document |
| Who approved this procedure? | The approval record: name, date and revision |
| What changed from the previous revision? | The document’s change history |
| How do you prevent the use of obsolete documents? | The withdrawal method and how retained obsolete copies are marked |
| Which external documents do you use and how are they kept current? | Their entry in the master list, with source and owner |
| Can people access what they need? | A visit to the point of use: the operator finds the right revision |
Auditors almost always test this on the floor: they pick up a document at a workstation and compare it with the master list. If they match, the control works. If they do not, it does not matter how well written your procedure is.
The 5 mistakes behind most findings
- Over-documenting. A hundred procedures nobody reads are a hundred documents to maintain. Document what prevents errors, not everything people do.
- A master list that does not match reality. If the list says revision 4 and the line has revision 3, the finding is guaranteed.
- Approvals without evidence. A document marked “approved” with no date or name is not approved as far as the auditor is concerned.
- Uncontrolled copies. The procedure printed two years ago and taped to the wall is still there after it changed.
- Forgetting external documents. A customer specification three revisions out of date is a product risk, not just an audit risk.
Spreadsheet, shared drive or software?
You can comply with a spreadsheet and a shared folder, and plenty of companies start that way. The trouble starts as documents and people multiply: the master list drifts, versions get duplicated and nobody knows who changed what. We cover the specific risks in the disadvantages of shared folders.
Quality management software handles those points for you: one current revision, an approval workflow that leaves evidence, change history and review reminders. In QualityWeb 360 that lives in the document control module. If everything is in spreadsheets today, here is how to migrate your QMS from Excel without disrupting operations. And if you are not ready to switch tools yet, start with the basics: a clean master list and a short procedure everyone understands.
Frequently asked questions about ISO 9001 document control
What is the difference between document control and records control?
Document control applies to what tells people how to work (procedures, instructions, blank forms) and relies on revisions and approvals. Records control applies to evidence of work already done (completed forms, reports, minutes) and relies on protecting and retaining it. ISO 9001 requires both under clause 7.5.
Does ISO 9001 require a documented procedure for document control?
Not since the 2015 revision. The standard requires you to control documented information, not to write a specific procedure. Most companies still document it on one or two pages, because it is the simplest way to make everyone follow the same rules.
How many mandatory documents does ISO 9001:2015 require?
The standard does not set a number. It requires documented information at several points, such as the scope of the system, the quality policy and objectives, and evidence of internal audits, management review and corrective actions. The rest depends on your company: document what your processes need to run consistently.
How often should QMS documents be reviewed?
ISO 9001 does not set a minimum frequency. Common practice is to review critical documents once a year and the rest every two years, and whenever the process changes, a related nonconformity is found or an audit calls for it.
What is a master document list?
It is the central table of document control: every document in the system with its number, title, current revision, approval date, owner and process. It tells you in seconds which revision is the right one, and it is one of the first things an auditor reviews.
What happens if document control fails in an ISO 9001 audit?
An obsolete document in use, an unapproved revision or a master list that does not match reality all lead to a nonconformity. Depending on its extent it can be minor or major; a major one can hold up certification until it is corrected and the action is shown to be effective.
Document control is part of ISO 9001 clause 7, alongside resources, competence, awareness and communication. Get it right and the rest of the system has something solid to stand on.
