What Clause 7.5 Is Actually About
Documented information is one of those topics that sounds straightforward until you are sitting in front of an auditor who is asking why a particular record does not exist, or why a procedure nobody uses is still listed as a controlled document. ISO 9001 Clause 7.5 covers everything the standard requires you to maintain and retain in writing, and it does so across three tightly connected subclauses.
On this page
Understanding Clause 7.5 properly means understanding the difference between documents and records, knowing what the standard actually mandates versus what your organisation chooses to do, and being able to demonstrate that your documented information is controlled in a way that keeps it accurate, accessible, and protected. This article walks through each subclause in plain English, with the kind of practical commentary that matters when you are preparing for an audit or conducting one.
The Three Subclauses at a Glance
Clause 7.5 is divided into three parts:
- Clause 7.5.1 covers the general requirements for what documented information your QMS must include.
- Clause 7.5.2 deals with creating and updating documented information, including format, media, and review and approval.
- Clause 7.5.3 addresses the control of documented information, covering distribution, access, protection, storage, and disposal.
Each subclause builds on the previous one. You cannot control documented information properly if you have not first established what needs to exist and how it should be created. The three subclauses work together as a system.
Exemplar Global Certified Training ProviderRTP No. 310970
Clause 7.5.1: General Requirements
The standard requires that your QMS includes documented information that is required by the standard itself, plus any additional documented information that your organisation has determined is necessary for the effectiveness of the QMS.
That second part is important. ISO 9001:2015 deliberately removed many of the prescriptive document requirements that existed in earlier versions. There is no mandatory quality manual. There is no required procedure for corrective action or internal audits. What the standard does require is that you have documented information where the standard explicitly says so, and wherever your organisation needs it to operate consistently.
What the Standard Explicitly Requires You to Maintain
Throughout ISO 9001, the phrase shall maintain documented information signals a document, meaning something that defines how things should be done or what applies. Examples include:
- The scope of the QMS (Clause 4.3)
- Quality objectives (Clause 6.2.1)
- The quality policy (Clause 5.2.2)
- Information to support the operation of processes (Clause 4.4.2)
What the Standard Explicitly Requires You to Retain
The phrase shall retain documented information signals a record, meaning evidence that something happened. Examples include:
- Evidence of competence (Clause 7.2)
- Results of the monitoring and measurement of processes (Clause 9.1.1)
- Internal audit programme and results (Clause 9.2.2)
- Management review outputs (Clause 9.3.3)
- Results of corrective actions (Clause 10.2.2)
If you are preparing for an audit, it is worth going through the standard clause by clause and marking every instance of these phrases. That list becomes your minimum documented information requirement. Anything beyond it is your organisation's choice, and that is fine, but auditors will not raise a nonconformity simply because you have fewer documents than expected, provided the ones you have are adequate.
Clause 7.5.2: Creating and Updating Documented Information
This subclause is brief but specific. When creating and updating documented information, your organisation shall ensure appropriate identification and description, appropriate format and media, and review and approval for suitability and adequacy.
Identification and Description
Documents and records need to be identifiable. That typically means a title, a document number or reference, a version number or date, and an owner. The standard does not prescribe a particular format, but the intent is clear: anyone picking up a document should be able to tell what it is, which version it is, and whether it is current.
In practice, this is where organisations often create unnecessary complexity. Elaborate numbering systems and multi-level approval hierarchies can make document management harder, not easier. A simple, consistent approach works better than a complicated one that nobody follows.
Format and Media
Documented information can exist in any format and on any media. Paper, electronic files, databases, photographs, videos, even physical samples can all qualify as documented information if they communicate the required information. The standard is deliberately neutral on this point.
What matters is that the format is appropriate for its purpose. A work instruction for a complex machining operation might need diagrams. A training record might be a simple spreadsheet. A customer complaint log might be a database entry. The format should serve the user, not the auditor.
Review and Approval
Before documented information is used, it should be reviewed and approved for suitability and adequacy. This does not mean every document needs a signature from the CEO. It means there is a defined process for who reviews and approves what, and that process is followed consistently.
Auditors commonly find problems here. Documents that have been in use for years without any review. Procedures that were approved by someone who left the organisation five years ago. Version numbers that do not match what is actually being used on the floor. These are the kinds of gaps that surface quickly during document sampling.
For more on how auditors approach this area, the article on Clause 7.5.2 Creating and Updating Documented Information goes into the specific requirements in detail.
Clause 7.5.3: Control of Documented Information
This is the subclause that generates the most audit findings. Clause 7.5.3 requires that documented information required by the QMS and by the standard shall be controlled to ensure it is available for use where and when it is needed, in a suitable format, and adequately protected.
For the control of documented information, the standard specifically addresses distribution, access, retrieval, and use; storage and preservation; control of changes, including version control; and retention and disposition.
Availability and Accessibility
Documents need to be where people need them. A work instruction stored in a shared drive that shop floor workers cannot access is not controlled effectively, regardless of how well it is written. Auditors will ask workers where they find the procedures they use, and if the answer is I just remember what to do or I ask my supervisor, that is a signal worth investigating.
Accessibility also means the right people have the right level of access. Some documented information, such as customer data or commercially sensitive specifications, may need restricted access. The control mechanism needs to reflect the sensitivity of the information.
Protection
Protection means preventing unintended alteration, loss, or disclosure. For electronic documents, this typically involves version control settings, backup procedures, and access permissions. For paper documents, it might mean controlled copies with watermarks, or physical storage that prevents damage or loss.
The standard does not tell you how to protect documented information. It tells you that you must. Your approach needs to be proportionate to the risk. A customer complaint record that is accidentally deleted and cannot be recovered is a protection failure. So is a procedure that gets edited by someone without authority to change it.
Version Control and Change Management
When documented information changes, the old version needs to be managed. Obsolete documents should not be available at the point of use. If someone is working from a superseded procedure, the control system has failed.
This is one of the most common findings in document control audits. Printed copies of old procedures left at workstations. Multiple versions of the same document in a shared drive with no clear indication of which is current. Email attachments containing old versions still being used because nobody told the team the document had been updated.
A practical approach is to have a single source of truth for all current documents, whether that is a document management system, a controlled intranet page, or a simple folder structure with clear naming conventions. The key is that the current version is unambiguous and the obsolete version is either removed or clearly marked as superseded.
Retention and Disposition
Records need to be kept for defined periods. The standard does not specify retention periods for most records; that is left to the organisation to determine based on legal requirements, contractual obligations, and practical need. What the standard does require is that you have determined those retention periods and that you follow them.
Disposition means what happens when the retention period ends. Records should be disposed of in a controlled way, particularly if they contain personal information or commercially sensitive data. Shredding, secure deletion, and documented disposal are all acceptable approaches depending on the media and sensitivity involved.
The article on Clause 7.5.3 Control of Documented Information covers the specific control requirements in more detail, including common audit findings and how to address them.
Documents vs Records: Why the Distinction Matters
The 2015 version of ISO 9001 replaced the older terms documents and records with the single term documented information. This was intended to simplify the language, but it sometimes creates confusion because the control requirements are actually different depending on whether you are dealing with a document or a record.
A document tells you how to do something. It can be updated, revised, and replaced. Version control is critical. A record provides evidence that something was done. It should not be altered after the fact. Integrity and retention are critical.
In practice, organisations still need to treat these differently. A quality plan is a document. A completed inspection record is a record. Both are documented information under the standard, but the way you control them is different. Auditors understand this distinction and will look for evidence that your controls reflect it.
External Documented Information
Clause 7.5.3 also requires that documented information of external origin that is determined to be necessary for the planning and operation of the QMS is identified and controlled. This is often overlooked.
External documented information includes things like customer-supplied specifications, regulatory standards, industry codes of practice, supplier data sheets, and calibration certificates from external laboratories. If your organisation uses these to control its processes, they are part of your documented information system and need to be managed accordingly.
In practice, this means knowing which external documents you rely on, having a current version of each, and having a process for updating them when the external source changes. An organisation that is still working to a superseded version of a customer specification because nobody checked for updates has a documented information control failure, even if all their internal documents are perfectly maintained.
Common Audit Findings in Clause 7.5
After conducting hundreds of certification audits, the same patterns appear repeatedly. Here are the findings that come up most often:
- Obsolete documents at the point of use. Printed copies of old procedures left at workstations, or old versions in shared drives without clear supersession marking.
- No defined retention periods. Organisations that keep records indefinitely because nobody has determined how long they actually need to be kept.
- Approval gaps. Documents that have been revised without going through the defined review and approval process, or documents approved by people who no longer have that authority.
- External documents not identified. Customer specifications or regulatory standards being used without being formally included in the document control system.
- Records that cannot be retrieved. Particularly in small organisations where records are kept in personal email inboxes or on individual computers without backup.
- No evidence of review. Documents that have not been reviewed in years, with no documented evidence that they were checked and confirmed as still current.
These findings range from minor nonconformities to major ones depending on the impact. An obsolete procedure being used for a safety-critical process is a very different situation from an obsolete procedure for a low-risk administrative task.
What Good Document Control Looks Like in Practice
Good document control does not require expensive software. It requires a clear, consistent approach that people actually follow. Here is what effective documented information management looks like in practice:
- A master list or index of all controlled documents, showing the current version and where each document is held.
- A defined process for creating, reviewing, approving, and issuing new documents or revisions.
- A single access point for current documents, whether electronic or physical, so there is no ambiguity about which version is current.
- A process for withdrawing or marking obsolete documents when new versions are issued.
- Defined retention periods for all record types, documented somewhere accessible.
- A process for identifying and controlling external documents that are necessary for QMS operation.
The size and complexity of your system should match the size and complexity of your organisation. A ten-person business does not need a document management system with workflow approval chains. A five-hundred-person manufacturer probably does.
Exemplar Global Certified Training ProviderRTP No. 310970How Auditors Approach Clause 7.5
When auditing Clause 7.5, experienced auditors do not just ask to see the document register. They follow the trail. They pick a process, ask to see the procedure that governs it, and then check whether the version being used matches the approved version. They ask workers where they find the documents they use. They pull a sample of records and check whether they are complete, legible, and retrievable.
The most revealing question is often the simplest: How do you know this is the current version? The answer tells you immediately whether document control is real or just documented on paper.
Auditors also look at the connection between Clause 7.5 and other clauses. Competence records connect to Clause 7.2. Calibration records connect to Clause 7.1.5. Monitoring and measurement results connect to Clause 9.1. If the records required by other clauses are missing or inadequate, that is a Clause 7.5 finding as well as a finding against the specific clause that required the record.
For a broader look at how auditors verify support requirements including documented information, the article on Audit Techniques for Clause 7: Verifying Competence, Awareness and Documents provides practical guidance on the full clause 7 audit approach.
Preparing Your QMS for a Clause 7.5 Audit
If you are preparing for a certification or surveillance audit, here is a practical checklist for Clause 7.5 readiness:
- Review the standard and identify every instance of shall maintain documented information and shall retain documented information. Confirm you have each one.
- Check your document register or master list against what actually exists. Are there documents listed that no longer exist? Documents that exist but are not listed?
- Pull a random sample of documents and verify the version in use matches the approved version.
- Ask a few workers where they find the procedures they use. If the answer surprises you, your accessibility controls need attention.
- Check retention periods for your main record types. Are they documented? Are they being followed?
- Identify the external documents your organisation relies on. Are they current? Are they controlled?
- Look for obsolete documents that might still be accessible at the point of use.
This kind of self-assessment before an external audit will surface most of the issues that would otherwise become findings. It is the same approach a good internal auditor would take, and it is exactly the kind of practical skill that separates auditors who add real value from those who just tick boxes.
If you want to build that kind of practical auditing skill, the ISO 9001 auditor training courses at Audit Workshop are built around real audit scenarios, not just clause reading. Whether you are starting out as an internal auditor or working toward lead auditor qualification, the training is designed to give you the confidence to audit documented information and every other clause with genuine competence.
