ISO 9001 audit document list: which documents the auditor wants to see in advance
A document list is an overview of the documents and records you prepare before or at the ISO 9001 audit. Many certification bodies ask for documents in advance, for example when they plan the audit. The purpose is simple: the auditor knows in advance what to look at, and you avoid searching during the audit. A good document list is short, includes only what the standard asks for, and refers to where each document is kept. For more on how the audit runs, see the ISO 9001 audit process. For the documents the standard requires, read mandatory documents per chapter. The text of the standard is available from NEN , the Dutch standardisation institute.
What exactly does the standard require?
ISO 9001 does not prescribe a fixed list of documents you must submit. The standard does require documented information that is needed for the quality management system. You decide which documents those are. For this, read document control (7.5) and mandatory documents per chapter.
There is a new version, ISO 9001:2026. Read the revision of ISO 9001. The chapter structure has largely stayed the same as in ISO 9001:2015, so the clause numbers in the table below apply to both versions. Check them against the final text, which NEN sells. Put the clause numbers in your document list, so the auditor sees the link straight away.
Do not supply the whole system. Supply what the auditor needs to test the requirements. A thick package with everything in it is harder to use than a short list of references.
Document list as a template
The table below is an example for an installation company with twelve employees. Fill in the columns for your own organisation.
| No | Document or record | Clause | Format | Where it is kept | Owner |
|---|---|---|---|---|---|
| 1 | Quality policy, signed | 5.2 | Quality folder, version 2.1 | Management | |
| 2 | Quality objectives with measurement results | 6.2 | Spreadsheet | Dashboard, objectives tab | Quality manager |
| 3 | Overview of processes with owners | 4.4 | Process sheet | Intranet, processes section | Quality manager |
| 4 | Competence matrix | 7.2 | Spreadsheet | HR folder | HR |
| 5 | Document register | 7.5 | Spreadsheet | Quality folder | Quality manager |
| 6 | Customer satisfaction measurements, last year | 9.1.2 | Report | Customer folder | Account manager |
| 7 | Internal audit schedule and reports | 9.2 | Folder with reports | Audit folder | Internal auditor |
| 8 | Minutes of the management review | 9.3 | Minutes | Management folder | Management |
| 9 | Nonconformity and improvement register | 10.2 | Spreadsheet | Dashboard, nonconformities tab | Quality manager |
| 10 | Supplier evaluations | 8.4 | Spreadsheet | Purchasing folder | Purchasing |
Pay attention to the column “where it is kept”. An auditor wants to open the document directly. A reference to “the Quality folder” is useful only if that folder really exists, with the same name and with access rights for the auditor.
How do you share the document list?
Ask your certification body how much time before the audit they want the documents. This differs per body. Share the list as one document, with a date and a version number. Do not send loose emails or messages alongside it. This keeps it clear to everyone which version applies.
For the external audit you work with a schedule. For example, an audit of two days with five audit parts. Each part comes with a few documents. Make that link visible in the document list yourself, for example by adding an “audit part” column.
What does the auditor look for in the document list?
The auditor does not only check whether a document exists. They look at three things:
- Up to date. The version is from this year, the date is correct and the last change is recorded.
- Completed. A register with empty fields, or a policy without a signature, raises questions.
- Used. The document is actually used in practice. That is why auditors often ask for a recent example: a nonconformity, a complaint, a supplier.
A document list that matches practice is worth a lot. A list that sounds good but does not match what happens becomes a problem during the audit.
Common mistakes
- Documents that do not exist. You list a procedure that is on paper but not used in practice. The auditor will ask about it.
- Multiple versions. A document is in two folders, with different version numbers. Choose one source and refer to that.
- Too much added. Sending everything from the last five years makes the list unusable. Supply the recent evidence and keep the rest available if the auditor asks for it.
- No owner. Each document has someone who maintains it. Without a name, it gets left behind.
- Internal documents shared as external. Salary details or customer details do not belong in a document list. Supply anonymised examples instead.
How do you prepare the list?
Start with the clauses of the standard. Go through each chapter and note, for each requirement, which document is the evidence. The ISO 9001 checklist per chapter helps you with this, because it states per clause what the auditor wants to see. Then collect the documents, check the dates and put everything into one overview.
If you have done an internal audit, use its findings as a second check. Which points came up there? Is the solution already in the document list? If not, it is wise to process it before the external auditor arrives. See the internal audit.
Example covering email
Do not send the list without an explanation. A short email prevents misunderstandings. For example:
Dear auditor,
Please find attached the document list for our audit on the agreed date. For each document it states the clause of the standard, the version and the location. Documents you cannot open directly, we will make available in the shared folder on the day itself.
Do you have questions in advance about the scope or a specific process? Let us know, and we will make sure the right person is present.
Kind regards, [name and position]
Keep the tone businesslike and brief. An auditor prefers a clear list to a long explanation.
What do you do with documents that are not finished yet?
Sometimes a document is not ready when the list must be shared. That is not a disaster, provided you say so honestly. In the “format” column, write “in development” with a planned date. In your covering email, name which document that is and when it will be ready.
Do not let a draft pass as an approved document. The auditor recognises a draft by its version and date. This causes more trouble than an honest notice in advance.
Which documents are better left out?
Not everything belongs in the document list. You usually leave these documents off the list and keep them available on request:
- Personal details of employees, such as payslips or medical information.
- Customer details that are not needed for the check, for example complete quotes with prices.
- Internal correspondence about disputes or legal matters.
Supply an anonymised example instead. For example, a handover form without the customer name, or a supplier evaluation without price information. For personal data, the Algemene verordening gegevensbescherming (AVG, General Data Protection Regulation) applies. So share only what the auditor needs.
Next step
Make the list using the table above and fill it in for your organisation. Check per line whether the document exists, is up to date and is used. After that you can prepare better for the audit. For more on preparation, see nonconformities and improvement, in case the auditor finds something.