Document control and documented information (ISO 9001 7.5)

Document control means that the right version of a document is available at the right time, that someone has approved it, and that evidence cannot simply disappear or change. ISO 9001 calls everything you record “documented information” and regulates its control in clause 7.5. Which documents are mandatory is set out in mandatory documents for ISO 9001. This page covers how to control them, with an example document register. The format is free: paper, SharePoint, a wiki or quality software, as long as you meet the requirements of the NEN standard .

Short answer: clause 7.5 asks for three things. Decide which information you record (7.5.1). Give each document a title, version, date and approval (7.5.2). Make sure it is findable, protected, version-controlled and has a retention period (7.5.3).

What is documented information in ISO 9001?

Documented information is everything you record and control. It falls into two types, each controlled in a different way.

Type	What it is	Examples	Main control point
Document (maintained)	Describes how you do something	Quality policy, process description, work instruction	Version control: only the current version in use
Record (retained)	Evidence that you did it	Completed checklist, audit report, measurement report	Protection against change and retention

In ISO 9001:2026, the wording of clause 7.5 has been clarified on this point: the standard draws a sharper distinction between information that supports your activities and information that you keep as evidence. The requirements themselves barely change. You do not have to rename existing documents.

Clause 7.5.1 also determines how much you record. Beyond what the standard requires, you record what you consider necessary. That depends on the size of your company, how complex your processes are and how competent your people are. A team of experienced fitters needs fewer instructions than a team with many new temporary workers.

The requirements of ISO 9001 clause 7.5 at a glance

Below are all the control requirements from 7.5.2 and 7.5.3, translated into what you concretely arrange.

Requirement	Clause	What you concretely arrange
Identification and description	7.5.2 a	Title, date, author or owner, document number
Format and media	7.5.2 b	Language, file format, paper or digital
Review and approval	7.5.2 c	Who approves it before it is used
Available where needed	7.5.3.1 a	A fitter can open the work instruction on the building site
Adequately protected	7.5.3.1 b	Against loss, unintended change and unauthorised access
Distribution, access and use	7.5.3.2 a	Who may read, who may change
Storage and preservation, legibility	7.5.3.2 b	Back-up, a file format that will still open in five years
Control of changes	7.5.3.2 c	Version number, change overview
Retention and disposal	7.5.3.2 d	Retention period per type of record
External documents	7.5.3.2	Standards, client specifications, supplier manuals

Do not forget external documents. An outdated client drawing or an expired version of a standard in use is a classic audit finding. Include external documents in your register too, with the version you use.

Example document register ISO 9001

A document register is a single list of all your controlled documents. It is not mandatory, but it is the quickest way to demonstrate clause 7.5. This example is from a fictitious installation company.

No.	Title	Type	Version	Date	Owner	Approved by	Location	Review
KB-01	Quality policy	Document	2.0	10 February 2026	Director	Director	Intranet	Annually
PR-01	From quote to handover	Document	3.0	12 January 2026	Project manager	Director	Intranet	Annually
WI-04	Handover inspection work instruction	Document	1.2	5 March 2026	Project manager	Director	Fitters’ app	On change
FO-07	Handover form	Form	1.1	5 March 2026	Project manager	Director	Fitters’ app	On change
HR-02	Competence matrix	Record	n/a	Ongoing	HR	Director	HR folder	Every six months
EX-01	NEN 1010	External	2020	n/a	Work planner	n/a	NEN Connect	With each new edition

And a table of retention periods for records. The standard does not prescribe periods, so you set them yourself. Take into account warranties, legislation and contracts.

Record	Retention period	Reason
Handover forms and measurement reports	10 years	Liability and warranty on installations
Audit reports and management reviews	3 years after completion	Certification cycle
Training certificates	Length of employment plus 2 years	Evidence of competence
Complaints and nonconformities	3 years	Trend analysis and audit

These periods are an example. Check the statutory retention obligations, such as the tax retention obligation and the AVG (Dutch GDPR), for your own situation.

What does the auditor want to see for document control?

The auditor usually tests document control on the work floor, not at your desk. They ask an employee to show a work instruction and compare it with the version in your register.

What the auditor does	Where it often goes wrong
Asks a fitter for the work instruction	The fitter has an old printed version in the van
Looks at the document header	No version or date, or approval is missing
Asks who may change a document	Everyone can change everything in the shared folder
Asks for a record from two years ago	Cannot be found, or the file does not open
Checks external documents	The client sent a new specification, but the old one is still in use

Practical tips for document control

Work from one source. One place where the current version is held. Printouts are copies, so mark them “uncontrolled when printed”.
Use read and write rights. Everyone may read, only the owner may change.
Keep a change overview. At the bottom of each document: version, date and what changed.
Archive old versions separately. Keep them for history, but outside the working folder.
Link review to your cycle. Have owners check their documents annually, for example before the internal audit.

Do you need software for ISO 9001 document control?

No. A well-organised SharePoint or Google Drive environment with version history and permissions is sufficient for most SMEs. Quality software becomes worthwhile if you have many documents, want to automate approval workflows or combine several standards. You can read how to bring everything together in one overview under the quality manual.

Next step

See which documents are mandatory in the list of mandatory documents, or use a process description example as the first document in your register. Want to go through all clauses? Use the ISO 9001 checklist.

Sources

NEN-EN-ISO 9001:2026 - clause 7.5 Documented information
NEN-EN-ISO 9001:2015
ISO.org - ISO 9001