Mandatory ISO 9001 documents: what must you record?

ISO 9001 no longer speaks of a “quality manual” or “procedures”, but of “documented information”. That sounds vague, but it is actually broader: you choose the form yourself. The NEN-EN-ISO 9001:2015 standard sets a fixed list of what you must record, and an accredited body certifies it. On this page you can see, clause by clause, exactly what is mandatory, what is no longer required and how this connects to the quality manual.

Documented information comes in two types. A document describes how you do something (policy, procedure, scope). A record is evidence that you did it (a completed form, a signed report, meeting minutes).

Mandatory documented information per clause

The standard gives an exact list of what you must record. Below you can see all mandatory documents and records, arranged by clause.

Required item	Clause	Type	Explanation
Scope of the quality management system	4.3	Document	What does the system cover? Which activities, locations, products or services?
Quality policy	5.2	Document	Commitment from top management; it must be communicable and understandable. See a quality policy example
Quality objectives	6.2	Document	Per relevant function and level; measurable and monitored
Evidence of staff competence	7.2	Record	Diplomas, certificates, proof of training and experience, for example in a competence matrix
Operational planning and control	8.1	Document	How you control the processes needed to deliver
Results of review of customer requirements	8.2.3	Record	Evidence that you checked whether you can deliver what the customer asks for
Design and development records	8.3	Record	Only mandatory if you design products or services
Evaluation of external suppliers	8.4	Record	Selection, assessment and performance of suppliers and subcontractors
Identification and traceability	8.5.2	Record	Only mandatory if traceability is required by contract or law
Property belonging to customers or suppliers	8.5.3	Record	What you manage on behalf of others; report any damage or loss
Evidence of release of products and services	8.6	Record	Who checked and approved before delivery?
Nonconforming output	8.7	Record	What did not meet requirements, what action was taken, who approved it
Results of monitoring and measurement	9.1	Record	Customer satisfaction, process performance, product conformity
Audit programme and audit results	9.2	Record	Planning, findings and follow-up of internal audits
Results of the management review	9.3	Record	Minutes with decisions and improvement actions from the management review
Nonconformities and corrective actions	10.2	Record	Description of the nonconformity, cause, action and verification of effect

The list above is the minimum set. You may always record more if it benefits your system. Many organisations, for example, add a supplier list, a complaints register or a calibration schedule. You do not have to, but it is useful.

What is no longer required after ISO 9001:2015?

Until 2015, you had to have six fixed procedures. The current version has dropped these:

Previously required (pre-2015)	Now
Procedure for control of documents	No longer required as a separate procedure; control is covered in 7.5
Procedure for control of records	Same as above
Procedure for internal audit	Not required; the audit programme and results are still required
Procedure for control of nonconforming output	Not required; the records are still required
Procedure for corrective action	Not required; the records are still required
Procedure for preventive action	Fully dropped; risk-based thinking (6.1) has taken over this role
Quality manual	No longer required (see below)

The fact that no fixed procedures are required any more does not mean you no longer need to describe anything. It means you choose whether to create a formal procedure document or to record the information in another way.

Relation to the quality manual

The term “quality manual” no longer appears in the 2015 standard. What has replaced it is the requirement that you control documented information: keep it easy to find, update it, approve it and protect it against unintended change.

A manual is one way to organise this. You can also work with:

A set of separate procedures per process
A wiki or intranet
A documentation folder per department
A combination of the above

The choice does not matter to the auditor, as long as you can show that the information is up to date, easy to find and controlled. Read more about how to organise this in practice on the page ISO 9001 quality manual.

Practical tips for managing documented information

Version control

Give every document a version number and date. Make sure employees can always find the current version. Remove old versions from circulation or mark them clearly as “obsolete”. You will find all the requirements for control, and an example document register, under document control under ISO 9001 (7.5).

Example of a simple document header:

Field	Entry
Document	Purchasing procedure
Version	2.1
Date	1 March 2026
Author	Purchasing department
Approved by	Director

Approval

Every document you use as “documented information” must have an owner who approves it. This can be a signature on paper, but digital approval (email, a workflow in a tool) works just as well.

Retention periods for records

The standard does not set fixed retention periods. Use common sense and take into account:

Warranty periods for your products or services
Legal retention obligations (VAT (BTW), employment law)
Contractual requirements from clients

In practice, most companies keep ISO 9001 records for at least three years, which matches the certification cycle.

Common mistakes

Writing procedures that nobody reads or uses
Not updating documents when processes change
Storing records in locations that employees do not know about
Not naming an owner for each document

Next step

Now you know what you must record, read the requirements of ISO 9001 clause by clause to see what the standard asks in substance. Or see how to organise this in practice through the quality manual.

Sources

NEN-EN-ISO 9001:2015, clause 7.5 : Documented information
ISO.org: ISO 9001