ISO 14001 clause 7.5.3: control access, changes and records
ISO 14001:2026 clause 7.5.3 requires documented information to be available and suitable where and when needed, and adequately protected. Protection includes avoiding loss of confidentiality or integrity and improper use. Control also addresses distribution, access, retrieval, storage, preservation, changes, retention and disposition as applicable.
What clause 7.5.3 requires in practice
Clause 7.5.3 covers control of the documented information that the EMS and the standard require. Two outcomes are expected. The information can be found and used at the place and time it is needed, and it is properly safeguarded, for instance from leaks, misuse or damage to its integrity.
To achieve these outcomes the organisation addresses a set of activities as they apply: who receives the information and how it is reached, found and used; how it is stored and preserved, including keeping it legible; how changes are controlled, such as version control; and how long it is kept and what happens to it afterwards. The standard's note points out that access can mean permission to view only, or permission and authority to change.
A final paragraph deals with information of external origin that the organisation judges necessary for planning and operating the EMS. That information is identified as appropriate and controlled. The clause fixes no platform, retention period or master list.
Balance availability and protection
People need access to current information to perform work correctly. Restricting access so heavily that users rely on old local copies can undermine control. At the same time, access rights should prevent inappropriate changes or disclosure. Decide who needs to view information and who may alter it according to its purpose.
Consider the work setting. Remote sites, interruptions to normal systems or shared devices may affect availability. The standard does not prescribe one technical architecture, but the organisation should understand whether its chosen arrangement supports actual use.
Control the information life cycle
Define how current versions are issued and how changes are recognised. Preserve legibility and usability during storage. Determine retention and disposition arrangements from applicable requirements and organisational needs rather than choosing an arbitrary universal period for every record.
Completed evidence needs protection from changes that would undermine its meaning. If a correction is necessary, use an appropriate method that preserves understanding of what changed. A routine practice of overwriting results without explanation can destroy confidence in monitoring or compliance evidence.
Include necessary external information
Information from external sources that the organisation determines necessary for EMS planning and operation must be identified and controlled as appropriate. This can include relevant instructions, technical material or obligation sources. Control may involve identifying the applicable version, maintaining access and recognising relevant updates.
The organisation does not need to control every public document it reads. Focus on information necessary for the system. Where an external source changes, determine whether the change affects instructions, obligations or operating decisions rather than merely replacing a file.
Why access and record control matter
Environmental evidence has a long tail. A monitoring result, a waste transfer record or a permit may be needed after a complaint, an inspection or a dispute with a provider, sometimes long after the people involved have moved on. If records are overwritten, lost in an unmanaged folder or kept without context, the organisation loses its best defence and its basis for learning. Equally, outdated instructions that remain in circulation cause avoidable mistakes. Clause 7.5.3 gives a framework to prevent both. It also protects sensitive information, such as site layouts or commercial terms, without making it unavailable to those who need it. Good control saves time during audits and builds confidence in every report.
How to implement clause 7.5.3
Focus on whether a real user can find and trust the right item at the moment of need.
- Group information into instructions, completed records and external sources, since each needs slightly different control.
- Decide who needs to view each group and who may change it, and set access to match.
- Make the current version easy to find at the point of use, and withdraw or clearly mark obsolete copies, including printed ones on site.
- Define how changes are made and recognised, including how a correction to a record preserves the earlier entry.
- Set retention and disposition from obligations and evidence needs, rather than one arbitrary rule for everything.
- Identify external documents the system depends on and agree who monitors them for updates.
- Run a retrieval test on a sample from issue to archive, including a field check of which version people really use.
Backups alone do not amount to retention and retrieval, so confirm that a relevant user can actually locate and interpret the information when asked.
Two illustrative control arrangements
A construction project uses a current site environmental plan and location information. The team establishes how revised information reaches supervisors and relevant contractors, and how obsolete printed copies are withdrawn or clearly identified. A field check tests which version people actually use. The presence of a current master copy at head office would not resolve outdated instructions on site.
A BPO provider stores evidence of equipment collections and final destinations. Access permits relevant staff to retrieve records while limiting unauthorised changes. Retention decisions reflect the organisation’s obligations and evidence needs. When a provider’s document is corrected, the company preserves a clear relationship between the earlier information and the corrected record.
Evidence and common weaknesses
Evidence can include access arrangements, current-version identification, change history, retrieval tests and actual retained records. The standard does not require a specific document-management platform or a paper master list. A simple arrangement can work if it is reliable and suited to the information.
Common weaknesses include uncontrolled downloads, missing units after file conversion, inaccessible archives and automatic deletion that ignores evidence needs. Another is treating a backup as a complete retention and retrieval process. Check whether a relevant user can find and interpret the required information when it is needed.
Frequently asked questions
Must all EMS information be confidential?
No. Apply protection appropriate to the information, while meeting availability and communication requirements.
Is a shared folder sufficient?
It may be suitable if the necessary access, version, protection, retention and retrieval controls are effective.
Can obsolete information be retained?
Yes, where needed, with controls that prevent unintended use and preserve a clear distinction from current information.
Test retrieval and current use
Ask Sterling to assess a document-control sample from issue through use and retention. The Documented Information Management course develops relevant skills. Consider Effivity ISO & GRC automation software against agreed controls and audit needs. Return to documented information and the complete directory.