ISO 9001 documentation: what you need, what you do not, and how to keep it alive

Documents and records: two kinds of documented information

Documented information is the standard's term for anything it expects you to keep under control, on paper or in software. It covers two different things. Documents define the system and how work should be done: the scope, the quality policy, a process description, an inspection plan. They are living, changing when the process changes, with the old version withdrawn. Records show what was done: a completed order review, a calibration certificate, an audit report. They are fixed: a record changed after the event without a trace is no longer evidence.

ISO 9001:2015 marked the difference with two verbs: documented information to be maintained was a document, and documented information to be retained was a record. ISO 9001:2026 adopts the wording of the harmonised structure shared by ISO management system standards; Global ACI's transition requirements describe this as a new phrase for documented information and a clarification that it "shall be available". The line between documents and records has not moved; "maintain" and "retain" remain useful shorthand.

What ISO 9001 requires, and what it does not

The standard requires two kinds of documented information: the items it names, and whatever your organisation determines is necessary for the quality management system to be effective. Over-documentation usually starts with the second.

The named list has no quality manual; ISO 9001 has not required one since the 2015 edition. Nor does it ask for a set number of procedures, a document hierarchy or a form for each clause. Template packs often include all of these, out of habit from older editions or because a thick binder looks like value.

Procedures are a judgement call: the standard wants the documented information your processes need, to the extent necessary, and leaves the extent to you. Document a process when the work is complex, rarely done or shared by people who must do it the same way, or when a slip would reach the customer or breach a legal or contractual obligation. Where competent people already get consistent results from a simple task, a procedure adds upkeep, not control. Size, process complexity and your people's competence set the right volume.

The minimum set most organisations need

For a typical single-site organisation the document list is short: the scope, the quality policy, the quality objectives, and a description of each main process. A process map plus one page per process, covering inputs, outputs, responsibilities, criteria and records, is enough for many.

The certification body's Stage 1 readiness review starts with your documents; at Stage 2 the auditor samples records alongside interviews and observation, because records show the system running. Here are the records nearly every organisation needs, with the clause behind each:

Design, release against acceptance criteria and other activities add records where they apply.

Document control in practice, and how to keep it alive

In practice, the documented information requirements of clause 7 (Support) come down to five disciplines:

• Versions. Each document carries a title, reference, version and date, so anyone can see whether it is current.
• Approval. A competent person reviews it for suitability and adequacy before release; a recorded approval is the simplest proof.
• Access. The current version is available where the work is done, editing is limited to owners, and content is protected from disclosure, misuse and unauthorised change.
• Change. Changes are requested, approved and communicated; superseded versions are withdrawn, or archived and marked.
• Retention. Each type of record has a retention period and a disposal route; the standard sets no periods, but law, contracts and product life often do.

Control documents of external origin too, such as customer drawings, standards and regulations. Documentation stays alive when each document has an owner who revises it whenever the process, the organisation or a requirement changes.

Effivity builds these disciplines into the workflow: single or multi-level approval, version numbers incremented with each controlled change, change requests routed for approval with their history, archiving of old versions, access by user rights, a register of external documents, and retention and disposal rules for forms and checklists, all in one repository of documents and records.

Four documentation mistakes that auditors notice

• Writing everything down. A procedure per clause and a form per task create a system nobody can keep current, and auditors hold you to every word.
• Copying someone else's company. Inherited templates describe departments, job titles and controls you do not have; one conversation with a supervisor shows that the procedure and the practice have never met.
• Documents nobody uses. A procedure left in a folder while people follow an older habit is decoration. Ask its owner what would go wrong without it; if the answer is nothing, retire it.
• Records produced for the audit. A year of training records or supplier evaluations created the week before Stage 2 shows in dates, signatures, file histories and interviews. A gap with a credible plan is an ordinary finding; manufactured evidence undermines trust in the whole system.

Documentation for an integrated management system

ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001 share clauses 4 to 10 and much of the same core text, so one documentation set can serve them all. Organise it around your processes rather than one standard's clause numbers, and write the shared disciplines once: document control, competence, internal audit, management review, and nonconformity and corrective action. Each standard then adds its own elements, such as environmental aspects and compliance obligations for ISO 14001, hazard identification for ISO 45001 and the Statement of Applicability for ISO/IEC 27001. A cross-reference table showing where each requirement is met helps your team and the auditors. Effivity is modular in the same way, managing ISO 9001, ISO 14001, ISO 45001, ISO 22000 and ISO/IEC 27001 together.

ISO 9001 documentation: questions buyers ask