ISO 9001 clause 7.5.2: review and approve information before use

What clause 7.5.2 requires in practice

Clause 7.5.2 applies whenever documented information is created or updated. It asks the organisation to make sure three things are appropriate. The first is identification and description, so users can tell what an item is; the clause gives a title, date, author or reference number only as examples. The second is format and media, which covers language, software version, graphics, and whether the item is on paper or electronic. The third is review and approval for suitability and adequacy before the information is relied on.

This clause is about preparing and changing information. It does not itself say how the information is distributed or retained, which belongs to 7.5.3. It also does not require a standard template, a particular numbering scheme, or a signature on every item. The word appropriate leaves the organisation to decide what suits each type of information. A work instruction, a completed transaction record and an external specification may each need different identification. The output is information that people can recognise, read and trust because a competent person has judged that it fits its purpose.

Make the information identifiable

Users should be able to recognise what the information is and distinguish it from other material. A title, date, author or reference number can help, but the standard presents such identifiers as examples rather than a mandatory field set for every item. Choose identification appropriate to the information and the way it will be used.

For a work instruction, the relevant process and version may be important. For a completed transaction record, connection with the actual activity may be essential. Avoid imposing an elaborate numbering system that users cannot apply consistently while leaving the substantive identity of the information unclear.

Choose a usable format and medium

Consider the audience, language, software compatibility and working conditions. Information may be accurate but unusable if the intended recipient cannot open it, understand its presentation or find the relevant part. Graphics, structured fields and concise prose can help where suited to the task.

Paper and digital media can both be appropriate. The choice should support the information's purpose and its control. If a document depends on a particular application version, consider whether intended users can access the content reliably. Format decisions should not unintentionally remove important meaning during conversion or translation.

Why careful creation and approval matters

An instruction that nobody checked can embed an error that every user then repeats. Clear identification prevents staff from confusing a draft with an approved version, and suitable format ensures that the people who need the information can actually read and use it. Review by someone with the right knowledge turns a signature into a real control instead of a formality. The business benefits through fewer errors in delivery, less rework and a stronger position if a customer questions what was instructed. Auditors can also follow a change from proposal to approval and see whether authority and competence were respected, which tells them a lot about how seriously the organisation treats its own rules.

How to implement clause 7.5.2

Keep the arrangements light but real. One way Sterling's teams do this is to choose identification and approval rules per type of information instead of one rule for everything.

1. Group your information into types, such as work instructions, specifications, plans and completed records.
2. For each type, decide what users need to see to recognise it, such as a title, version or link to the activity it records.
3. Choose the format and media that suit the users, including language and the device or location of use.
4. Name who may propose a change and who may approve it, and make sure approvers understand the content.
5. Define what the reviewer checks, for example technical accuracy, consistency with related information and fit with the actual process.
6. Make the revision visible to users, and consider what other information depends on the change.
7. Do not rewrite historic records to match a new process; keep them as evidence of what applied then.

Evidence an auditor expects for clause 7.5.2

The auditor follows a piece of information from creation or change to approval. Expect to see:

• an approved instruction or specification that is identifiable and readable by the people using it;
• records or system traces showing who reviewed and approved a recent change, and that they were suited to judge it;
• observation of the version staff are using compared with the approved one;
• interviews with authors and approvers about what they check before release;
• completed records that can be linked to the activity and circumstances they describe.

Common nonconformities with clause 7.5.2

Findings often involve approval that exists on paper but not in practice.

• A changed instruction has no evidence of review or approval before it was used.
• Users cannot tell which version of an item is current because identification is missing or inconsistent.
• The approver lacks the knowledge to judge the content, so approval is a signature only.
• Information is in a format or language that the people using it cannot readily understand.
• A completed record was rewritten or replaced after a process change, removing the original evidence.

Illustrative construction example: a revised instruction

Illustrative BPO example: a changed decision script

A hypothetical BPO team revises a customer-service script to clarify an exception. The author changes the wording but does not test whether the new question gives agents enough information to choose the correct route. A manager approves the script based only on its shorter length.

The team introduces a proportionate review using representative cases and the accepted customer rule. It resolves ambiguity before approval and confirms that the approved version is the one prepared for use. Evidence of review and approval supports the decision, but the organisation still needs effective communication and control when the script reaches agents.

Review and approve for suitability and adequacy

Review asks whether the information meets its intended purpose; approval authorises its use through the organisation's chosen arrangements. The standard requires both, but does not universally require two different individuals or handwritten signatures. The arrangement should provide appropriate competence and authority for the information concerned.

For routine records created through a controlled workflow, consider how identification, format and appropriate review and approval arrangements are established. Do not assume every entry needs an identical manual signature sequence. Equally, automation should not obscure responsibility for the suitability of the information and process.

Recognise weak creation controls

Common failures include copied material with the wrong scope, approval by someone unable to assess adequacy and changes that alter a requirement without relevant review. Another is treating a revision number as proof that the content has been checked. A version identifier helps distinguish information; it does not establish correctness.

Useful evidence can include the information itself, the review and approval arrangement and records sufficient to support the decision where needed. The clause does not prescribe one document-control application. Existing systems can work if their configuration and use provide the required outcomes.