ISO 9001 clause 7.5.3.2: manage information from issue to disposition

What clause 7.5.3.2 requires in practice

Clause 7.5.3.2 lists the activities that the organisation must address, as applicable, when controlling documented information. They are distribution, access, retrieval and use; storage and preservation, including keeping information legible; control of changes, with version control given as an example; and retention and disposition. The words as applicable allow the organisation to focus on the activities that matter for each type of information.

Two further expectations follow. Documented information of external origin that the organisation has determined to be necessary for planning and operating the system must be identified as appropriate and controlled. This might cover a customer specification, a regulation or a supplier's technical sheet. Secondly, information that serves as evidence of conformity must be protected from unintended alteration. A note explains that access can mean only permission to view, or permission and authority to change. The clause does not set a retention period, a classification scheme or a technology. Its output is a managed lifecycle in which the organisation can say where an item is, which version applies, who may change it and what happens to it at the end.

Follow the information through actual use

Consider how information is distributed, who can access it, how it is retrieved and how it is used. Access may mean permission to view, permission to change or both. The arrangement should reflect the person's responsibility and the nature of the information.

Choose storage and preservation methods that keep information legible and interpretable for the required period. A file may still exist while its software format is obsolete or its connection with the relevant project is lost. Preserving meaning can matter as much as preserving the bytes or paper.

Why lifecycle management matters to the business

Records are most valuable when something goes wrong, which is usually long after they were created. A customer may question what was delivered, a regulator may ask for proof, or a repeat problem may need the earlier history. If information has been lost, overwritten or kept in a format nobody can read, the business cannot defend its position or learn from the past. Controlled changes also prevent the quiet drift in which several slightly different versions circulate. Sensible retention avoids both keeping everything and discarding too soon. This clause therefore protects the business in disputes, supports improvement through reliable history and shows auditors that records can be trusted.

How to implement clause 7.5.3.2

Work through the four activity groups for each type of information and write down the decision. One way Sterling's teams do it is to hold a short review per process with the owner.

1. Describe how each type is distributed and who can access, retrieve and use it, separating view-only from change rights.
2. Choose storage and preservation methods that keep information readable, such as backups and attention to file formats and media ageing.
3. Set version control rules so that one current version is clear and earlier ones are withdrawn or labelled.
4. Decide retention and disposition per record type, reflecting customer contracts, legal duties and the likelihood of later need.
5. Identify external documents the work depends on, record their source and version, and check for updates.
6. Protect conformity evidence from unintended alteration, using locked records, audit trails or controlled access.
7. Test by retrieving an older record and an older version, and confirm that you can show what applied at the time.

Evidence an auditor expects for clause 7.5.3.2

The auditor looks for proof that each stage of the lifecycle is under control. Typical evidence includes:

• a list or system view showing which external documents are in use and which version applies;
• change history demonstrating how a recent revision was released and the earlier version withdrawn;
• successful retrieval of an older record that remains legible and complete;
• access settings that match roles, with a clear distinction between viewing and changing;
• defined retention and disposal practice applied to a sample of records.

Common nonconformities with clause 7.5.3.2

Gaps normally appear at the edges of the lifecycle, where attention fades.

• The version of a customer or regulatory document used in the work is not identified.
• Records cannot be opened or read after a system upgrade or media change.
• Anyone can modify completed quality records without a trace.
• No retention or disposal rule exists, or the rule that was written is ignored in daily practice and nobody notices.
• Several versions of an instruction are in circulation with no way to tell which is current, and users guess.

Illustrative software example: a changing external reference

Illustrative construction example: retrieving handover evidence

A hypothetical contractor completes a project and transfers its records to an archive. Later, a customer asks about an accepted installation detail. The files are present, but naming changes and missing links make it difficult to connect the relevant evidence with the location and approved requirement.

The contractor reviews retrieval and preservation arrangements, including how archived information retains its context. It confirms relevant retention needs and the method for authorised corrections or additions without silently changing the original evidence. An appropriate retrieval check demonstrates that the archive remains useful. The example does not set a universal retention period or replace contractual and legal review.

Control changes without preventing necessary correction

Changes should be managed so users can understand which information applies. Version control may help, but a version number alone does not ensure affected users receive the update. Connect change control with distribution and access at the point of work.

Protection of conformity evidence against unintended alteration does not mean every error must remain uncorrected forever. Establish a suitable authorised correction approach that preserves the information needed to understand what occurred. The exact method depends on the record, applicable requirements and the importance of maintaining a trustworthy account.

Determine retention and disposition responsibly

Address retention and disposition as applicable. Consider the information's purpose, contractual commitments, relevant legal requirements and the organisation's need to demonstrate its work. ISO 9001 does not prescribe one number of years for all QMS information.

Keeping everything indefinitely is not automatically the best control. Excess information can make retrieval difficult and create unnecessary management burdens. Disposition should be deliberate, with relevant needs considered before information is removed. Where requirements are uncertain, seek appropriate advice rather than selecting an arbitrary period from a generic template.

Control external information proportionately

External origin does not remove responsibility for the information used in planning and operation. Relevant customer specifications, provider instructions or technical references may need identification and control. The organisation determines which external information is necessary and how it will maintain confidence in its applicability.

Common failures include uncontrolled links, archives that cannot be searched effectively and changes that overwrite evidence without an understandable record. Another is assigning retention responsibilities to nobody. Follow one information item from receipt or creation through use, revision, storage and eventual disposition to identify where control is weak.