Auditing Clause 7.5 Documented Information Controls in ISO 45001

ISO 45001 establishes a flexible yet structured framework for managing documented information across the occupational health and safety management system. Under Clause 7.5.1, the management system must include documented information required by the ISO 45001 standard as well as documented information determined by the organisation as being necessary for management system effectiveness. The standard replaces historical, rigid documentation hierarchies with a unified concept that encompasses both maintained procedures and retained evidence of operational performance.

This documentation architecture applies across all management levels, including top management, compliance leads, department managers, internal auditors, and non-managerial workers. Failing to distinguish between maintaining documented information, such as procedures and policies, and retaining documented information, such as inspection records and audit results, creates significant audit nonconformities. ISO 45001 allows organisations to adapt documentation complexity to their scale, activities, processes, and worker competence. Quality managers and compliance leads must establish robust control mechanisms under Clause 7.5 to ensure documented information remains accessible, protected, and audit-ready.

Technical Nuances: Mandatory Documentation Controls

Understanding the technical nuances of Clause 7.5 requires examining the distinct mandatory controls established for creating and updating under Clause 7.5.2 and control of documented information under Clause 7.5.3. Under Clause 7.5.2, when creating and updating documented information, the organisation must ensure appropriate identification and description, such as title, date, author, or reference number. Furthermore, the organisation must ensure appropriate format, such as language, software version, and graphics, as well as media type, whether paper or electronic. Finally, Clause 7.5.2 c) dictates that organisations must conduct review and approval for suitability and adequacy prior to release.

Under Clause 7.5.3, documented information required by the management system and by ISO 45001 must be controlled to ensure two primary protective conditions. Under Clause 7.5.3 a), documented information must be available and suitable for use, where and when it is needed. Under Clause 7.5.3 b), documented information must be adequately protected against loss of confidentiality, improper use, or loss of integrity.

For the control of documented information, the organisation must address distribution, access, retrieval, use, storage, preservation, control of changes, retention, and disposition. Documented information of external origin determined by the organisation to be necessary must also be identified and controlled.

Example

A manufacturing facility updates its hazardous energy control procedure under Clause 8.1.1. Under Clause 7.5.2, the compliance lead reviews the revised lock-out procedure for adequacy and updates version numbers before releasing electronic files across production halls. Under Clause 7.5.3, the facility controls document access while ensuring operators have immediate workstation access to current instructions. During an internal audit, the auditor checks approval dates for maintained procedures and inspects retained lock-out permits to verify that operational evidence matches documented procedure requirements, confirming full compliance with Clause 7.5.

Audit Verification Procedure and Requirement Matrix

Auditing Clause 7.5 controls requires a structured, multi-step verification procedure that evaluates document creation, accessibility, protection, and record retention. Internal auditors must execute the following four-step procedure during internal audits to verify whether workers can access required information without administrative delays.

• Review management system documentation procedures to verify that creation, review, approval, and version control rules align with Clause 7.5.2 requirements.
• Inspect electronic and physical document repositories under Clause 7.5.3 to verify access permissions, retrieval ease, and protection against unauthorised changes.
• Sample maintained documented information across operational departments to confirm current approval status, correct formatting, and systematic review dates.
• Sample retained documented information, including inspection logs, incident files under Clause 10.2, and audit reports under Clause 9.2.2, to confirm preservation and disposition controls.

Before your audit

• Verify that all mandatory documented information required by ISO 45001 is identified and maintained.
• Confirm that documented information creation rules enforce formal review and approval sign-offs under Clause 7.5.2 c).
• Inspect document repositories to ensure workers have immediate access to current operational procedures under Clause 7.5.3 a).
• Check access control settings to verify that documented information is protected against unauthorized changes under Clause 7.5.3 b).
• Verify that external documents, including statutory regulations and equipment manuals, are identified and controlled under Clause 7.5.3.
• Confirm that retention periods and disposition rules for retained records are established and implemented.
• Sample completed inspection logs and maintenance records to verify that retained evidence is legible and preserved.

Questions people ask

What is the difference between maintaining and retaining documented information in ISO 45001?

Maintaining documented information refers to keeping procedures, policies, or instructions up to date and subject to revision as operational conditions change. Retaining documented information refers to preserving static records, such as audit reports, calibration logs, or incident files, as objective evidence of completed activities. Both controls are necessary to maintain system integrity.

Does ISO 45001 require a formal document control procedure?

ISO 45001 requires organisations to control documented information in accordance with Clause 7.5.3. While the standard does not explicitly mandate a written document control procedure, the organisation must establish processes to manage document identification, distribution, access, protection, storage, and disposition. Establishing formal written rules helps maintain operational consistency.

How does Clause 7.5 apply to electronic health and safety management systems?

Clause 7.5 applies equally to paper and electronic media types under Clause 7.5.2 b). For electronic systems, organisations must ensure software access controls, data security, backup preservation, and version control under Clause 7.5.3. Electronic systems must ensure workers can easily access and retrieve required information during operational tasks.

What external documents must be controlled under Clause 7.5.3 in ISO 45001?

Under Clause 7.5.3, documented information of external origin determined by the organisation to be necessary for planning and operating the management system must be identified and controlled. Examples include applicable statutory legal regulations, technical safety standards, equipment operation manuals, and safety data sheets provided by chemical suppliers. Controlling external documents ensures operational compliance.

Reference documents

• BS ISO 45001:2018 Occupational health and safety management systems — Requirements with guidance for use