Auditing ISO 50001 Clause 7.5 Documented Information Control

What Clause 7.5 requires, and why it exists

Clause 7.5 of ISO 50001:2018 specifies mandatory requirements for managing documented information within an energy management system. Inadequate control over system documents and operational records leads to outdated operating criteria, data corruption, and unverified performance improvement claims. The standard requires organisations to control documented information required by ISO 50001:2018 alongside information determined necessary for EnMS effectiveness and energy performance improvement.

The rationale behind Clause 7.5 is to establish information integrity, operational consistency, and auditability across all energy-using activities. Annex A.3 clarifies that ISO 50001:2018 replaces the distinct terms documentation, documents, and records with the unified term documented information. To distinguish operational intent, the standard uses the phrase maintain documented information for living documents subject to periodic updating. Conversely, the phrase retain documented information applies to static records serving as historical evidence of results achieved.

Distinguishing maintained documentation from retained energy records

Auditors must clearly differentiate between maintained documented information and retained documented information when evaluating Clause 7.5 conformity. Maintained documented information comprises living management system framework documents that must be reviewed and kept up to date. Key examples include the EnMS scope and boundaries under Clause 4.3, the energy policy under Clause 5.2, energy review methods under Clause 6.3, and EnPI determination methods under Clause 6.4.

Conversely, retained documented information represents permanent historical records that demonstrate results achieved and cannot be altered retrospectively. Standard requirements for retained records include energy review results under Clause 6.3, EnPI values under Clause 6.4, energy baseline modifications under Clause 6.5, measurement accuracy data under Clause 6.6, competence evidence under Clause 7.2, and management review outputs under Clause 9.3.

Creation, updating, and controlling documented information

Under Clause 7.5.2, creating and updating documented information requires organisations to apply rigorous control protocols. Every document or record must display appropriate identification and description, such as a clear title, date, author, or unique reference number. Organisations must also ensure acceptable formatting and media choices, while mandating formal review and approval for suitability and adequacy prior to release.

Clause 7.5.3 dictates that documented information must be controlled to guarantee availability where and when needed, alongside adequate protection against loss of confidentiality, improper use, or loss of integrity. Organisations must address specific control activities, including distribution, access, retrieval, storage, preservation of legibility, control of changes, retention, and disposition. Furthermore, documented information of external origin necessary for EnMS planning and operation, such as energy regulations or utility meter manuals, must be identified and controlled.

Example

An industrial glass manufacturing facility operates an automated energy data collection system to monitor natural gas consumption on a primary furnace, designated a significant energy use under Clause 6.3. During an internal audit, the auditor requests evidence of measurement accuracy for temperature sensors and flow meters required by Clause 6.6. Although the facility maintains an updated calibration procedure, calibration logs were stored on an unprotected drive where technicians accidentally overwritten historical data, prompting a nonconformity under Clause 7.5.3 for failing to preserve record integrity. To resolve the nonconformity, the organisation migrates all calibration logs to a read-only database with automated access tracking and backup controls.

Auditing Clause 7.5 control mechanisms in practice

Evaluating documented information control requires internal auditors to trace both system-level documentation and shop-floor operational records. Auditors must ensure that administrative controls maintain document integrity without creating unnecessary bureaucracy that hinders energy performance.

• Review the master document register to confirm that all maintained documented information required by ISO 50001:2018 is identified and approved.
• Inspect operational work areas to verify that current versions of operational criteria and energy control procedures are available at points of use.
• Sample retained operational records, such as energy baseline data, calibration certificates, and audit reports, to verify legibility, retention controls, and protection against tampering.
• Verify that documented information of external origin, including legal requirements, energy standards, and equipment manuals, is properly identified and controlled.
• Test electronic document management systems for user access rights, version tracking, file preservation, and backup recovery protocols.

Before your audit

• Master register of maintained EnMS documentation, including current revision status and approval details.
• Documented information defining the EnMS scope, energy policy, energy review methodologies, and EnPI determination methods.
• Inventory of retained documented information, including calibration logs, training records, and measurement data.
• Approved procedure or defined protocol for document identification, creation, updating, review, and approval.
• Evidence of access rights and protection controls for both paper records and electronic energy databases.
• Register of external documents, including legal compliance requirements, technical standards, and equipment manuals.
• Defined document retention and disposition schedules ensuring preservation of legibility and record integrity.
• Audit logs demonstrating periodic review and maintenance of electronic document management systems.

Questions people ask

What is the difference between maintaining and retaining documented information in ISO 50001:2018?

Annex A.3 explains that maintaining documented information refers to keeping living system documentation, such as policies, scopes, and procedures, updated and suitable for use. Retaining documented information refers to preserving static records, such as measurement results, calibration logs, and management review minutes, as evidence of completed activities and achieved results.

Are paper documents required for ISO 50001 compliance?

No, Clause 7.5.2 explicitly permits documented information to exist in any format and medium, including paper, electronic databases, graphics, or software applications. Organisations may choose the media that best fits their operational complexity and technical competence, provided appropriate controls under Clause 7.5.3 are implemented.

How does ISO 50001:2018 address documents of external origin?

Clause 7.5.3 requires organisations to identify and control documented information of external origin determined necessary for EnMS planning and operation. Annex A.7.5 clarifies that external documented information can include legal regulations, technical standards, equipment operating manuals, utility weather data, and static factor datasets.

Can an organisation exclude mandatory documented information if it is small?

No, while Clause 7.5.1 notes that the extent of documented information can vary based on organisation size and process complexity, all documented information explicitly mandated by ISO 50001:2018 must be established and controlled regardless of organisation size.

Reference documents

• BS EN ISO 50001:2018 / ISO 50001:2018, Energy management systems — Requirements with guidance for use