ISO 9001 Documented Information Checklist: Mandatory Records

What Clause 7.5 documented information requirements are, and why they exist

An ISO 9001 documented information checklist provides quality managers, compliance leads, and internal auditors with a structured summary of all mandatory documents and records required under Clause 7.5. Using an ISO 9001 documented information checklist ensures an organisation maintains operational policies and retains audit evidence to demonstrate full compliance with the ISO 9001 standard. In ISO 9001:2015, the term documented information replaces legacy terms such as documentation, quality manual, documented procedures, and records. This term applies to all organisations operating a quality management system regardless of company size, industry sector, or operational media.

The strategic rationale behind Clause 7.5 focuses on process control, operational consistency, and evidence-based decision making. Under Subclause 4.4.2, organisations must maintain documented information to support process execution and retain documented information to give confidence that processes perform as planned. Without controlled documented information, operational knowledge risks being lost during staff turnover under Subclause 7.1.6, and workers may execute tasks using outdated specifications. Establishing formal control over documented information ensures that quality policies under Subclause 5.2.2 and quality objectives under Subclause 6.2.1 remain aligned with strategic direction.

ISO 9001:2015 distinguishes clearly between two verbal requirements regarding documented information. Organisations must maintain documented information, which refers to living documents such as system scope statements, quality policies, process criteria, and operating procedures that require periodic review and updating. Conversely, organisations must retain documented information, which refers to permanent records such as calibration logs, training records, inspection outputs, internal audit results, and management review minutes that prove activities occurred. While organisations may determine the extent of documented information based on process complexity and staff competence under Subclause 7.5.1, satisfying mandatory retention clauses remains strictly obligatory.

Procedure for creating, updating, and controlling documented information

Under Subclause 7.5.2 and Subclause 7.5.3, organisations must implement systematic procedures to manage the life cycle of every document and record within the quality management system. Compliance leads must establish robust controls covering document creation, formatting, authorization, distribution, protection, and disposition.

1. Identify and describe new documented information: Assign every document an explicit title, creation date, author name, and unique reference number under Subclause 7.5.2 to ensure unambiguous identification across departments.
2. Select appropriate format and media: Define suitable language, software versions, structural layouts, and storage media under Subclause 7.5.2, whether using physical paper archives or electronic management systems.
3. Conduct suitability and adequacy reviews: Ensure designated authorities review and approve every document prior to issue under Subclause 7.5.2 to verify technical accuracy and operational alignment.
4. Distribute and control access permissions: Make documented information available where and when needed under Subclause 7.5.3.1 while restricting editing permissions to protect document integrity.
5. Manage revision history and changes: Track version numbers and document modifications under Subclause 7.5.3.2 to prevent personnel from inadvertently using superseded procedures.
6. Control external origin documents and record retention: Identify external standards or customer drawings under Subclause 7.5.3.2, establish retention periods, and protect stored records from loss or damage.

Evaluating Clause 7.5 requirements against audit evidence

External and internal auditors evaluate Clause 7.5 compliance by checking document control mechanisms alongside retained operational evidence. Organisations must present documented information demonstrating that both system management clauses and operational clauses operate under controlled conditions.

Requirement | What the auditor checks | Evidence to have ready

--- | --- | ---

Clause 4.3 & Subclause 5.2.2 Maintained scope and policy | Whether the system scope and quality policy are available and maintained as documented information | Documented scope statement and controlled quality policy document

Subclause 6.2.1 Quality objectives | Whether measurable quality objectives are maintained as documented information across relevant functions | Quality objective plans and performance tracking records

Subclause 7.1.5.2 Measurement traceability | Whether the basis used for calibration or verification is retained when no national standards exist | Calibration certificates and verification basis records

Clause 7.2 Competence evidence | How the organisation proves personnel performing quality-affecting work possess appropriate competence | Training logs, qualification certificates, and experience records

Subclause 8.2.3.2 Contract review results | Whether contract reviews and new product requirements are documented prior to customer commitment | Order review records and customer requirement change logs

Subclause 8.4.1 External provider evaluations | How the organisation documents the evaluation, selection, performance monitoring, and re-evaluation of suppliers | Approved supplier lists and supplier performance evaluation logs

Subclause 8.6 Release of products | Whether product release records demonstrate acceptance criteria fulfillment and identify authorizing personnel | Inspection sign-off sheets and release authorization logs

Subclause 8.7.2 Nonconformity records | Whether nonconforming outputs are documented alongside corrective actions, concessions, and authorizing decisions | Nonconformity reports and concession authorization files

Clause 9.2 & Clause 9.3 Audits and management reviews | Whether internal audit programme implementation, audit findings, and management review outputs are retained | Internal audit reports and signed management review minutes

Practical audit scenario and document control findings

Example

During a surveillance audit at an electronics manufacturing plant, an auditor reviewed Subclause 8.5.1 regarding controlled production conditions. The auditor observed line technicians assembling circuit boards using printed work instructions displaying revision index B. However, a review of the engineering change control log revealed that design engineers had issued revision index C two weeks prior under Subclause 8.3.6. The plant failed to control document distribution and disposition as required by Subclause 7.5.3.2, allowing superseded documents to remain in active operational areas.

The quality manager logged a nonconformity under Subclause 10.2.1, retrieved all outdated printed instructions, and instituted an electronic document portal with restricted print access. When re-audited, the plant demonstrated that production staff accessed only current, approved work instructions, resolving the root cause.

Before your audit

• Confirm that the quality management system scope, quality policy, and quality objectives are maintained as documented information under Clause 4.3, Clause 5.2, and Clause 6.2.
• Verify that all active operating procedures and work instructions carry title, date, reference number, and approval authorization under Subclause 7.5.2.
• Ensure that obsolete documents are removed from operational points of use or marked to prevent unintended use under Subclause 7.5.3.2.
• Check that competence records, training certificates, and experience logs are retained for all operational staff under Clause 7.2.
• Inspect measuring equipment calibration records to verify traceability standards and retained calibration evidence under Subclause 7.1.5.2.
• Confirm that supplier evaluation, selection, and performance monitoring records are retained under Subclause 8.4.1.
• Retain product release records showing conformity with acceptance criteria and identifying authorized release personnel under Subclause 8.6.
• Retain documented evidence of internal audit programme execution, audit findings, management review minutes, and nonconformity corrective actions under Clause 9.2, Clause 9.3, and Clause 10.2.

Questions people ask

What is an iso 9001 documented information checklist?

An iso 9001 documented information checklist is an audit tool listing all mandatory documents to maintain and records to retain under ISO 9001:2015. It helps quality managers verify that mandatory files, procedures, and evidence logs are controlled and ready for audit inspection.

What is the difference between maintained and retained documented information?

Maintained documented information refers to living documents, such as quality policies and operating procedures, that must be kept up to date. Retained documented information refers to static records, such as audit reports and calibration logs, that must be preserved as evidence that activities occurred.

Is a quality manual mandatory under ISO 9001:2015 Clause 7.5?

A formal quality manual is not explicitly mandatory under ISO 9001:2015 Clause 7.5. Organisations may choose to maintain a quality manual, but the standard requires only specific documented information such as system scope, quality policy, quality objectives, and operational records.

How must external origin documents be controlled under ISO 9001:2015?

Under Subclause 7.5.3.2, documents of external origin necessary for system planning and operation must be identified and controlled. Organisations must manage their distribution, access, and revisions to prevent work from being performed against invalid external standards or customer specifications.

Reference documents

• ISO 9001:2015 Quality management systems — Requirements