Management system guidance
7.0 Support
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
7.5 Documented information
It should be noted that ISO 9001 does not require a documented procedure for controlling documented information, but organizations may still choose to operate one. If you need a procedure and forms to help control your business's documents and records, click here.
Ensure that your organization’s management system includes the documented information that is required by ISO 9001:2026, and the documented information identified by the organization to demonstrate the effective operation of its management system processes as defined below.
7.5.1 Documented information - general
The terms ‘documented procedure’ and ‘record’ used in ISO 9001:2008 were replaced in 2015 by the term ‘documented information’. ISO 9001:2026 now defines this term in its own Clause 3: it means information that an organization needs to control and maintain, together with the medium that holds it.
Operational procedures, work instructions, flow charts, process maps, signs, placards, container markings, labels etc. are all examples of ‘documented information’. Documented information can take any format, be held on any medium and come from any source.
The organization needs to determine the level of documented information necessary to control its management system. ‘Access’ may mean a decision to allow someone only to view documented information, or to give them both the permission and the authority to view and change it. Your organization must have the following documents and records available (for re-certification over a period of three years).
What changed in ISO 9001:2026: ‘available as documented information’ and ‘available as evidence’
ISO 9001:2015 used two verbs: documented information was either ‘maintained’ (broadly, documents that are kept up to date) or ‘retained’ (broadly, records). ISO 9001:2026 replaces these with two new phrases, which Annex A.2 e) of the standard explains:
- ‘Shall be available as documented information’ (replaces ‘maintain’) is about the availability of information that your organization obtains, uses or provides, e.g. the QMS scope, the quality policy and quality objectives;
- ‘Documented information shall be available as evidence of…’ (replaces ‘retain’) is about keeping objective evidence, e.g. records of competence, audit results and management review outputs. Annex A makes clear that ‘as evidence of’ does not mean evidence in a legal sense.
What this changes in practice: very little in terms of what you need to document, as no new documents or records are required by the change of wording, and existing document and record systems remain valid. The emphasis moves from the activity (maintaining or retaining) to the outcome: the right information must be available, to the right people, when it is needed, and evidence must be kept for long enough, and protected well enough, to show that requirements were met. You decide the retention periods and the medium. There is no need to rename existing procedures, but if your procedures or audit checklists quote the old ‘maintain/retain’ wording, update them at the next review so that they match ISO 9001:2026.
Information to be available as documented information (formerly ‘maintain’):
- The scope of the quality management system (4.3);
- Information necessary to support the operation of QMS processes (4.4.2);
- The quality policy (5.2.2);
- The quality objectives (6.2.1);
- The basis used for calibration or verification where no traceable measurement standards exist (7.1.5.2);
- Documented information determined by the organization as necessary for the effectiveness of the QMS (7.5.1 b);
- Information needed to have confidence that operational processes have been carried out as planned (8.1);
- Documented information defining the characteristics of products and services, the activities to be performed and the results to be achieved (8.5.1).
Documented information to be available as evidence (formerly ‘retain’):
- Evidence that processes are being carried out as planned (4.4.2);
- Evidence of fitness for purpose of monitoring and measuring resources (7.1.5.1);
- Evidence of competence of people doing work under the control of the organization that affects the performance and effectiveness of the QMS (7.2);
- Evidence of the conformity of products and services (8.1);
- Results of the review of requirements for products and services, and any new or changed requirements (8.2.3.2);
- Documented information needed to show that design and development requirements have been met (8.3.2);
- Records of design and development inputs (8.3.3);
- Records of the activities of design and development controls (8.3.4);
- Records of design and development outputs (8.3.5);
- Design and development changes, including the results of the review and the authorization of the changes and necessary actions (8.3.6);
- Records of the evaluation, selection, monitoring of performance and re-evaluation of external providers and any actions arising (8.4.1);
- Documented information needed to enable traceability, when traceability is a requirement (8.5.2);
- Records of property of the customer or external provider that is lost, damaged or non-conforming and of its communication to the owner (8.5.3);
- Results of the review of changes for production or service provision, the persons authorizing the change, and necessary actions taken (8.5.6);
- Records of authorized release of products for delivery to the customer including acceptance criteria and traceability to the authorizing person(s) (8.6);
- Records of non-conformities, actions taken, concessions and the identity of the authority deciding the action in respect of the nonconformity (8.7);
- Results of the evaluation of the performance and the effectiveness of the QMS (9.1.1);
- Evidence of the implementation of the audit programme and the audit results (9.2.2);
- Evidence of the results of management reviews (9.3.3);
- Evidence of the nature of the nonconformities and any subsequent actions taken (10.2.2);
- Results of any corrective actions (10.2.2).
For the documentation requirements of ISO 14001 and ISO 45001, see the corresponding EMS and OH&S Navigator pages.
Additional recommended documentation and records
- Results of the context and stakeholder analyses (see 4.1 and 4.2);
- Process application matrix (4.3);
- Description of the organization and responsibilities;
- Overview of documented information and records (including any descriptions of processes and procedures other than those more or less required on the basis of 6.1.1, 8.1 and 8.2).
7.5.2 Creating and updating
You should seek to confirm that when documented information is created or updated, your organization has ensured that it is appropriately identified and described (e.g. title, date, author, reference number). It must be in an appropriate format (e.g. language, software version, graphics) and on appropriate media (e.g. paper, electronic). Confirm that documented information is reviewed and approved for suitability and adequacy.
Documents that you use as a business should have clear document control. You will already be used to doing this. It also expects a clear format and for it to be approved. This is to prevent anyone just using documents that they see fit.
It seems slightly unnecessary when you are a SME as there may be a very small team or even one of you. For larger businesses this is really important so that documents are used properly and changes that have been incorporated for the good don’t get lost when someone else doesn’t understand them or removes them.
7.5.3 Control of documented information
A robust document control process invariably lies at the heart of any compliant management system; almost every aspect of auditing and compliance verification is determined through the scrutiny of documented information. With this in mind, it becomes apparent that the on-going maintenance of an efficient document management system must not be overlooked.
Your organization must control the documented information required by its QMS and by ISO 9001 itself, so that it can be found and used at the point and time it is needed, is suitable for that use, and is adequately protected. A suitable process should be implemented to define the controls needed to; approve, review, update, identify changes, identify revision status and provide access. The documented information process should define the scope, purpose, method and responsibilities required to implement these parameters.
In order to comply with the documented information requirements, it is essential that all personnel understand what types of information that should be controlled and more importantly, how this control should be exercised.
To get the most out of your documented information process, it must communicated to ensure that staff and other users of the documentation information understand what they must do in order to manage that information effectively and efficiently. Demonstrate the organization's arrangements for controlling documented information required by ISO 9001 and your organizations own requirements, including:
- Availability e.g. document accessibility (hard copy, electronic media), readily available at the point of use;
- Suitability e.g. format, media suitable to the environment, ease of understanding, language, interpretation;
- Protection e.g. document authentication, document markings (official, secret, restricted, confidential, private, sensitive, classified, unclassified), access controls (individual, role specific),
- Physical security (master documents, server rooms, libraries) IT security (User ID, password, servers, download, back up, encryption, ‘read only’, ‘read/write’), protection from corruption and unintended alterations.
Demonstrate the organization's arrangements for document retention e.g. organization/legal/contractual retention periods, storage, preservation, back up, retention of knowledge, disposal, obsolescence e.g. withdrawal, replacement, legacy archive and suitable identification (‘for information only’, ‘not to be used after….’, ‘uncontrolled copy’, ‘for reference purposes only’, etc.
Ensure your organization protects electronic data, e.g. security policy, system access profiles, password rules, storage and back-up policy including protection from loss, unauthorized changes, unintended alteration, corruption, physical damage. Your access controls should decide who may only read documented information and who is authorized to read and change it.
Documented information of external origin that your organization needs to plan and operate its QMS (e.g. customer drawings, standards, regulations) must be identified and controlled. Documented information that is available as evidence of conformity must be protected from unintended alterations; Annex A adds that it should be protected from unauthorized alteration or deletion, and that obsolete documented information, if kept, must be controlled so that it is not used by mistake.
Departmental managers should always be responsible for promoting good documented information practices in their area whilst supporting overall compliance to the requirements. Individuals and their line managers should be responsible for the information that they create, as well as being responsible for their retention and disposal in line with legislative requirements and organizational needs.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.