Documented Information Control Procedure: ISO 9001 Guide

A documented information control procedure is a formal set of steps an organization follows to create, approve, distribute, access, update, and retain its documents and records, as required by ISO 9001:2015 clause 7.5. This procedure ensures that the right people have the right information at the right time, and that obsolete or inaccurate documents are removed from use.

Background: Why This Procedure Exists

Before ISO 9001:2015, the standard used the terms “documents” and “records” separately. The 2015 revision introduced the single term “documented information” to cover both. A procedure for controlling this information exists because uncontrolled documents cause real problems: workers using outdated work instructions, auditors finding conflicting versions of the same form, or legal disputes over which contract version was in force.

The procedure is not just about filing. It is a control system that answers five questions for every piece of documented information:

• Who is allowed to create or change it?
• Who must review and approve it before use?
• How do users know they have the current version?
• How do we prevent accidental use of obsolete versions?
• How long do we keep it, and what do we do with it afterward?

Most organizations implement this procedure as part of their quality management system (QMS). It applies to policies, work instructions, forms, drawings, specifications, and records such as inspection reports or training logs.

How the Control Procedure Works

The procedure typically follows a lifecycle with distinct stages. Each stage has defined actions and responsibilities.

1. Identification: Every document gets a unique title, number, revision number, and date. For example, “WI-014 Rev. C” might mean work instruction 14, revision C.
2. Creation and review: The author drafts the document. A designated reviewer checks accuracy and clarity. The approver (often a department manager or quality manager) gives final authorization.
3. Approval: The approved version is signed (physically or electronically) and logged in a master list. The master list is itself a controlled document.
4. Distribution: The document is published in the official location—a shared network drive, a QMS software portal, or a controlled print copy. Access is restricted to people who need it.
5. Use and access: Users access the current version from the official source. Printed copies are marked “uncontrolled” if they are not managed.
6. Review and update: At scheduled intervals (e.g., annually) or when processes change, the document is reviewed. Changes go through the same approval cycle.
7. Obsolete handling: Superseded versions are removed from all access points. If kept for legal or historical reasons, they are marked “obsolete” and stored separately.
8. Retention and disposal: Records are kept for a defined period (e.g., 3 years, 7 years) and then destroyed securely.

In practice, the procedure is often written as a flowchart or a table listing each step, the responsible role, and the record produced.

Key Elements of a Documented Information Control Procedure

Every procedure should include these core elements, even if the format varies:

• Scope: Which documents and records are covered (usually all QMS documents, but sometimes excluding external originals).
• Definitions: Clear definitions of “document,” “record,” “controlled copy,” and “obsolete.”
• Responsibilities: Who does what—author, reviewer, approver, document controller, and users.
• Document numbering and versioning: A consistent system so each document has a unique identity.
• Approval and review process: Minimum review frequency and how changes are proposed.
• Distribution and access: Where the official version lives and who can read or edit it.
• Control of changes: How changes are tracked, including revision history tables.
• Control of obsolete documents: How old versions are marked and removed.
• Records management: Retention times and disposal methods.

Many organizations also include a section on external documents (e.g., customer drawings, regulatory standards) and how those are controlled separately.

How to Write and Implement Your Own Procedure

Writing the procedure is straightforward if you follow a logical sequence. Start by listing every type of documented information your organization uses. Then decide who needs to control each type. Draft the procedure using simple language—avoid jargon. Use a table to show the approval matrix (e.g., “Work instructions require supervisor approval; policies require director approval”).

Implementation is where most organizations struggle. Common steps to make it work:

• Train all employees on how to find and use the official version.
• Designate a document controller (even part-time) to manage the master list and version updates.
• Use a simple folder structure on a shared drive with read-only permissions for the official copy.
• Conduct periodic audits to verify that only current versions are in use.
• Encourage staff to report any uncontrolled copies they find.

A common misconception is that the procedure must be a long, formal document. In reality, a two-page procedure with a clear flowchart is often more effective than a 20-page manual. The goal is control, not bureaucracy.

Common Problems and How to Avoid Them

Even with a good procedure, problems arise. The most frequent issues include:

• Multiple versions floating around: Prevent by making the official location the only place to get documents. If you must print, stamp “Uncontrolled” on each copy.
• People bypassing approval: This happens when the approval process is too slow. Speed it up by limiting approvers to one or two people.
• Lost revision history: Keep a simple revision table inside each document. That way, you don’t need a separate log.
• Obsolete documents not removed: Assign the document controller to remove old versions immediately after approval of the new one.
• Records not retained: Set a retention schedule and use a calendar reminder or a records management system.

Another common issue is confusion between “documents” and “records.” Documents are living instructions (e.g., a procedure). Records are evidence that an activity happened (e.g., a completed inspection form). Records are not updated—they are fixed once created. Your procedure should treat them differently: documents get revised; records get retained.

Template for a Documented Information Control Procedure

Below is a blank template you can adapt. It covers the main sections required by ISO 9001. Fill in the blanks with your organization’s details.

Comparing Options: Paper vs. Electronic Control

Organizations can control documented information on paper, with electronic files, or with specialized software. Each has trade-offs.

• Paper-based: Low cost, easy for small teams, but hard to ensure everyone has the latest version. Requires manual distribution and physical storage.
• Electronic files (shared drive/cloud): Low cost, easy to update, but requires discipline to avoid multiple copies. Version control can be managed with file naming (e.g., SOP_001_RevC.docx).
• QMS software: Higher cost, but automates approval workflows, version history, and access permissions. Good for larger organizations or those with remote teams.

For most small to medium businesses, a shared drive with read-only access and a simple master list is sufficient. The key is consistency, not the tool.

Frequently Asked Questions

What is the difference between a document and a record in ISO 9001?

A document is information that guides an action, like a procedure or work instruction. It can be revised. A record is information that proves an action happened, like a completed checklist or audit report. Records are not revised; they are kept as evidence. Your control procedure should handle them differently: documents get approval and updates, records get retention and disposal rules.

Do we need a documented procedure for document control?

ISO 9001:2015 does not require a specific procedure to be documented, but it does require that you “maintain documented information to support the operation of your processes.” In practice, most auditors expect to see a written procedure because it demonstrates that you have defined the controls. A simple one-page procedure is usually enough.

How often should documents be reviewed?

There is no fixed frequency in the standard. Common practice is to review documents at least annually, or whenever a process changes, an error is found, or a customer requirement changes. Your procedure should state the review interval and who is responsible.

Can we keep obsolete documents if we mark them as such?

Yes. If you need to keep obsolete documents for legal, historical, or knowledge purposes, you can. The key is to mark them clearly as “Obsolete” and store them separately from current documents so they cannot be accidentally used. Your procedure should describe how this is done.

What happens if we fail an audit because of document control issues?

An audit finding for document control usually means the auditor found evidence that uncontrolled documents are in use, or that records are not being retained as claimed. This is a nonconformity that you must correct by updating the procedure, training staff, and implementing corrective actions. It is rarely a major finding unless it causes a systemic failure.

Costs and Practical Considerations

Implementing a documented information control procedure has minimal direct costs—mostly staff time for writing and training. If you choose QMS software, costs range from a few hundred to several thousand dollars per year, depending on the number of users and features. The indirect cost of not having control is higher: errors, rework, audit failures, and potential legal liability.

Start simple. Write a one-page procedure, train your team, and use a shared drive. As your organization grows, you can add more structure or software. The goal is to ensure that anyone who needs information can find the correct version quickly, and that records are kept as long as needed.

Related

• Dog Walking Invoices: How to Make One
• Volunteer Shift Schedule: How to Build One
• Volunteer Shift Schedule: How to Create One