The ISO standards document control procedure is a set of documented steps that ensure documents are created, reviewed, approved, distributed, and revised in a controlled manner, so only the correct, current version is in use. It is a core requirement of ISO 9001:2015 (clause 7.5.3) and other management system standards.
Why Document Control Matters in ISO Standards
Document control exists to prevent errors caused by outdated or unauthorized documents. In a certified organization, every procedure, work instruction, form, and policy must be traceable and current. Without a procedure, an employee might use a superseded specification, leading to product defects, safety issues, or audit nonconformities. The ISO framework requires you to define how documents are identified, stored, protected, retrieved, and retained, and how obsolete versions are handled.
Core Requirements of ISO 9001:2015 Clause 7.5.3
The standard mandates that you maintain documented information to the extent necessary for the effectiveness of your QMS. Specifically, the document control procedure must address:
- Distribution: Ensure documents are available where and when needed.
- Protection: Prevent loss of confidentiality, improper use, or loss of integrity.
- Changes: Control revisions, including review and approval by authorized personnel.
- Obsolete documents: Prevent unintended use of outdated versions, and apply suitable identification if they are retained.
- External documents: Identify and control documents from external sources (e.g., customer drawings, regulatory standards).
How to Write a Document Control Procedure
Most organizations write a procedure that outlines the lifecycle of a document. A typical procedure includes these steps:
- Create or revise: The author drafts the document or changes to an existing one.
- Review: Subject matter experts check technical accuracy and clarity.
- Approve: An authorized approver (e.g., department manager) signs off.
- Publish: The document is uploaded to a controlled repository (e.g., shared drive or EDMS) with a unique identifier.
- Distribute: Notify relevant users and ensure access to the current version.
- Obsolete: Remove old versions from active use, archive or mark them as obsolete.
You should also define the metadata for each document: title, document number, revision number, effective date, and owner. This makes retrieval and auditing straightforward.
Common Document Control Mistakes
Auditors frequently find the same issues. Avoiding these will keep your process robust.
- Uncontrolled copies: Printing a document and leaving it on a bench means the printed copy is uncontrolled. Use watermarks like “Uncontrolled when printed.”
- Missing revision history: You must show what changed and why. Keep a table of revision dates and descriptions.
- No external document control: If you use a customer drawing or a safety regulation, you must track its latest version.
- Approval by the wrong person: The standard says documents must be approved by “authorized personnel,” not just anyone. Define roles.
- Storing documents in email: If the only copy is in an inbox, you cannot guarantee everyone has the same version.
Choosing a Document Control Method
You can use paper, spreadsheets, or specialized software. The method must fit your size and risk. A small firm might use a shared network drive with folder permissions and a simple Excel log. A larger or regulated company should consider an electronic document management system (EDMS) that automates approvals, versioning, and audit trails. The key is that the method must be reliable, secure, and user-friendly. If people find it too hard to use, they will bypass it.
Document Control vs. Records Control
People often confuse these two. Document control applies to documents that are live and subject to change (procedures, work instructions). Records are evidence of completed activities (test results, training logs) and cannot be changed once created. ISO 9001 has separate clauses: 7.5.3 for controlled documents and 7.5.2 for creating and updating, but records are covered under 7.5.1 and 7.5.3.2. Your procedure should clearly state that records are not revised, they are retained and disposed of according to a retention schedule.
Template for a Document Control Procedure
Below is a blank template you can adapt. Fill in the blanks with your organization’s details.
| Section | Content |
|---|---|
| Purpose | To ensure all controlled documents are reviewed, approved, and distributed in a consistent manner. |
| Scope | Applies to all QMS documents, including policies, procedures, work instructions, and forms. |
| Definitions | Controlled document: any document subject to revision control. Obsolete: superseded version. |
| Responsibilities | Document Owner: author and reviewer. Approver: authorized to approve. Document Controller: manages repository. |
| Procedure | 1. Create/revise. 2. Review. 3. Approve. 4. Publish. 5. Distribute. 6. Retire/archive. |
| References | ISO 9001:2015, clause 7.5.3 |
| Revision History | Rev 0: Initial release. Rev 1: Added external document control. |
Sample (fictional): In a small manufacturing company, the Quality Manager owns the document control procedure. The Production Supervisor approves work instructions. When a customer drawing changes, the Quality Manager updates the external document log and issues a new revision of the drawing to the shop floor, removing the old one from the shared drive.
Cost and Effort of Implementation
Implementing document control does not require expensive software. A basic system using shared folders and a spreadsheet can be free. The main cost is staff time: writing procedures, training employees, and maintaining the repository. For a small company, expect a few days of effort to set up. For a large enterprise, an EDMS may cost thousands of dollars per year, but it saves time in audit preparation and reduces the risk of using wrong documents.
Frequently Asked Questions
Do we need a separate document control procedure if we use an EDMS?
Yes. The software is a tool, not the procedure. You still need to define who approves, how revisions are made, and how obsolete versions are handled. The EDMS enforces the rules, but you must document them.
Can we keep documents on a shared drive?
Yes, if you control access and versioning. Use folder permissions so only authorized staff can edit, and enable version history. Do not allow multiple copies in different folders. A shared drive is acceptable for many small businesses.
How long must we keep obsolete documents?
ISO does not specify a retention period. Your organization must decide based on legal, regulatory, and customer requirements. Common practice is to keep them for the life of the product plus a few years, but check your industry’s regulations.
What is the difference between a controlled copy and an uncontrolled copy?
A controlled copy is one that is tracked and updated when revisions occur. An uncontrolled copy is a printout or PDF that is not tracked; it might become outdated. Label uncontrolled copies clearly to prevent accidental use.
Can we combine document control with other management systems?
Yes. Many organizations integrate ISO 9001, ISO 14001, and ISO 45001 into one document control system. The procedure can be generic, but you must meet each standard’s specific requirements. For example, ISO 45001 requires control of documents related to OH&S risks.
What happens if we fail an audit because of document control?
You will receive a nonconformity. You must correct it by updating your procedure and ensuring compliance. If it is a major nonconformity, your certification could be suspended. The fix usually involves retraining staff and cleaning up your document repository.