Documentation is the nervous system of any quality management system. Without it, knowledge lives only in people's heads and is lost with every resignation, retirement or staff turnover. The 2015 revision of the ISO 9001 standard deliberately cut the mandatory documentary burden and replaced the old "documents and records" jargon with the unified term documented information (clause 7.5). The aim was not to eliminate paperwork, but to make each organisation document what it genuinely needs to operate consistently, no more and no less. This article breaks down how to structure that documented information, how to control it and how to audit it without falling into sterile bureaucracy.
What the standard really requires: documented information under ISO 9001:2015
A widespread misconception needs clearing up. ISO 9001:2015 does not require you to have a quality manual or a documented procedure for each of the six processes that the 2008 version demanded in writing (document control, records control, internal audit, control of nonconforming product, corrective action and preventive action). What clause 7.5.1 requires is the documented information "required by the standard" plus "whatever the organisation determines to be necessary for the effectiveness of the system." In practice, the explicit requirements to maintain documented information include the scope of the system (4.3), the quality policy (5.2), the quality objectives (6.2) and the information needed to support the operation of the processes (4.4.2).
Alongside the information that is "maintained" (the procedures, that is, how things are done), the standard requires information that is "retained" as evidence: records. Mandatory records include evidence of personnel competence (7.2), the results of the review of product requirements (8.2.3), the outputs of management review (9.3.3), the results of internal audits (9.2.2) and the follow-up of corrective actions (10.2.2). The conceptual difference matters: a procedure is updated and lives on; a record is a snapshot of a moment and is not modified once it has been generated.
The documentation pyramid: four clearly distinct levels
Although it is no longer mandatory, the classic four-level documentation hierarchy remains the clearest structure for organising information. It lets each document answer a different question and stops a single sheet of paper trying to be everything at once.
| Level | Document type | Question it answers | Example |
|---|---|---|---|
| 1 | Policy and manual | What do we want and what do we commit to? | Quality policy, scope of the QMS |
| 2 | Procedures | Who does what, and in what order? | PR-07 Control of nonconformities |
| 3 | Work instructions | How is a specific task carried out? | WI-12 Calibration of the digital gauge |
| 4 | Records and forms | What proves it was done? | Audit report, inspection sheet |
A common mistake is mixing levels: cramming detailed operational steps into a high-level procedure means that any minor change on the shop floor forces you to revise and re-approve a governance document. The practical rule is that levels 1 and 2 change rarely (governance, responsibilities, flows) while levels 3 and 4 change often (parameters, values, forms). Separating them drastically reduces the cost of maintenance.
Anatomy of a useful procedure
A well-written procedure should be executable by a newcomer without a tutor. A minimum header includes: a unique code, a title, the version, the effective date, the author, the reviewer and the approver. The body should answer, at the very least, the purpose, scope, definitions, responsibilities, the procedure itself (the step-by-step flow, ideally with a diagram), the records generated and cross-references to other documents. We recommend describing the flow with present-tense verbs and an explicit subject ("The quality manager records the nonconformity in form F-07"), avoiding the passive voice that blurs who is responsible for each step.
Controlling documented information: the heart of 7.5.2 and 7.5.3
Documenting well is pointless if three different versions of the same procedure are in circulation. Clause 7.5.2 requires you to control creation and updating (identification, format, review and approval), and 7.5.3 requires you to control distribution, access, storage, change control, retention and disposition. In operational terms this translates into six controls that any documentation matrix must guarantee:
- Unique identification: a code that is never repeated and a version number visible on every page.
- Traceable approval: who approved which version and when, ideally with an electronic signature.
- Controlled distribution: ensuring that the operator only accesses the current version. This is where digital document management systems beat paper: they automatically withdraw the obsolete version.
- Change control: a revision history that states what changed and why between version 3 and version 4.
- Retention and expiry: defining how long each record is kept. Note: when records contain personal data, the retention period must align with the storage limitation principle of the General Data Protection Regulation (GDPR, EU Regulation 2016/679); you cannot keep them indefinitely "just in case."
- Secure disposition: destruction or archiving of documents at the end of their life cycle.
The procedures matrix: a single-page map
The documentation matrix is a master table that cross-references each process with its procedure, its owner, its records and its review frequency. It is the tool that most quickly reveals the cracks: critical processes with no procedure, orphan procedures with no real process behind them, or records that nobody generates. Keeping it alive, with the current version of each document and the next review date, turns the preparation of an external audit into a matter of minutes rather than weeks.
From paper to the electronic document management system
The transition from the physical filing cabinet to an electronic document management system (EDMS) is today the decision that most affects the health of a documentation system. A good system automates precisely the six controls of clause 7.5.3: it assigns the code, enforces the approval flow, withdraws the obsolete version from circulation the moment the new one is published, stores the complete change history and applies automatic retention policies. The most visible operational benefit is the elimination of the risk of crossed versions: the operator who opens a procedure from the internal portal always sees the current edition, with no chance of printing and pinning to the wall a copy that will be out of date at the next revision.
That said, digitising badly is worse than not digitising at all. A frequent mistake is to transfer the same paper chaos to the server: folders with names like "final_v2_good_FINAL" that reproduce the absence of version control. Digitisation only adds value if it goes hand in hand with a clear taxonomy, role-based permissions and a naming policy that the system enforces, rather than one that depends on individual discipline. It is also worth verifying that the system meets the requirements for qualified electronic signatures when records have evidentiary value before third parties, and that its backup policy guarantees that the retained evidence is not lost in the event of a technical failure.
Common mistakes any auditor spots
- Over-documenting: writing procedures for trivial tasks that nobody reads. The 2015 standard was born precisely to combat this.
- Documents "for the audit's sake": perfect manuals that do not reflect how work is really done. The auditor detects this within five minutes by asking an operator.
- Uncontrolled versions: the procedure pinned to the wall is version 2, while version 5 sits on the server.
- Records with no signature or date: a record with no authorship or timestamp is not valid evidence.
- Failing to distinguish maintain from retain: treating records as editable, thereby losing their evidentiary value.
Frequently asked questions
Is the quality manual still mandatory?
No. ISO 9001:2015 removed that requirement. Many organisations keep it voluntarily as a presentation document and an index of the system, but they can replace it with a process map and the documentation matrix.
What is the difference between a document and a record?
A document (a procedure, an instruction) states how to do something and is updated over time. A record is the evidence that something was done and, once generated, is not modified. The standard speaks of documented information that is "maintained" versus that which is "retained."
How long must records be kept?
The standard sets no single period: the organisation determines it according to risk and the legal and contractual requirements of its sector. When personal data is involved, the GDPR principles of data minimisation and storage limitation prevail.
Does a digital document management system help meet 7.5?
Yes, and it greatly simplifies version control, access and the traceability of approvals. What matters is not the tool but that it guarantees the six controls: identification, approval, distribution of the current version, change control, retention and disposition.
Conclusion: document to operate, not to archive
Quality documentation is neither an end in itself nor a formality for passing the audit: it is the operational memory of the organisation. A good procedures matrix means that a process survives the person who designed it, that a new worker becomes productive in days rather than months, and that management can demonstrate with evidence, not speeches, that the system works. The principle we keep repeating to our clients at Summum Quality is this: document just enough, control it rigorously and review it on a schedule. A lightweight, living documentation system is worth infinitely more than an exhaustive manual that nobody opens. If your documentation faithfully describes how you really work and anyone can find the current version in seconds, you have won the game; the certificate will arrive as a consequence, not as the goal.