ISO 9001 Document Control Checklist: 20 Checks Before Your Audit

Document control is where most ISO 9001 audits start. An auditor picks one procedure, asks who approved it, when it was last reviewed and where the previous revision went, then walks to the shop floor to see which version the operator is using. If any answer is unclear, it becomes a finding.

This checklist turns clause 7.5 of ISO 9001:2015 into 20 checks you can run on your own system in an afternoon. Use it before an internal audit, a surveillance audit or a customer visit.

What clause 7.5 actually requires

ISO 9001:2015 calls documents and records "documented information". Clause 7.5 asks you to:

• Create and update it with proper identification, format and review and approval (7.5.2).
• Control it so it is available where needed and adequately protected (7.5.3.1).
• Manage distribution, access, storage, changes, retention and disposition, and prevent unintended use of obsolete versions (7.5.3.2).

The standard does not require a written document control procedure, but it does require these outcomes. The checks below test the outcomes.

Identification and format (checks 1–5)

1. Every controlled document has a unique number, title and revision on every page.
2. The numbering scheme is defined and followed: site, standard, document type and department are recognisable from the number.
3. Each document shows its owner department and its document level (manual, procedure, work instruction, form).
4. Approved templates exist for each document type, and new documents use them.
5. Forms used for records are locked to their approved format; users cannot add or delete fields.

Review and approval (checks 6–9)

6. Every published document has a recorded approval with name, role and date.
7. Approvers are the people defined for that department and document type, not whoever was available.
8. Each revision records the reason for change.
9. Documents have a periodic review frequency, and no review is overdue. Reviews without changes are still recorded ("reviewed – no change").

Availability and protection (checks 10–13)

10. Users can find the current version of any document they need in under a minute.
11. Shop-floor users see only current, approved versions, on screen or as controlled copies.
12. Access is limited by role: users can read what they need, and only authorised people can edit or approve.
13. Documents are backed up and protected against accidental deletion or unauthorised change, and changes are logged.

Changes and obsolete documents (checks 14–17)

14. Previous revisions are kept, read-only, with their approval history.
15. When a new revision is published, the old one is withdrawn everywhere it was used.
16. Printed controlled copies are listed in a register showing who holds which copy, and are recalled on revision.
17. Uncontrolled printouts are clearly marked (for example "Uncontrolled when printed" with the print date).

Records, retention and external documents (checks 18–20)

18. Retention periods are defined per record type and meet customer and legal requirements.
19. Records are disposed of only after their retention period, and disposal is recorded.
20. External documents (standards, customer specifications, drawings, statutory requirements) are identified and their current version is controlled.

How to score yourself

Why shared folders fail these checks

Most failures come from the same root cause: a shared drive cannot enforce rules. It cannot stop someone publishing a document without approval, remind an owner that a review is due, or withdraw an old revision from every desktop it was copied to. Each control depends on someone remembering to do it, every time.

A document control system turns the checklist into steps the software enforces. A document cannot be published without its approval chain, reviews are reminded automatically, old revisions are withdrawn and every action is logged. The checklist then becomes something you pass by default.

← All articles