A document register cannot prevent an obsolete instruction from reaching the point of use. A workable document control procedure for ISO manages the full lifecycle: identifying what needs control, approving changes, making current information accessible and retaining evidence of decisions.
It can be difficult to decide which documents and records belong in scope, who should review them and how to show that controls are working. This guide explains how to design, implement and maintain a procedure with clear responsibilities, reliable access to approved information and traceable review, approval and change history.
We cover how to identify controlled information, assign ownership, set practical review and approval steps, manage revisions and prevent unintended use of obsolete documents. We also compare when a manual approach may be sufficient with when document management software can support access controls, workflows and audit trails. Adapt the examples to the standard and scope your organisation is pursuing. During management system certification assessments, documentation may be reviewed alongside verification of implementation, so the procedure needs to work in daily operations, not just on paper.
Key Takeaways
- Scope controlled information around what staff need to perform work, and tailor the procedure to your organisation’s operations and applicable standard.
- Build the document control procedure for ISO around an ordered lifecycle, with named owners for drafting, review, approval, maintenance and access administration.
- Choose between a manual register and document management software by weighing version visibility, access management, audit trails, administrative effort and expected scale.
- Map existing documents and owners before changing processes, then roll out the approved procedure through migration, communication and user training.
- Prepare to show both the controlled documented system and evidence that personnel follow it in practice during certification assessment.
What an ISO document control procedure needs to control
Staff need approved information they can find and use where work happens. If an instruction is outdated, difficult to locate or missing approval, the process may not be carried out as intended. A document control procedure for ISO sets out how an organisation identifies, approves, makes available, updates and retains documented information relevant to its management system.
The procedure should fit the organisation’s operations and the standard and edition in scope. It is not necessary to treat every file as controlled information in the same way. A practical test is whether the information guides work, supports a management system process or provides evidence of what took place.
Which documents and records belong within scope?
Documents tell people what to do or provide information they need to do it. Examples include policies, procedures, work instructions, blank forms and external specifications. Because these can be revised, users need a dependable way to identify the approved version and access it where the work happens.
Records are completed information that demonstrates an activity or result, such as a filled-in inspection form or completed training record. They are not normally managed as editable instructions. Controls should protect their integrity, make them retrievable and define how they are retained or disposed of in line with organisational needs and applicable requirements.
Determine scope by considering each process and the information needed to operate it. An external specification used to accept incoming materials may need clear identification and update control, while an unrelated reference file may not need the same level of oversight. Make controls proportionate to the document’s purpose, its effect on operations and the risk of using information that is incorrect or no longer current.
A Document Management System is one way to organise controlled information. The essential decision is what needs control and how staff will access the right version. During management system certification assessments, documented information may be reviewed alongside verification of implementation.
What does ISO require about documented information?
Requirements depend on the management system standard and the edition applicable to the organisation. Review the relevant standard’s documented-information provisions and verify clause references against that edition before finalising the procedure. Do not assume every ISO standard requires a standalone document titled “document control procedure”. Instead, establish controls that address the requirements applicable to the organisation’s scope.
In practice, documented-information controls may cover identification, review and approval, availability, protection, changes, retention and the handling of information from external sources. Set the precise controls according to the relevant standard, organisational context and operational risks, rather than copying a generic template.
Design documented-information controls around the organisation’s processes, risks and applicable standard, rather than imposing a one-size-fits-all procedure.
How to design the document control procedure around its lifecycle
A document control procedure for ISO should describe what happens from the moment information is identified as necessary until it is revised, withdrawn or retained as a record. A practical reference such as this guide to the ISO 9001 document-control lifecycle can help frame the stages. Adapt them to your organisation’s processes, put the workflow in an order employees can follow and assign an owner at each decision point. This makes responsibility visible and helps prevent drafts or superseded instructions from being mistaken for approved information.
- Identify the need. Link the document to the process, activity or requirement it supports, and identify the people who use it.
- Prepare the content. Assign an author with appropriate process knowledge and use a consistent format where it improves clarity.
- Review and approve. Have a technically competent reviewer check accuracy, then obtain approval from a person authorised to release the information.
- Identify and issue. Record suitable fields, such as title, owner, status, revision and effective date, and make the approved version available to relevant users.
- Maintain or revise. Assess proposed changes, record the decision and issue the revised information through the same controlled route.
- Withdraw or retain. Remove obsolete versions from active points of use, while retaining or archiving information when needed as evidence.
Make responsibilities explicit, even in a small organisation where one person may hold more than one role. The author prepares the content; the technical reviewer checks it; the approver authorises release; the process owner ensures it remains suitable; and the person administering access manages publication and withdrawal. Define who covers each role when the usual owner is unavailable.
A controlled lifecycle makes approval, current status and withdrawal traceable, reducing the risk that staff use obsolete information.
Set review, approval and revision rules
Set review timing according to operational importance, risk and the likelihood of change, rather than applying the same arbitrary interval to every item. A change to equipment, process steps or an external specification may trigger an earlier review. Before release, assess the proposed change, authorise it and communicate what users need to do differently. Keep revision history concise but detailed enough to identify material changes and their approval.
Control access, distribution and obsolete versions
Users should be able to identify the current approved version at each relevant point of use. Define who can edit and approve documents, and specify how controlled copies are distributed or replaced. For external documents, assign responsibility for identifying relevant updates and assessing their impact. Withdraw obsolete versions from active use. Retain archived versions only where there is a defined need, and manage access and retention under the organisation’s arrangements.
Certification assessment can include documentation review and verification of implementation. The controls should therefore be usable in practice, not merely described in a procedure. Management system certification assessments provide independent verification of documented arrangements and their implementation.
Manual registers or document management software: how to choose
The right system is one staff can use consistently to find current information and follow required controls. A document control procedure for ISO can use a controlled register and shared repository or dedicated document management software. Choose based on document volume, revision frequency, access requirements, risk and organisational complexity, not on the assumption that a more technical tool is automatically more effective.
The comparison below outlines typical differences. The controls available depend on how a repository or software platform is configured and managed.
| Consideration | Register and shared repository | Document management software |
|---|---|---|
| Version visibility | A register can identify the current version, but users may need to check it against repository files. | A configured system may make status and revision easier to view in one place. |
| Access management | Permissions are often set through repository folders and require active administration. | Access controls may be managed within the system, depending on configuration. |
| Audit trail | Evidence of changes and approvals may need to be recorded and maintained manually. | Some systems can record workflow events, subject to the features and settings in use. |
| Effort | Simple to maintain at modest scale, but updates rely on disciplined manual steps. | Initial configuration and user training take effort; routine handling may be more structured. |
| Scalability | Can become difficult to oversee as document numbers, revisions or user groups grow. | May better support complex needs, provided ownership and system administration are maintained. |
When can a simple register and repository be proportionate?
A manual approach can work when document numbers are manageable, users know where to find approved files and a responsible owner can keep the register aligned with the repository. Use consistent naming, clearly mark status and revision, restrict editing to authorised people and establish backup arrangements. Reassess the approach if teams become more dispersed, revisions become frequent or staff struggle to identify the current version.
When does dedicated document management software help?
Consider software when process needs justify structured approval workflows, controlled access or traceable revisions across multiple teams. Assess the whole operating model: who configures permissions, maintains the system, trains users and monitors whether workflows are followed? A tool that staff bypass or do not understand can add complexity without improving control. Software supports the procedure; it does not define approval authority, assign document ownership or communicate changes by itself.
Before selecting an approach, map where information is created, approved, accessed and changed. Identify controls that are difficult to perform reliably with the current method, then compare tools against those needs. Keep the process proportionate: a well-maintained register may provide clearer control than poorly configured software, while a growing or distributed operation may benefit from more structured document handling.
How to implement and test the procedure in daily work
Before changing controls, map the documents people already use, where they are stored and who owns them. This helps distinguish useful existing practices from genuine gaps and reduces the risk of introducing duplicate forms or disrupting established work. Prioritise information according to its operational significance, relevance to the management system and the consequences of using an outdated version.
Agree who will approve the procedure, coordinate migration and resolve questions about ownership before moving or renaming files. Then roll out the controls in a sequence users can follow:
- Approve and release the procedure. Confirm responsibilities and the route for requesting, reviewing and authorising changes.
- Migrate controlled information. Check each item’s owner and status, transfer the approved version and remove obsolete copies from active locations.
- Communicate the change. Explain what is changing, where current information is stored and how staff can report an error or request a revision.
- Train affected users. Tailor guidance to roles. An operator may need to locate and use an instruction, while an approver needs to understand how to review and release changes.
Keep communication practical. A brief demonstration at a workstation or team briefing can show users how to locate the current instruction and recognise its status. For remote or dispersed teams, provide the same guidance through channels staff can access during their work.
Prepare the rollout without creating unnecessary paperwork
Focus first on documents where outdated information could affect important operational activities or management system controls. Set migration responsibilities and resolve duplicate or ownerless files before changing repositories. Training should explain the actions each role must take, rather than asking every employee to learn the full procedure. The aim is dependable use, not additional records that do not help control information.
Check implementation and correct control failures
Test the process across relevant teams and points of use. Select a sample of documents and associated records, then verify current status, approval evidence, revision traceability and user access. Ask staff to locate the information they need and explain how they know it is current. Record gaps, assign corrective actions and check whether the changes addressed the cause, not just the immediate error.
Effective control is evident when approval, access and revision history can be traced, and users can apply current information at the point of work. This evidence can support management system assessment, where documentation review is considered alongside verification of implementation.
Internal auditors can help evaluate whether the new arrangements operate as intended. Developing relevant audit capability through lead auditor training can support systematic assessment of processes and evidence.
Use findings to refine the document control procedure for ISO if responsibilities are unclear, users cannot locate approved information or revisions are not traceable. An independent management system certification assessment includes documentation review and implementation verification.
How document control supports ISO certification readiness
Document control can help demonstrate that management system activities are planned and that relevant information is maintained for use. During certification assessment, however, the existence of a written procedure is not evidence by itself that it is followed. Assessment considers documented arrangements and whether they are implemented within the organisation’s activities and the scope being assessed.
Stage 1 and stage 2 assessments have distinct purposes. Stage 1 includes documentation review, while stage 2 includes verification of implementation. Documented information can help show how controls are intended to operate, and evidence from relevant activities can help show how they work in practice. Assessment does not guarantee certification; conclusions depend on the applicable standard, scope and assessment evidence.
What document-control evidence may be reviewed during assessment?
Depending on the applicable standard, scope and assessment, relevant evidence may include the document control procedure, controlled documents, approval and revision information, and records generated by processes in scope. Sampling is specific to the assessment, so be ready to explain how documented controls relate to actual work rather than assembling a generic file set. The Complete Guide to ISO 9001 Document Control Procedure offers additional context on the lifecycle of controlled information.
What to do before seeking certification assessment
Review whether the written process matches current practice. Check that responsibilities are understood, users can access information relevant to their work and the management system identifies the standard edition and scope being pursued. Resolve mismatches between documented instructions and routine activity, and ensure the available evidence relates to those processes. This provides a more reliable basis for assessment than last-minute document preparation.
International Associates Limited conducts independent management system certification assessments, including documentation review and verification of implementation. Organisations evaluating certification can review the management system certification assessment process to understand how assessment relates to their chosen standard and scope.
Certification readiness is demonstrated when documented controls align with the applicable standard and can be verified in practice. A document control procedure for ISO supports that evidence, but it is one part of the management system, not a substitute for effective implementation across relevant processes.
Make document control part of ongoing readiness
Build document ownership into planning for new processes, equipment or team changes. This helps identify information that may need updating before revised ways of working are introduced, keeping the document control procedure for ISO connected to how the organisation develops.
As your organisation considers its next certification objective, explore how an independent assessment can fit its plans and chosen scope.
Explore management system certification assessment with International Associates Limited to take the next step towards assessing your management system.
Frequently Asked Questions
Does ISO require a documented document control procedure?
Not necessarily as a standalone procedure. The applicable standard and edition determine the documented-information controls an organisation needs to address, and those controls may be incorporated into other documented processes. For an integrated management system, consider whether one shared approach clearly addresses each applicable standard without obscuring differences in scope. Verify the relevant requirements and clause references before settling on the format.
What should an ISO document control procedure include?
It should explain how control is applied from creation through use and change, including who can authorise release and how users are informed when requirements change. Define how urgent changes are handled, too, so staff know what to do if an instruction needs prompt correction. The document control procedure for ISO should be understandable to the people expected to use it, not just those who administer the system.
How do you control documents and records for ISO?
Start by connecting each item to the process it supports, then decide how a user will recognise its intended use and status. For example, a controlled template should be easy to distinguish from a locally saved copy that is no longer current. Check the full route, from where the item is maintained to where work is performed. Control can fail if a reliable master exists but users rely on an old local copy.
What is the difference between document control and records control?
Document control applies to information that can be revised to guide future activity; records control applies to evidence already generated. A blank inspection form is a controlled document, while the completed form is a record. This distinction matters if a result needs correction: the original evidence should remain understandable, and any correction should be handled transparently under the organisation’s arrangements rather than silently replacing the completed record.
Can a spreadsheet be used for ISO document control?
Yes, if it remains dependable as the document population changes. A useful test is whether the person maintaining the register can identify entries that no longer correspond to an active file or detect when a document has changed without its status being updated. A spreadsheet is an index, not proof that every linked file is approved. Periodic reconciliation between the register and the documents it describes can expose discrepancies.
How often should controlled documents be reviewed?
Set review arrangements that account for both planned checks and changes that could make content unsuitable. A review trigger might include a process change, a revised external specification or a change in responsibility for the activity. Record whether the document remains appropriate or needs amendment, so each review has a clear outcome. Avoid revising a document solely to show activity when no change is necessary.
What document control evidence may an ISO auditor sample?
Sampling depends on the applicable standard, scope and assessment. An auditor may trace a completed activity back to the instruction or form used, then consider whether the information was appropriate to that activity. For example, a record linked to a process change may prompt questions about when the revised instruction took effect and how affected users learned of it. The purpose is to examine evidence in context, not simply count documents.