Nov 06, 2026

Document Control in Quality Assurance: ISO 9001 + Checklist

Document control is the process of making sure the right version of a quality document reaches the right person, and that outdated versions do not. It covers creation, review, approval, distribution, revision, and retirement.

In quality assurance, it is the mechanism that turns written procedures into something an auditor can trust.

A procedure that nobody can find, or that three departments hold in three different versions, is not a control. It is a liability with a document number.

What Document Control Means in Quality Assurance

Quality assurance depends on people doing the same thing the same way. Document control is what makes that possible at scale.

It applies to policies, procedures, work instructions, forms, specifications, drawings, and quality manuals. Anything that tells someone how work should be done.

The core promise is simple. Every document is identifiable, approved before use, current at the point of use, and traceable through every change it has been through.

Documents and Records Are Not the Same Thing

This trips up a lot of teams, and auditors notice.

A document tells you what should happen. A procedure, a work instruction, a form template. It gets revised over time.

A record shows what did happen. A completed inspection sheet, a signed training log, a filled calibration certificate. It does not get revised, because altering evidence defeats its purpose.

Both need control. They need different control.

ISO 9001:2015 uses one term for both - documented information - and then distinguishes between information you "maintain" (documents) and information you "retain" (records). Worth knowing when you read the clauses.

What ISO 9001 Says About Document Control

One of the more common questions on this topic, and the answer sits in clause 7.5.

ISO 9001:2015 does not prescribe a documented procedure for document control. The 2008 edition did, along with a mandatory quality manual and five other procedures. Those requirements were removed.

That surprises people who learned the standard under the older edition. You can still keep a documented procedure. You are simply no longer required to.

What the standard does require falls into three sub-clauses.

Clause 7.5.1 - What You Have to Keep

Your quality management system has to include the documented information the standard explicitly requires, plus whatever you determine is necessary for the system to work.

That second part gives you latitude. It also puts the burden on you to justify what you chose to document and what you did not.

Our breakdown of mandatory documentation under ISO 9001 lists the explicit requirements clause by clause.

Clause 7.5.2 - Creating and Updating

Three things have to be right when a document is created or changed.

Identification and description. Title, date, author, reference number - enough to tell one document from another without ambiguity.

Format and media. Language, software version, graphics, and whether it lives on paper or on screen.

Review and approval for suitability and adequacy. Somebody with authority has to sign it off before it is used.

Clause 7.5.3 - Controlling It

This is the operational half.

Documents must be available where and when they are needed, and adequately protected - from loss of confidentiality, improper use, or loss of integrity.

The standard then names specific activities. Distribution, access, retrieval and use. Storage and preservation, including keeping documents legible. Control of changes, which means version control. Retention and disposition.

Two more requirements often get missed.

Documented information of external origin - customer specifications, regulatory documents, supplier drawings - has to be identified and controlled too.

And records retained as evidence of conformity have to be protected from unintended alteration. Not just stored. Protected.

Where the 2026 Revision Fits

ISO 9001 has been revised. Organisations holding certification to the 2015 edition move across during the transition period rather than overnight.

The documented information model is well established and the fundamentals of document control have not changed in character. If you are planning a transition, our summary of the ISO 9001:2026 changes covers what is confirmed.

Check the current edition before rewriting procedures against clause numbers. That is a small habit that saves rework.

The Six Stages of the Document Control Lifecycle

Most document control failures happen at a handover between stages rather than inside one.

The Six Stages of the Document Control Lifecycle

Creation. The document is drafted against an approved template, with an owner and a reference number assigned at the start rather than retrofitted later.
Review. The right people check it for technical accuracy. Not everybody. The right people, named in advance.
Approval. Someone with the authority signs it off. Approval is recorded with who, when, and which version.
Distribution. The approved version reaches everyone who needs it, and previous versions are pulled from circulation at the same moment.
Revision. Changes go through the same review and approval path. The change history records what changed and why, not just that something did.
Retirement. Obsolete documents are withdrawn. If a copy is kept for legal or historical reasons, it is marked obsolete so nobody uses it by accident.

Step 4 is where paper systems break. A printed copy in a folder on the shop floor has no idea it has been superseded.

The Eight Building Blocks of a Document Control System

Element	What it does	Common failure
Ownership and roles	Names who controls what	Ownership sits with someone who left
Templates	Keeps format and structure consistent	Everyone builds their own
Numbering and labelling	Makes documents findable and unambiguous	Two documents share a number
Central repository	One place the current version lives	Three places, all claiming to be current
Version control	Tracks revisions and prevents concurrent edits	Filenames ending in final_v2_USE_THIS
Review workflow	Routes documents to the right approvers	Approval chased over email
Access control	Limits who can view and who can change	Everyone has edit rights
Retention and disposal	Keeps what is needed, removes what is not	Nothing is ever deleted

The failures column is not hypothetical. Those are the patterns that turn up in audit findings year after year.

What a Document Controller Actually Does

A question that comes up often enough to deserve a straight answer.

The document controller owns the system rather than the content. They do not write procedures. They make sure procedures get written to template, reviewed by the right people, approved, issued, and withdrawn on schedule.

Day to day, that means managing the repository, running version control, chasing approvals, maintaining the master document list, handling change requests, and preparing documentation for audits.

In regulated sectors the role carries more weight. In pharmaceutical and medical device operations, a document controller sits close to the regulatory function and the audit trail they maintain is itself inspectable.

Is Document Control a Stressful Job?

Honestly, it depends on the system more than the person.

With a manual or part-manual setup, the pressure is real. You are chasing approvals, reconciling versions, and absorbing the consequences when somebody works from an outdated copy. Audit season concentrates all of it into a few weeks.

With a properly configured electronic system, most of that load shifts to the software. Routing, reminders, version locking, and audit trails happen automatically.

The stress in this role tends to come from doing a system's job by hand.

What Does the Role Pay?

Pay varies considerably by country, sector, and seniority, so any single number would mislead.

What is reasonably consistent is the pattern. Regulated industries pay more than unregulated ones. Pharmaceutical, aerospace, nuclear, and oil and gas sit at the higher end, because the consequences of a documentation failure are larger there.

Experience with electronic quality management systems raises the band noticeably. So does recognised auditing experience.

For current figures, national salary surveys and job boards in your own market will be more accurate than a global average.

Document Control Checklist

Work through this against your current setup. Anything you cannot answer quickly is probably a finding.

Is there a master list of controlled documents, and is it current?
Does every controlled document have a unique identifier and a version number?
Can you show who approved each document, and when?
Is the current version accessible to everyone who needs it, at the point of use?
Are obsolete versions removed from circulation, and marked if retained?
Do changes go through the same review and approval path as the original?
Does the change history record what changed and why?
Are documents of external origin identified and controlled?
Are records protected from alteration after the fact?
Are retention periods defined, and is disposal happening against them?
Can you produce any document's full revision history during an audit without preparation?
Does a new starter know where to find the current version on day one?

Question 11 is the one that separates a working system from a tidy archive.

Four Failures Auditors Write Up Most Often

Uncontrolled copies in use. A printed procedure pinned near a workstation, two revisions out of date. Nearly always found on the floor rather than in the system.

Change history that records nothing. Version 4 superseding version 3, with no record of what changed. Technically versioned, practically useless.

External documents left outside the system. Customer specifications and regulatory documents treated as reference material rather than controlled information. Clause 7.5.3 covers them explicitly.

Retention periods defined but not applied. A policy saying records are kept seven years, and a repository holding everything since 2009. Policy and practice have to match, in both directions.

Most of these connect back to non-conformance handling, because a documentation failure usually surfaces as something else first.

Manual Versus Software-Based Document Control

Aspect	Manual or shared drive	Electronic system
Version control	Naming conventions and discipline	Enforced by the system
Approval	Email chains	Routed workflow with audit trail
Access control	Folder permissions	Role-based, per document
Obsolete versions	Removed manually, often missed	Withdrawn automatically on release
Change history	Maintained by hand	Captured on every action
Audit preparation	Weeks of assembly	Report generated on request
Multi-site	Copies, then drift	One source, everywhere

Small single-site operations can run a manual system well. It needs discipline rather than technology.

The point where it stops working is usually multi-site, or the first regulatory audit, or the first time two people edit the same procedure in the same week.

Document Control in Effivity

Effivity's document control and management capability handles the lifecycle as a controlled flow rather than a folder structure.

Documents are created against templates, routed to named reviewers and approvers, and released with the previous version withdrawn in the same action. Nobody has to remember to pull the old one.

Version history carries date and time stamps, the user who acted, and what changed. Role-based access decides who can view, edit, and approve. E-signatures record approval in a form that stands up to inspection.

Because it sits inside the wider quality management system software, documents connect to the processes they govern. A procedure links to the internal audits that test it and the non-conformances raised against it.

That connection is what makes audit preparation a report rather than a project.

Looking for the broader process view rather than the quality assurance angle? Our guide to document control covers the fundamentals, and the ISO 9001 certification guide covers where it fits in a certification programme.

Try Effivity for Free and see your document set as a controlled system.

Frequently Asked Questions

What is quality document control?

Quality document control is the process of managing quality documents so the correct, approved version is available where it is needed and outdated versions are withdrawn. It covers creation, review, approval, distribution, revision, and retirement, and it applies to policies, procedures, work instructions, forms, and specifications.

What does ISO 9001 say about document control?

Clause 7.5 covers it. Documented information must be identified and described, in a suitable format, and reviewed and approved before use. It must be available where needed, protected, version controlled, and retained or disposed of according to defined rules. ISO 9001:2015 removed the requirement for a documented procedure that the 2008 edition had.

What is the difference between documents and records?

A document states what should happen and gets revised over time, such as a procedure or a form template. A record shows what did happen and is not revised, such as a completed inspection sheet. ISO 9001 calls documents information you maintain and records information you retain.

Is a quality manual still required under ISO 9001?

No. ISO 9001:2015 removed the requirement for a documented quality manual, along with the six mandatory procedures required by the 2008 edition. Many organisations keep a manual because it is useful, but it is no longer a requirement.

What does a document controller do?

A document controller owns the document control system rather than the content. They manage the repository, run version control, route documents for review and approval, maintain the master document list, handle change requests, and prepare documentation for audits.

Is document control a stressful job?

It depends mostly on the system. Manual or part-manual setups create real pressure around chasing approvals, reconciling versions, and audit deadlines. An electronic system shifts routing, version locking, and audit trails to the software, which removes most of that load.

Do external documents need to be controlled?

Yes. Clause 7.5.3 requires documented information of external origin to be identified and controlled. That covers customer specifications, regulatory documents, supplier drawings, and standards you work to.

How often should controlled documents be reviewed?

ISO 9001 does not set a fixed interval. Most organisations review on a defined cycle, commonly annually or every two years, and additionally whenever the process changes, a non-conformance points at the document, or a regulatory requirement shifts.

Kaushal Sutaria

Managing Director at Effivity Technologies

Kaushal Sutaria is an expert in strategic business management and an entrepreneur behind three global companies. His latest venture, Effivity Technologies, simplifies ISO standard compliance with innovative automation. Kaushal's dedication to best practices and mentorship has earned him clients in over 50 countries.

View All Posts

Improve Workflow & Profitability with Superior Integrated Management System Software free-demo

Schedule a Free Demo