Clause 7.5, documented information: what the auditor actually asks for
Written from the auditor's side of the table. Clause numbers are pointers; the wording is ours, not the standard's. Last checked against the published ISO 9001:2026 text: October 12, 2026.
Most 7.5 findings are not about missing documents. They are about documents that exist and cannot be shown to be the current version, the right version, or a controlled version at the point of use. This page is the clause from the auditor's side: what gets asked, what gets written up, and what closes it.
The three findings auditors write most under 7.5
1. Uncontrolled copies at the point of use
The auditor picks a work instruction at the machine and compares it with the master. A printout from a superseded revision, a laminated card with no revision at all, or a photo on an operator's phone is the finding, and it is written against 7.5.3 whatever the master list says. The fix is a walk, not a procedure: the current copy at every point of use, and a date on the master list for when someone last checked.
2. Retention that cannot be demonstrated
"Show me the inspection record for this serial number" is the retrieval test, and a record that exists somewhere but cannot be produced in a few minutes fails it. The same finding lands on a retention period nobody decided and a disposition nobody can describe. A retention line per record type, with an owner, closes it; the internal audit should run the retrieval test before the certification body does, and the audit checklist has the question.
3. Clause references that point at the 2015 numbering
After September 16, 2026 a procedure that cites 10.3, Annex B, or "retain documented information" is citing an edition that no longer exists. It is the cheapest finding in a transition audit and the most common. The document control checklist has the eleven search strings; the Gap Analysis Kit carries the change log with a what-to-check column for every clause whose wording moved.
What clause 7.5 requires
| Sub-clause | In plain words |
|---|---|
| 7.5.1 General | Your system must include the documented information the standard requires, and whatever else you decide is necessary for the system to work. A note says how much that is depends on your size, the complexity of your processes and the competence of your people. There is no required manual and no required set of procedures. |
| 7.5.2 Creating and updating | When you create or update documented information, make sure it is identified and described (title, date, author, reference), in a suitable format and medium, and reviewed and approved as suitable and adequate. |
| 7.5.3 Control | Documented information must be available at the place and time it is needed, and protected from loss of confidentiality, misuse or loss of integrity. As applicable, address distribution, access, retrieval and use; storage and preservation, including keeping it legible; change control, such as version control; and retention and disposition. Documented information from outside that you need for planning and operation, such as customer drawings and standards, must be identified and controlled. Evidence of conformity must be protected from unintended alteration. A note says access can mean permission to view, or permission to view and change. |
Two kinds of documented information, one clause. Information you maintain (procedures, work instructions, drawings) has to be current, approved and at the point of use. Information you keep as evidence (records) has to be retrievable, legible and protected from change. The 2015 edition called these "maintain" and "retain." The 2026 edition changed that wording, which is the part that touches your procedures.
What changed in 2026
Clause 7.5 itself barely moved: 7.5.2's title now names documented information, and 7.5.3 says evidence of conformity is to be "available" rather than "retained." What changed is everywhere else. Throughout the standard, the phrases "retain documented information" and "maintain documented information" were replaced with wording about documented information being available, or available as evidence. Annex A explains which is which. The records you keep are the same; the words you used to cite the requirement are not. Any procedure that quotes the 2015 phrasing, and any document-control procedure that defines its scope by "maintain" and "retain," has a sentence to update. The document control checklist gives the eleven search strings to run, and the what changed page lists every clause the new phrasing appears in.
What an auditor checks
- Point of use. The auditor picks a work instruction on the floor and compares it to the master. Revision, approval, and whether the copy at the machine is the current one.
- The list of what you decided is necessary. 7.5.1 b) is a decision. An auditor asks how you decided which processes need documented information and at what level of detail, and looks for processes that plainly need it and have none.
- Retrieval. "Show me the inspection record for this serial number" and a stopwatch. Records that exist but cannot be found in reasonable time fail the retrievability test.
- External documents. The customer drawing, the standard, the regulation: which revision you hold, how you learn it changed, and whether the floor has the old one.
- Protection of evidence. Records that can be edited after the fact with no trace, shared spreadsheets with no access control, paper records in a damp cabinet.
- Retention and disposition. How long each record is kept, who decided, and what happens to it after.
The findings that come up most
- Uncontrolled documents at the point of use. A printout from three revisions ago taped to the machine.
- Forms without identification. No title, number, revision or approval.
- External documents at the wrong revision, most often customer drawings.
- Editable records. Inspection results in a spreadsheet anyone can change.
- Procedures still citing the 2015 clause numbers or phrasing after the 2026 edition: "10.3," "retain documented information," "6.1.2" for opportunities.
- A quality manual nobody uses, kept because someone believes the standard requires it. It does not, and it is where stale clause references live.
The last two findings are the ones the 2026 edition created, and they are mechanical to clear. The free ISO 9001:2026 document control checklist gives the eleven search strings to run across your procedures and the documents that always need a pass; the Gap Analysis & Transition Kit carries the change log with a what-to-check column for every clause whose wording moved, so the sweep becomes evidence that the system was reviewed against the new edition.
How to control documented information without drowning in it
- Keep less. 7.5.1 b) lets you decide what is necessary. A competent crew with a good work instruction needs fewer documents than a new crew with a bad one. Retire what nobody reads.
- Identify everything the same way. Title, number, revision, date, approver, on every document and form, in the same place.
- Control the point of use, not the file server. The master list matters less than whether the copy at the machine is current. Walk the floor with the list once a quarter.
- Register external documents with a revision and an owner whose job is to know when they change.
- Protect records from edits. Lock the sheet, or move to a system that logs changes. An inspection record that can be changed silently is not evidence.
- Run the clause-reference sweep after every edition change. Search for the old numbers and phrases, fix the references, re-approve, and keep the search results as evidence that the system was reviewed against the new edition.
The tools for this clause: the free ISO 9001:2026 document control checklist gives the eleven search strings and the documents that always need a pass. The Gap Analysis & Transition Kit carries the change log with a what-to-check column for every clause whose wording moved.
Not sure where your system stands on the 2026 edition?
The free readout asks thirteen questions and gives you your readiness, your timeline to the deadline, and your first three actions. Nothing you enter leaves your browser unless you ask for the optional AI reading.
Run the free readoutSee every toolQuestions
What documented information does ISO 9001 require?
The clause splits it in two: what the standard itself requires at specific points (the scope, the policy, objectives, and the records named in individual clauses such as audit results, management review results, calibration, nonconformity and corrective action, and design and production records), and whatever else the organization decides is necessary for the system to be effective. The standard does not require a quality manual or a fixed set of procedures.
Does ISO 9001 still require a quality manual?
No. The requirement for a quality manual was removed in the 2015 edition and the 2026 edition does not restore it. If you keep one, it is documented information you decided is necessary and it has to be controlled like anything else, including keeping its clause references current.
What is the difference between maintain and retain documented information?
In the 2015 edition, maintain meant documents you keep current, such as procedures, and retain meant records you keep as evidence. The 2026 edition replaced both phrases with wording about documented information being available, or available as evidence. The distinction between living documents and records still exists in practice; the words changed.
How long must ISO 9001 records be kept?
The standard does not set retention periods. Clause 7.5.3.2 requires you to address retention and disposition, which means deciding a period for each record type, recording that decision, and following it. Customer contracts, regulations and product liability considerations usually set the minimums.
Do electronic records need to be controlled differently?
The same requirements apply: availability, protection, access, change control, retention. For electronic records the questions become access permissions, backups, and whether changes are logged. A shared spreadsheet that anyone can edit without a trace fails the protection requirement whatever it contains.
What changed in 7.5 between 2015 and 2026?
The intent is the same; the wording was adjusted and the surrounding clause numbers moved, so procedures that cite the 2015 numbering need a reference check. The document control checklist page has the search strings.
What does an auditor ask first under 7.5?
Usually: show me the current version of this procedure, show me where the person using it would find it, and show me how a superseded version is kept from being used.