Document Control under ISO 9001 Clause 7.5: status, approval, filing, retention – without bureaucracy

12 modules · about 61 minutes · final test with 30 questions, 24 correct to pass · certificate of participation as PDF

What this course is about

“Document control” sounds like administration – what is meant is something simple: everyone in the company works with the valid version, old versions are gone, records can be found and are kept for as long as they are needed.

No registration needed. We only ask for your name and e-mail address before the final test – just for your certificate. Your progress is saved in this browser. You can stop at any time and continue later.

Module 1 of 12

What clause 7.5 requires: four points, no bureaucracy

Clause 7.5 can be summarised in four questions — the auditor checks no more than that:

Two kinds of documented information:

ISO 9001:2026 only speaks of “available as documented information” (instead of “maintain” for specifications and “retain” for records) and adds notes on digital media: access rights, versioning, backup, legibility over the retention period. The distinction above remains useful in practice — it determines whether a document needs a status or a period.

Not required: a document management system, signatures, distribution lists, a change history in every document, cover sheets, a “procedure for document control”. One page in the manual (chapter 7) with the rules of this course meets 7.5 completely.

Module 2 of 12

Folder structure and naming rule: a filing system that explains itself

The five-folder structure (cloud or server, one place for everything):

Order-related records (quotation, order confirmation, delivery note, the order's inspection record) stay with the order — in the ERP or the order folder — and are not copied into 03. The document list refers to the location.

Naming rule for specification documents: Number_Title_Status.ext → WI-04_Final-inspection-station-2_2026-10.docx. The status is YYYY-MM; with several changes in one month YYYY-MM-DD. No special characters in the file name (cloud synchronisation), no spaces, no “final_final_new”.

Naming rule for records: YYYY-MM-DD_Event_Reference.pdf → 2026-10-14_Complaint_C-2026-07_Customer-X.pdf. Date first, so that sorting shows the chronological order.

E-mails and chats are records if they carry a decision (customer approval, change request, supplier commitment): as PDF into the order or into 03 — do not leave them in the mailbox. Rule: what an auditor might want to see does not live in a mailbox.

📄 The five-folder structure with rights, naming rules for specifications and records, examples, rule for e-mails and chats (German – English version to follow)

Module 3 of 12

Status and approval: footer, initials, no signature folder

Footer of every specification document (one line, font size 8): WI-04 · Final inspection station 2 · Status 2026-10 · Approved foreman/mk · Page 1 of 1. That meets 7.5.2 a) (identification) and c) (approval) at once. In Word: footer in the template, fields for file name and page.

Who approves?

The author does not approve their own work — the four-eyes principle in one line. Approval means: read, fits practice, date and initials. No signature folder, no cover sheet with three signatures. Anyone who approves digitally writes the initials in the footer or enters “approved on/by” in the document list — both are records.

Drafts carry _DRAFT in the file name and are not in folder 01/02 but with the editor. Only with approval does the file move to the storage location and receive its status.

Forms: the template has a status (in the footer: FO-07 Complaint form · Status 2026-05). The completed record carries the date of the event — do not change the status of the template. That way the auditor can see whether an old record was created with the template valid at the time.

Version or date? Both are permissible. The date (YYYY-MM) shows immediately in the audit whether the document is current; version numbers (2.1) need the list to look up. For small companies: the date.

Module 4 of 12

The document list: the only register — and what belongs in it

One table, ten columns, everything in it — that is the document list. It replaces distribution lists, change histories in every document and the question “Do we have something for that?”.

Maintenance: touch one row with every approval — three minutes. Without this discipline the list is worthless within a year; that is why “document list updated” is the last step of the change (module 7).

Deletion list (second sheet): no., title, removed on, reason, decided by. It demonstrates in the audit that documents were removed deliberately — and answers “Where is your procedure for …?”.

How the auditor works with it: he takes the list, goes to three workplaces and compares the status at the workplace with the status in the list. Then he takes an external document (drawing, standard) and asks how the company learns that it has changed. Both are in the list.

📄 Document list (ten columns, drop-downs for type, review-date traffic light) with deletion list and sheet “External documents” — Excel (German – English version to follow)

Module 5 of 12

External documents: standards, drawings, customer specifications, manufacturer instructions, laws

The company does not produce external documents itself, but must know them and use them in the valid version. The standard requires: identify (recognisable as external, with source and status) and control (know where they are, when they were checked).

Identification: external documents are in folder 04, carry EXT- in the file name and are in the document list with source and revision. Printouts receive the stamp “external — status checked on …” or the row in the list.

Drawings from the customer are the most frequent audit finding: rev. A at the workplace, rev. B in the purchase order. Rule: the order file carries the revision from the purchase order; the operator works only with the drawing from the file; on change, work preparation prints anew and withdraws the old one (change note).

The annual check (30 minutes before the internal audit): standards — check edition date; laws — go through the list; manufacturer documents — on product change. Date into the column “last review”. Anyone who has a list of standards/laws (legal register) keeps it as a sheet of the document list.

Module 6 of 12

Paper, notices, tablets, cloud: distribution and protection in practice

Digital is the rule: one storage location (cloud or server), folder structure from module 2, read access for all, write access for few. Versioning follows from the status in the file name — old versions move to the archive (05), not to “_old” folders everywhere.

Paper and notices are “controlled copies”: every notice and every folder is in the document list (column “displayed at”). On change they are swapped the same day; the old notice is removed. Printouts without an entry in the list are “uncontrolled” — work must not be done from them (note in the footer: “Printout valid only with status in the document list”).

Tablet or screen at the workplace with a link to the storage location solves the notice problem completely: it always shows the current status. QR code on the machine → PDF of the work instruction. The best solution for workshop and assembly.

Protection — three directions:

Private copies on laptops, in e-mail attachments or messengers are the second most frequent audit finding (“I downloaded it once”). Rule in the manual: work is done at the storage location or with the link — never with copies.

Home office (2026, 7.1.3): access via VPN/cloud with the same rights, no customer data on private devices. Software change: before the changeover, export all records as PDF and ensure legibility over the retention period (2026 says so expressly).

Module 7 of 12

The change in three steps: copy, approve, swap

Duration: ten minutes for a work instruction, one hour for a manual chapter. The step that is forgotten is always 3 — that is why “displayed at” is in the list.

Urgent change (red pen rule): if a correction is needed immediately (wrong target value), the owner may enter it by hand with date and initials on the notice — and thereby triggers steps 1 to 3 within one week. That conforms to the standard (the change is controlled) if it remains the exception and is noted in the list.

Example ISO 9001:2026: the transition changes manual chapters 1, 2, 4, 5, 7, the risk analysis and two templates. All run through the same three steps; afterwards the document list shows “2027-01: transition to ISO 9001:2026” everywhere in the column “changed on/what” — for the auditor that is the evidence of the transition.

📄 The change in three steps as a flow sheet with red pen rule and checklist per change (German – English version to follow)

Module 8 of 12

Retention and disposal: periods from commercial law, tax, liability — the retention list

ISO 9001 names no periods — it only requires that the company defines some (7.5.3.2 d). The periods come from commercial and tax law, liability, customer contracts and the certification cycle. They differ by country — the table shows typical values; enter the periods of your national law in the retention list and have them checked by your accountant or lawyer.

Periods usually run “from the end of the calendar year in which …” — simply: year + period + 1. When in doubt, take the longest applicable period; the table does not replace legal advice.

Retention list: record · location · period · reason · disposal by · deletion period (for personal data). It is one page, hangs in the manual chapter 7 and is checked annually together with the document list.

Disposal: paper with customer data into the confidential waste container, digital files deleted permanently (consider the backup cycle too). A note “year 2015 disposed of on … by …” is sufficient as a record. Keep nothing “just in case” — for personal data that is a data protection violation, for everything else it is effort.

📄 Retention list with typical periods per type of record, location, reason, disposal note and deletion periods for personal data — Excel, periods adjustable (German – English version to follow)

Module 9 of 12

Document control in the audit: the ten questions — and the answers in two minutes

The three most frequent findings: old version at the workplace (minor nonconformity 7.5.3) · external drawing without revision control (minor nonconformity 7.5.3.2, major if it affects the product) · records without a defined period (“we keep everything”) (observation to minor nonconformity 7.5.3.2 d, data protection problem for personal data).

Five-minute check before the audit: three notices against the list · one customer drawing against the purchase order · date of the last backup test · retention list current · archive folder contains no valid documents.

📄 Text module manual chapter 7 “Documented information” (one page, 2015 and 2026) and the ten audit questions with record (German – English version to follow)

Module 10 of 12

Case study: Waldner Joinery — tidying up a grown filing system in two hours

Waldner Joinery (fictitious; any resemblance to existing companies is coincidental), 14 employees, windows and front doors, interior fit-out and made-to-measure furniture, certified since 2024. The server has a folder “QM” with seven subfolders and 37 files — grown over three years and two changes of quality manager. Examples:

Task (120 minutes):

1. Create the five-folder structure and sort all 37 files (download 06 lists them): valid (01/02) — archive (05) — record (03) — external (04) — delete. One word of reasoning per file.
2. Assign number, status and approval to the valid specification documents according to the naming rule.
3. Fill in the document list (download 02) and the retention list (download 04) for Waldner.
4. Answer audit questions 3, 4 and 6 from module 9 for Waldner — with the record you created.

📄 Waldner: all 37 files with location, date and anomaly, task (German – English version to follow)

📄 Model solution: sorting of all 37 files with reasoning, document list, retention list, answers to three audit questions (German – English version to follow)

Learning point: of 37 files, 16 valid specification documents remain, 11 records receive a period, 4 external documents receive source and status, 3 move to the archive, 3 are deleted (including the applications). Afterwards the filing system is not bigger but smaller — and the auditor needs two minutes instead of twenty.

Module 11 of 12

Records and annual maintenance: what the auditor sees, what to do once a year

Annual maintenance in one hour (date: two weeks before the internal audit, entered in the audit programme):

1. Document list row by row: does it still apply? Status = file? Enter the last review. (20 min)
2. Walk-through: notices and folders against the list. (10 min)
3. External documents: edition date of standards, list of laws, manufacturer documents. (10 min)
4. Retention list: dispose of expired years, note. (10 min)
5. Backup: restore one file from the previous year, note the result. (10 min)

The result — five records with date — is the section “7.5” in the internal audit report and saves the certification body's auditor half an hour he would otherwise spend searching.

📄 Checklist document control: 15 criteria (mature/almost/not yet) and annual maintenance checklist (German – English version to follow)

Module 12 of 12

Procedure in our company

Your company completes this module. The general part of the training ends here; what follows, only your company knows:

Companies with a company account of the Academy receive this module with their own details; participants then see the names, dates and filing locations of their company. Without customisation: ask your management or your quality manager where these details are laid down in your company — usually in the quality manual.

Final test

30 questions, one correct answer each. You need 24 correct answers to pass (80 %). Scoring happens on the server — there is no answer key on this page.

Your result