ISO Documentation Requirements Explained

Published 14 September 2026

The harmonised ISO management system standards no longer talk about “documents” and “records” as separate things. They use one term, documented information, and then distinguish between information the organisation must maintain (documents that describe how things are done) and information it must retain (records that show what was done). The distinction is simple and it decides how each item is controlled.

Maintained documented information

These are the living documents: the scope of the management system, policies, objectives, procedures where the organisation decides they are needed, work instructions, forms and specifications. They are controlled for currency. When the process changes, the document changes, the old version is withdrawn and people use the new one.

Retained documented information

These are records: audit reports, calibration certificates, training records, management review minutes, nonconformity and corrective action records, inspection results, contract reviews. They are evidence that something happened. Records are controlled for integrity and retrieval. They are not revised; if a record is wrong, a new record corrects it and both are kept.

What the standards actually require

Modern standards require far less prescribed documentation than older editions did. ISO 9001:2026 requires the organisation to maintain the scope, the quality policy and the quality objectives, and to retain records where specific clauses say so, for example results of design reviews, calibration, monitoring and measurement, internal audits and management reviews. Beyond that, clause 7.5.1 leaves it to the organisation: documented information “determined by the organisation as being necessary for the effectiveness of the quality management system.”

That sentence is a responsibility, not an escape. The organisation must be able to show that it has thought about what needs documenting. A process that depends on the memory of one experienced person is a risk, and an auditor will treat it as one.

Sector standards ask for more

ISO 13485:2016 for medical devices is the exception. It retains explicit requirements for a quality manual, documented procedures for many processes, a medical device file for each device type, and records that regulators expect to see. ISO/IEC 27001:2022 requires the Statement of Applicability and the results of risk assessment and treatment. ISO 22000:2018 requires the hazard analysis and the HACCP plan. Read the specific standard; do not assume the minimal ISO 9001 approach applies everywhere.

Control of documented information

Clause 7.5.3 asks for documented information to be available where needed, adequately protected, and controlled through distribution, access, retrieval and use; storage and preservation; control of changes; and retention and disposition. In practice a good system has:

• A single controlled location, whether a document management system, a shared drive with permissions, or a quality module in an ERP, so people know where the current version is
• Clear identification: title, unique reference, version or date, and approval
• Defined authority for approving and changing each type of document
• A way to stop obsolete versions being used, and to keep obsolete versions where they are needed for legal or knowledge purposes
• Retention periods for records that meet legal, contractual and business needs, and a disposal method that protects confidential information
• Rules for documented information of external origin, such as customer specifications and standards, which must also be identified and controlled

Common findings

The nonconformities auditors raise against documented information are rarely about missing documents. They are about uncontrolled copies on desks and in email, forms that have been photocopied through three revisions, records that cannot be found within the time the auditor is prepared to wait, changes made without approval, and retention periods that nobody has set. Every one of those is a control failure, not a writing failure.

Write less, control better

The best documentation systems are small. Document what people need to do the job consistently and what the standard requires you to retain, keep it where people work, and control it properly. A 300 page quality manual nobody opens is worse than a two page process map that everyone follows.