In short
ISO 9001 requires you to maintain only four documents: the scope, information supporting your processes, the quality policy and the quality objectives.
Mandatory records are the evidence that what you planned has been done; many apply only if the activity is relevant to you, such as design.
A quality manual and "one per clause" procedures are no longer required: keep them only if they genuinely serve your processes.
Every document needs an owner, a valid version and a reason to exist: that is what the auditor checks, not the number of pages.
Clause 7.5 is common to all ISO management system standards: with several certifications you can run a single document control process.
ISO 9001 does not ask for an 80-page manual. It asks for a handful of mandatory documented information, plus whatever your company genuinely needs to run well. Everything else is paper nobody reads, ageing on a shared drive and, on audit day, turning into a risk rather than a safeguard.
Many SMEs approach certification with the opposite idea: the more documents you produce, the safer you are. It is an understandable belief, often inherited from quality systems built decades ago, when the standard prescribed specific procedures. That is no longer the case. The message of the ISO/TC 176 guidance on documentation is clear: what you need is a documented management system, not a system of documents.
In this guide you will find the list of documented information required by ISO 9001, split into documents to maintain and records to retain. You will then see which documents you can drop safely, how to decide what to write beyond the minimum, how to keep everything under control and what the auditor actually checks. If you want to revisit how to build a quality system from the ground up first, start with our guide to the ISO 9001 quality management system.
What is documented information in ISO 9001?
Documented information is information your company has to control and maintain, together with the medium that contains it. The term was introduced with the harmonised structure shared by all ISO management system standards and is defined in ISO 9000. It replaces the old terms "documents", "documented procedures" and "records".
The medium makes no difference. According to ISO 9000, documented information can be in any format and come from any source: a file, a web page, a business system, a photograph, even a master sample kept on the shop floor. A video showing how to set up a machine is as valid as a written instruction, provided it is controlled.
Maintain and retain: documents and records
The standard uses two different verbs, and understanding them saves you a great deal of work. To maintain documented information means keeping it up to date: it applies to things that can change over time, such as the quality policy, the scope or a work instruction. This is what you used to call a "document".
To retain documented information means keeping it as evidence of something that has already happened: a management review report, an inspection result, a training certificate. This is the old "record". The official FAQs of ISO/TC 176 make the distinction clear: what can change is maintained, what normally does not change is retained. In practice, a record is never "updated": if something changes, you create a new one.
What clause 7.5 of the harmonised structure requires
Clause 7.5 is the core of the documentation rules, and it is the same across all ISO management system standards. It states that the system must include only two categories: the documented information required by the standard and the documented information the company determines is necessary for the effectiveness of its system.
The note to this clause explains that the extent of documentation can differ from one company to another depending on three factors: size and type of activities, complexity of processes and their interactions, and the competence of people. The other two parts of 7.5 cover how documents are created and updated (identification, format, review and approval) and how they are controlled (availability, protection, distribution, versions, retention and disposition). We cover these further on.
Which documented information is mandatory for ISO 9001?
Mandatory documented information is limited: four documents to maintain and a set of records to retain, many of which apply only if the activity is relevant to you. The list below follows the official ISO/TC 176 guidance on the documentation requirements of ISO 9001:2015.
A useful caveat: the new edition, ISO 9001:2026, was published in September 2026. It keeps the harmonised structure, but may change the wording or numbering of some sub-clauses. When you update your system, check the references against the text of the edition you are certified, or seeking certification, to.
Documents to maintain
These are the "top-level" documents of the system, the ones that define its boundaries and direction:
the scope of the quality management system (clause 4.3);
the documented information needed to support the operation of processes (clause 4.4);
the quality policy (clause 5.2);
the quality objectives (clause 6.2).
Note the wording of 4.4: it does not say which documents you need, but leaves you to decide what is genuinely needed to run your processes. For one company that may be a process map and five work instructions; for another, a set of records in its business system.
Records to retain
Records are the evidence that what you planned has actually been done. This table brings them together, with the clause reference from the 2015 edition.
Record to retain | Clause | When it applies |
|---|---|---|
Evidence that processes are carried out as planned | 4.4 | Always, to the extent necessary |
Fitness for purpose of monitoring and measuring resources | 7.1.5.1 | If you use measuring or inspection equipment |
Basis used for calibration or verification where no international or national standards exist | 7.1.5.2 | Only in that case |
Evidence of staff competence | 7.2 | Always |
Results of the review of requirements for products and services | 8.2.3 | Always |
Design and development records (planning, inputs, controls, outputs, changes) | 8.3.2–8.3.6 | Only if you design products or services |
Evaluation, selection, performance monitoring and re-evaluation of external providers | 8.4.1 | Always |
Unique identification of outputs | 8.5.2 | Where traceability is a requirement |
Customer or external provider property that is lost, damaged or unsuitable | 8.5.3 | If you handle third-party property |
Review of changes to production or service provision | 8.5.6 | When changes occur |
Release of products and services, including who authorised it | 8.6 | Always |
Nonconforming outputs and actions taken | 8.7 | When they occur |
Results of monitoring, measurement and evaluation | 9.1.1 | Always |
Internal audit programme and results | 9.2.2 | Always |
Results of management review | 9.3.3 | Always |
Nonconformities, subsequent actions and results of corrective actions | 10.2.2 | When they occur |
The design case
The heaviest row in the table is design and development. If your company works to customer drawings and designs nothing itself, you can declare the requirement not applicable, justifying it in the scope. A subcontract machine shop, a cleaning company delivering a standard service or a distributor often fall into this situation. Be careful, though: non-applicability is only acceptable if it does not affect your ability to ensure the conformity of products and services. If you adapt, customise or develop solutions for the customer, you are almost always designing.
Which documents can you drop safely?
You can drop anything the standard does not require and that does not help your processes run. The official ISO/TC 176 FAQs are clear on two points: specific documented procedures are no longer mentioned, and a quality manual is no longer specifically required. That does not mean they must be thrown away, but that they must earn their place through their usefulness.
The quality manual
The quality manual is not mandatory. If it helps you explain the system to a customer, a new hire or the auditor, you can keep it. But a manual that copies the standard clause by clause, with sentences such as "the company ensures that…", adds nothing: the auditor reads it and then goes looking for evidence on the shop floor anyway.
An alternative that works in many SMEs is a system document of a few pages. It contains the scope, the policy, the process map and an index of where to find everything else. It covers three of the four documents to maintain and is easy to keep up to date.
"One per clause" procedures
Many systems still have a procedure for every chapter of the standard: document control, internal audits, nonconformities, corrective actions, training, purchasing. None of these is an obligation as a document. What is mandatory are the records those processes generate, such as the audit programme or the nonconformity log.
The criterion is simple: a written procedure is worthwhile where consistent results depend on steps that cannot be left to individual experience. A delicate calibration, the release of a batch, handling a serious complaint. Where the process is simple and people are competent, the form that records the outcome is often enough.
Forms and logs nobody fills in
The third block to cut is forms created "because they might come in handy". An empty form is not a problem as long as it stays empty; it becomes one when the system refers to it and nobody fills it in. At audit, a planned form left unused is evidence that the written system does not match the real one. Better to remove it than to justify it.
How do you decide what to document beyond the minimum?
Documentation beyond the minimum is decided starting from your processes, not from the standard. The ISO/TC 176 guidance says so explicitly: process analysis should drive the amount of documentation, rather than documentation driving the processes.
Clause 8.1 on operational planning also leaves it to you to determine what documented information is needed to have confidence that processes are carried out as planned and to demonstrate the conformity of products and services. That is room for freedom, but also for responsibility: you must be able to explain why a document exists or does not.
Three questions for every document
Before creating or keeping a document, ask yourself three questions. First: if the person who does this activity today were away for a month, would their replacement do it properly without this document? If the answer is no, the document is needed, because it protects organisational knowledge.
Second: does the document reduce a concrete risk, such as a costly mistake, a complaint or a product safety issue? If so, keep it and look after it. Third: does anyone actually use it, at least occasionally? If nobody has opened it for years, it is probably the ideal candidate for removal or merging into another document.
An example: a 25-person company
Take a subcontract machine shop with 25 employees, certified for years. Its system includes an 80-page manual, about twenty procedures and more than 50 forms. The Quality Manager spends the weeks before each audit updating revisions and signatures.
After a reasoned review, the company keeps a six-page system document, four work instructions for critical operations and the forms that produce mandatory or useful records. Simple activities are described in the process map. The result is a leaner system in which every document has an owner and a reason to exist. At the next audit the auditor finds less paper but more consistency between what is written and what happens on the shop floor.
How do you keep documents and records under control?
Controlling documented information means ensuring it is available, suitable and protected when needed. Clause 7.5 requires it to be available and suitable for use where and when it is needed, and protected from loss of confidentiality, improper use or loss of integrity.
Versions, approvals and access
Every document to maintain needs clear identification (title, date, revision or author) and must be reviewed and approved before use. The classic mistake is a printed copy of the old version still pinned up on the shop floor. Change control exists precisely to ensure that people always use the valid version.
Access must be decided too. The standard recognises that access may be read-only or include permission to change: an operator must be able to consult an instruction, not correct it on their own initiative. With a digital system this control becomes almost automatic, while shared folders require discipline.
Retention and documents of external origin
For records, the key rule is that they must be protected from unintended alteration. You also need to decide how long to retain them and how to dispose of them when they are no longer needed. The standard does not set a single period: you decide it, taking into account legal obligations, contracts, warranties and the certification cycle.
Do not forget documents of external origin: customer drawings and specifications, supplier data sheets, product standards. They must be identified and controlled just like your own, because an outdated drawing used in production creates a nonconformity exactly as an obsolete internal instruction does.
Where a platform helps
This is where a platform makes the difference compared with shared folders. In the Complaion platform you manage documents and versions in one place, collect evidence as it is produced and keep deadlines under control with the compliance calendar: calibration renewals, supplier re-evaluation, the annual document review. This way mandatory records build up throughout the year, instead of being hastily reconstructed before the audit.
What does the auditor actually check on documented information?
The auditor does not count pages: they look for objective evidence that the system works. ISO 9000 defines objective evidence as data supporting the existence or truth of something, obtained through observation, measurement, testing or other means. So not just documents, but also interviews, shop-floor visits and data in business systems.
In the first stage of the certification audit, the auditor reviews the documentation to understand whether the system is ready: scope, policy, objectives, processes, first records. In the second stage, they verify on site that what is written matches what is done. If you want to understand both stages in detail, everything is in our guide to Stage 1 and Stage 2 audits.
Evidence without documents
The ISO/TC 176 guidance contains a little-known passage. Where you have no specific documented information for an activity and the standard does not require it, it is acceptable to carry it out using the relevant clause of the standard as the basis. Auditors, internal and external, can assess conformity directly against the text of ISO 9001.
In practice: if your complaints process is simple and always handled by the same competent person, you do not need a procedure. You need complaints to be recorded, analysed and closed, and the person to be able to explain how they work.
What happens if a record is missing
If a mandatory record is missing, for example evidence of the management review or of an operator's competence, the auditor raises a nonconformity. Its severity depends on how far the gap calls the functioning of the system into question. A forgotten signature on a report is not the same as a review that never took place. The best way to avoid this is to check records during the internal audit, which is itself a mandatory record.
With Complaion, your Lead Auditor checks the records during the internal audit, which they conduct for you: gaps surface months before the certification body arrives, when you can still produce genuine evidence rather than reconstructed evidence.
What are the most common mistakes with documented information?
The most common mistakes come from a system written for the auditor rather than for the company. These are the ones seen most often in SMEs:
Copying a generic template, with procedures that mention departments, roles or processes the company does not have.
Treating the manual as the main document and not updating it when the organisation or processes change.
Confusing documents and records, "updating" a report instead of creating a new one.
Scattering evidence across emails, USB sticks, personal folders and spreadsheets with different names.
Forgetting documents of external origin, such as customer drawings or product standards that are no longer valid.
Creating documents in bulk in the weeks before the audit, with identical dates and signatures.
The last mistake is the riskiest. An experienced auditor immediately recognises records produced after the fact: same pen, same date, no corrections. Besides proving nothing, they undermine confidence in the whole system.
Do the same rules apply to other ISO standards?
Yes, the logic is the same. Clause 7.5 is part of the harmonised structure, the common text of ISO management system standards: ISO 14001, ISO 27001, ISO 45001 and the others repeat it identically or almost. Each standard then adds its own sector-specific documentation requirements.
ISO 27001, for example, requires among other things a statement of applicability for the security controls. ISO 14001 asks you to document significant environmental aspects and compliance obligations. If you are finding your way among the standards, our guide to what ISO certifications are helps you understand what each one covers.
For companies with several certifications, the common structure is a concrete advantage. Scope, policy, objectives, document control, internal audits and management review can be managed once only for all standards, in an integrated management system. Document control becomes a single process, with the same rules for versions, approval and retention.
How Complaion helps you keep only the documentation you need
Complaion helps you build and maintain a quality system with the documentation you genuinely need, no more and no less. Your dedicated Lead Auditor follows your company: they review your existing documentation, point out what is mandatory, what is useful and what you can drop, conduct the internal audit and prepare you for the certification audit with the eye of someone who conducts audits.
In the platform you collect evidence throughout the year, manage documents and versions, keep the calendar of calibrations, suppliers and reviews, and prepare the audit with everything in order. We propose the most suitable path for your company's needs: first ISO 9001 certification, simplification of an already certified system or integration with other standards. More than 1,000 clients have already chosen Complaion.
Want to find out how much documentation you can remove from your system? Talk to our team and get a tailored quote.
Frequently asked questions about ISO 9001 documented information
Is a quality manual mandatory for ISO 9001?
No. The official ISO/TC 176 FAQs confirm that a quality manual is no longer specifically required. You can keep one if it helps you describe the system, but it is not a requirement. Many SMEs replace it with a system document of a few pages that brings together the scope, the policy and the process map.
How many written procedures are needed for ISO 9001 certification?
The standard does not set a number of procedures. It requires you to maintain the documented information needed to support the operation of your processes, and leaves the company to decide which. Procedures are useful where the process is critical or complex, or where people rotate often. For simple activities, a form and a competent person may be enough.
What is the difference between maintaining and retaining documented information?
Maintaining means keeping up to date a document that can change, such as the policy or a work instruction. Retaining means keeping unalterable evidence of something that has already happened, such as a management review report or an inspection result. In essence they correspond to the old concepts of document and record. A record is not modified: if something changes, a new one is created.
Can I manage all ISO 9001 documentation digitally?
Yes. According to ISO 9000, documented information can be in any format and medium: files, business systems, platforms, photographs, videos. What matters is that it is controlled: identified, approved, available where needed, protected from unauthorised changes and retained for the period you have set. A well-designed digital system makes these controls simpler.
How long do I need to retain records?
ISO 9001 does not set a single retention period. You decide it, taking into account legal and contractual obligations, product warranties and the length of the certification cycle. A practical rule is to define retention periods for each type of record in a single list, so the auditor can see straight away that the choice was made deliberately.
Does the risk analysis have to be documented?
In the ISO/TC 176 guidance on the 2015 edition, risks and opportunities do not appear among the mandatory documented information. You must, however, show that you have considered and addressed them, and a simple risk register is the most convenient way to do so. If you are moving to ISO 9001:2026, published in September 2026, check the requirements against the text of the new edition.
What happens if a mandatory record is missing at the audit?
The auditor raises a nonconformity, whose severity depends on its impact on the system. A missing signature weighs less than a management review that never took place. You will need to analyse the cause and define a corrective action within the timeframe agreed with the certification body. The best way to prevent the problem is to check records during the internal audit.
