ISO 9001 Document Control: Versions, Approval and Distribution

A new revision of a work instruction has been released, but the old printout is still pinned to the board on the line. A procedure has been updated, but nobody knows who approved it, who received it or who has read it. Then audit day arrives and “which version of this document is current?” sends everyone scrambling. Many nonconformities in a quality management system trace back to gaps like these in document control.

This article looks at what ISO 9001:2015 clause 7.5 requires for “documented information”, the difference between documents and records, and how to turn versioning, approval and distribution into an orderly flow.

Clause 7.5: what is documented information?

ISO 9001:2015 merges the older split between “documents” and “records” into a single concept: documented information. Two phrases stand out in the standard’s wording:

• Maintained information: documents that must be kept current — procedures, instructions, policies, blank form templates.
• Retained information: records that prove an activity took place — completed audit forms, corrective action records, training attendance lists, measurement results.

Clause 7.5 sets expectations under three headings:

1. General (7.5.1): the organisation needs the documented information the standard requires plus whatever it considers necessary for an effective system. The extent depends on its size and the complexity of its processes.
2. Creating and updating (7.5.2): documents need proper identification (title, date, author or reference number), a suitable format, and review and approval for suitability and adequacy.
3. Control (7.5.3): information must be available where and when it is needed and adequately protected, covering distribution, access, storage, control of changes (version control), retention and disposition.

In short, the standard doesn’t prescribe a tool or format, but it does expect you to show which document is current, who approved it and who it reached.

Documents and records: why keep them apart?

A document is a living text: it gets revised and each new version replaces the last. A record is a snapshot: it should not change afterwards. Managing both in the same folder under the same rules leads to two kinds of error — records get “updated” and lose their value as evidence, or documents are frozen and stay outdated while the process moves on.

	Document (maintained)	Record (retained)
Example	Procedure, instruction, form template	Completed form, audit result, corrective action
Does it change?	Yes, through revision	No, it is kept as evidence
Key control	Approval, version, distribution	Access, retention period, disposal

A healthy revision cycle

The revision process is the heart of document control. A cycle that works usually has these steps:

1. Revision request: the process owner or an employee raises the need for a change with a reason. It may stem from a corrective action, an internal audit finding or a process change.
2. Drafting: the change is made and a revision note explains what changed and why.
3. Review and approval: the document passes in turn through people with defined authority. Decide in advance which document types need whose approval.
4. Release and distribution: the approved version becomes current and reaches the relevant people.
5. Read acknowledgement: recipients confirm they have read it, documenting that distribution actually happened.
6. Withdrawing the old version: the previous version is taken out of use; it can stay in an archive for history but must not be confused with the current one.

Who should be in the approval chain?

Not every document needs the same path. A work instruction may need only the department manager and the quality officer, while the quality manual or a policy should go up to top management. Defining the chain by document type or folder avoids both needless bureaucracy and unauthorised changes.

Distribution: “published” is not the same as “received”

Putting a document in a shared folder doesn’t mean anyone knows its content. The requirement in 7.5.3 that information be “available where and when it is needed” means being able to show that it reached the right people. Two tools help:

• Distribution lists: define in advance which departments and roles each document goes to. When a revision is released, the same list is used and nobody is forgotten.
• Read acknowledgement: each person confirms they have read the document, so “do the operators know the latest version of this instruction?” can be answered with a record.

Recall the label example in our corrective action article: the root cause was that a template revision never reached the line. Distribution lists and read acknowledgement stop errors like that at the source. See our ISO 9001 corrective action guide for details.

How to organise the document library

Control starts with structure. Making a few decisions up front saves reorganising later:

• Folder structure: choose a process-based (purchasing, production, sales) or type-based (procedures, instructions, forms) structure and use it consistently. Folders are also the natural unit for deciding who approves and who receives documents.
• Coding: give every document a unique code (such as PR-PUR-01). Together with the version number, the code is the document’s identity.
• Version numbering: define how revision numbers increase (Rev.00, Rev.01…) and where the revision date appears.
• Ownership: give each document a process owner, so it’s clear who acts when a review is due.

Don’t forget documents of external origin

Clause 7.5.3 also requires documented information of external origin that the organisation needs for planning and operation to be identified and controlled. Customer specifications, relevant standards, legislation and supplier data sheets fall into this group. Tracking which version you use matters as much as for your own documents, because a new customer specification may require your instructions to be revised too.

Periodic review

Reviewing documents at set intervals is good practice even without a change request. A procedure nobody has touched for years may have quietly drifted from what actually happens on the floor. Even when no change is needed, confirming that a document is still valid is useful evidence at an audit.

Common mistakes

• Different versions of the same document circulating by e-mail, in shared folders and on desktops.
• No revision notes, so a year later nobody knows what changed or why.
• Tying approval to wet signatures and walking the document from desk to desk for weeks.
• Releasing a new version without collecting the printed copies.
• Leaving records editable like documents.
• Keeping documents on one person’s computer, so the system stalls when they go on leave.

Document control in HibritİK Quality Management

HibritİK Quality Management lets you run this cycle in one place:

• The document library is kept in folders with revisions and distribution lists, so employees reach the current version.
• Employees acknowledge reading each document, putting distribution on record.
• Revision requests pass through an approval chain of manager → quality officer → quality management representative (QMR) → general manager. The chain is configurable per folder, so each group of documents follows its own path.
• The steps work like the approval workflows in other modules: each person is notified at their step and the approval history stays on record.

To manage the findings that trigger revisions, read our internal audit planning article too.

Conclusion

Document control is the invisible infrastructure of a quality system. When there is a single current version, a known approval path and distribution documented by read acknowledgements, you find the evidence ready at the audit instead of hunting for it. To try the document library with your own folders and approval chains, start your 14-day free trial or get in touch.