Document control makes sure people use the right version of a procedure, form or policy, and that records are kept safely for as long as you need them. Clause 7.5 of every ISO management system standard covers it under the name "documented information". It is simple in principle and easy to get wrong in a shared drive.
Documents and records
- Documents tell people what to do: policies, procedures, work instructions, forms. They change over time and need version control.
- Records prove what was done: completed forms, inspection results, training certificates, audit reports. They should not change once made, and need protecting and keeping.
What the standards require
- Identification: a title, reference number, version and date on every document.
- Review and approval before issue, by someone with the authority to approve it.
- Availability where and when it is needed, in a usable form.
- Protection from loss, unintended change and loss of confidentiality.
- Control of changes, so people can see what changed and why.
- Retention and disposal of records, with a defined retention period.
- Control of external documents, such as standards, customer drawings and manufacturers' manuals.
A simple approach for a small business
- Keep one master list (a document register) with reference, title, owner, version, approval date and next review date.
- Store approved documents in one place that everyone reads from. Remove superseded versions from use, and keep one archive copy marked as superseded.
- Discourage printing. If printed copies are used, mark them as uncontrolled or check them at each review.
- Review every document at a set interval, often two years, and whenever the process changes.
- Set retention periods for records based on legal requirements and customer contracts.
Common audit findings
- An out-of-date form in use on the shop floor.
- Documents with no approval or version.
- A shared drive with several versions of the same procedure and no way of telling which is current.
- Records with no defined retention period.
Frequently asked questions
Does ISO 9001 still require a quality manual?
No. Since the 2015 version, a quality manual is optional. You decide what documented information you need, beyond what the standard specifically requires.
How long should records be kept?
As long as the law, your customers or your own needs require. Some examples: RIDDOR records for at least three years, health surveillance records for 40 years for some substances, and financial records for six years.
Do employees need to sign documents to show they have read them?
Not by the standard, but it is a good way to prove awareness for key procedures and policies, especially for health and safety.
This guide is general information for UK businesses, not legal advice. Check the current regulations and HSE guidance at hse.gov.uk, and take professional advice for your situation.