A hybrid guide to ISO 9001 document control: step-by-step setup, a software buyer's checklist, and the clause 7.5 evidence auditors look for.
By Konstantin Dolgan, Ph.D. · 9 min read · Topics: ISO 9001, Document Control, Audit Readiness, Quality Management
The complete hybrid guide: practical setup, a software buyer's checklist, and the ISO 9001 clause 7.5 evidence auditors expect to see.
What you'll get from this guide
A six-step blueprint for building document control from scratch
A demo-ready software buyer's checklist (the non-negotiables)
A clause-by-clause evidence pack auditors actually look for
The three traits every audit-proof system shares
Why document control still trips up most ISO 9001 audits
Ask any seasoned ISO 9001 auditor where the most findings come from, and you'll get the same answer: documented information. Clause 7.5 of ISO 9001:2015 is short — barely a page — but it carries the weight of the entire quality management system. Every procedure, work instruction, form, record, calibration certificate, and training acknowledgement has to be the right version, in the right place, under the right control, for the right length of time.
⚠️ The real failure mode isn't missing documents — it's uncontrolled ones. The wrong revision on the shop floor. A procedure that references a form that no longer exists. SOP-014 updated last March while three departments still print the December version.
This guide walks through exactly how to set up a document control system that survives a third-party audit — first the practical how-to, then a software buyer's checklist, then the clause-by-clause evidence list auditors actually open their laptops to find.
Part 1 — Practical how-to: setting up document control from scratch
Step 1. Define your document hierarchy
Before you control anything, decide what you have. A simple, defensible hierarchy looks like this:
The classic five-level documentation pyramid. ISO 9001:2015 doesn't mandate it, but auditors recognise it instantly.
Level 1 — Quality Manual / QMS scope (clause 4.3, 4.4)
Level 2 — Procedures describing what is done and who does it
Level 3 — Work Instructions describing how tasks are performed
Level 4 — Forms, checklists, and templates used to capture evidence
Level 5 — Records — the completed forms and outputs that prove the system worked
Step 2. Establish a document numbering convention
A good numbering scheme tells you the document type, the owning process, and the sequence at a glance. A common pattern is [TYPE]-[PROCESS]-[####] :
Example Type Process Sequence
SOP-PUR-0007 Procedure Purchasing #7
FRM-QA-0012 Form Quality #12
WI-PRD-0034 Work Instruction Production #34
REC-HR-0103 Record Human Resources #103
📋 Auditor's tell: Inconsistent numbering is the #1 signal an auditor uses to test whether a system is real or theatre. Pick a scheme, write it into your document control procedure, and apply it without exception.
Step 3. Define approval and revision workflow
Every controlled document needs four states defined:
Draft → Reviewed → Approved → Released. The same path applies to every revision.
For each state, document:
Who can author
Who must review (typically the process owner)
Who must approve (typically the function head or Quality Manager)
How the approval is captured — wet signature, electronic signature, or system-generated audit trail
Revisions follow the same workflow. A common convention: minor edits bump the revision letter (A → B → C), substantive changes that affect process bump the integer (1.0 → 2.0). Whatever you pick, the rule is in writing and applied consistently.
Step 4. Control distribution and access
Distribution is where most paper-based systems collapse. If your only control is "the master is in Sharon's filing cabinet", you have no control. Pick one of these models and stick to it:
Model How it works When it fits
Single source of truth One digital location holds the released version. Print-outs are stamped "uncontrolled when printed" and dated. Default for any modern QMS. Dramatically easier to maintain.
Controlled copy register Numbered copies are issued to named holders, who return obsolete copies on revision. Legacy paper environments or restricted-access shop floors.
Step 5. Define retention and disposition
Clause 7.5.3.2 requires you to specify how long records are retained, where they live, and how they are eventually disposed of. The baseline most organisations adopt:
Record type Minimum retention
Quality records (audits, NCRs, CAPAs, management review) 3 years
Calibration and training records Life of asset / employee + 3 years
Customer / regulatory records Per contract or statute (often 7–10 years)
Design and product realisation records Life of the product
💡 Don't just retain — dispose. Auditors increasingly check that obsolete records were removed on schedule. A retention table without execution evidence is a finding.
Step 6. Protect documents from loss, alteration, and unauthorised access
Clause 7.5.3.1(b) is explicit: documents must be protected from loss of confidentiality, improper use, or loss of integrity. In practice this means access roles, backups, and an audit trail of who changed what and when.
Part 2 — Software buyer's checklist
If you've decided that spreadsheets and shared folders won't carry you to certification (a reasonable conclusion), here is the checklist to take into vendor demos. Anything missing is a future audit finding waiting to happen.
✅ Core controls (non-negotiable)
Unique document identifiers and enforced numbering convention
Version history with full audit trail (who, what, when, why)
Configurable approval workflows with electronic signatures (21 CFR Part 11-style attribution where required)
Automatic obsoleting of superseded revisions — old versions cannot be presented as current
Role-based access control
Read-and-acknowledge tracking for affected employees
Retention schedules with automated disposition reminders
Integration and traceability
Bidirectional links between documents and the processes, risks, NCRs, audits, training, and equipment they govern
Linkage to the competency matrix so training records auto-update when a procedure revises
Linkage to internal audit checklists so auditors test against the current revision automatically
Compliance and reporting
Clause-level mapping to ISO 9001:2015 (and ideally readiness for ISO 9001:2026)
One-click evidence export for a chosen clause or audit
Drift detection — alerts when a procedure no longer matches actual practice or has not been reviewed within its review cycle
Usability and adoption
Drag-and-drop document upload with automatic metadata extraction
AI-assisted compliance scoring on upload (gap identification against ISO clauses)
Mobile / shop-floor access to the released revision
Search that actually works — full text, not just title
Vendor due-diligence
SOC 2 / ISO 27001 hosting controls
Data residency options if you have EU or other regional obligations
Export of all data, in standard formats, with no vendor lock-in
A signed Data Processing Agreement
Part 3 — Auditor-facing checklist: clause 7.5 evidence pack
This is the order in which most ISO 9001 auditors will work through your document control system. Pre-stage every item below and you'll cut the documented-information portion of the audit in half.
Clause Evidence to pre-stage
7.5.1 Determination List of documents required by ISO 9001:2015 (Quality Policy, objectives, scope) + additional documents your organisation deemed necessary for QMS effectiveness
7.5.2 Creating & updating Document control procedure showing identification (title, date, author, ref. number) • format / media rules • evidence of review and approval (signatures, electronic approvals, audit trail)
7.5.3.1 Control Evidence the document is available where needed (link, print station, intranet) • evidence it is suitably protected (access controls, backups)
7.5.3.2 Specific controls Distribution, access, retrieval and use records • storage and preservation, including legibility • control of changes (revision history) • retention and disposition schedule, plus evidence of execution
External Register of external documents (customer specs, regulatory standards, supplier drawings) showing they are identified and their distribution controlled
How QMS2GO automates the whole thing
Most of what you've just read is mechanical. It's exactly the kind of work software should do for you, freeing the Quality Manager to focus on improvement rather than version policing. QMS2GO handles document control end-to-end:
What QMS2GO automates
AI-generated procedures with built-in numbering, revision control, and clause mapping
Approval workflows with electronic signatures and a tamper-evident audit trail
Read-and-acknowledge tracking pushed to every affected employee, with reminders
Bidirectional linkage to processes, risks, audits, training, equipment, and forms — so updating one document propagates everywhere
Retention schedules with automated disposition reminders and a 3-year baseline aligned to ISO 9001
AI compliance scoring on every document, with clause-level gap identification
One-click evidence export for any clause, audit, or management review
The platform was built so that walking into a third-party audit feels routine instead of frightening. If you'd like to see how it handles your documents specifically, book a guided demo or start with the free ISO 9001 roadmap .
The bottom line
💡 A document control system that survives audits has three traits: one source of truth, one workflow, and one audit trail. Whether you build it on shared drives, a dedicated DMS, or a full QMS platform, those three traits are what auditors test against clause 7.5.
Get them right and document control stops being the thing that keeps you up the night before the audit.
QMS2GO is the audit-ready operating system for ISO 9001 manufacturers — documentation, registers, internal audits, CAPA, suppliers, production, and QuickBooks data in one connected quality management system. Manufacturing teams use it to build, run, and prove their ISO 9001 system without spreadsheets or scattered SharePoint folders.
Browse all articles · See the QMS software · Book a demo · Get a free ISO 9001 roadmap