Anyone who works to ISO 9001 must have their documents under control: which version applies? Who has reviewed and approved it? Do all the people who work with it know that there is a new one? That is exactly what document control is about. This guide explains in substance what the standard requires (clause references follow the 2015 edition; the text of the standard itself is protected and is not reproduced) and shows how an SME can set up document control in a few clear steps: from the draft through review and approval to read acknowledgement.
What document control means
In ISO 9001:2015 the topic is called “documented information” (clause 7.5). The term document control is the usual name in practice. It means that the documents your management system needs are created, distributed and maintained in such a way that the right version is always in the right place. This includes the manual, policy, procedures, work instructions and forms; records such as completed minutes also fall under it, but are usually retained rather than changed.
Since 16 September 2026 the new edition ISO 9001:2026 has been available. In the certification bodies’ overviews of the changes, clause 7.5 is not singled out; however, they mention minor adjustments in other clauses from 4 to 10. Even so, check your requirements in your copy of the edition against which you will be audited.
What the standard requires in substance
Under the 2015 edition, two stages are to be distinguished: creating and updating (clause 7.5.2) and control (clause 7.5.3). In substance, following the structure of the 2015 edition (overview from a certification body, see Sources), the following points are involved:
| Requirement (in substance) | Clause (2015 edition; check the numbering in your edition) | How SMEs implement it (practice) |
|---|---|---|
| Identify documents unambiguously | 7.5.2 | Title, number, date, author, version |
| Choose a suitable format and medium | 7.5.2 | Text in the software, PDF, paper with a note |
| Review for suitability and approve | 7.5.2 | Review and approval by responsible persons |
| Available when and where needed | 7.5.3 | Central storage, access by role |
| Protected from loss, misuse and falsification | 7.5.3 | Rights, backup, traceable changes |
| Distribution, access, storage, control of changes, retention | 7.5.3 | Versions, distribution list, periodic review |
| Identify and control external documents | 7.5.3 | Laws, standards, customer specifications with source |
The requirements are given in substance and in simplified form; the text of the standard for your edition is what counts. How much documented information is needed is for the company itself to decide; the standard does not prescribe form, medium or content (ISO 9001 Auditing Practices Group, whose papers are not formally endorsed by ISO and IAF).
The control workflow in five steps
A simple, clearly regulated workflow is enough:
- Draft. One person writes or changes the document. Drafts are not visible to employees.
- Review. A second person checks content and clarity. If they find defects, they reject the draft with a reason.
- Approval. The responsible manager approves and decides from when the version applies.
- Valid. The version is binding; the previous version is withdrawn but remains viewable.
- Withdrawn. Outdated documents are taken out of circulation but not deleted if they are needed as records.
The four-eyes principle (whoever writes a document neither reviews nor approves it themselves) is the simplest safeguard against errors. In very small teams in which there is no second person, the rule can be deliberately relaxed (practice); record this in writing if you do.
Versions, validity and periodic review
Every change produces a new version with number, date and change note: what was changed, and why? The earlier versions remain traceable. The valid-from date is important: a work instruction that requires training should not apply on the day of approval, but only once everyone affected knows it. Until then the previous version applies.
Equally important is the periodic review: decide for each document after how many months it is to be reviewed again. A document that nobody looks at any more becomes outdated unnoticed, and this is noticed in the audit (practice).
Distribution and read acknowledgement
An approved document is only useful if it reaches the right people. Decide who must know it: all employees, a department, a job title or individual people. For important documents, have the acknowledgement confirmed. Read acknowledgement is a practical tool, not a requirement of the standard; it helps to show in the audit that the specifications are actually known. The read rate, that is the share of those who have confirmed, shows at a glance where gaps remain.
External documents
It is not only your own documents that count. Laws, standards, manufacturers’ information and customer specifications that govern your work must be known and kept up to date. Record the publisher, source and status so that it is clear which edition applies, for example the standard ISO 9001:2015 or 2026.
Practical example: Muster Logistik AG
Muster Logistik AG in Musterhausen is a fictitious company with 40 employees. Work instruction AA-007 “Goods receipt inspection” has applied since 1 March 2026 in version 1. After a complaint, the inspection of cardboard goods is to be tightened.
On Tuesday, 1 September 2026, the warehouse manager starts a new version 2 and enters “Additional visual inspection of cardboard goods” as the reason for the change. The quality manager reviews the draft and rejects it once because a section is unclear; the reason goes to the warehouse manager. After the revision, the managing director approves it on Friday, 18 September 2026, with a valid-from date of Thursday, 1 October 2026. Until then version 1 applies. On 1 October it is withdrawn and version 2 is valid.
The document is distributed to the “Warehouse” job title, 18 people, with mandatory reading. On Friday, 9 October 2026, 15 of 18 have confirmed, so the read rate is 83 per cent. The quality manager reminds the other three. The periodic review is set for 1 October 2027.
Checklist
- Every controlled document has a title, number, version and responsible persons
- Drafts are not visible to employees
- Review and approval are regulated; whoever writes does not approve
- A valid-from date controls when a version becomes binding
- A change note records what has changed
- Old versions can be viewed but are clearly recognisable as withdrawn
- Distribution and mandatory reading are defined
- A periodic review is set for each document
- External documents are recorded with publisher, source and status
- Rejections include a reason
How KMU | base helps
QMS | base maps the workflow in document control.
1. Control workflow with rejection. Every version goes from draft through review and approval to valid and withdrawn; a rejection requires a reason. The buttons are called “Submit for review”, “Reviewed – for approval”, “Approve” and “Reject”. Responsible persons and the quality management lead receive a message when something needs to be reviewed or approved; the author is informed of a rejection.
2. Four-eyes principle. Whoever has written a version can neither review nor approve it. Very small teams switch the rule off in the QMS settings.
3. Versions and validity. Every new version records what was changed and who reviewed and approved it; old versions remain viewable. With a valid-from date in the future you approve a version today and have it apply only on the effective date; the old version is then withdrawn and the distribution list is notified. For each document you set a periodic review of 1 to 120 months and see in the cockpit which documents are due for review.
4. Distribution and reading. You distribute a document to everyone, to a company, a department, a job title or individual people and make reading mandatory. Each person sees their outstanding reading obligations on the “To read” page and confirms that they have read the valid version with one click. Responsible persons and document administrators see for each document who has confirmed, and the read rate in per cent; with one button they remind everyone who has not yet confirmed.
5. External documents. You control laws, standards or customer specifications like your own documents, with publisher and source.
Where to find it: in the QMS | base sidebar, in the “Day to day” group, open “Documents” and “To read”. The four-eyes principle is under “QMS settings”.
What QMS | base does not do: you write documents in the program as simple text with headings, lists and bold type; files such as plans, contracts or certificates are stored in Docu. Whether document control is effective in the audit depends on your employees actually reading and following the versions. No program can replace that for you.
If you would like to try it yourself, take a look at the demo or open a trial account. If you have questions, we will be glad to help via the contact page.
Sources
- Kiwa ZertPunkt: Mindestanforderungen der DIN EN ISO 9001:2015 an zu dokumentierende Informationen, overview (2015 edition, in German), accessed 27.10.2026.
- ISO 9001 Auditing Practices Group: Guidance on Processes, Edition 2, 19.07.2020; the APG is an informal group and its papers are not formally endorsed by ISO and IAF; accessed 27.10.2026.
- ISO: ISO 9001:2026 Quality management systems – Requirements, standard page, accessed 27.10.2026.
- DNV: ISO 9001:2026 Standard Revision, changes by clause, accessed 27.10.2026.
This guide does not replace legal or tax advice. Information as at 27 October 2026.