Document Control in eQMS: What ISO 9001 Really Requires

2026-10-04

Executive Summary

• Document control is not “having documents in a folder.” It’s making sure the right people use the right version, at the right time and place, and being able to prove it.
• ISO 9001:2015 (clause 7.5) expects documented information to be identified, approved, protected, distributed, change-controlled, retained and disposed of. It does not prescribe paper or electronic.
• The most common problems aren’t missing documents. They’re outdated copies still in circulation, slow approvals, uncontrolled printouts, and no way to tell who received which version.
• An eQMS doesn’t make documents better, but it makes control depend less on the discipline of a few people.
• A 10-point checklist at the end helps you review your current document control.

A familiar scene

An operator on the production floor is working from an instruction posted beside the machine. That instruction was revised two months ago. The new version sits in a shared folder on an office computer. The one by the machine is the old one, because nobody remembered to swap it.

Nobody did anything deliberately wrong. The operator followed what they could see. The quality team released the new version through the proper process. Yet the result is still a product made to a version that is no longer valid.

This is the problem document control exists to solve. And it shows why document control isn’t about storage: it’s about making sure the right version reaches the right person at the right time.

What ISO 9001 requires for document control

The statements below are based on ISO 9001:2015, clause 7.5 (Documented information), summarized in practical terms.

The clause has three parts bearing directly on document control:

General (7.5.1). The system must include documented information the standard requires, plus whatever the organization determines is needed for the system to be effective. How much depends on organization size, process complexity and people’s competence.

Creating and updating (7.5.2). Information should be identified and described (title, date, author, reference number), have a suitable format and medium, and be reviewed and approved for suitability and adequacy.

Control (7.5.3). Information must be available and suitable for use where and when needed, and adequately protected from loss of confidentiality, improper use or loss of integrity. The organization must address distribution, access, retrieval and use; storage and preservation (including legibility); control of changes (for example version control); and retention and disposition. Documents of external origin needed for the system must also be identified and controlled.

Two things to note. First, the list describes control outcomes, not tools. Second, the standard no longer requires a separate documented procedure for document control the way the 2008 edition did; organizations decide how to do it, provided the control outcomes are achieved.

Version, approval and distribution

From those requirements, document control in practice revolves around three closely linked tasks.

Version

Every document needs a way to tell which version is current. Common practice includes a document number, a revision number, an effective date, and a document register (or master list) showing which version is in force at any point.

The easily missed part is the old version. When a new version is released, the old one has to be withdrawn or clearly marked as obsolete. If it needs to be kept for reference (for example to show which procedure applied when a batch was produced), it should be clearly identified so it can’t be mistaken for the current one.

Approval

Documents need to be reviewed and approved before use. What matters isn’t only the signature, but whether the approver has the authority and information to decide. A long approval loop (a document travelling desk to desk) tends to produce one of two outcomes: the document takes effect late, or people use an unapproved version to “get ahead.”

A useful practice, though not a requirement of the standard: record the reason for change alongside the change itself. Users and auditors both need to understand why a step in a procedure was altered.

Distribution

Documents must reach the people who need them, where they work. The practical question is: who needs this, where, and how do we know they’ve received the new version? For printed copies, distinguish controlled copies (with a recipient list) from uncontrolled ones (printed for reference, clearly marked). For electronic copies, decide who may only read and who may edit.

Don’t overlook documents of external origin if the system relies on them: standards, customer drawings or specifications, regulatory texts. They also need to be identified and version-controlled.

The most common problems

From what’s seen across many manufacturing operations, six problems come up most often. (A general observation, not measured figures.)

1. Outdated copies in circulation. Printouts on the floor, copies on personal computers, old files in shared folders. The most direct problem, and the most dangerous.

2. No way to tell who uses which version. When a document changes, there’s no reliable way to confirm everyone affected has received and understood the new one.

3. Slow or bypassed approval. Long loops push people toward shortcuts.

4. Changes leave no trail. A file is edited, but it’s unclear who changed it, when or why.

5. Documents and records get mixed. Documents need updating when processes change; records are evidence that should stay unaltered and protected. One folder for both often leads to records being edited by mistake or documents not being updated.

6. Too many documents. When documents multiply fast, especially with tools that generate text in bulk, control gets harder. ISO 9001:2015 lets organizations decide which documents they need; not every document has to enter the controlled system.

Illustrative example (a composite scenario, not a real customer case): a plant has three production areas using one set of work instructions. The quality team updates one instruction and sends an email notice. Two areas replace their printed copies; the third doesn’t because the person responsible is on leave. Two months later a nonconformance occurs in the third area, and tracing the cause takes days because nobody is sure which area was using which version.

How document control changes inside an eQMS

First, to be clear: an eQMS doesn’t make your documents better, and it doesn’t replace deciding which documents you actually need. What it changes is how much control depends on human discipline.

One source. The current document lives in one place and users go there rather than keeping their own copies. When a new version is released, users see the new version.

Approval by workflow. Review and approval steps are predefined, with owners and deadlines. The system won’t release a document that hasn’t passed every step.

Effectivity and withdrawal built in. The effective date is tied to the document, and the old version changes status when the new one takes effect, instead of relying on someone remembering to collect copies.

Receipt and read acknowledgment. The system records who received the new version and can require confirmation. This answers “who is using which version” directly.

Change history. Who edited what, when, on which version is recorded, supporting change control and traceability.

Links to other components. When documents are connected to training, nonconformances and audits, a process change can trigger a retraining requirement automatically, rather than relying on memory.

What an eQMS does not solve: unclear writing, processes nobody has agreed, creating more documents than needed, and staff who don’t read what the system sends. It makes control more durable, but content quality remains a human task. This also ties closely to the issue of SOPs that exist but aren’t followed: the gap between document and action doesn’t disappear just because documents are better managed.

If you’re weighing a move to an eQMS, document control is often a sensible starting point for an SME, as discussed in eQMS for Small Manufacturers: Why It Doesn’t Have to Be Complex.

A practical checklist

Use these 10 questions to review your document control, whether you use paper, files or software.

1. Is there a document register showing which version is current at any time?
2. Does every document carry a clear number, revision and effective date?
3. Is it defined who approves which type of document, and do they have the authority and information to do so?
4. When a new version is released, is the old version withdrawn or marked obsolete everywhere, including the floor?
5. Can you say within minutes who holds which version of an important document?
6. Are uncontrolled printouts clearly marked?
7. Are external documents (standards, customer specifications) identified and version-controlled?
8. Do document changes record who changed what, when and why?
9. Are records (evidence of what was done) separated from documents and protected from unintended alteration?
10. Do you review periodically which documents are no longer needed or have become outdated?

If three or more answers are “no” or “not sure,” it’s a sign to revisit how control is organized before thinking about which tool to choose.

A note on ISO 9001 editions

This article refers to ISO 9001:2015. According to certification bodies, a revised ISO 9001:2026 was scheduled for publication in September 2026, with a transition period expected to run about three years and 2015 certificates remaining valid during it. Clause structure may change; check against the edition your organization is certified to.

Where does your organization’s knowledge and document control stand?

→ Take the Knowledge Management Maturity Assessment to identify your maturity level and the first improvement to make.

→ Contact OKELAS to discuss how to organize document control for your manufacturing business.

Further reading:

• eQMS for Small Manufacturers: Why It Doesn’t Have to Be Complex (previous)
• Effective CAPA: Why Corrective Actions Often Don’t Correct Anything (next)
• SOPs That Exist But Aren’t Followed: Why? (related)
• Audit Preparation: Why It Takes Weeks (related)
• eQMS for Manufacturing SMEs: A Practical Guide (pillar)

Sources:

• ISO 9001:2015, clause 7.5 (documented information): iso.org/standard/62085.html
• LRQA, ISO 9001 revision update: Publication date confirmed (certification body source; verify with ISO): lrqa.com

ISO 9001:2015 clauses are summarized in practical language and do not replace the text of the standard; compliance decisions should be checked against the official edition. The example is a composite illustrative scenario based on common patterns in manufacturing SMEs, not a specific customer case. Practices mentioned, such as a document register or recording the reason for change, are common approaches, not mandatory requirements of the standard.