How to meet ISO 9001:2026 document control requirements in a small shop without building a paperwork bureaucracy
Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.
The Copy on the Machine Is the Only Revision That Counts
ISO 9001 document control isn’t judged by how clean your master file looks. It’s judged by which revision your operator is holding when the part gets made.
A small shop can have a tidy master document list, a revision log, and approval signatures on every procedure, and still fail Clause 7.5 in five minutes on the shop floor. Auditors don’t stay in the quality office. They walk to the saw, the press brake, the weld booth, and the inspection bench, and they ask to see what people are working to.
If you’re setting up document control for the first time, or you’re already certified and suspect your system only works on paper, this guide is for you. It covers what Clause 7.5 of ISO 9001:2026 requires, what changed from the 2015 edition (very little), and how a 15–40 person shop meets the requirement with controls sized to the operation.
From the Floor: When I audited our shops as a certified ISO 9001 internal auditor, one of the first things I looked for was procedures on the shop floor. As an operations manager, I also made a habit of verifying my team was working to the current revision of whatever procedure the job specified. When I found a procedure on the floor, my first question was the same whether it was the latest revision or not: “Where did you get this copy?” The answer told me more about how their document control system actually worked than the revision block ever did.
👉 Before your next audit, find out which shop-floor controls an auditor is likely to test first. The free Manufacturing Compliance Checklist walks through the ISO, OSHA, and quality requirements production environments get checked on, including document and record control. Run it against your floor this week
In This Guide
- What ISO 9001:2026 Clause 7.5 requires, sub-clause by sub-clause
- What changed from the 2015 edition, and what didn’t
- The difference between documents you keep current and records you keep as evidence
- The five document controls auditors test at the point of use
- How to trace and eliminate uncontrolled copies
- How to control customer drawings, codes, and specifications you didn’t write
- A right-sized document control setup for a 15–40 person shop
- When paper, a shared drive, or QMS software makes sense
- A quick audit checklist and FAQ
Table of Contents
👉 Start Here (Top Resources)
- Work from the actual requirement. Clause 7.5 is short, but the wording matters. Buy the current ISO 9001:2026 standard from ANSI Webstore and use code CC2026 for 5% off through December 31, 2026. ANSI serves international buyers and offers standards in multiple languages.
- Skip the blank-page problem. If you’re building procedures, forms, and a master document list from scratch, 9001Simplified’s ISO 9001 documentation kits give manufacturers a structured starting set to adapt, without a consultant’s invoice.
- Know what has to be controlled. Our ISO 9001:2026 Mandatory Documents list shows every document and record the standard calls for, clause by clause.
ISO 9001 Document Control at a Glance: What Clause 7.5 Requires
Clause 7.5 has three parts. Here’s what each asks for and what the evidence looks like in a small shop. Clause numbering follows ISO 9001:2026, which kept the 2015 structure. Confirm exact wording against your own copy of the standard.
| Clause | What It Requires | Small-Shop Evidence |
|---|---|---|
| 7.5.1 General | The QMS includes the documented information the standard requires, plus whatever you decide is needed for the system to work. The extent can differ by organization size, process complexity, and the competence of your people. | A master document list showing what exists and why |
| 7.5.2 Creating and updating | Documented information is identified (for example, a title, date, author, or reference number), in a suitable format and media, and reviewed and approved for suitability and adequacy. | Revision block on every procedure; approval signature or electronic approval record |
| 7.5.3.1 Control | Documented information is available and suitable for use where and when it’s needed, and adequately protected against loss of confidentiality, improper use, or loss of integrity. | Current revision at the work station; restricted edit rights |
| 7.5.3.2 Control activities | Distribution, access, retrieval and use; storage and preservation, including legibility; control of changes; retention and disposition. Documents of external origin are identified and controlled. Records kept as evidence are protected from unintended alteration. | Distribution list, obsolete-document removal, external document register, locked completed records |
That’s the whole clause. The rest of this guide is about making it hold up at the saw and the weld booth.
What Changed in ISO 9001:2026 Document Control (and What Didn’t)
The structure of Clause 7.5 didn’t change. The wording around it did.
ISO 9001:2026 was published September 16, 2026. Published clause-by-clause comparisons report that the 2026 edition replaces “maintain documented information” with “shall be available as documented information,” and “retain documented information” with “documented information shall be available as evidence of.” The same comparisons describe Clause 7.5 itself as unchanged apart from that wording shift. Check the exact phrasing against your own copy before you revise your procedures.
The International Organization for Standardization (ISO) publishes the standard; ISO 9000, which holds the full vocabulary, is now cited undated in ISO 9001:2026.
Here’s what the change means on the floor:
- ✅ If your document control worked under 2015, it needs tuning, not rebuilding.
- ⚠️ “Available” is an active test. An auditor will ask to see the document or record during the audit. If it’s in a supervisor’s truck or on a laptop nobody else can open, it isn’t available.
- ⚠️ New requirements elsewhere in the standard create new things to control. Our ISO 9001:2026 mandatory documents guide lists them.
Two neighboring changes matter for small shops. Clause 7.1.6 now says organizational knowledge is retained, applied, and shared to the extent necessary. A shop where one person knows where every form lives is exposed on both clauses at once. And Clause 6.3 on planning changes now asks about communicating the change and reviewing its effectiveness, so a procedure revision that reflects a real change to how your QMS works deserves more than a new revision letter.
If you are certified to ISO 9001:2015 → search your procedures for “maintain” and “retain” and update the wording at each document’s next scheduled revision. Don’t let anyone sell you a full rewrite for a wording change.
Certified organizations must complete the transition by September 30, 2029, and new or initial accredited certifications must use ISO 9001:2026 from March 31, 2028. Your certification body may set earlier cut-offs, so confirm its schedule before you plan the work.
These dates come from Global ACI’s mandatory document, Transition Requirements for ISO 9001:2026 (Global ACI-TECH-3-TR 2029-09-30 (M)). Global ACI took over the work of the IAF when the IAF ceased operations on January 1, 2026.
For the full transition picture, see ISO 9001:2026 Is Here: What Manufacturers Need to Do Right Now.
Documents vs. Records: Two Kinds of Control
ISO 9001 doesn’t use the words “documents” and “records.” It uses documented information. But the standard still treats the two differently, and so should you.
| Category | Documents (Kept Current) | Records (Evidence) |
|---|---|---|
| Shop examples | Procedures, work instructions, drawings, inspection plans, welding procedure specifications | Completed travelers, inspection reports, calibration certificates, material test reports, audit results |
| 2026 wording | “Available as documented information” | “Available as evidence of” |
| Control goal | Current revision at the point of use; obsolete versions removed | Complete, legible, retrievable, and protected from change |
| How it fails an audit | Wrong revision on the floor | Missing, altered, or can’t be found |
A fabrication shop example makes it concrete. Your WPS is a document: it gets revised, approved, and distributed. The completed weld inspection report is a record: once it’s filled out and signed, nobody should be editing it.
Common finding in practice: A completed inspection record gets “corrected” by overwriting a cell in a spreadsheet, with no trace of the original value or who changed it. That’s a records-protection problem under Clause 7.5.3.2, and it can undermine an auditor’s trust in every other record in the file.
The Five Document Controls Auditors Test on the Shop Floor
Clause 7.5 reads like an office requirement. It’s tested on the floor. Here are five controls worth checking at the point of use.
1. Identification: Can Anyone Tell What This Is?
Clause 7.5.2 requires appropriate identification and description. As a practical shop rule, make every controlled document easy to identify: a consistent header or footer with the title, document number, revision, and date covers it for most small shops. The exact identifiers should fit the document and your system, but an operator must be able to tell which instruction applies. If they can’t tell which revision is in front of them, you can’t show they’re working to the right one.
2. Review and Approval: Who Said This Was Right?
Approval doesn’t require a committee. It requires a designated person with the competence to judge the document, and a record that they approved it. Hand-marked redlines on a router are a common gray area. If your shop allows redlines, define who can make them, how they’re approved, and when they get rolled into a formal revision.
3. Availability at the Point of Use
The standard says available “where and when it is needed.” A binder in the quality office doesn’t meet that for a press brake operator on second shift. A practical test: ask an operator to show you the current work instruction for the job they’re running. If they can’t get to the current instruction when they need it, the control isn’t working.
If you are preparing for your first certification audit → walk the floor with your master document list and check every station before the auditor does.
4. Change Control: Retiring the Old Revision
Releasing a new revision is easy. Retrieving the old ones is where systems tend to break down. Keep a distribution list for each document, swap copies out by hand when a revision releases (new one in, old one back), and mark any obsolete copy you keep for reference as OBSOLETE. Record the reason for each change in the revision history so the next person understands why it changed.
Common finding in practice: The work instruction is current in the master file, but a prior revision is still taped inside a cabinet door at the station.
5. Protection, Retention, and Disposition
Decide who can edit, not just who can view. Set retention periods for each record type; the standard doesn’t set them, so they come from you, your customers, your contracts, and any regulations that apply. Decide what happens when a retention period ends. And watch legibility: pencil on a traveler, grease on a print, and sun-faded sheets in a window all count as preservation problems.
👉 If you are not 100% certain every station on your floor is working to the current revision, that’s the gap an auditor is likely to find first. The free ISO 9001 Roadmap lays out implementation step by step, including where document control fits in the build order. Get it before you start rewriting procedures →
“Where Did You Get This Copy?” Tracing Uncontrolled Documents
That one question is diagnostic. A current revision with an unexplained source isn’t control. It’s luck. Here’s what the answers tell you.
| Answer You Hear | What It Tells You | Fix |
|---|---|---|
| “From the binder at my station” | Distribution may be working | Confirm the binder is on the document’s distribution list |
| “I printed it off the drive” | Drive access works, but printed copies escape control | Date-stamp printouts as valid for that day or shift, or set a reference-only rule |
| “The guy before me left it here” | Obsolete copies aren’t being retrieved | Swap-out on every revision, plus a periodic floor sweep |
| “I took a picture of it with my phone” | Personal copies the system can’t see | Give point-of-use access so nobody needs a photo |
| “My supervisor emailed it to me” | Email is acting as a distribution channel | Send a link to the controlled location, never an attachment |
| “I wrote it up myself” | An informal work instruction exists | Review it, approve it, and add it to the master list |
That last answer deserves attention. An operator’s handwritten notes are often your best source of process knowledge. Bring them into the system instead of confiscating them.
A note on “Uncontrolled When Printed” footers: the label alone doesn’t control anything. If operators work to printed copies, those printouts are your distribution system, whatever the footer says.
Documents of External Origin: Codes, Specs, and Customer Drawings
For a fabrication or machine shop, some of the most important controlled documents are ones you didn’t write. Customer drawings, purchase orders that call out drawing revisions, AWS and ASME codes, coating specifications, and customer quality requirements all count. Clause 7.5.3.2 requires you to identify and control the external documents you’ve determined are necessary.
A simple external document register is one practical way to handle it: title, edition or revision, source, who checks for updates, and how often. Check every customer drawing revision against the purchase order at contract review, before material gets cut.
The American Welding Society publishes edition and errata information for its welding codes.
ASME lists current editions and update cycles for its boiler, pressure vessel, and piping codes.
AMPP maintains the joint SSPC and NACE coatings and surface-preparation standards that show up in coating specifications.
Watch the edition trap. A contract may call out an older code edition than the current one. Control the edition the contract specifies, and record that it’s contractually required so nobody “upgrades” it by mistake.
When your register points to a code, it should point to a copy you actually own. If your shop welds structural steel, buy the current AWS D1.1/D1.1M:2025 from ANSI Webstore and apply code CC2026 at checkout. Shops that reference several standards can look at ANSI Webstore standards bundles, where buying titles together can cost less than buying each one separately.
For a deeper look at code selection, see Welding Standards: AWS vs ASME vs ISO. For format decisions on the copies you buy, see Digital vs Printed ISO Standards.
👉 Customer revision changes are where flow-down breaks. If a customer revises a drawing and your supplier is still machining to the old one, the nonconformance lands on you. Use the free Supplier Quality Checklist to check whether your purchase orders and supplier controls carry the right revisions downstream →
Right-Sized Document Control for a 15–40 Person Shop
Clause 7.5.1 lets the extent of your documentation scale with your size and complexity. The controls still apply. Here’s a setup that works for a small shop, and the signals that it’s time to scale up.
| Element | Minimum That Works | Scale Up When |
|---|---|---|
| Master document list | One register: number, title, revision, owner, location | Several people edit it, or it stops matching the floor |
| Numbering and revision scheme | Simple prefix plus sequential number; letter or number revisions | You add sites, product lines, or customer-specific document sets |
| Approval | One designated approver per document type | A customer or regulation requires multi-party approval |
| Distribution | Listed locations per document; swap-out on each revision | Too many stations or shifts to track by hand |
| Obsolete documents | Remove and destroy, or mark OBSOLETE if kept for reference | Customers require you to keep superseded revisions on file |
| External documents | Register with edition and an owner who checks for updates | Many customers each send their own specifications |
| Records retention | One schedule: record type, location, period, disposition | Contracts carry different retention terms |
If you are building your QMS from scratch → set up the numbering scheme and master list before you write procedure number two. Retrofitting numbers onto 30 existing documents is slower than starting with them.
Objection: “We’re Too Small for Formal Document Control”
It’s a common objection, and it’s half right. You probably don’t need a 15-page document control procedure. You do need the controls. Five documents controlled well will hold up better at audit than 80 documents nobody can trace.
The time cost is smaller than it looks. Once the master list and numbering are set, control is mostly a habit: swap out the old copy, log the change, check the floor. Compare that to scrapping a batch of parts machined to a superseded revision, plus the corrective action that follows.
If the blank page is the real bottleneck, 9001Simplified gives you procedure templates and forms to adapt instead of writing your document control system from nothing. Our 9001Simplified Review and ISO Documentation Kits for Manufacturers guide cover what to look for before you buy.
Paper, Shared Drive, or QMS Software?
ISO 9001 doesn’t care whether your documents are paper or electronic. It cares whether the controls work. Each method can pass an audit. Each one fails in a predictable way.
| Method | Works When | Breaks When |
|---|---|---|
| Paper binders | Few stations, stable documents, one person owns control | Revisions get frequent or the shop runs multiple shifts |
| Shared drive plus spreadsheet register | Small team, disciplined folder permissions | One person is the only one who understands it, edit rights are wide open, or printouts escape control |
| QMS software | Several editors, frequent revisions, audit trails needed | Nobody owns adoption and people keep working around it |
The “available as evidence” wording puts the emphasis on being able to demonstrate control. Electronic approval records and audit trails can make it easier to show who changed what and when, but a well-controlled paper or spreadsheet system can also meet the requirement. We covered the tipping points in detail in QMS Software vs Spreadsheets: When a Small Shop Outgrows Excel.
If you are already certified and fighting your shared drive → look at software built to run the system day to day. QualityWeb 360 is ISO 9001 management software with document control, internal audit, CAPA, and KPI modules. Submit your company through our referral page to start the conversation.
Quick ISO 9001 Document Control Audit Checklist
Run this before your next internal audit or registrar visit. Some items are audit-readiness practices rather than explicit Clause 7.5 requirements, but each one closes a gap an auditor could find.
✅ Every controlled document shows a title, number, revision, and date
✅ Every document has a recorded approval by a designated person
✅ The master document list matches what’s actually at each station
✅ Operators can show the current work instruction for the job they’re running
✅ No obsolete revisions are at any work station, cabinet door, or desk drawer
✅ Obsolete copies kept for reference are clearly marked OBSOLETE
✅ Customer drawing revisions are checked against the purchase order at contract review
✅ An external document register lists codes and specifications with editions and update owners
✅ Completed records are protected from editing, and corrections show the original entry
✅ A retention schedule exists for each record type
✅ More than one person can find any document or record when the auditor asks
⚠️ If several of these checks depend on one person who knows where everything lives, that’s the point where a managed system starts paying for itself. Refer your shop to QualityWeb 360 and we’ll pass your details along for a conversation about running document control in one place.
For what’s at stake when these checks fail, see What Happens If You Fail an ISO 9001 Audit?
Frequently Asked Questions
What does ISO 9001 Clause 7.5 require for document control?
Clause 7.5 requires you to include the documented information the standard and your QMS need, identify and approve it when you create or update it, and control it so it’s available where needed and protected. Control covers distribution, access, storage, legibility, changes, retention, disposition, external documents, and protecting records from alteration.
Did document control change in ISO 9001:2026?
Not in substance. The structure of Clause 7.5 carried over from 2015. Published comparisons report that the main change is wording: “maintain” and “retain” became “available as documented information” and “available as evidence of.” Confirm the phrasing against your own copy of the standard. New requirements elsewhere in the standard create new documented information you’ll need to control.
Does ISO 9001 require a written document control procedure?
No. Neither the 2015 nor the 2026 edition mandates a specific document control procedure. Many small shops write a short one anyway, because it tells new hires how the system works and gives auditors something to test against. One or two pages is often enough.
Is an “Uncontrolled When Printed” footer enough to control printed copies?
Not on its own. If operators work to printed copies, those copies are part of your distribution system. Pair the footer with a rule, such as printouts valid only for the day or shift they’re printed, and enforce it during floor checks.
Can a small shop use a spreadsheet as its master document list?
Yes. A spreadsheet can meet the requirement if it’s accurate, access-controlled, available to authorized users, and managed under defined controls. As good practice, make sure someone else can locate and use it when the primary owner is out. As the number of editors, documents, and revisions grows, those controls can get harder to maintain. See QMS Software vs Spreadsheets for the warning signs.
How long do we have to keep quality records under ISO 9001?
ISO 9001 doesn’t set retention periods. You set them, based on customer contracts, regulatory requirements, product life, and warranty exposure. Write them into a retention schedule. Aerospace, defense, and pressure equipment customers may specify their own periods in purchase order terms, so check yours.
How should we control customer drawings and industry codes?
Treat them as documents of external origin. List them in an external document register with their edition or revision, check customer drawing revisions against the purchase order at contract review, and assign someone to check for code updates. Control the edition your contract specifies, even if a newer one exists. You can buy the standards your register points to through ANSI Webstore.
Does someone on our team need training to audit document control?
It helps. An internal auditor who understands Clause 7.5 knows to test controls at the point of use, not just in the master file. BSI Group’s ISO 9001 training courses and ISOQAR’s ISO 9001 courses both offer internal auditor options.
When does QMS software make sense after certification?
Once your documentation is built and certified, software earns its place when revisions get frequent, several people edit documents, or audit prep turns into a hunt for records. QualityWeb 360 handles document control, audits, CAPA, and KPIs for ISO 9001 shops. If you’re still building documentation, start with ISO Documentation Kits for Manufacturers.
📥 Free Resources
- ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
- Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
- Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
Not Sure What to Do Next?
🔹 Still figuring out what your system needs? Read the ISO 9001 for Small Manufacturers pillar and the ISO 9001 Clause Breakdown, then grab the free Manufacturing Compliance Checklist to see where your floor stands today.
🔹 Ready to build your documentation? Start from a proven structure instead of a blank page. Get a 9001Simplified documentation kit and adapt the procedures and forms to your shop.
🔹 Need the standard itself? Get your own copy of ISO 9001:2026 through ANSI Webstore and use the CC2026 coupon for 5% off through December 31, 2026. Buying several titles? Compare ANSI bundle packages first.
🔹 Already certified and outgrowing your shared drive? Tell us about your shop through our QualityWeb 360 referral page and we’ll connect you for a look at running document control, audits, and CAPA in one system.
Document control isn’t paperwork for its own sake. It’s the reason the part on the bench matches the drawing the customer approved. Get the revision right at the point of use, know where every copy came from, and Clause 7.5 stops being a finding and starts being a habit. The Standards Navigator will keep breaking down the ISO 9001 requirements small manufacturers actually get audited on, one clause at a time.
Old Revisions Don’t Retire Themselves
Shops that struggle with document control treat it as a filing job. They update the master file and assume the floor follows.
Shops that pass audits treat it as a floor job. They know where every copy lives, who has it, and how the old one gets pulled.
The Standards Navigator covers ISO 9001 for small manufacturers from the operations side: the standard, the documents, and the system to run it.
👉 Get updates on ISO 9001:2026 document control, internal audits, and transition requirements
👉 Be first to access new checklists, template guidance, and audit-prep resources
Industrial Compliance. Clearly Explained.