ISO 9001 Clause 7.5 — What Controlled Documents Actually Require

Clause 7.5 is a frequently cited clause in ISO 9001 nonconformances. It’s also one of the most misunderstood.

The three parts of clause 7.5

7.5.1 — General. Your quality management system needs the documents and records the standard itself asks for, plus whatever else you decide it needs to work effectively.

7.5.2 — Creating and updating. Whenever you create or change a document or record, it has to say clearly what it is, be in a form that suits its use, and be reviewed and approved to the degree it warrants, so you know it is fit for purpose. This is where review and approval stop being a nice-to-have, and where an approval workflow earns its place.

7.5.3 — Control of documented information. The people who need a document must be able to get the right version, in a usable state, whenever and wherever they need it, and it must be kept safe from misuse, from people who should not see it, and from tampering. As far as each applies, you manage who can see or change it, how it is shared, found, stored and kept legible, how changes to it are controlled, and how long it is kept and what happens to it afterwards. Documents from outside that you rely on, such as customer drawings and specifications, have to be tracked and controlled too, and records that serve as your evidence must be safe from accidental change.

What this looks like in practice

These are the questions an auditor is likely to test:

Is there a defined approval process before a document becomes effective?
Can you prove who approved it and when?
Are employees working from the current effective version?
Are obsolete versions kept out of day-to-day use, and clearly marked as obsolete wherever they can still be retrieved?
Can you show which revision was in force on a given date, for as long as you have decided to keep it?

A lifecycle that meets these expectations

Draft → Review → Approval → Effective → Superseded/Obsolete

Each transition should be traceable. The approval step should be enforced, not optional.

ClearVue Document Control enforces this lifecycle on every revision you create in Document Control — with role-based approvals, effective dates, and a record of who approved each step and when. See the platform