Control of Documented Information: ISO 9001 Clause 7.5.3 Explained

If you hold ISO 9001:2015, clause 7.5.3 is the one your auditor keeps coming back to. It is titled "Control of documented information," and it sits underneath the broader 7.5 requirement on documented information. In practice it is where a large share of audit findings land, because it governs something every manufacturer struggles with: making sure the document a person is reading is the right one, the current one, and the approved one.

This article explains what 7.5.3 requires in plain English, the findings auditors raise against it most often, and how to satisfy it without drowning your quality team in paperwork.

What "Documented Information" Means

ISO 9001:2015 dropped the old language of "documents" and "records" and replaced both with a single term: documented information. It covers two things. First, the information your quality management system needs to operate: your quality policy, procedures, work instructions, process maps, specifications. Second, the evidence that your system is actually working: inspection records, calibration logs, training records, audit reports. The standard treats both under the same control requirements, but some controls matter more for one than the other.

What Clause 7.5.3 Actually Requires

The clause splits into two parts. Read them as a pair.

7.5.3.1 — availability and protection. Documented information must be available and suitable for use, where and when it is needed. And it must be adequately protected, for example from loss of confidentiality, improper use, or loss of integrity. In plain terms: the people who need a procedure can get to it at the point of work, it is the right version for the job, and it cannot be tampered with, deleted by accident, or read by people who shouldn't see it.

7.5.3.2 — the controls. To achieve that, the standard says you must address the following activities as applicable: distribution, access, retrieval and use; storage and preservation, including preservation of legibility; control of changes, such as version control; and retention and disposition. The final paragraph adds one more requirement that catches a lot of manufacturers out: documented information of external origin that you have determined is necessary for your QMS must be identified and controlled too. That means customer drawings, supplier specifications, regulatory standards, and equipment manuals you rely on are in scope.

The phrase "as applicable" matters. ISO 9001 does not dictate how you do this. It does not require a specific software tool, a specific numbering scheme, or a specific approval workflow. It requires that you can show the outcome: the right document, available where needed, protected, version-controlled, retained appropriately, and that external documents you depend on are under control too. How you get there is your decision.

The Findings Auditors Raise Most Often

Three findings come up again and again against 7.5.3. If you fix these, you have addressed most of the clause.

Obsolete documents still in use. An auditor walks the floor, picks up a work instruction at a workstation, checks the revision, and finds it is two versions behind the controlled master. The current revision exists in your system, but the operator is working from a superseded copy. This is the single most common nonconformity in document control, and it goes to the heart of 7.5.3.1: the information available at the point of use was not suitable.

No real version control. Files named "Procedure_FINAL_v2_updated_REALLY_final.docx" in a shared folder. Two people editing the same document at once. No record of who changed what, when, or why it was approved. Clause 7.5.3.2 explicitly calls for control of changes, and a folder of ambiguously named files does not demonstrate it.

Uncontrolled copies. Someone printed a procedure for a meeting six months ago and it is still pinned to a noticeboard. A laminated instruction at the bench was never updated when the master changed. Once a copy leaves your controlled system, you have lost control of it, and you cannot guarantee it matches the approved version.

How to Satisfy 7.5.3 in Practice

You do not need an enterprise document management system to meet this clause. You need a few disciplines applied consistently.

Establish one controlled source for each document, and make it the only place the current approved version lives. Everything else is a reference to that source, not a copy of it. Apply a simple, consistent revision scheme so anyone can see at a glance whether they are looking at the current version. Define who can approve changes and keep a record of each change: what changed, who approved it, and when it took effect. Decide how long each type of record is retained and how it is disposed of when that period ends. And identify the external documents your processes depend on so that when a customer issues a new drawing revision or a standard is updated, you have a way to notice and replace the old one.

Minimise printed and local copies wherever you can. Every copy that leaves your controlled source is a copy that can go stale. The fewer of them there are, the fewer obsolete-document findings you will collect.

Why the Hard Part Is Keeping It Current

Notice that every common finding has the same root cause. It is not that manufacturers lack a procedure for document control. Most have one. The problem is the gap between the controlled master and what people actually work from. Processes change faster than documentation gets updated, copies drift out of sync, and nobody notices until the auditor does. We have written more about why your documentation is already out of date and why discipline alone rarely closes that gap.

This is exactly the problem Promptable was built to solve, and it maps closely onto 7.5.3. Instead of asking operators to hunt through folders and hope they have the current version, Promptable puts your existing documents behind an AI you can question directly. Ask a question about a procedure or a specification and you get an answer drawn from the current approved document, with a citation back to the source. The right version is one question away, available at the point of work, which is the heart of 7.5.3.1.

It also helps with the control-of-changes requirement in 7.5.3.2. Because the system reads across all your documentation, it can flag when procedures appear to have fallen out of date or when two documents conflict with each other. That turns "obsolete documents in use" from something you discover during an audit into something you catch and fix beforehand.

If you are building out your wider document control approach, our guide to ISO 9001 document control software for UK manufacturers covers how to choose an approach, and the difference between a work instruction and an SOP is worth getting straight before you start numbering and controlling them. For unfamiliar terms, our glossary explains the quality and compliance language used throughout.

The Bottom Line

Clause 7.5.3 is not asking for more paperwork. It is asking you to prove a simple outcome: the people doing the work have the right document, it is protected, changes are controlled, records are kept for as long as they should be, and the external documents you rely on are managed too. Auditors find the same three failures over and over because the manual effort of keeping a single source of truth current is genuinely hard.

If you would rather catch obsolete and conflicting documents before an auditor does, book a demo and we will show you how Promptable keeps the current version of your existing documentation one question away.