ISO 9001 Clause 7.5: Do You Need a Document Register?

Every external audit I’ve witnessed starts the same way. The auditor sits down, opens their laptop, and within ten minutes asks for your documented information register. The thing is, ISO 9001:2015 never actually asks you to have one.

That might sound like a loophole. It isn’t. What the standard does require is considerably more practical, and understanding the difference saves you from maintaining a spreadsheet nobody updates.

What Clause 7.5 Actually Says

Clause 7.5 replaced the old “documents and records” language from the 2008 version. The 2015 revision collapsed the distinction between the two and called everything “documented information.” This was supposed to simplify things. In practice it confused a generation of quality managers who had spent years separating their document control procedure from their record retention schedule.

The clause breaks into three parts.

7.5.1 General: your QMS shall include the documented information required by the standard itself, plus whatever documented information your organisation determines is necessary for the system to work. That second part is deliberate. ISO 9001 recognises that a ten-person job shop and a 500-person Tier 2 supplier operate differently.

7.5.2 Creating and updating: when you create or update documented information, you need to make sure it’s properly identified, in an appropriate format, and that someone with the authority to do so has reviewed and approved it.

7.5.3 Control of documented information: this is the substantive bit. Documented information needs to be available where and when it’s needed, suitable for use, and adequately protected from loss, misuse or improper alteration. You also need to control distribution, access, retrieval, storage, version changes, and eventual disposal.

Nowhere in those three sub-clauses does the word “register” appear.

So Why Does Every Auditor Ask for One?

Because without some form of register, it’s difficult to demonstrate that you’re actually in control. Control implies you know what documented information exists, where it lives, and that you can retrieve any given item on request. A register is the most obvious way to show that.

The register itself doesn’t need to be elaborate. A simple spreadsheet listing document title, reference number, issue status, owner, and review date covers what most auditors want to see. What matters is that it reflects reality. A register showing sixty documents, twenty of which are obsolete drafts nobody has looked at in three years, makes things worse not better.

What the Standard Does Explicitly Require

If you strip out the register question and focus on what Clause 7.5.3 actually mandates, the list is concrete:

• Documented information must be available to the right people at the point of use.
• It must be protected from unintended alteration or loss.
• You must control changes, including retaining superseded versions where required.
• External documented information, such as customer drawings, regulatory standards, and supplier specifications, must be identified and controlled.
• Records must be protected against unintended modification.

That’s it. How you achieve those outcomes is largely up to you.

The Practical Answer

If your organisation has more than a handful of documents, you almost certainly need some form of register to demonstrate control. Not because the standard says so, but because it’s the most efficient way to prove the things the standard does say.

Keep it simple. One line per document. Assign ownership. Set review frequencies that match the actual rate of change in your processes, not an arbitrary annual cycle. If a work instruction for a process that hasn’t changed in five years is reviewed annually, you’re generating paperwork for its own sake.

The bigger risk is the opposite: companies that build elaborate document management systems and spend more energy maintaining the system than doing the work. The point of documented information is to support consistent operation. The moment the documentation becomes a parallel universe of ideal processes that bear no relation to what happens on the floor, it’s stopped serving its purpose.

Where This Fits in a Broader QMS

Clause 7.5 doesn’t sit in isolation. It supports every other clause in the standard. Your risk register, your competence records, your calibration evidence, your nonconformance logs: these are all documented information, and they all fall under the same control requirements.

If you’re trying to build a QMS that’s genuinely lean rather than a compliance exercise, the document structure needs to follow the process structure, not the other way around. Map your processes first, then determine what documented information is actually necessary to run them consistently. That’s what the standard is asking for.

For teams working through a QMS build or overhaul, the free diagnostic at losses.cadencestandard.com is a reasonable place to start if you want to understand where your operational gaps actually are before you decide what to document. And if you’re setting up shop floor controls at the same time, the 5S assessment tool at 5s.cadencestandard.com helps anchor your documented standards to physical reality rather than filing cabinet theory.