_1762866128417-DS2_OO1j.png)
Fewer obligations, more ownership
With the 2015 revision, ISO 9001 significantly reduced the number of explicitly required documents. A quality manual and the six documented procedures previously required were dropped. Instead, the standard requires documented information in specific places and otherwise leaves it to you to decide what documentation your QMS needs (clause 7.5.1 b).
That is both an opportunity and a risk: you can keep documentation lean – but you must be able to explain why your processes work reliably without additional requirements. Auditors check not only whether mandatory documents exist, but also whether your processes are under control.
Documents that must be maintained
| Clause | Document | Note |
|---|---|---|
| 4.3 | Scope of the QMS | With products, services and justification for requirements that don't apply |
| 4.4 | Documented information to support the operation of processes | To the extent necessary, e.g. process descriptions |
| 5.2 | Quality policy | Available, communicated and understood |
| 6.2 | Quality objectives | Measurable, with planning to achieve them |
| 8.1 | Documented information for operational planning and control | To the extent necessary so processes run as planned |
Records that must be retained
| Clause | Record |
|---|---|
| 4.4 | Evidence that processes are carried out as planned |
| 7.1.5.1 | Fitness for purpose of monitoring and measuring resources |
| 7.1.5.2 | Basis for calibration where no measurement standards exist |
| 7.2 | Competence of persons |
| 8.2.3.2 | Results of the review of requirements for products and services |
| 8.3.2–8.3.6 | Design: planning, inputs, controls, outputs, changes |
| 8.4.1 | Evaluation, selection and monitoring of external providers |
| 8.5.2 | Unique identification where traceability is a requirement |
| 8.5.3 | Loss of or damage to customer property |
| 8.5.6 | Review of changes in production |
| 8.6 | Release of products and services |
| 8.7.2 | Nonconforming outputs and actions taken |
| 9.1.1 | Results of monitoring and measurement |
| 9.2.2 | Audit programme and audit results |
| 9.3.3 | Results of the management review |
| 10.2.2 | Nonconformities, corrective actions and their results |
Some requirements only apply if the topic is relevant to you – such as design (8.3) if you don't develop your own products, or calibration without measurement standards. Justify requirements that don't apply in your scope.
Often expected, but not mandatory
Many companies keep further documents because they make control easier and auditors ask for them. They are not explicitly required:
- Quality manual: useful as an entry point and overview of the system, but not required.
- Process map: shows processes and their interactions per 4.4 – almost always the first topic in an audit.
- Context analysis and interested parties: 4.1 and 4.2 require monitoring and review but no documentation. Without a written basis this is hard to demonstrate.
- Risks and opportunities: 6.1 requires actions but not a risk register. A simple overview helps with follow-up.
- Procedures for internal audit, corrective action or control of nonconforming outputs: formerly mandatory, now optional, but often sensible.
- Organisation chart and role descriptions: make it easier to demonstrate responsibilities and authorities per 5.3.
The documentation pyramid
A layered structure has proven itself. The lower a document sits, the more specific and closer to the workplace it is:
| Level | Content | Audience |
|---|---|---|
| 1 Policy and objectives | Quality policy, scope, quality objectives | Everyone, customers, auditors |
| 2 Processes | Process map, process descriptions, procedures | Managers, process owners |
| 3 Work instructions | Specific steps at a workstation | Employees in the process |
| 4 Forms and records | Checklists, inspection records, reports | Everyone who creates evidence |
References connect the levels: a process description names the related work instructions and forms. That keeps each document short yet complete.
How much documentation is enough?
ISO 9001 itself names the factors that determine the extent: size of the organisation, type of activities, products and services, complexity of processes and their interactions, and the competence of people. An engineering office with ten specialists needs fewer work instructions than a manufacturer running shifts with semi-skilled staff.
- Document what would be lost through staff turnover, absence or growth.
- Document where mistakes are expensive or dangerous.
- Document what customers, laws or authorities require.
- Skip documents nobody reads or that merely repeat the standard.
Example: documentation of a manufacturer with 60 employees
This example of a mid-sized supplier with design, manufacturing and assembly shows what lean but complete documentation can look like. The figures are guidelines and depend heavily on products and processes.
| Area | Controlled documents | Typical records |
|---|---|---|
| Management | Scope, policy, objectives, process map, roles | Management review minutes, objective tracking |
| Sales | Process description from quote to order | Contract reviews, customer satisfaction |
| Design | Design process, design review checklist | Specifications, reviews, releases |
| Purchasing | Supplier management, evaluation criteria | Supplier evaluations |
| Production | 10 to 20 work and inspection instructions | Inspection records, releases, calibration certificates |
| Quality | Complaints, deviations, CAPA, internal audit | 8D reports, audit reports, action lists |
| HR | Onboarding, training matrix | Training records |
In total that is often 40 to 60 controlled documents. What matters is not the number but that each document has an owner, is current and is actually used.
How auditors check your documentation
In the stage 1 certification audit, the auditor mainly checks whether the required documentation exists and is adequate. In stage 2 and surveillance audits, the focus is on whether requirements are actually lived. Typical audit trails are:
- A requirement is looked for at the workstation: is it available, current and known?
- Evidence is traced backwards: from the complaint through the root cause analysis to the changed work instruction.
- Employees are asked how they carry out a specific task, and the answer is compared with the requirement.
- Samples of training records, supplier evaluations and inspection records are checked for completeness.
Documents written only for the audit and irrelevant in everyday work stand out quickly. Short requirements that describe exactly what really happens are better.
Five steps to complete documentation
- 1
Collect mandatory documents
Use the tables above to check which documents and records already exist and where they are.
- 2
Assess gaps
A gap analysis shows which requirements are not yet covered by evidence.
- 3
Create what is missing
Templates from the template library or the AI document generator produce drafts that you adapt to your company.
- 4
Approve and control
All documents go through review and approval and are distributed in a controlled way.
- 5
Generate evidence
Run the system for a few months so that records such as training records, audit reports and the management review exist.
ISO 9001 documentation with docxpert
docxpert includes 23 templates mapped to ISO 9001 – from scope, context, process map, policy, objectives and risks through control of documented information, competence, order handling, design and suppliers to audit programme, management review, 8D report and supplier evaluation. Each template shows which clauses it covers.
Frequently asked questions
Which documents are added with several standards?
For ISO 14001, for example, environmental aspects, the legal register and emergency plans; for ISO 45001 risk assessments; and for ISO 27001 risk assessment and the statement of applicability. Policy, roles, document control, internal audit and management review can be shared and extended with standard-specific sections.
How do I keep documentation current after certification?
Assign an owner and a review interval to every document. Changes from audits, complaints and process adjustments should be incorporated promptly through new versions. Software with reminders and change requests makes this much easier.
Is a quality manual still mandatory under ISO 9001?
No. Since ISO 9001:2015 a manual is no longer required. It can still be useful as an overview for employees, customers and auditors.
How many documents does an ISO 9001 system need?
That depends on size and complexity. Small companies often manage with 20 to 40 controlled documents; larger organisations with many processes need considerably more.
Do I have to keep a risk register?
ISO 9001 requires actions to address risks and opportunities, but not a register. A documented overview is still recommended because it makes the audit evidence easier.
Is a process map enough as process documentation?
For simple processes it can be enough together with responsibilities and KPIs. Complex or error-prone processes usually also need procedures or work instructions.
What happens if a mandatory document is missing in the audit?
It usually leads to a nonconformity. Depending on its significance it is graded as major or minor and must be corrected within a deadline.
May mandatory documents be digital?
Yes. Format and medium are up to you. What matters is that documents are controlled, available and protected.
How can I show that digital QMS documents are available and current at the point of use?
For each document, define who approves it, where the current version is found and how changes are identified. Check that employees can access it where the work happens, including areas with shared devices or limited connectivity. Prevent downloaded or printed copies from being passed around as current instructions without anyone noticing; identify such copies and explain how their status is checked. For records, define permissions, backup, retention and protection against accidental change. Test the arrangement with a real work instruction and ask users which version they open in practice. The medium and controls should fit the document's importance and the risk of using outdated information.