What is documented information?

What it is

ISO 9001:2015 replaced two older words with one. "Documents" and "records" both became documented information, and the standard now distinguishes them by what you do with them: information you maintain (a procedure, a work instruction, a process definition) and information you retain (an inspection record, a training record, a completed traveler).

The distinction matters in practice. Maintained information describes what should happen and has to be current. Retained information proves what did happen and has to be preserved, legible, and retrievable.

Clause 7.5 governs both. It requires appropriate identification, format, and review, and it requires control over distribution, access, storage, and retention. It does not require a particular system, a particular format, or paper.

When you will hear it

In findings. A nonconformity that says documented information was not controlled usually means one of four things: an obsolete revision in use on the floor, a record that could not be produced, an uncontrolled copy, or a document that describes a process nobody follows.

In scoping conversations with a consultant, where it is often a proxy for how much writing lies ahead.

In arguments about software. Document control applications are sold on this clause. They help with revision control and access. They do not make the underlying process real.

What the auditor expects to see

The current revision, in the hands of the person doing the work, and the record that the work was done.

Auditors test document control by walking to a workstation and looking at what is taped to the bench. If it is revision B and the system says revision D is current, the finding writes itself. They test record retention by picking a job from six months ago and asking for its file.

They also look for the retention period being applied rather than declared. A procedure that says records are kept for seven years, in a company that cannot produce one from last quarter, is worse than a procedure that says two years and holds.

Common mistakes

Writing more than you can maintain. Every procedure is a promise to keep it current and to be audited against it. The 2015 edition requires much less than most companies produce.

Confusing storage with control. A shared drive that anybody can edit and nobody versions is not controlled, however well organized the folders look.

Leaving records unsigned or undated. An inspection record without a name and a date does not demonstrate that a competent person performed the inspection when the process required it.

Letting the floor build shadow documents. When people photocopy a form and annotate it because the official one is wrong, you have two problems: an uncontrolled document, and a procedure that does not match the work.

FAQ

Does documented information have to be on paper?

No. Electronic is fine and usually better for revision control. The requirement is about identification, access, and retention, not medium.

How long do we have to keep records?

The standard does not set a period. You set it, based on customer requirements, statutory requirements, and your product's life. Then you meet the period you set.

Do work instructions have to be written for every job?

No. Clause 8.5.1 requires documented information that defines the characteristics and the results to be achieved, to the extent necessary. A skilled operator running a familiar process may need very little. A new hire running a critical dimension needs more.

What happens to obsolete documents?

Clause 7.5.3 requires you to prevent unintended use of them. Marking and segregating them is normal; destroying them is not required and is often unwise when a customer may ask what you were doing at the time of a past shipment.