Many organisations think that the ISO 9001 Quality Management System requires you to document everything you do. How true is this?
If you’ve not yet developed your Quality Management System, or you’ve thought about implementing one and been put off by the idea that you basically need to put everything in writing and keep it in neatly organised files, you may want to think again.
The idea that you need folders full of documented procedures that record everything you do is rather dated. In fact, it was never really true at all.
ISO 9001:2026 continues the flexible approach to documented information established by the previous version of the standard. The amount of documented information needed will vary depending on factors such as the size of the organisation and its activities, processes, products and services, the complexity of its processes and their interactions, and the competence of its people.
What is the Purpose of Documented Information?
There are a number of reasons for maintaining documented information within a Quality Management System. These include:
- Communication of information
- Supporting the consistent operation of processes
- Evidence of conformity
- Knowledge sharing
- Sharing the organisation’s experiences and knowledge
ISO 9001:2026 defines documented information as information required to be controlled and maintained by an organisation, together with the medium on which it is contained. Documented information can relate to the management system and its processes, information created so the organisation can operate, or evidence of results achieved.
Two Types of Documented Information
There are generally two purposes for documented information within a Quality Management System:
- Documented information that is needed to support the operation of the Quality Management System and its processes; and
- Documented information that provides evidence that activities have been carried out or results achieved.
This is similar to the distinction previously made between documents that were “maintained” and records that were “retained”.
Information needed to support the operation of processes tells people what needs to be done or provides information necessary to carry out an activity. This can include policies, procedures, specifications, instructions, process maps and other information used to support the organisation’s processes, quality policy and quality objectives.
ISO 9001:2026 gives organisations flexibility over the amount and type of documented information needed for the effective operation of their Quality Management System. The standard does not require every process or activity to have a documented procedure. The organisation needs to determine what documented information is necessary for the effectiveness of its QMS.
Documented information can also be used as evidence of what has happened or what results have been achieved. This is similar to what has traditionally been referred to as a “record”.
For example, an organisation might have documented information explaining how an inspection is to be undertaken and then retain the results of the inspection as evidence that it was completed.
ISO 9001:2026 uses wording such as “documented information shall be available as evidence of” to identify this type of information. Its Annex A explains that this wording refers to the retention of objective evidence.
Control of Documented Information
Documented information can be in any format or medium and from any source. In practice, information may therefore be held in print or electronically and can include spreadsheets, specifications, procedures, drawings, process diagrams, reports, templates, photographs, images and other appropriate formats.
Naturally, you will need a system for controlling your documented information, and ISO 9001:2026 requires organisations to have appropriate controls in place.
When documented information is created or updated, there must be appropriate identification and description, format and media, and review and approval for suitability and adequacy. Required documented information must also be controlled so that it is available and suitable for use where and when it is needed and is adequately protected.
Documented information of external origin that the organisation determines is necessary for planning and operation of its QMS must also be appropriately identified and controlled.
Documented information used as evidence of conformity must be protected from unintended alterations.
The way you approach document control will depend on a number of factors, most notably the size of your organisation and the type and complexity of your processes.
So document control does not necessarily mean cupboards full of numbered procedures. Modern QMS documentation may be held across electronic systems, databases, cloud platforms, spreadsheets, workflow applications and other digital media.
What matters is that the information is controlled appropriately, easily retrievable and can be relied upon when it is needed.
Required Documented Information
Listed below is the documented information specifically required by ISO 9001:2026, together with documented information that must be available to the extent necessary for the organisation and its processes.
Documented information to support the Quality Management System and its processes:
- The scope of the Quality Management System, including the products and services covered and justification for requirements considered not applicable (clause 4.3).
- Documented information needed, to the extent necessary, to support the operation of QMS processes (clause 4.4.2).
- The quality policy (clause 5.2.2).
- The quality objectives (clause 6.2.1).
- Information needed to support operational planning and control (clause 8.1).
- Where applicable, documented information defining the characteristics of products and services or activities to be performed and the results to be achieved (clause 8.5.1).
Documented information to provide evidence of activities and results:
- Evidence that the organisation’s processes are being carried out as planned, to the extent necessary (clause 4.4.2 b)
- Evidence of the fitness for purpose of monitoring and measuring resources (clause 7.1.5)
- Evidence of competence (clause 7.2)
- Evidence that operational processes have been carried out as planned and that products and services conform to their requirements (clause 8.1)
- Results of reviews of product and service requirements, including any new or changed requirements (clause 8.2.3.2)
- Design and development inputs (clause 8.3.3)
- Evidence of design and development review, verification and validation activities (clause 8.3.4)
- Design and development outputs (clause 8.3.5)
- Design and development changes, including results of reviews, authorisation and actions taken to prevent adverse impacts (clause 8.3.6)
- Evidence of the evaluation, selection and performance monitoring of external providers, including re-evaluation and any necessary actions arising from evaluations (clause 8.4.1)
- Information necessary to enable traceability, where traceability is a requirement (clause 8.5.2)
- Evidence of what occurred when property belonging to a customer or external provider is lost, damaged or otherwise found unsuitable for use (clause 8.5.3)
- Results of the review of changes to production or service provision, including the person or persons authorising the change and any necessary actions arising from the review (clause 8.5.6)
- Evidence of the release of products and services, including conformity with acceptance criteria and traceability to the person or persons authorising release (clause 8.6)
- Evidence relating to nonconforming outputs, including the nature of the nonconformity, actions taken, concessions obtained and the authority deciding the action (clause 8.7.2)
- Monitoring and measurement results (clause 9.1.1)
- Evidence of the implementation of the internal audit programme and the audit results (clause 9.2.2)
- Results of management reviews (clause 9.3.3)
- Evidence of the nature of nonconformities and subsequent actions taken, together with the results of corrective action (clause 10.2.2)
Not every item will necessarily apply in the same way to every organisation. For example, the documented information relating to design and development will only be relevant where those requirements are applicable to the organisation’s QMS.
ISO 9001:2026 also requires relevant documented information to be updated when requirements for products and services change (clause 8.2.4).
Examples of Non-mandatory Documented Information
In addition to the documented information specifically required by ISO 9001:2026, an organisation may decide that other documented information is necessary for the effectiveness of its Quality Management System.
Examples could include:
- Procedure for determining context of the organisation and interested parties (clauses 4.1 and 4.2)
- Procedure for addressing risks and opportunities (clause 6.1)
- Procedure for competence, training and awareness (clauses 7.1.2, 7.2 and 7.3)
- Procedure for equipment maintenance and measuring equipment (clause 7.1.5)
- Procedure for document and record control (clause 7.5)
- Procedure for Sales (clause 8.2)
- Procedure for design and development (clause 8.3)
- Procedure for production and service provision (clause 8.5)
- Procedure for management of nonconformities and corrective actions (clauses 8.7 and 10.2)
- Procedure for monitoring customer satisfaction (clause 9.1.2)
- Procedure for internal audit (clause 9.2)
- Procedure for management review (clause 9.3)
These are examples rather than documents specifically mandated by ISO 9001:2026.
Whether they are needed, and the level of detail they contain, should be determined by the organisation based on what is necessary for the effective operation of its Quality Management System. Clause 7.5.1 specifically recognises that the extent of documented information can differ between organisations.
Keep Documentation Proportionate
Perhaps the most important point is that ISO 9001:2026 does not reward organisations for producing the largest QMS manual.
Your documented information should help your organisation operate effectively, provide consistent products and services, retain important knowledge and demonstrate that requirements have been met.
Too little documented information can lead to inconsistent processes, lost knowledge and difficulty demonstrating conformity. Too much can make the QMS unnecessarily complicated and turn document maintenance into an administrative exercise.
The objective is therefore to find the right balance: document what ISO 9001 requires and what your organisation genuinely needs to operate an effective QMS.
