ITF Consult

Document control that survives an audit

A master list, real version control and a retention rule you actually follow, built around how your people work.

Book a document control review See what an internal audit checks

Review: One day for a single-site document set
Rebuild: Two to six weeks depending on volume
Applies to: ISO 9001, 14001, 45001 and 22000 together
Retention: Set by your procedure, contracts and scheme
First test an auditor runs: Retrieve a named record in front of them

Document control means documents are approved and versioned before issue and records are identified, stored, protected, retrievable and retained. Most document control nonconformities are not missing documents. They are obsolete documents still in use at the point of work.

Document lifecycle, with the usual failure markedRevision 2 still on the wall while the master is at revision 4Swipe to pan

01 Enquiry
02 Gap analysis
03 Plan
04 Build
05 Embed
06 Internal audit
07 Close out
08 Management review
09 Handover

Document control that survives an audit sits at step 4 of the readiness cycle. You receive the documented management system.

The finding that keeps being written

An obsolete revision in active use, usually a laminated form at a workstation. It is the most common document control finding anywhere, and it is nobody's fault in particular.

The master moved to revision 4 in the office. The wall still has revision 2 because it was laminated, it is readable, and nobody was told. The system is not broken because somebody was careless. It is broken because the issue step has no mechanism for withdrawing what is already out there.

The rest of the recurring list is short and predictable. Approval not evidenced. External documents such as standards, client specifications and regulations not identified or controlled, so a site works to a superseded GSO standard for two years. Uncontrolled printouts alongside a controlled electronic master. Electronic records with no backup, no access control and no protection from alteration. Retention defined in the procedure and never applied. Forms in use that differ from the controlled template. Records signed by somebody with no documented authority to sign them.

Every one of those is a design problem in the control, not a discipline problem in the people, which is why tightening the procedure without changing the mechanism never works.

What we put in place

Control	What it does	How we test it
Master list	Every controlled document with its current revision, owner, approval and where it is issued.	Sample five, walk to the point of use
Version and approval rules	Who approves what before issue, and how the approval is evidenced without a signature ritual nobody keeps.	Check the last three revisions
Issue and withdrawal	The mechanism that takes the old revision off the wall when the new one goes up. This is the control most sets are missing.	Walk the floor against the list
External documents	Standards, regulations, client specifications and supplier manuals identified, dated and reviewed for currency.	Check for superseded editions
Records control	Identification, storage, protection, retrieval, retention and disposition, defined per record type.	Ask for a named record, time the retrieval
Electronic controls	Backup, access rights and protection against unintended alteration, tested rather than assumed.	Restore test and permissions review
Retention rule	Defined against contract, product life and your certification cycle, then applied. Keeping one full three-year cycle lets a recertification auditor see the whole period.	Check disposal actually happens

The set you end up with

The master list

One document, current, that answers what exists, at what revision, owned by whom and issued where.

A document control procedure people can follow

Short. If the procedure is longer than the process it controls, nobody will run it.

Controlled templates

The forms in use rebuilt to one template family, so a form found on the floor can be matched to the master in seconds.

A records matrix

Every record type with its owner, location, retention period and disposal method.

The external document register

Standards and specifications with their editions and the date currency was last checked, which is where the quiet failures hide.

How the review works

01
Ask for six documents
We name them and time how long retrieval takes. That single test tells us more about the system than the procedure does.
First hour
02
Walk to the point of use
Then we compare what is in use on the floor with what the master list says is current. This is where the finding is.
Same day
03
Fix the mechanism
Withdrawal, approval evidence and external document currency. Usually three changes, not a new system.
Two to six weeks
04
Rebuild the list and the matrix
Master list and records matrix built with your document owner, then handed over with the rules written down.
Inside the same window

Revision 2 on the wall

During an audit, the auditor stops at a workstation and finds a laminated work instruction at revision 2. The master list says revision 4.

Nobody hid it. The revision was approved in the office, the new copy was printed and filed, and nobody was sent to take the old one down. The issue step had no withdrawal step behind it.

We add a point-of-use check. Each issued copy is listed on the master list against the place it is posted. When a revision is approved, the list shows every location holding the old one, and the document owner signs off each location as replaced.

The client holds a master list with issue locations, a withdrawal record for each revision, and a short monthly walk that compares what is on the walls with what the list says is current.

Practical questions

Q01

Is a quality manual still required?

No. It has not been required since the 2015 edition and the 2026 edition does not bring it back. Plenty of organisations keep one because it is useful for induction or for customers. That is a choice, not a requirement.

Q02

How long do we have to keep records?

For as long as your retention schedule says, and that schedule has to meet every legal, contractual and customer requirement that applies to the record. Define it against those, your product life and your certification cycle. We do not quote a statutory Saudi retention period, because the figure that circulates for it is not something we have been able to confirm.

Q03

Can we go fully electronic?

Yes, if records are protected from unintended alteration, backed up, access-controlled and retrievable. Expect the auditor to test retrieval rather than admire the system, and expect them to ask who can edit a signed record.

Q04

Do we need a document control software package?

Not necessarily. Plenty of compliant systems run on a controlled folder structure and a disciplined master list. Software helps when volume or sites make manual control unrealistic. It does not fix a missing withdrawal mechanism, it just makes the same failure faster.

Q05

Does the 2026 revision change document control?

The documented information requirements are substantially unchanged. What the transition does create is a re-issue task: every document that cites ISO 9001:2015 needs updating, and that is exactly the moment an uncontrolled copy surfaces.