Document and records control
Half a day on clause 7.5, ending with the four questions that break a document system in ten minutes.
- Duration
- Half day, 4 contact hours. Full day with your own register
- Level
- Implementation
- Covers
- ISO clause 7.5, common to 9001, 14001, 45001 and 22000
- Prerequisites
- None
- Assessment
- Place a mixed item set into the hierarchy, assign retention, find five control failures
- Certificate
- ITF certificate of completion
A half-day course on controlling documented information: document hierarchy, approval, version control, distribution, obsolete document removal, records retention and the electronic controls auditors test. It covers ISO clause 7.5 across all the management system standards.
- 01 Enquiry
- 02 Needs analysis
- 03 Programme design
- 04 Scheduling
- 05 Delivery
- 06 Assessment
- 07 Certification
- 08 Records
Document and records control sits at step 5 of the delivery cycle. You receive course materials and an attendance record.
The expired standard in the quality manual
ISO 9001 and ISO 14001 were both revised this year. Any procedure that still cites either one by its 2015 edition now cites a superseded standard.
That is external document control, and it is the part of clause 7.5 that gets least attention because external documents are not ours. Standards, client specifications, supplier data sheets and regulatory documents all change without telling you, and if there is no register of them with an owner and a check date, the system silently goes out of date.
Internal control fails differently. A superseded form stays in the printer tray. A procedure is approved by someone who was not authorised to approve it. Three versions of the same document exist in three folders and the live one is whichever the person opened first. None of this is exotic and all of it is findable in ten minutes by an auditor who knows the four questions.
The four questions are the last session of the course, and delegates are taught to run them on their own system before anyone else does.
The half day, session by session
The full-day version spends the second half restructuring the client's own document register, which is the version worth buying if your system has been inherited.
| Session | What is covered | Time |
|---|---|---|
| What clause 7.5 actually requires | In plain language, and the widely believed requirements it does not impose. | 0:30 |
| Hierarchy and numbering | Policy to procedure to work instruction to form to record, with delegates mapping their own document set into it. | 0:45 |
| The lifecycle | Draft, review, approve, issue, distribute, revise, withdraw, archive, including who is allowed to approve what. | 0:45 |
| Records | Identification, storage, protection, retrieval, retention and disposition, with a retention table exercise on real record types. | 0:45 |
| External documents | Standards, client specifications and supplier data sheets, and the 2015 edition still cited in the quality manual. | 0:30 |
| Electronic control | Access rights, single source of truth, versioning in cloud storage, signature and audit trail, backup and recovery. | 0:30 |
| What an auditor tests | The four questions that find a broken document control system in ten minutes. | 0:15 |
Five templates, and what each fixes
A document master list template
With owner, revision, approval date and next review, which is the minimum set that makes a system auditable.
A records retention schedule template
Built around the rule that retention is whichever is longest of legal requirement, contract, certification scheme and your own need.
A numbering convention guide
Designed to survive a handover, which is the only real test of a numbering system.
An obsolete document control procedure
Covering withdrawal, marking, and retention of superseded versions where they still have to be kept.
An external document register
With the owner and the check date per item, so a standard revision gets caught by the system rather than by an auditor.
What a controller can do afterwards
- 01
Place any item in the hierarchy
Policy, procedure, work instruction, form, record. Assessed on a deliberately mixed set.
- 02
Tell a document from a record
And apply the right controls to each, because they are genuinely different control sets.
- 03
Run the withdrawal step
So a superseded form physically cannot be used. The step many systems have on paper and not in practice.
- 04
Set a defensible retention period
Longest of legal, contractual, scheme and operational need, with the reasoning recorded against each record type.
- 05
Control external documents
Including running the sweep that catches this year's two standard revisions before the next audit does.
- 06
Make a shared drive compliant
Access rights, version visibility, obsolete marking and a demonstrable approval trail.
Three kitchens, one SharePoint library
A central kitchen group in Riyadh runs three sites from one SharePoint library. Its last audit found a superseded temperature log in use at one site, and the procedures still reference ISO 9001:2015.
The document controller sent the master list, such as it was, and the folder structure a week ahead. The full-day version ran.
The morning taught the method. The afternoon rebuilt the master list with an owner, revision, approval date and next review per document, set a retention period per record type against the group's own procedure and its certification scheme, and started an external document register with the two superseded standards as its first entries. The four questions were run live on the SharePoint library before the day closed.
The group ended up holding a working master list, a retention schedule, an external document register and a certificate per delegate.
Who ends up owning this
The named role, where it exists
Document controllers and the administrators who do the job without the title, which is most of them.
- Restructure a register that grew rather than being designed
- Enforce approval authority without becoming the obstacle
- Keep an external document register that actually gets checked
Owners of the system as a whole
Management representatives and QHSE coordinators who carry clause 7.5 alongside everything else.
- Run the four auditor questions on your own system first
- Decide what the quality manual is still for
- Sweep procedures for the 2026 standard revisions
Nobody knows which version is live
The most common delegate. A folder structure built by three previous people, with no master list and several plausible current versions of everything.
- Establish which version is live and prove it
- Retire duplicates without deleting something that is still needed
- Build the master list from what exists rather than from scratch
Asked by whoever inherited the drive
Do we still need a quality manual?
Not as a requirement. ISO 9001 has not required one since 2015. Many organisations keep one because it is genuinely useful as the map of the system. The course covers what is worth keeping in it and what is there out of habit.
Everything is on SharePoint. Is that compliant?
It can be, and often is not. Compliance depends on access control, version visibility, whether obsolete versions are retrievable and marked, and whether an auditor can be shown the approval trail. The course works through exactly those points against your own setup.
Our procedures reference ISO 9001:2015 and the standard has changed. What now?
That is external document control, and with both ISO 9001 and ISO 14001 revised this year it is worth checking now which edition each document should cite. The course covers the sweep and the register that prevents it recurring at the next revision.
How long do we keep records?
There is no single figure. Each record type is kept for the longest of what applies to it: legal requirement, contract, certification scheme and your own operational need, as set in your own procedure. The exercise builds the table for your actual record types with the reasoning beside each.
Is the certificate recognised?
It is an ITF certificate of completion, and it records that the participant attended and met the assessment criteria on the day. It is not an accredited qualification. It is the kind of evidence a management system asks for under ISO 9001 clause 7.2 and its equivalents. If your buyer or regulator names a certificate issued under an accreditation scheme, tell us at enquiry and we will say plainly whether ours fits.
Can you run it in Arabic?
Yes. Arabic, English, or Arabic delivery with English material, which is the usual request for a mixed room. Confirm the language when you book, because it decides which trainer and which handouts are scheduled.
Do you come to our site?
Yes, and it is the default. On your site the exercises run on your own documents and processes, and the participants lose no travel time. We need a room, a screen, and the participants released from the floor for the whole session.
How many people can attend?
Awareness courses work up to about 20. Courses with assessed practical work cap at about 12 to 15, so every person does the exercise rather than watching it. These caps are our teaching judgement, not an external rule.
Who delivers it?
Practising auditors. The people teaching these courses spend their working weeks inside factories, warehouses, kitchens and offices carrying out audits, and the examples in the room come from that work. The standard every trainer meets is set out on the trainers page.
What if someone misses a day, or does not pass?
There is no certificate for partial attendance or a failed assessment. The participant can join the missed day or retake the assessment on a later run, and we tell you which person and why. We would rather report a gap than issue a record that says something untrue.
Where this connects
ISO 9001:2026 awareness
The standard whose revision is currently invalidating external document registers.
Read moreImplementationNonconformity and corrective action
The register discipline applied to findings rather than documents.
Read moreImplementationAI and digital tools in operations
Automating the review dates, expiry flags and register maintenance this course sets up.
Read moreConsultDocument control, set up for you
When the register needs rebuilding by someone else rather than taught to your team. ITF Consult.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Run the sweep before your auditor does
Two standards were revised this year, so an external document register that has not been checked since 2024 is now producing findings on its own. Tell us how your documents are stored and we will say which version of the day you need.