ISO 9001 document control — managing controlled documents without chaos

What document control means

Document control is the discipline of making sure that everyone in the plant is working from the right version of the right document, that changes to those documents are authorised, and that superseded versions cannot be used by mistake. In a quality context the “documents” are the ones that define how a part is made and checked: drawings, specifications, control plans, work instructions, FMEAs, inspection standards and the PPAP package.

It sounds administrative, but it is one of the highest-leverage controls in a quality system. An out-of-date control plan means parts checked against the wrong limits; a superseded drawing means parts made to superseded dimensions; an unapproved work instruction means a process nobody signed off. Document control is what stands between a well-run process and a plant quietly making the wrong thing correctly. ISO 9001 devotes clause 7.5 to it precisely because uncontrolled documents are one of the most common — and most damaging — quality failures.

What clause 7.5 actually requires

ISO 9001 clause 7.5 (“Documented information”) — carried into IATF 16949 with additional automotive requirements — asks for a handful of concrete controls. Stripped of the standardese, it requires that documented information be:

• Identified and described — a title, a number, a revision and a date, so any copy can be pinned to an exact version.
• Reviewed and approved for suitability before release, by an authority with the competence to sign it off.
• Available where needed — the current version accessible at the point of use, and legible.
• Version-controlled through change — changes made under control, with the revision history retained.
• Protected from loss and misuse — including preventing the unintended use of obsolete versions.

Notice that none of this demands a particular tool or a dedicated officer. It demands a system in which those five properties are true by default. A stack of Word files in shared folders can technically satisfy the letter of the clause, but it makes every one of the five a matter of human vigilance — which is exactly where document control breaks down.

Which documents must be controlled

A frequent confusion is scope: which documents actually need control, and which are just files. The test is impact — if using the wrong version could produce a non-conforming part or an invalid record, the document is controlled. In a manufacturing quality system that typically means:

The automotive angle sharpens the point. Every element of a PPAP package — drawing, FMEA, control plan, MSA study, dimensional results, the PSW — is a controlled document, which is why a document-backed PPAP (rather than a loose folder of files) is the only version that stays audit-ready. In Fast Quality, PPAP elements and quality documents live in the same shared document-control subsystem, so the same lifecycle that governs a drawing governs a PPAP element.

The controlled-document lifecycle

A controlled document is not a static file; it moves through a lifecycle, and the control is in the transitions. Getting the lifecycle explicit — with an approval gate before release and a change gate before revision — is what turns “a folder of files” into document control.

The approval and change gates are where a real system pays off. When a document can only reach “in force” through an approval step, and can only change through a controlled revision, the two hardest requirements of clause 7.5 — approval before use and controlled change — happen automatically rather than by discipline. In Fast Quality, documents move through the platform’s approval lifecycle (draft, verify, released/approved), and revisions run through change management.

Obsolete-document withdrawal — the audit favourite

If an auditor is going to catch a document-control failure, it will almost always be here. It is easy to release a new revision; it is easy to forget to remove the old one. And the moment an obsolete revision is still reachable at the point of use, you have failed the clause’s requirement to prevent unintended use — regardless of how neat your approval records are.

The classic finding is the photocopy: a controlled drawing revised in the system while a printed copy of the previous revision still hangs at the machine. This is why best practice minimises uncontrolled paper copies and drives operators to the current revision from the system, so the version on the item record and the version in use are the same by construction. When a document is superseded, the previous revision is marked obsolete and withdrawn — retained on record for traceability, but no longer reachable as a working document. In Fast Quality, releasing a new revision supersedes the prior one in the shared document store, so the current attached version is the one in force.

Attaching documents to the item record

The structural best practice that makes everything above easier is to attach controlled documents to the item record rather than filing them by folder. When the drawing, control plan, FMEA, work instruction and PPAP package all hang off the part they govern, finding “the current control plan for this part” is one lookup, not a hunt through shared drives. It also makes completeness visible: you can see at a glance which documents a part is missing.

This item-centric model is what powers a document-status dashboard — a view of document and PPAP completeness per item that answers, in one place, “is this part fully documented and approved?” It is the same data that feeds PPAP completeness reporting (see quality reports and KPIs). In Fast Quality, documents attach to the item and quality records, and an item document-status dashboard shows completeness per part, with upload and controlled download through the shared document engine.

Surviving an audit without a document officer

Large organisations can afford a full-time document controller whose job is to keep the paperwork straight. Most Indian SMEs cannot — and should not have to. The answer is not to hire the vigilance; it is to build a system where control is the default so the vigilance is not needed. Three moves make document control largely self-maintaining:

• Make the system the single source. If the current revision is always the one attached to the item, no one has to remember which copy is right — the system knows.
• Make approval and change gates mandatory. When a document can only go live through approval and only change through revision, the two hardest clauses enforce themselves.
• Let the dashboard find the gaps. A document-status view per item surfaces missing or unapproved documents before the auditor does.

Done this way, the pre-audit scramble disappears — not because someone worked harder, but because the records were controlled as a by-product of daily work. That is the same principle behind the whole quality system, laid out in the pillar guide on what quality management software is, and the antidote to the mistakes covered in 7 quality management mistakes.

How Fast Quality controls documents

Fast Quality Software, built by Improsys in Pune on the shared Fast Suite platform, implements clause 7.5 through the platform’s universal document-control subsystem:

Because document control is a shared platform service, the same subsystem serves quality, PPAP and the wider suite through native document-control integration — no separate document system to reconcile. For the connected quality loop this sits inside, see the pillar guide on what quality management software is.

Frequently asked questions