Which documents ISO 9001 requires: what the standard says

Maintain, retain and decide for yourself: building a defensible ISO 9001 documented information list

One disagreement keeps surfacing in practitioner discussions on Reddit. Some say an auditor expects around two dozen documents explicitly mandated by ISO 9001. Others say no such list exists. We listen to these discussions to share what is being talked about and to add to the conversation. This piece separates what the standard requires to be documented from what an organisation decides it needs, and shows UK organisations how to build a list they can defend.

The short answer is that ISO 9001:2015 contains no numbered list of mandatory documents. It requires documented information in specific clauses and leaves the rest to the organisation. Documented information is information an organisation must control and maintain, together with the medium that holds it.

What the standard says about which documents ISO 9001 requires

ISO 9001:2015, published in the UK as BS EN ISO 9001:2015, drops the old split between documents and records. It uses two verbs instead. The verb tells you what kind of evidence is expected.

Maintain: information that must be kept current

Three items are explicitly required to be maintained as documented information: the scope of the quality management system (clause 4.3), the quality policy (clause 5.2.2) and the quality objectives (clause 6.2.1). Clause 4.4.2 adds a general duty to maintain documented information to the extent necessary to support the operation of processes. Clause 8.5.1 expects documented information that defines the characteristics of products and services and the results to be achieved, where it is needed.

Retain: records that prove something happened

Retained documented information is evidence that an activity took place or a result was reached. Clauses that call for it include competence (7.2), the basis for calibration where no standard exists (7.1.5.2), design and development inputs, controls, outputs and changes (8.3), evaluation of external providers (8.4.1), release of products and services (8.6), nonconforming outputs (8.7.2), monitoring and measurement results (9.1.1), the internal audit programme and results (9.2.2), management review results (9.3.3) and corrective action (10.2.2). Several apply only when the activity happens, so a company with no design activity has no design records to retain.

Determined by the organisation: the documents the standard leaves to you

Clause 7.5.1 says the quality management system includes both the documented information the standard requires and documented information the organisation determines is necessary for the system to be effective. The standard notes that the extent differs between organisations because of size, the complexity of processes and the competence of people. That is the part no external list can fix.

Why a fixed number cannot be read from the text

Any count is a product of how the clauses are tallied. Counting each clause reference gives one figure. Grouping related records gives another. Excluding conditional items such as design records gives a third. Published lists differ for this reason, and the standard itself states no figure.

Older counts also persist. The 2008 edition required a quality manual and six documented procedures. The 2015 edition removed those requirements. A list that still includes them is describing a previous standard.

Both positions in the discussion hold part of the truth. An auditor can reasonably expect to see retained evidence for every required activity the organisation carries out. No auditor can point to a clause that sets a total.

Building a defensible list: five patterns and what fixes them

A defensible list is one where every item can be traced to a clause or to a stated reason. These five patterns are where lists can fall short.

What practitioners run into	What to do	What you gain
An auditor asks for a document you have not written and you cannot say why	Record for each clause whether documented information is required, determined by you or not applicable, with the reason	A written answer ready when the question is asked
A template list includes documents your processes never use	Keep only items that trace to a clause or to a stated need such as risk of error or a customer requirement	A smaller set that people actually keep current
Maintain and retain are treated as the same thing, so records get edited	Tag each item as maintain (kept current) or retain (kept unchanged as evidence)	Working documents stay current and records stay intact
Records exist but nobody can say which clause they answer	Add a clause reference column to the register	Faster retrieval during a surveillance audit
The list was built for certification and never revisited	Review it at management review and after any process change	A list that matches how the business works now

What a documented information register should record

The register is the working version of the list. Each entry should show:

The title of the document or record
The clause reference, or the reason the organisation determined it necessary
Whether it is maintained or retained
The owner responsible for it
Where it is stored
The review date for maintained documents and the retention period for records

For items the organisation chose to document, the reason might be a customer requirement, a legal requirement, the risk of error or the need to train new starters. For items it chose not to document, a short note on how consistent results are achieved without them completes the picture.

Keeping required documented information under control

Once documents are identified, clause 7.5 sets how they are handled. Clause 7.5.2 covers creation and updating: identification and description, format, and review and approval. Clause 7.5.3 covers control. Documented information must be available where and when it is needed and adequately protected. The organisation must manage distribution, access, retrieval and use, storage and preservation, control of changes such as version control, and retention and disposition. External documents that the organisation determines are necessary must be identified and controlled. Retained records must be protected from unintended alteration.

Ideagen's whitepaper on document control best practices for staying certification ready shows how required documents stay current and provable once they have been identified.

SharePoint for ISO 9001 document management in the UK: what to look for

SharePoint can hold controlled documents for ISO 9001 if it is configured to meet clause 7.5.3. It does not enforce the standard by default. Check that version history is on, that drafts and published documents sit in separate libraries and that edit permissions are limited to named owners. Add columns for owner, clause reference, status and review date. Use an approval flow before publication and retention labels for records. Confirm that staff open the controlled copy and not a downloaded one.

Cite the clause, record the reason and keep the list under control

ISO 9001 does not state how many documents an organisation needs. It requires specific documented information to be maintained or retained, and it asks the organisation to add whatever else its system needs to be effective. A list built clause by clause, with a recorded reason for every addition and omission, answers an auditor in either case. The register then keeps it current.

Readers who want to continue the discussion can join practitioners in Ideagen's Reddit community.

Which documents ISO 9001 requires: is there a fixed number or no list at all?