Home › ISO Knowledge Hub › Document Control & Evidence

Document Control & Evidence

A practical guide to documented information: Keep current instructions available where work happens, protect records of actual results, and assess whether audit evidence is complete, traceable and reliable.

Explore how templates differ from completed records, how changes and access should be controlled, and how digital evidence can withstand routine operational review and risk based audit sampling.

Key Concepts Document Lifecycle Evidence Quality Control Register FAQ

01. Understanding Documented Information

In ISO management systems, documented information covers information that needs to be controlled and maintained and information retained as evidence. A well written document establishes the intended approach; a reliable record demonstrates what actually happened.

Control is proportionate to the purpose and risk of the information. Not every note requires the same approval chain, and a template is not evidence merely because a file exists.

Maintain: Policies, procedures, work instructions and other information kept current to support operations.
Retain: Records that demonstrate completed activities, decisions, results or conformity.
Control external information: Relevant statutory requirements, client specifications, supplier documents or externally issued standards.

Core principle: Use the approved document in the process, then be able to retrieve credible evidence of the process as performed.

Quality manager and colleagues reviewing controlled process documentation in a modern office

02. Template, Record & External Document: Know the Difference

These three types of information often share storage systems but have different control objectives. A completed form normally becomes a record, while its blank template remains a controlled means of collecting information.

01 · Design Template

A predefined form, checklist or worksheet used to collect information consistently. The approved template needs an identifiable version and controlled distribution when relevant.

Example: Blank training attendance form, inspection sheet or supplier evaluation checklist.

Test: Can users identify the current template?

02 · Evidence Record

A completed record is information retained to show activity or results, including date, outcome, responsible person and any relevant traceability.

Example: Signed attendance record tied to a course, completed calibration report or released inspection result.

Test: Can the record be matched to real work?

03 · Source External Document

Relevant information from outside the organization must be identified and controlled to the extent needed for use.

Example: Customer engineering specification, applicable regulatory document or external technical standard.

Test: Is the applicable revision known and accessible?

Quick decision check

Blank: Is this intended to guide or capture future work?
Completed: Does it demonstrate a result, transaction or decision?
External: Does its validity and latest applicable revision depend on another issuer?
Mixed: Could one digital system contain all three with different access, version and retention controls?

03. Document Lifecycle: Seven Control Points

This illustrative lifecycle translates the intent of documented information control into practical decisions. Organizations may combine steps where justified by document criticality, scale and risk.

01 Draft

Create or revise an instruction with a defined owner and intended users.

02 Review

Check technical accuracy, usability and required interfaces.

03 Approve

Authorize release using role appropriate approval evidence.

04 Issue

Identify the effective revision and communicate where to find it.

05 Use

Apply the approved version in day to day work and retain needed records.

06 Revise

Assess proposed change, impact and new release requirements.

07 Archive

Withdraw superseded copies and apply retention/disposition rules.

Lifecycle control loop

Draft → Review → Approve → Issue → Use → Revise → Archive. Every significant change should return to a suitable review and approval before being presented as the current version. Records generated through use follow a separate retention and protection lifecycle.

04. Version Control & Change Management

The objective of version control is not simply naming files “v1”, “v2” or “final”. It is to prevent obsolete instructions from driving real work while preserving a meaningful history of changes.

Five change control checkpoints

Raise a change request: Document the reason, trigger and business impact.
Review affected interfaces: Identify linked forms, SOPs, outsourced activities, training or digital workflows.
Approve before release: Confirm author, reviewer, authority and effective date where applicable.
Communicate and deploy: Update the controlled source and prevent continued use of superseded instructions.
Retain the history: Keep traceable change records and apply retention obligations.

Mini scenario: An inspection checklist changes

Trigger: A customer adds a new acceptance criterion.

Controls: Process owner revises the checklist, quality approves the revision, affected inspectors are briefed, the new version becomes available at inspection stations, and prior completed records remain protected.

Audit test: Compare the effective checklist version with a live inspection and a sample of retained results.

05. Access, Retrieval, Retention & Disposition

Document control must help people find what they need while protecting sensitive or evidential information against inappropriate disclosure, loss, alteration or deletion. Retention periods should come from applicable legal, contractual, customer, operational and management system needs, not from an invented universal ISO period.

A Access & authority

Define who may read, edit, approve, release, export or delete information. Restrict privileged actions and periodically review access.

B Availability & retrieval

Use stable identifiers, location rules, search metadata and backup arrangements so staff can find current instructions and auditors can locate evidence.

C Retention & disposition

Set event based or time based retention criteria, legal holds where applicable, secure disposal and proof that disposition was authorized.

Simple retrieval test

Can an authorized employee retrieve the approved operating instruction and a corresponding completed record for a sampled transaction without relying on the memory of one individual? If not, investigate indexing, permissions, location, metadata and ownership.

06. Evidence Quality Matrix & Risk Based Sampling

Evidence is strong when it helps an evaluator reach a defensible conclusion against a defined audit criterion. Use these questions to assess quality rather than treating mere file availability as proof of conformity.

Quality dimension	Question to ask	Credible evidence	Weakness to investigate	Example audit test
Availability	Is the record accessible to authorized reviewers at the required time?	Retrievable controlled location; working links	Missing file, inaccessible archive or untested backup	Trace one training completion record from the course list.
Traceability	Can the record be connected to a task, person, site, period or product?	Unique ID, timestamps, linked transaction	Unidentified spreadsheet or detached signature	Match a calibration record to the instrument ID.
Completeness	Are essential fields, results, approvals and exceptions present?	Required outcomes and exception handling captured	Missing result, unexplained alteration or approval	Check an inspection record for limits and results.
Reliability	Is its origin credible, protected and internally consistent?	Authorized source and verifiable changes	Editable file with no provenance or control	Compare a system audit trail with the exported record.
Relevance	Does the sample actually address the criterion and time period?	Evidence linked to applicable process and requirement	Unrelated policy shown as proof of execution	Observe practice and sample the corresponding transaction.

Designing a useful sample

Identify the audit objective, criterion, population and relevant period.
Prioritize higher risk processes, recent changes, nonconformities and unusual results.
Select a mix of time periods, operators, sites, records and exceptions, as justified.
Verify important records through interviews or observations, not documents alone.
Record sample rationale, limitations, evidence examined and conclusions.

07. Digital Records, Metadata & Information Integrity

Cloud applications, e signatures, versioned documents, scanned records and workflow platforms can be suitable sources of evidence, provided their authenticity and reliability can be demonstrated for the intended use.

Identity & timestamps: Maintain meaningful creator, modifier, reviewer and transaction metadata.
Change history: Preserve relevant edits, approval events, superseded versions and reasons for changes.
Permission governance: Define least privilege access and protect critical records from unauthorized modification.
Integrity & recovery: Test backups, restoration, export readability and preservation of related metadata.
System migration: Validate that identifiers, version histories and retention needs survive technology changes.

Important: A scanned signature, PDF watermark or automated dashboard is not by itself proof that a source record is authentic. Evaluate provenance and system controls.

Business professionals reviewing structured digital document evidence alongside physical records

08. Document Control Review Register: Illustrative Example

A register helps reviewers understand what information exists, who owns it and what triggers the next review. Treat controlled templates and completed records differently; a retained record does not usually receive a new document revision every time it is accessed.

ID / Document	Category	Version / issue	Owner	Example date	Control / access	Review trigger
DOC-014 Work instruction: Final inspection	Maintained instruction	Rev. 04	Quality / Operations	2026-09-14	Controlled workstation access	Review after process or criteria change
FRM-018 Inspection results form	Controlled template	Rev. 03	Quality	2026-09-14	Approved template library	Reapprove when related WI changes
REC-228 Inspection batch 26-087	Retained record	Not versioned as instruction	Production / Quality	2026-10-08	Batch identifier; restricted edit access	Retain to contractual schedule
EXT-009 Customer acceptance specification	External document	Customer issue 06	Sales / Quality	2026-09-25	Source identified; update watch	Recheck upon customer revision

09. Common Document Control Failures and What They Reveal

01 “Final_v7_reallyfinal.xlsx”

Unclear master copy, uncontrolled revisions and conflicting versions. Fix the release/approval method and authoritative repository.

02 Procedure approved, staff use older copy

Release was not connected to workplace access, training and removal of obsolete instructions. Test at the point of use.

03 Completed records lack context

A form exists, but result, date, site, owner or transaction ID is missing. Improve capture design and routine checks.

04 External specifications not refreshed

The organization cannot show how relevant outside revisions are identified, approved or communicated.

05 Digital record overwritten silently

Weak permissions or history mean later edits cannot be traced. Review audit trail, permissions and retention safeguards.

06 Samples show paperwork but no activity

Record review is disconnected from live process evidence. Combine document samples with observation and interviews.

10. Practical Case Study: Revised Inspection Criteria

The following fictional manufacturing case illustrates how one document change must connect to operating evidence.

The challenge

A customer revises a dimension tolerance. Engineering updates the specification, but one inspection workstation uses an outdated form. The next audit finds completed results against a superseded acceptance limit.

Recovery actions

Contain affected work and determine which batches need reassessment.
Confirm the applicable customer specification and authorized revision.
Revise the inspection instruction and associated form; approve, issue and communicate both.
Check access at each station and brief inspectors on effective changes.
Sample new batch records, including exceptions, to verify implementation.

What an auditor would test

Requirement: Which acceptance criterion was applicable and from what effective date?
Document: Which instruction and blank form were current at the point of use?
Record: Do signed inspection results prove correct decisions for sampled batches?
Control: Who authorized the change and how were obsolete copies withdrawn?
Effectiveness: Did subsequent samples show the revised criterion was applied consistently?

11. Frequently Asked Questions

Answers to recurring questions about documented information, records and audit evidence.

Is documented information the same as a document?

Not exactly. Documented information is broader and includes information that an organization needs to maintain as instructions and information it needs to retain as evidence. It may exist in digital or physical form.

When does a blank template become a record?

A blank template becomes a completed record when it captures relevant activity, results or decisions. A file copy with no completed transaction is not proof that the activity occurred.

Does every document need a signature?

Not necessarily. Approval and authorization methods should be appropriate to the document, the management system, relevant contracts and applicable rules. A controlled electronic approval can be appropriate.

Does ISO prescribe one retention period for all records?

No. Retention and disposal criteria depend on applicable regulatory, contractual, customer, business and standard specific requirements. Establish a justified schedule and legal holds where relevant.

Can cloud stored documents be accepted as audit evidence?

Yes, if the evidence is relevant, retrievable, sufficiently reliable and protected. The reviewer should be able to establish the record’s provenance and whether changes are controlled.

Is a PDF automatically a controlled record?

No. PDF format alone does not demonstrate that the information was approved, current, authentic, complete or protected from inappropriate alteration.

How should externally supplied documents be controlled?

Identify external documents necessary for operations, check the applicable source and revision, control access to current versions and monitor important updates.

Is there a fixed percentage of records an auditor must sample?

There is no universal percentage applicable to every audit. Sampling depends on objectives, population, risks, process variation and evidence needs; record any relevant limitations.

What happens when obsolete instructions remain in circulation?

Assess the effect on completed work and customers, take appropriate correction or containment, revise distribution controls and consider whether the underlying cause requires corrective action.

How can an auditor test daily document control effectively?

Start at the point of use, select a real transaction, check the applicable controlled instruction, follow the completed record and test access, review history and operating practice together.

12. Official Sources & Related Knowledge

Official ISO references

ISO 10013:2021: Guidance for documented information (quality management systems; useful across other management systems).
ISO 30301:2019: Management systems for records (published edition at verification; amendment and revision status should be checked).
ISO 15801:2026: Trustworthiness of electronically stored information.
ISO 19011:2026: Guidelines for auditing management systems.
ISO/TC 176 documented information guidance (explains the ISO 9001:2015 context; read alongside the current applicable edition).