IgeraIndustria Quality Team · Updated 2026-07-07 · 8 min read
Part 5 of the ISO 9001:2015 Step by Step series · ← Article 4: Clause 6
ISO 9001:2015 replaced the old terminology of "documents" and "records" with the unified term "documented information". Information that must be maintained (kept current and available) corresponds to what were formerly called documents or procedures. Information that must be retained (kept as evidence of what happened) corresponds to what were formerly called records. Understanding this distinction is fundamental to document control under Clause 7.5.
78%
of SMEs still write a formal quality manual — despite ISO 9001:2015 removing the requirement entirely in 2015
Source: IgeraIndustria survey of 140 SME manufacturers undergoing initial ISO 9001:2015 certification, 2025
This article provides the definitive reference list for ISO 9001:2015 documented information requirements. Bookmark it — it is the resource quality managers search for most before certification audits and Stage 1 document reviews.
The definitive list: all 24 mandatory documented information items
The following table covers all documented information explicitly required by ISO 9001:2015. Items marked Maintain are living documents that must be kept current. Items marked Retain are records that provide evidence of conformance and must be preserved for defined periods.
| # | Documented information | Type | Clause | Practical example | Typical retention |
|---|---|---|---|---|---|
| 1 | QMS scope | Maintain | 4.3 | Scope statement in QMS manual or standalone document | Current version only |
| 2 | Quality policy | Maintain | 5.2.2 | Signed policy document, published on intranet | Current; archive superseded versions |
| 3 | Quality objectives | Maintain | 6.2.1 | Quality objectives register with targets, owners, review dates | 3 years minimum |
| 4 | Monitoring and measuring resources (calibration records) | Retain | 7.1.5.1 | Calibration certificates for gauges, CMMs, thermometers | Life of equipment + 2 years |
| 5 | Basis of calibration (when no international standard exists) | Retain | 7.1.5.2 | Documented comparison method for custom measurement tools | Life of equipment |
| 6 | Competence evidence | Retain | 7.2 | Training records, qualifications, skills matrices | Duration of employment + GDPR retention limit |
| 7 | Documented information determined by the organisation as necessary for QMS effectiveness | Maintain | 7.5.1(b) | Procedures, work instructions, forms (org-determined) | Current version; archive superseded |
| 8 | Operational planning and control | Maintain | 8.1 | Process plans, control plans, production routings | Current version |
| 9 | Customer requirements review results | Retain | 8.2.3.2 | Order review forms, contract review records, RFQ responses | Product life + 5 years minimum |
| 10 | Design and development inputs | Retain | 8.3.3 | Design briefs, specifications, regulatory requirements (if Clause 8.3 applies) | Product life + 10 years (regulatory) |
| 11 | Design and development controls | Retain | 8.3.4 | Design review minutes, verification test results, approval records | Product life + 10 years |
| 12 | Design and development outputs | Retain | 8.3.5 | Released drawings, specifications, approved prototypes | Product life + 10 years |
| 13 | Design and development changes | Retain | 8.3.6 | Engineering change notices (ECNs), change authorisation records | Product life + 10 years |
| 14 | Externally provided processes, products, services criteria and evaluation | Retain | 8.4.1 | Approved supplier list, supplier evaluations, audit results | 3 years minimum |
| 15 | Property of customers or external providers (unique items) | Retain | 8.5.3 | Records of customer-supplied tooling, materials, IP received and returned | Duration of custody + 3 years |
| 16 | Changes to production/service provision | Retain | 8.5.6 | Process change records, authorisation, review of consequences | 3 years minimum |
| 17 | Release of products and services | Retain | 8.6 | Inspection and test records, certificates of conformance, despatch notes | Product life + 5 years (or regulatory minimum) |
| 18 | Nonconforming outputs | Retain | 8.7.2 | NCRs, concession requests, scrap records, rework authorisations | 3 years minimum |
| 19 | Monitoring, measurement, analysis, and evaluation results | Retain | 9.1.1 | KPI trend charts, customer satisfaction survey results, process metrics | 3 years minimum |
| 20 | Internal audit programme and results | Retain | 9.2.2 | Audit programme, audit reports, nonconformity findings, follow-up records | 3 certification cycles (9 years) |
| 21 | Management review results | Retain | 9.3.3 | Management review minutes, decisions, action items, resource approvals | 3 certification cycles (9 years) |
| 22 | Nonconformities and corrective actions | Retain | 10.2.2 | CARs (Corrective Action Requests) with root cause analysis and effectiveness review | 3 years minimum |
| 23 | Traceability — unique identification of outputs (when required) | Retain | 8.5.2 | Batch/lot records, serial numbers, material traceability certificates | Product liability period (min 10 years for safety-critical) |
| 24 | Customer satisfaction data | Retain | 9.1.2 | Customer surveys, complaint logs, compliment records, NPS trend data | 3 years minimum |
Maintain vs Retain — the distinction that trips up every first-timer
The maintain/retain distinction is the single most common area of confusion in ISO 9001:2015 document control. Here is the clearest way to understand it:
- Maintain = a living document that must exist in a current, approved version. When you update it, you replace the old version. Examples: quality policy, procedures, work instructions, control plans. These are the "how we do things" documents.
- Retain = a record of something that happened. Records are never modified after the fact — they are kept as evidence. Examples: calibration certificates, inspection records, training completion records, audit reports. These are the "evidence that we did it" documents.
A concrete example: your calibration procedure (how to calibrate gauges) is maintained documented information — it should always be the current approved version. The calibration certificate for a specific gauge calibrated on a specific date is retained documented information — it is an historical record that cannot be changed.
GDPR consideration for retained records: UK GDPR (the retained EU law version post-Brexit) applies wherever records contain personal data about identifiable individuals. Competence records (training certificates, personal qualifications), customer contact records, and supplier contact records all contain personal data. Retention periods must balance ISO 9001 evidence requirements against UK GDPR's storage limitation principle. The recommended approach: define a retention schedule that satisfies both — typically employment duration plus 2–6 years for competence records, with documented justification for the period chosen.