Which documents are required for ISO 9001?

Which documents are required for ISO 9001?

ISO 9001 does not require a quality manual, but it does require specific documented information: defined requirements such as the scope of the quality management system (QMS), the quality policy and the quality objectives, as well as records, for example on competence, supplier evaluation, internal audits, management review and corrective action. You decide yourself in which format you keep this information. What matters is that it is controlled, up to date and easy to find in an audit.

In this article, you will learn which documents the standard explicitly requires, which additional documents are useful and how to control them properly. The current edition is ISO 9001:2026, which keeps the clause structure 4 to 10. You can find all changes in the revision in our article ISO 9001:2026: What changes with the new version?.

What does “documented information” mean in ISO 9001?

Since the 2015 edition, the standard no longer refers to manuals, procedures and records, but uses the single term documented information. It distinguishes between two types:

In addition, Clause 7.5.1 requires you to determine any further documented information you need for your QMS to be effective. How much that is depends on the size of your organisation, your processes and the competence of your people.

Is a quality manual still mandatory?

No. The standard has not required a formal quality manual since the 2015 edition, and ISO 9001:2026 does not require one either. Many companies still keep a lean manual or a wiki start page because it gives auditors and new employees a quick overview.

Which documents do you need to maintain?

The standard explicitly names these requirements:

• Scope of the QMS (4.3): which sites, products and services the QMS covers and why individual requirements do not apply.
• Process information (4.4): to the extent necessary to operate your processes.
• Quality policy (5.2): available, communicated and understood.
• Quality objectives (6.2): measurable and backed by a plan for achieving them.
• Characteristics of products and services (8.5.1): the requirements that apply when delivering them.

Which records do you need to retain?

Records show the auditor that your QMS works in day-to-day practice. The standard requires them in these areas:

Not every item applies to every company: if you do not design your own products or services, Clause 8.3 usually does not apply. You justify this in your scope. For how the clauses fit together, see our overview ISO 9001 requirements for companies.

Which documents are useful but not explicitly required?

• Context analysis and stakeholder overview (4.1, 4.2): including the assessment of whether climate change is a relevant issue for your company.
• Risk and opportunity assessment (6.1): the standard requires actions but no specific format. A matrix is the easiest evidence in an audit.
• Organisational chart and role descriptions (5.3): show responsibilities and authorities.
• Process map: makes the interactions between your processes visible.
• Supplier list with evaluation criteria: the basis for the records required under Clause 8.4.

How to build your ISO 9001 documentation

1. Define the scope: determine sites, products and services, and justify requirements that do not apply.
2. Check against the mandatory lists: go through both lists above and mark what applies to your company.
3. Choose a central location: keep requirements and records in one place with access rights and version control.
4. Assign owners: every document gets a responsible person and a date for its next review.
5. Create records continuously: document training, approvals and corrective actions as part of your workflows, not just before the audit.
6. Check before the audit: complete the internal audit and management review and document the results.

How do you control documented information properly?

Clause 7.5.3 sets out how documents must be handled. Auditors focus on these points in particular:

1. Availability: documents are available and suitable where they are needed.
2. Protection: they are protected against loss, unauthorised changes and improper use.
3. Versions: changes are traceable, including who approved what and when.
4. Retention: retention and disposal are defined.
5. External documents: documents of external origin, such as standards or customer specifications, are identified and controlled.

How can you use documents for several standards?

You need many ISO 9001 records for other standards too. Supplier evaluations under Clause 8.4 partly overlap with supplier assessments under ISO 27001 and the assessment of processors under Art. 28 GDPR. A shared vendor risk management process avoids duplicate work, but the additional requirements of each standard still apply. Policies are best managed centrally, for example with policy management.

Conclusion

ISO 9001 does not require a manual, but it does require clearly defined requirements and complete records. The key mandatory items are the scope, quality policy and quality objectives, plus records on competence, suppliers, internal audits, management review and corrective action.

If you control this information in one place and create it continuously as part of your daily work, you won’t need to gather anything before the audit. This applies to initial certification as well as to the transition to ISO 9001:2026.

Want to build your ISO 9001 documentation in a structured way? With ISO 9001 audit preparation from heyData, you manage all relevant policies and documented information digitally, version them and assign document owners. You train your employees on quality management and ISO 9001 via the heyData platform; the trainings are documented in certificates and serve as evidence of competence under Clause 7.2. For the management review, we support you including documentation and meeting facilitation.

Take the first step: Book a free demo now