Document control per ISO 9001 – the 7 most important requirements

What ISO 9001 really requires

ISO 9001:2015 talks about "documented information" in clause 7.5. It does not prescribe a specific tool but defines seven requirements that every document control system must meet.

The 7 requirements at a glance

1. Identification and description

Every document must be uniquely identifiable: title, date, author, reference number. M365 implementation: content type with mandatory columns in SharePoint.

2. Format and medium

The format must fit the purpose (PDF for unchangeable distribution, Word for editing). M365 implementation: template library with standardised templates.

3. Review and approval

Every document must be reviewed and approved before publication – traceable. M365 implementation: Power Automate approval workflow with documented approval history.

4. Availability at the point of use

Employees must have access to the currently valid version. M365 implementation: permission groups per area, search in the QM hub.

5. Protection against unintentional change

Only authorised people may change documents. M365 implementation: SharePoint permissions, sensitivity labels for particularly protected documents.

6. Distribution, access, retrieval

Who saw which version when? M365 implementation: read confirmations via list + Power Automate, audit log via Purview.

7. Control of obsolete documents

Outdated documents must be clearly marked or archived. M365 implementation: lifecycle policy, status column (draft / valid / archived / withdrawn).

Common mistakes

• Distributing documents only as email attachments (no version control)
• "Final_v3_new_final.docx" instead of proper versioning
• No read confirmation for documents that require approval
• Old versions are overwritten instead of archived
• External documents (supplier certificates, standards) are not controlled

Pragmatic starting point

1. List all existing QM documents
2. Define mandatory fields (content type)
3. Build the approval workflow cleanly once
4. Define three permission groups
5. Training for end users (max. 30 minutes)

Those who do not want to reinvent the wheel use a pre-configured QM module in which all 7 requirements are already mapped cleanly.