Documented Information as per ISO 9001:2015

The organization’s quality management system must include:

a) documented information required by this International Standard;

b) documented information determined by the organization as being necessary for the effectiveness of the quality management system.

NOTE: The extent of documented information for a quality management system can differ from one organization to another due to the:

a) size of organization and its type of activities, processes, products, and services;

b) complexity of processes and their interactions;

c) competence of persons.

7.5.2 Creating and Updating

When creating and updating documented information the organization must ensure appropriate:

a) identification and description (e.g., a title, date, author, or reference number);

b) format (e.g., language, software version, graphics), and media (e.g., paper, electronic);

c) review and approval for suitability and adequacy.

7.5.3 Control of Documented Information

7.5.3.1 Documented information required by the quality management system and by this International

Standard must be controlled to ensure it is:

a) available and suitable for use, where and when it is needed;

b) adequately protected (e.g., from loss of confidentiality, improper use, or loss of integrity).

7.5.3.2 For the control of documented information, the organization must address the following activities, as applicable:

a) distribution, access, retrieval, and use;

b) storage and preservation, including preservation of legibility;

c) control of changes (e.g., version control);

d) retention and disposition.

Documented information of external origin determined by the organization to be necessary for the planning and operation of the quality management system must be identified as appropriate, and controlled.

NOTE: Access can imply a decision regarding the permission to view the documented information only, or the permission and authority to view and change the documented information.

Definition References to Documented Information

3.03 Requirement

Requirement is the need or expectation that is stated, generally implied, or obligatory.

A note to this definition states that a specified requirement is one that is stated, for example, in documented information.

3.47 Product

Product is the output that is a result of activities where none of them necessarily is performed at the interface between the provider and the customer.

A note to this definition states that software consists of information and is generally intangible and can be in the form of approaches, transactions, or documented information.

3.54 Verification

Verification is the confirmation, through the provision of objective evidence that specified requirements have been fulfilled.

A note to this definition states the objective evidence needed for verification can be the result of an inspection or of other forms of determination, such as, performing alternative calculations or reviewing documented information.

3.55 Validation

Validation is the confirmation, through the provision of objective evidence, that the requirements for a specific intended use or application have been fulfilled.

A note to this definition states the objective evidence needed for a validation is the result of a test or other form of determination, such as, performing alternative calculations or reviewing documented information.

3.60 Audit Criteria

Audit criteria is the set of policies, documented information, or requirements used as a reference against which audit evidence is compared.

3.64 Release

Release is the permission to proceed to the next stage of a process.

A note to this definition states in the context of software and documented information, the word “release” is frequently used to refer to a version of the software or the documented information itself.