# Document control

Number, review, approve, publish, change and retire your policies and procedures the way ISO 9001, ISO 13485 and ISO 27001 auditors expect.

Source: https://sted.digital/docs/guides/document-control · Last reviewed 17 October 2026 · Strand Guides

Good document control means everyone uses the current, approved version and you can show how it got there. Give each document an identifier, owner and review date; approve it before use; publish it where people work; change it only through a new version with a reason; review it on schedule; and retire old versions so nobody uses them.

## When you need this

ISO 9001:2015 7.5.2 asks you to identify documents, choose their format, and review and approve them for suitability. ISO 9001:2015 7.5.3 asks you to keep them available where needed, protected, and under control of distribution, access, changes, retention and disposal, including documents from outside. ISO 27001:2022 7.5.2 and 7.5.3 say the same for an ISMS. ISO 13485:2016 4.2.4 goes further: a documented procedure, re-approval of changes by the original approving function or another it designates, and retention of obsolete versions. ISO 13485:2016 4.2.5 sets the rules for records.

The everyday triggers are a new policy, a review date falling due, a change in law or process (a privacy notice must change when your processing does), an audit finding, and a customer asking for your current version. Each document's owner runs its reviews; a quality or compliance lead runs the system.

A privacy notice is a controlled document too. A new version of what you tell people under UK GDPR Article 13 and UK GDPR Article 14 needs the same numbering, approval and record of what changed.

This is guidance to help you understand the requirement, not legal advice.

## Before you start

You need a list of every controlled document with its owner, a numbering scheme, the people allowed to approve each type, and a decision on where the master copies live. List the external documents you rely on: standards, regulations, customer specifications and supplier manuals.

Setting up the scheme for 30 to 60 documents takes a day or two. After that, a routine review takes an hour per document, and a change with re-approval half a day. Plan reviews across the year so they do not all fall due in one month.

## Steps

1. Identify each document with a code, title, version, owner and review frequency. Done when no controlled document lacks any of the five.
2. Draft the document from a template, and record why it is being written or changed. Done when the draft and its reason exist.
3. Review the draft with the people who do the work and one person who did not write it. Done when every comment is resolved or answered.
4. Approve the document before anyone uses it. Record the approver, the approval date, the effective date and the next review date. Done when the approved version carries all four.

An administrator, or a Policy and Process Owner who owns the document, approves a Draft or starts a new version of an Approved one, and only an administrator assigns a document's owner; a document still awaiting review cannot be approved.
Administrators and a document's owner can open superseded versions from History.

5. Publish the approved version where people work, and tell the people affected what changed. Done when the people who use it have been told and, where the change affects how they work, trained.
6. Control access. Decide who may edit drafts and who reads approved versions, and mark every print or export as an uncontrolled copy. Done when access matches the decision.
7. Review each document by its review date, even if nothing has changed, and record the outcome. Done when the review record shows the date, the reviewer and "no change", "minor revision" or "major update".
8. Change a document only through a new version, with a reason and change notes, approved by the function that approved the original or one designated to stand in for it. Done when the new version and its reason are approved.
9. Retire the superseded version. Mark it obsolete, remove it from points of use, and keep at least one copy for your retention period. Done when no obsolete copy is in use.
10. Control external documents. Record each one's version and source, who checks it for updates, and how often. Done when every external document has a current version and a check date.

## Documents and records

A document tells people what to do and changes under version control: a policy, a procedure, a work instruction. A record shows what was done and must not change once complete: an audit report, a training record, a batch record. ISO 13485:2016 4.2.5 asks for records to stay legible, identifiable and retrievable, for any change to a record to stay visible, and for retention of at least the device's lifetime and no less than two years from release.

The common confusion is a form. A blank form is a document and is version-controlled; a completed form is a record and is retained. Auditors check that completed records reference the version of the document that was current when they were made.

## Controlled and uncontrolled copies

A controlled copy is one you know is current: the master in your document system, or a numbered print you replace at every change. Everything else is uncontrolled: a PDF in an email, a print on a noticeboard, a copy on a shared drive.

### The copy that time forgot

Auditors find old versions in three places: printed work instructions at a workstation, policies attached to a staff handbook, and supplier portals holding a policy you sent two years ago. Mark every export as uncontrolled, keep prints to a minimum, and when you issue a new version, check where the old one was sent.

## Worked examples

### ISO 13485, a work instruction change

A cold-sealing problem leads Lindale Medical's change control to raise the seal temperature on its pouch sealer. Work instruction WI-PK-04 moves from revision C to D. A production engineer drafts it, the line supervisor reviews it, and the quality manager approves it on 24 February 2026, as she approved revision C (ISO 13485:2016 4.2.4). Operators train on revision D before it takes effect on 2 March. Printed revision C copies are collected from the line and destroyed, and one copy is archived for the seven-year device lifetime the company defines. Batch records made before 2 March still reference revision C, so an investigator can tell which instruction each batch was sealed under.

### ISO 27001, an annual policy review

Brightwell Analytics' Access Control Policy is due for review on 15 April 2026; ISO 27001:2022 Annex A 5.1 expects topic-specific policies reviewed at planned intervals. The head of IT reviews it in March and finds one change: contractors must now use multi-factor authentication. Version 3 records the reason and the change notes, the managing director approves it on 9 April, and it takes effect on 14 April. Staff and contractors confirm they have read it within two weeks, and version 2 moves to the history, still retrievable. The review record lists the policy, its version and effective date, the outcome "minor revision" and the reason, so the auditor can follow the change from review to approval.

### ISO 9001, the same controls for quality

ISO 9001:2015 7.5.2 and 7.5.3 follow the ISO 27001 example for quality procedures, with obsolete versions retained for the period you decide. A machine shop adds its customers' drawings as external documents: each is logged with its revision, and when a customer issues a new revision, the old drawing leaves the shop floor that day.

## Checklist

- [ ] Every controlled document has a code, title, version, owner and review frequency.
- [ ] Every approved version records the approver, approval date, effective date and review date.
- [ ] Changes are re-approved by the original approving function or its designated substitute.
- [ ] Every new version carries a reason and change notes.
- [ ] Each review is recorded, including reviews that changed nothing.
- [ ] Only approved versions are available at points of use.
- [ ] Prints and exports are marked as uncontrolled copies.
- [ ] Obsolete versions are marked, withdrawn and retained for the defined period.
- [ ] External documents have a recorded version, source and check date.
- [ ] Completed records reference the document version they were made under.

## How Sted helps

Each revision records "Why this revision" and the changes; the PDF ends with a revision history of approved versions.
Approving sets an effective date and a review date, which starts at the effective date plus the document's review frequency; a review task opens 30 days before the review date and turns overdue after it.
Every exported page carries your organisation and the title in its header, an UNCONTROLLED COPY watermark, a footer naming who exported it, when, the code and version and an export reference, a line to refer to StedOS for the controlled latest version, and a page counter; a document's PDF ends with a revision history of its approved versions, newest first, with date, approver and change notes.
For ISO 27001 clause 7 Sted's knowledge base carries the Training Competence and Awareness Procedure (PRC-TCA) with its Training Record (REC-TR), Training Needs Analysis (REC-TNA) and Awareness Campaign Record (REC-AWC), and the Document Control Procedure (PRC-DCT) with its Document Review Record (REC-DCR) and External Document Control Record (REC-EDCR).
Records are part of the Full Management System plan.

Sted controls the documents held in it. Copies printed or saved elsewhere are yours to control, and approving a version is a person's decision, not Sted's.

## Related standards

- [ISO 27001 support](/docs/standards/iso-27001/support): clause 7.5 on documented information, with competence and awareness.
- [ISO 13485 quality management system](/docs/standards/iso-13485/quality-management-system): document and record control for medical devices.
- [Approved document](/docs/glossary/approved-document): why only an approved version counts as evidence.
- [Documented information](/docs/glossary/documented-information): the ISO term for documents and records together.
- [Adopting and rolling out policies](/docs/guides/policy-adoption-and-rollout): getting a new policy read and acknowledged.
- [Approval and versions](/docs/product/approval-and-versions): approving, versioning and reading history in Sted.

## Frequently asked questions

Q: What should a document control procedure cover?
A: How documents are identified, reviewed and approved before use, made available, protected, changed, reviewed periodically, retired and retained, and how external documents are controlled. ISO 13485:2016 4.2.4 requires the procedure to be documented; ISO 9001 and ISO 27001 leave that to you, though most certified firms write one.

Q: How often should policies be reviewed?
A: At the interval your own procedure sets, and whenever something they depend on changes. Once a year is the common choice for policies, with longer intervals for stable work instructions. A review that changes nothing still needs a dated record that it happened.

Q: Do I need to keep old versions of documents?
A: Yes. ISO 9001 and ISO 27001 ask you to decide how long and to stop old versions being used by mistake. ISO 13485:2016 4.2.4 asks you to keep at least one copy of each obsolete controlled document for a period you define, long enough to cover the lifetime of the devices made under it.

Q: Is a printed copy of a policy controlled?
A: Only if you track who holds it and replace it at every change. Most organisations instead mark every print or PDF as an uncontrolled copy and point readers to the system that holds the current version.