Record control preserves information about activities, results and decisions so it remains reliable and usable for its intended purpose. A completed inspection record, approval or action review can provide evidence, but only when its context and integrity are understandable.
The documentation guide explains the information system around those records. A record is not simply an old document: it captures something about a particular event or case, which affects how corrections, access and retention should be handled.
Identify the record’s purpose
Ask what the record needs to demonstrate and who will use it. A release record may support an authorisation decision. A complaint record may preserve the customer’s concern and the organisation’s response. A performance record may support evaluation over time.
Choose information that serves that purpose. Case identity, date, criteria, result and authority can matter, depending on the activity. Do not add fields solely because another organisation’s template includes them.
Avoid collecting unnecessary personal or confidential details. Evidence should be sufficient for the decision while access and handling reflect the information’s sensitivity.
Preserve context and traceability
A result without an identifiable item or criterion can be difficult to interpret. Connect the record to relevant work, instructions or decisions where needed. A reader should understand what the entry actually establishes.
If a procedure changes, historical records may need to remain connected to the earlier applicable criteria. Reformatting them to look current can obscure what happened.
The document versus record comparison explains why changing a blank form and correcting a completed entry require different reasoning.
Protect integrity during creation and correction
Define who can enter, approve or change relevant information. Electronic permissions, controlled forms or other arrangements can support the decision. The method should fit the consequence and environment.
If an error is corrected, preserve an appropriate trail so the original meaning is not silently replaced. Identify the correction and its basis where consequential. Do not create retrospective evidence that falsely appears to have been recorded at the time of the activity.
| Situation | Control question |
|---|---|
| Entry created | Does it identify the relevant case and result? |
| Entry approved | Is the authority and decision clear? |
| Error corrected | Can the change and reason be understood? |
| Record exported | Is necessary context preserved? |
| Record archived | Can it still be retrieved and interpreted? |
These questions guide design rather than mandate one record format.
Control access and availability
Give relevant people suitable access while protecting restricted information. A record can be retained securely yet unavailable to someone who needs it for an authorised decision. Consider both protection and practical use.
For external audit evidence, agree suitable viewing or transfer arrangements. Copying all underlying records into unrestricted folders can create unnecessary duplication and exposure.
If records are distributed across systems, define the authoritative source and relationships. A local spreadsheet should not silently become a competing history of the same decision.
Plan retrieval and retention
Set retention using purpose and applicable legal, regulatory, customer, contractual and operational obligations. There is no one universal ISO retention period for all QMS records.
Identify category ownership, storage, retention basis and disposal authority where useful. Investigations or other applicable holds may require preservation beyond normal disposal timing. Obtain appropriate advice where obligations are uncertain.
The retention article explains why keeping a file and retaining usable evidence are different things. Formats, permissions and links can affect availability throughout the required period.
Test electronic and physical arrangements
For electronic records, examine permissions, backups, exports, migrations and audit trails as relevant. A backup designed for disaster recovery may not allow routine retrieval of a specific historical record.
For paper records, consider legibility, storage conditions, identification and authorised access. Scanning can support retrieval, but the organisation should understand whether the resulting copy preserves the information needed.
Test a real retrieval after a staff change or system update. A theoretical retention policy provides limited assurance if nobody can locate the record or explain its context.
Use records as evidence, not decoration
An auditor or manager should evaluate what a record supports and what it does not. A signed checklist can show an entry was made without proving the effectiveness of the entire system.
Where records are repeatedly incomplete, investigate process conditions, field design, access and responsibility. More reminders may not resolve a form that is impractical or a system that allows an important step to be bypassed.
Reliable record control preserves truthful information for decisions and review. It connects purpose, context and integrity with suitable access and justified retention, while avoiding both uncontrolled accumulation and changes that rewrite the organisation’s history.
Where evidence spans several systems, identify the relationship explicitly. A release approval in one application and test results in another can be useful together, but a later reviewer needs a reliable case reference and enough context to understand the connection.