QMS documentation should support reliable work and preserve information needed for decisions and evidence. It can include policies, process descriptions, instructions, forms, records and controlled system data. A large manual is not a substitute for clear responsibilities or effective operations.
This guide connects document design, approval, distribution, revision, records and retention. The examples are original implementation suggestions. Applicable requirements come from the official standard, relevant obligations, customer commitments and the organisation’s adopted arrangements. A preferred hierarchy or software product does not become mandatory merely because it is familiar.
Begin with the information people need
Ask which decisions and activities require information. A person reviewing an order needs current customer requirements and authority to resolve uncertainty. An operator needs suitable instructions and acceptance conditions. A manager evaluating performance needs reliable definitions and results.
Identify the intended user, purpose and consequence of error. This helps decide whether information needs a detailed instruction, a simple process view, a system control or another suitable form. Documentation should follow the work rather than force every activity into the same template.
Some information is needed to operate a process; other information records what happened. The document versus record explanation describes that distinction. Both need suitable control, but revising an instruction and correcting a historical record are different actions.
Identify requirements without inventing document mandates
Review the documented information required by applicable criteria and what the organisation needs for effective operation. Include relevant legal, regulatory and customer obligations where they apply. Keep the requirement reference separate from the chosen implementation format.
Do not assume that a fixed list of procedures, a particular numbering system or a quality manual is universally compulsory. An organisation may choose these methods, and its own adopted arrangements then need to be understood and controlled. The actual requirement must still be identified.
Documented information requirements should be evaluated using the applicable edition and scope. Historical templates can be useful examples while containing requirements or terminology that need review before reuse.
Choose a structure that users can navigate
A simple structure might connect policy, process descriptions, task instructions and evidence. Another organisation may rely heavily on electronic workflows and linked system information. The useful test is whether people can obtain the correct information when needed and understand its status.
Avoid maintaining the same requirement in several uncontrolled locations. Copying a customer specification into multiple local instructions can create conflicting versions. Use references or controlled transfers where appropriate, while ensuring that users can still access the information practically.
The documentation structure article explains possible arrangements. The structure should make relationships clear without creating layers that nobody uses.
Assign ownership and approval authority
Identify who understands the information, who can authorise it for use and who maintains its control. These responsibilities may involve different people. A document controller can manage status while the process owner evaluates technical suitability.
Approval should address purpose, accuracy, usability and relevant requirements. A signature without substantive review provides limited assurance. For a consequential instruction, consider whether users can perform the work safely and correctly under actual conditions.
Document approval can be electronic or recorded through another suitable method. The control should make the decision and authority identifiable rather than depend on a decorative signature box.
Control release and access
Make current approved information available where it is needed. This may involve a controlled repository, system access, printed copies or another arrangement. The method must fit the working environment, including locations or activities with limited connectivity.
Distinguish draft, approved, superseded and withdrawn status. A user should not need to infer authority from a file’s name or the most recent email. If an instruction is copied locally, consider how its status will remain reliable when the master changes.
Protect sensitive information through suitable access controls. Availability to relevant users does not imply unrestricted access for everyone. Confidential customer information and personal records may need particular handling.
Manage revisions as changes to the work
A revision can change acceptance criteria, responsibilities or process sequence. Evaluate its effect rather than treat it as an administrative event. Identify which linked information, systems, training or external communications need attention.
Record enough revision information to distinguish the new arrangement from the old one. A simple version label may be adequate in one context; another may need a fuller change history. The chosen method should support reliable use and later traceability.
The revision control article explains how release timing and affected work matter. A new instruction can be correct while being applied to the wrong job or introduced before supporting resources are ready.
Prevent unintended use of obsolete information
Withdraw or identify superseded material according to the organisation’s arrangements. Consider shared drives, personal folders, printed instructions, mobile devices and externally supplied documents. Removing a master copy does not necessarily remove every point-of-use copy.
Some superseded information needs retention for historical evidence. Preserve it with clear status and appropriate restrictions so it is not mistaken for the current instruction.
Obsolete document management needs to address the actual distribution mechanism. Repeated reminders may not solve a repository that continues offering old versions as the easiest option.
Preserve records without rewriting history
Records can capture checks, authorisations, results, decisions or other relevant activity. They need enough context to be interpretable: the case, period, criteria or relevant identity may matter depending on purpose.
If a record needs correction, preserve an appropriate trail. Do not silently replace the historical entry or create retrospective evidence that falsely appears contemporaneous. Explain what was corrected and why where that distinction is consequential.
The record control article discusses integrity, access and retrieval. A signed form is not automatically persuasive if it lacks the context needed to understand what happened.
| Information purpose | Useful control question |
|---|---|
| Direct work | Can the user obtain the current approved instruction? |
| Capture a result | Does the record identify the relevant case and criteria? |
| Support a decision | Is the basis and authority understandable? |
| Preserve history | Can later reviewers distinguish versions and corrections? |
| Demonstrate action | Is the evidence connected to the original issue? |
These questions guide design; they are not a compulsory document list.
Set justified retention and disposal arrangements
Retention depends on purpose and applicable obligations. Consider legal, regulatory, customer, contractual and operational needs. Do not invent one universal ISO retention period for every document or record.
A retention schedule can identify categories, owners, locations, retention basis and disposal authority. Where an investigation or other applicable hold requires preservation, ordinary disposal may need to be suspended. Obtain suitable specialist advice when obligations are uncertain.
Document retention should include the ability to retrieve and interpret the information throughout the required period. Keeping an unreadable file indefinitely does not meet every evidence need.
Evaluate electronic controls realistically
Electronic systems can support permissions, workflow, versioning and audit trails. Their presence does not establish that configuration and actual use are suitable. Test the relevant process, including exceptions, migrations and account changes.
A backup intended for disaster recovery may not provide routine access to a particular retained record. An export may omit relationships or metadata needed for interpretation. Understand the system’s actual capability before relying on it.
The electronic document-control article considers these issues. Software should support defined information needs rather than determine the entire documentation strategy by default.
Use registers and matrices for decisions
A register can help identify documents, current versions, owners and locations. A control matrix can connect information categories to approval, access, retention or other responsibilities. Neither should become an administrative duplicate of a system that already supplies reliable information.
Define what the fields mean and who updates them. A complete-looking spreadsheet with broken links or unclear status can mislead users more than a simpler arrangement that is maintained properly.
The document register example illustrates a proportionate design. Test the tool with a real retrieval or change decision to see whether it provides the information needed.
Check documentation through actual use
Follow a real case from requirement through instruction, activity, result and review. Ask users to locate current information and explain exceptions. Examine whether document changes reached affected people and whether records retain sufficient context.
The audit evidence guide explains how documents and records support evaluation without proving system effectiveness by themselves. Audits should assess applicable requirements and actual implementation rather than reward the size of a document library.
Use problems to improve the information flow. Repeated obsolete copies, missing context or unreviewed changes can indicate weaknesses in ownership and distribution, not simply careless users.
Keep the system useful as it grows
Review whether information remains necessary, accurate and accessible. Remove avoidable duplication through controlled decisions and preserve required history. Do not add a new form solely because a template package includes it.
Documentation succeeds when it helps people perform work reliably and enables relevant evidence to be understood later. A proportionate system connects purpose, authority, current use and historical integrity, with enough control to support decisions without turning quality management into document accumulation.