ISO 9001 Documents Checklist: the Manual, Procedures and Records an Auditor Will Ask For

ISO 9001:2015 does not demand a quality manual or a fixed set of procedures. It demands documented information: a short list of documents you maintain, such as your scope, policy and objectives, plus records you retain as proof, such as audit reports and calibration certificates. This checklist covers both, so you walk into your audit with nothing missing.

If you have ever watched a founder panic the week before a certification audit, you know the scene. Someone opens a shared drive, finds four versions of the same procedure, a policy nobody signed, and a training register that stops in March. The system might be fine. The paper trail says otherwise. Auditors do not certify intentions. They certify evidence.

I have seen the same mistake from the other side too: companies that wrote a 90-page manual nobody reads, because a vendor told them ISO 9001 requires one. It does not. Not since 2015, anyway. This guide gives you the list that actually matters, clause by clause, and flags the documents most teams forget until the auditor asks for them.

What does "documented information" actually mean?

ISO 9001:2015 replaced the old words "documents" and "records" with one term: documented information. Inside that term sit two different jobs, and keeping them apart clears up most of the confusion.

Think of it like a restaurant kitchen. The recipe cards pinned above the counter are documents you maintain. You update them when the recipe changes, and everyone cooks from the current card. The photographs of finished dishes, the temperature logs, the customer comment cards — those are records you retain. They prove what actually happened on a given day. You cannot rewrite a photograph after service, and you should not rewrite a record after the fact either.

The standard uses the same two verbs throughout. "Maintain documented information" means keep a document current. "Retain documented information" means keep the evidence afterwards. When you read a checklist that mixes the two up, treat it with suspicion. An auditor will ask for each type in a different way.

Is a quality manual mandatory for ISO 9001?

No. ISO 9001:2008 required a quality manual and six documented procedures: document control, record control, internal audit, control of nonconforming product, corrective action, and preventive action. ISO 9001:2015 dropped both requirements.

You may still keep a manual if it helps. A short manual that states your scope, your policy, and where each process lives can be a handy map for new staff and for the auditor. But it is a choice, not a certification requirement, and a manual that duplicates your procedures word for word is worse than no manual at all. The moment a procedure changes and the manual does not, you own a contradiction the auditor will find.

The same goes for procedures. The 2015 standard names no fixed list of procedures you must write. It names specific pieces of documented information you must maintain or retain, and it leaves the rest to your judgement: document what your people need in order to run each process the same way twice.

The documents you maintain: the short list the standard names

These are the documents an auditor expects to exist, be current, and be available where they are used. Four of them are named in plain terms:

Beyond those four, Clause 4.4 asks you to maintain whatever documented information is needed to support the operation of your processes, and Clause 7.5.1 asks for whatever else your organisation itself has decided is necessary for the system to work. In practice, for a small manufacturer or service company, that means process descriptions or flowcharts for your core processes, work instructions where a task goes wrong without them, and the forms your people actually fill in. If a step only ever happens one way because one person remembers it, write it down. That memory is not a system.

One document deserves a warning of its own: the scope statement. Auditors test it hard, because it decides what the certificate covers. A scope that claims a product line you do not control, or quietly leaves out a site that ships product, will come back as a finding. Write the scope last, after you know your processes, and read it as if you were a customer deciding whether to trust it.

The records you retain: the proof an auditor will sample

Records are where most audits are won or lost. The auditor will not read every record. They will sample — pick a process, follow it through, and ask for the evidence at each step. Here is the set they reach for most often:

• Management review minutes (Clause 9.3): inputs, decisions and actions, with owners. A review that happened but was never minuted is, for audit purposes, a review that never happened.
• Internal audit programme and reports (Clause 9.2): the schedule covering the whole system, the reports, and the nonconformities raised — with their corrective actions closed or visibly in progress.
• Competence and training records (Clause 7.2): evidence that each person is competent for the work they do, tied to the role, not a generic attendance sheet.
• Calibration and verification records (Clause 7.1.5): for every measuring instrument that affects quality, proof it was checked against a traceable standard, and what happened when one was found out of tolerance.
• Monitoring and measurement results (Clause 9.1): product checks, process measures, and customer satisfaction evidence, kept in a form you can trend, not just file.
• Nonconformity and corrective action records (Clause 10.2): what went wrong, what caused it, what you did, and whether the fix worked when you checked again.
• Supplier evaluation and re-evaluation records (Clause 8.4): the criteria applied, the scores or decisions, and the re-evaluation cycle. A supplier file with only a GST certificate in it will not pass.
• Release records (Clause 8.6): evidence that each product or service was checked against its requirements before it went out, and who authorised the release.
• Design records where design is in scope (Clause 8.3): inputs, reviews, verification, validation, and changes. If you genuinely do no design, say so in your scope with the reason — do not invent design records.

The standard sets no single retention period for these records. Your retention schedule is yours to define — but it must be defined, followed, and able to survive customer contracts and any regulatory rule that applies to your sector. "We keep everything forever" is not a schedule. Neither is a folder nobody has cleaned since 2019.

How auditors actually use your documents: Stage 1, then Stage 2

Initial certification audits run in two stages under ISO/IEC 17021-1, the standard that governs certification bodies. Stage 1 is a readiness check. The auditor reads your documented information — scope, policy, objectives, process descriptions, risk work, internal audit and management review records — and decides whether a real system exists to audit. Gaps here do not fail you on the spot, but they can postpone Stage 2, and a postponed audit costs you the timeline you promised your customer.

Stage 2 is the implementation audit. The auditor walks the floor, interviews staff, watches work happen, and pulls records to check that the documented process matches the real one. This is where a beautiful procedure nobody follows becomes a finding. If your team does the job differently from the written procedure, fix the procedure or fix the job — but do not leave both standing. Auditors trust the evidence trail over either story alone.

Digital records pass perfectly well, provided they are controlled, backed up, protected from quiet alteration, and retrievable in readable form when asked. Nobody needs a paper file room in 2026. What you do need is version control: one current version available at the point of use, old versions clearly marked so nobody works from them by mistake.

Document control: the habit that holds the whole list together

Clause 7.5.3 asks for control over every piece of documented information, and the controls are practical, not bureaucratic. Identify each document. Approve it before issue. Review and update it when things change. Make the current version available where it is used. Protect it from loss and unintended change. Keep it legible. Decide how long each record is kept, and how it is disposed of.

The test I give clients is a simple one. Pick any document on your shop floor and ask three questions: who approved this version, when was it last reviewed, and where is the previous version? If your team cannot answer all three in under a minute, your control is weaker than your documents suggest. Fix the control before you write another procedure.

Five mistakes that cost companies their first audit

1. Copying a template set wholesale. A procedure written for someone else's factory will describe controls you do not have and miss the ones you do. Auditors spot template language fast, and every mismatch becomes a question you cannot answer honestly.

2. Writing objectives nobody measures. "Improve quality" is not an objective. "Cut rework from 4% to 2% by March, owned by the production head, reviewed monthly" is one. If you cannot show the measurement, drop the objective or fix the measurement.

3. Running the internal audit the week before Stage 1. The internal audit must cover the whole system at least once, with time to close findings before the certification body arrives. A rushed internal audit with no corrective actions reads as theatre, and auditors treat it that way.

4. Keeping records in personal drives and chat apps. Evidence scattered across phones and inboxes is evidence you cannot produce under pressure. One controlled location, with access for the people who need it, beats five convenient ones.

5. Treating the management review as a signature exercise. The review must work through its required inputs — audit results, customer feedback, process performance, nonconformities, risks — and leave with decisions and actions. A one-page minute that says "all discussed, all satisfactory" invites the auditor to dig deeper.

What does getting this done cost?

Cost depends on how much of this list already exists in usable form. A company with a working scope, policy and a few real procedures needs a shorter engagement than one starting from a blank drive, and any honest quote should say so after a gap check, not before.

ComplyKart's ISO 9001 consultancy starts at ₹9,999 for the Standard tier (up to 25 employees) and ₹19,999 for the Growth tier (26–100 employees). That covers the consultancy: building the documented information with you, running the internal audit, and preparing you for the certification audit. Certification-body audit fees sit outside that figure and are charged at actuals — the body quotes on your headcount, sites and scope, so anyone quoting you a single all-in fee before knowing those facts is guessing. If you want the honest arithmetic for the full three-year cycle, read our ISO 9001 certification cost guide, and if you run more than one standard, our integrated 9001, 14001 and 45001 guide explains where one document set can serve three certificates.

Start with the four named documents, then the records list, then document control. In that order. The companies that pass first time are rarely the ones with the most paper. They are the ones whose paper matches what their people actually do — and can prove it, page by page. If you want help building that set, our ISO 9001 certification page sets out the process, and the compliance fee calculator gives you a quick sense of the engagement cost for your size.

Frequently asked questions

Do I need a quality manual for ISO 9001:2015? No. The 2015 revision removed the mandatory manual. Keep one only if it genuinely helps staff and auditors find their way around your system, and keep it short enough that you will actually update it.

How many procedures does ISO 9001 require? None by number. The standard names specific documented information to maintain or retain, and asks you to document whatever else your processes need. A company with five honest procedures passes; a company with forty copied ones struggles.

Can all our ISO 9001 records be digital? Yes, provided they are controlled, backed up, protected from unauthorised change, and retrievable in readable form. The standard does not require paper records.

How long must we keep ISO 9001 records? The standard does not set one universal period. Define your retention periods, follow them, and check them against customer contracts and any sector regulation that applies to you before you finalise the schedule.

What happens if a document is missing at Stage 1? Stage 1 is a readiness check, not a pass-or-fail gate. The auditor records the gap and may postpone Stage 2 until it is closed. The expensive version of this story is a Stage 2 postponed after you have already promised a customer a certificate date.