ISO 9001 document control
ISO 9001 document control software, mapped to the clause.
Clause 7.5 describes outcomes, not a method — which is why two organizations can satisfy it very differently and why software comparisons are hard. This page takes each requirement in turn and names the mechanism that answers it, including the one DocumentSynth does not answer yet.
What the standard asks for
Documented information, in two parts.
7.5.2, creating and updating covers a document at the point it comes into existence: it must be identified and described, it must be in a suitable format, and it must be reviewed and approved for suitability and adequacy before it is used.
7.5.3, control of documented information covers the rest of its life: it must be available where it is needed, protected against loss of integrity, distributed and accessed under control, stored so it remains legible, changed under version control, and retained and disposed of according to a defined approach.
The standard never says “use software”. Plenty of certified organizations run parts of this on paper. What it says is that the outcomes have to be achieved and evidenced, and that is where a controlled system earns its place: it makes the evidence a by-product of doing the work rather than a thing assembled before an audit.
Requirement by requirement
Clause 7.5, and the mechanism for each part.
7.5.2 a)Identification and description
In practiceA document needs a title, a date, an author or owner, and a reference number — an identity that does not change when the content does.
DocumentSynthEvery document carries a number, a type its organization defines, and an owner. Revising the content changes none of them, so a reference from a procedure or a record still resolves years later.
7.5.2 c)Review and approval for suitability and adequacy
In practiceSomebody competent has to review it, and somebody authorized has to approve it, before it is used. The standard treats these as distinct.
DocumentSynthReview and approval run as workflow on the document, assigned as tasks to named people, with distinct permissions. Approving is not the same act as reviewing and the system does not treat them as one.
7.5.3.1 a)Available and suitable for use, where and when needed
In practiceThe people doing the work can find the current version at the moment they need it.
DocumentSynthA register with server-side search, filtering and sorting, showing each document’s lifecycle state wherever it appears. Search covers document metadata; it does not search inside file content.
7.5.3.1 b)Adequately protected — confidentiality, improper use, loss of integrity
In practiceNot just backed up. Protected from being changed by the wrong person, or changed without anyone knowing.
DocumentSynthEach organization runs in an isolated environment at its own address, decided before anyone is authenticated and enforced again independently in the database. Approved versions are not edited, and every state change writes an append-only, hash-chained audit event.
7.5.3.2 a)Distribution, access, retrieval and usePartial
In practiceWho may see it, who may change it, and — where paper is used — which printed copies are controlled and who holds them.
DocumentSynthAccess and lifecycle actions are governed by named permissions within the isolated environment. Printed-copy control is a different problem and DocumentSynth does not solve it.
7.5.3.2 b)Storage and preservation, including legibility
In practiceIt has to still be there, and still readable, years later.
DocumentSynthDocuments are held in encrypted object storage. Every read passes through the application’s authorization — no pre-signed URLs are generated, so there is no link that outlives the permission that created it.
7.5.3.2 c)Control of changes, including version control
In practiceA revision produces a new version. The old one is superseded, not overwritten, and exactly one is in force.
DocumentSynthA revision adds a version and never edits one. One version is effective and the rest are superseded, each carrying the dates it held that state — and the database enforces that only one can be effective at a time. A version becomes effective when its approval completes; scheduling a future date is not supported.
7.5.3.2 d)Retention and dispositionNot built
In practiceHow long each kind of document is kept, and what happens at the end of that period.
DocumentSynthNot implemented. There are no per-document retention periods, no retention schedules, no legal hold and no disposition process. A document can be retired with a recorded reason, and retirement keeps the record rather than removing it — which is withdrawal, not disposition.
Where DocumentSynth does not meet the clause
Two gaps, stated here rather than found later.
A quality manager will find these in an evaluation. Putting them on the page costs a section and saves everyone a wasted call.
- Retention and disposition (7.5.3.2 d). DocumentSynth does not implement per-document retention periods, retention schedules, legal hold or disposition. If your quality system defines retention by document type and expects the system to enforce it, DocumentSynth does not do that today. Retirement with a recorded reason exists, and it preserves the record rather than disposing of it.
- Controlled printed copies (7.5.3.2 a). There is no controlled printing, no copy register and no “uncontrolled when printed” watermark. Organizations that depend on distributed paper at a workstation or a line will need to keep that control where it is.
Everything else in the clause maps to a mechanism that is in the shipped build, and the table above names which.
What this page is not saying
No software can make an organization conform.
Certification is granted to an organization by an accredited body after auditing its whole quality system — its procedures, its records and what its people actually do. A vendor is not part of that assessment, and any supplier suggesting otherwise is selling something they cannot deliver.
DocumentSynth holds no certification and claims none. It implements mechanisms; whether a given record satisfies a given clause for a given organization is that organization’s assessment to make, usually as part of its own validation activity.
Questions
What quality managers ask first.
- What does ISO 9001 require for document control?
- Clause 7.5 covers documented information. In outline: documents must be identified and described, reviewed and approved for suitability before use, available where they are needed, protected against loss of integrity, controlled through changes, and retained and disposed of according to a defined approach. The standard describes outcomes rather than a method, which is why two organizations can satisfy it very differently.
- Does using DocumentSynth make an organization ISO 9001 compliant?
- No, and no software can. Certification is granted to an organization by an accredited body after auditing its whole quality system — its procedures, its records and its practice, not its vendor list. What software can do is make the document-control parts demonstrable rather than assumed. DocumentSynth holds no certification and claims none.
- Which parts of clause 7.5 does DocumentSynth not cover?
- Retention and disposition is the significant one. Clause 7.5.3.2 expects a defined approach to how long documented information is kept and how it is disposed of, and DocumentSynth does not implement per-document retention periods, retention schedules or disposition today. Controlled distribution of printed copies is also not implemented. Both are listed on this page rather than left for an evaluation to discover.
- Do auditors accept electronic signatures for document approval?
- ISO 9001 does not prescribe a signature technology; it expects approval to be evidenced and attributable. What matters at audit is that the approval can be tied to a person, a moment and the exact content approved. DocumentSynth binds each signature to the specific version and its content hash, records the meaning of the signature and how the signer authenticated, and requires re-authentication at the moment of signing.
- How do you show which revision was in force during an audit period?
- By reading it off the version register rather than reconstructing it. Each version carries the date it became effective and the date it was superseded, so the version that applied on a given date is a lookup. The database enforces that only one version of a document can be effective at a time.
Next steps.
Every request is reviewed by a person. Submitting the form does not create an environment or an account.