ISO 9001 mandatory documents and records: the complete list
By Evin Lim, Founder and Managing Director, AA Alive Sdn Bhd · Published
Key points
- ISO 9001:2015 does not require a quality manual or a fixed set of procedures. It requires "documented information" in specific clauses.
- Three items must be maintained as documents: the QMS scope (4.3), the quality policy (5.2) and the quality objectives (6.2).
- About twenty types of records must be retained, including competence, calibration, supplier evaluation, internal audit, management review and corrective action records.
- ISO 9001:2026 keeps the same approach to documented information, so a well-built 2015 document set carries forward.
Documented information: what the standard actually asks for
ISO 9001:2015 replaced the old terms "documents" and "records" with one term: documented information. The standard uses two phrases to tell you which is which:
- "Maintain documented information" means a document you keep up to date, such as a policy or a procedure.
- "Retain documented information" means a record: evidence that something happened, such as an audit report or a training record.
Clause 7.5.1(b) also asks for any other documented information your organisation decides it needs for the QMS to work. That is where most procedures and work instructions come from. The size of your company, the complexity of your processes and the competence of your people all affect how much you need.
Documents you must maintain
| Clause | Document | What it covers |
|---|---|---|
| 4.3 | Scope of the QMS | Products and services covered, sites, and justification for any requirement you say does not apply |
| 4.4 | Information to support process operation | Whatever you need so processes run as planned (to the extent necessary) |
| 5.2 | Quality policy | Top management commitment, available to staff and relevant interested parties |
| 6.2 | Quality objectives | Measurable objectives for relevant functions and levels |
| 8.1 | Operational planning information | Enough to be confident processes were carried out as planned |
Records you must retain
| Clause | Record |
|---|---|
| 4.4 | Evidence that processes are carried out as planned |
| 7.1.5.1 | Evidence that monitoring and measuring resources are fit for purpose |
| 7.1.5.2 | Basis used for calibration or verification when no national or international standard exists |
| 7.2 | Evidence of competence (qualifications, training, experience) |
| 8.1 | Evidence that products and services conform to requirements |
| 8.2.3.2 | Results of the review of customer requirements, and any new requirements |
| 8.3.2 – 8.3.6 | Design and development records: planning, inputs, controls, outputs and changes (only if design applies) |
| 8.4.1 | Evaluation, selection, monitoring and re-evaluation of external providers |
| 8.5.2 | Unique identification of outputs, when traceability is a requirement |
| 8.5.3 | Customer or external provider property that is lost, damaged or unsuitable |
| 8.5.6 | Review of changes to production or service provision, who authorised them and any actions |
| 8.6 | Release of products and services, including acceptance criteria and who authorised release |
| 8.7.2 | Nonconforming outputs: description, actions taken, concessions and who decided |
| 9.1.1 | Results of monitoring, measurement, analysis and evaluation |
| 9.2.2 | Internal audit programme and audit results |
| 9.3.3 | Management review results |
| 10.2.2 | Nature of nonconformities, actions taken and results of corrective action |
Documents most companies add, even though they are optional
Certification auditors cannot raise a nonconformity just because an optional document is missing. They check whether your processes are controlled and effective. In practice, most Malaysian SMEs find these documents make that easier to show:
- Quality manual: a short overview of the QMS, its processes and how they interact. Useful for new staff and customers, even though it is no longer mandatory.
- Context and interested parties register: supports clauses 4.1 and 4.2, and is where climate change is considered under the 2024 amendment.
- Risk and opportunity register: supports clause 6.1.
- Procedures for document control, internal audit, nonconformity and corrective action, purchasing, and control of nonconforming output.
- Work instructions and forms where a mistake would affect product or service quality.
- Organisation chart and job descriptions to show roles, responsibilities and authorities (clause 5.3).
How to keep the document set lean
- Start from your real processes, not from a template. Document only what people need in order to do the work consistently.
- Use the records you already keep. Delivery orders, job sheets, inspection checklists and WhatsApp approvals can all be evidence if they are controlled.
- Give each document an owner, a version and an approval, and keep the current version where people work.
- Set retention periods for records that match customer, legal and warranty needs.
- Review the set at each management review and remove anything nobody uses.
What changes with ISO 9001:2026
ISO 9001:2026 keeps the same approach to documented information and the same 10-clause structure. The main updates to plan for are in context (including climate change), risks and opportunities, and quality culture. See our ISO 9001:2026 transition guide for details. For the clause-by-clause requirements, see ISO 9001 requirements.
Frequently asked questions
Is a quality manual mandatory in ISO 9001:2015?
No. ISO 9001:2015 removed the requirement for a quality manual. Many companies keep a short one because it helps explain the QMS to staff, customers and auditors.
How many mandatory procedures does ISO 9001:2015 require?
None by name. The 2008 version required six documented procedures. ISO 9001:2015 instead requires documented information in specific clauses and lets you decide which procedures you need.
Can ISO 9001 documents be electronic?
Yes. Documented information can be in any format or media, including cloud folders and software, as long as it is controlled, protected and available where it is needed.
How long should ISO 9001 records be kept?
ISO 9001 does not set a retention period. You decide it, based on customer contracts, legal requirements, product life and warranty periods, and record it in your document control process.
Need help with your ISO 9001 system?
We prepare Malaysian companies for ISO 9001 certification by an accredited certification body. The first consultation is free.