ISO 9001 SOP Requirements: Documented Information, Procedures & Records

ISO 9001 is the world's most widely used quality management standard, and teams often assume it demands a mountain of policies and procedures. The 2015 revision went the opposite direction: it removed the requirement for a formal quality manual and a mandated set of six documented procedures, replacing them with a flexible concept called "documented information." That flexibility is good news — but it also confuses teams about what they actually have to write down.

Here's the practical answer. ISO 9001 requires some documented information explicitly, requires you to keep certain records, and expects you to decide what additional procedures and SOPs your operations genuinely need. This guide walks through exactly which documents are mandatory, which procedures most teams still write, and how to keep the whole system from going stale.

The Shift: From Six Procedures to "Documented Information"

Earlier versions of ISO 9001 listed six procedures you had to document: control of documents, control of records, internal audit, control of nonconforming product, corrective action, and preventive action. The 2015 revision scrapped that prescriptive list. Instead, clause 7.5 says the organization shall maintain the documented information required by the standard and the documented information it determines is necessary for the effectiveness of its quality management system (QMS).

In plain terms: the standard tells you what must exist, and it trusts you to decide how much procedure you need to run your processes consistently. Many teams still find it useful to document roughly the same six areas, but now you can size the documentation to your operation rather than writing boilerplate to check a box.

Documented Information ISO 9001 Explicitly Requires

Even under the flexible model, the standard names specific documented information you must maintain or retain. You're not free to skip these:

• Scope of the QMS (clause 4.3) — which products, services, and sites the system covers.
• Quality policy and quality objectives (clauses 5.2, 6.2) — your commitments and measurable targets.
• Evidence of competence (clause 7.2) — records showing personnel are competent for their roles.
• Operational planning and control information (clause 8.1) — whatever is needed to run and control your processes.
• Records of design and development (clause 8.3) — where you design products, the review and change records.
• Records of process control and conformity (clause 8.5) — evidence products and services meet requirements.
• Monitoring, measurement, and internal audit records (clause 9) — results of audits and performance evaluation.
• Records of nonconformity and corrective action (clause 10.2) — what went wrong and what you did about it.

Notice the pattern: the mandatory items are mostly records — evidence that you ran the system. The procedures, on the other hand, are largely up to you, which is exactly why smart teams document the actual workflows they run.

The Procedures Most Teams Still Document

Even without the old mandated list, a workable QMS needs operating procedures for the core things the standard keeps pointing at. In practice these are your SOPs — step-by-step instructions for the processes that keep quality intact:

• Document control — how documents are created, reviewed, approved, distributed, and updated.
• Control of records — how records are identified, stored, protected, retained, and disposed of.
• Internal audit — how audits are planned, conducted, and reported.
• Control of nonconforming output — what happens when a product or service fails requirements.
• Corrective action — how you investigate, fix, and prevent recurrence.

These five are rarely optional in practice — auditors consistently probe them — and they map cleanly to documented procedures most teams can produce quickly.

How to Document Your ISO 9001 Procedures Without Writing Them by Hand

The painful part of an ISO 9001 implementation is not the policy documents — it's the operational procedures, which describe how people actually do the work: how an order gets processed, how a defect gets logged, how a document gets through review. These are the SOPs that go stale the fastest because they describe live processes that change.

Recording the workflow while you do it is far more reliable than reconstructing it from memory. For any browser-based process — quality checks in a portal, order entry, complaint handling, audit evidence — a click-by-click recording captures the exact steps, the exact screens, and the exact navigation. It produces a step-accurate procedure in the time it takes to actually run the task, instead of an hour of writing and screenshotting.

Keep Records and Procedures Local and Current

ISO 9001 records can be sensitive — inspection results, nonconformity reports, audit findings, corrective actions. When you document these processes, where the records live matters. A privacy-first, local-first tool keeps your quality procedures and their evidence on your own devices rather than uploading sensitive QMS material to a third-party server. For a quality team handling inspection and customer data under a certification scope, that control is a real advantage.

Currency is the other half. A QMS full of stale SOPs is an audit finding waiting to happen. Assign an owner to each procedure, review on a regular cadence, and fold process capture into the work so procedures reflect what you actually do — not what you wrote a year ago.

FAQ: ISO 9001 SOP Requirements