Document version control under ISO 9001:2015
A guide to document version control under the withdrawn ISO 9001:2015 edition, with a worked control process and a link to the current ISO 9001:2026 guide.
This guide describes ISO 9001:2015, which ISO replaced with ISO 9001:2026 on 16 September 2026; check the current edition before applying it.
The short version
- Clause 7.5 requires documented information to be identified, reviewed and approved before issue, distributed and access-controlled, and retained or disposed of: version control is the identification-and-approval half of that list.
- ISO 9001:2015 removed the mandatory “control of documents” procedure; a written procedure is optional, the control itself is not.
- An auditor samples version control by picking a document at the point of use and checking its revision against the register, not by reading your procedure.
- Version control (= revision control) is not change control (approving a change) or document control (the whole clause 7.5 system) or document management (storage and retrieval).
- Withdrawing the superseded copy is as much a clause 7.5 requirement as issuing the new one: most audit gaps are here, not in the numbering scheme.
- QueryChart's version history helps retain revision evidence, but conformity depends on the complete controls operating in your organization; see /features/version-control.
Clause 7.5 dropped the procedure, not the proof
ISO 9001:2026 is the current published edition. For a current implementation starting point, use /guides/version-control-for-iso-9001 and verify the exact requirements against your licensed standard and certification transition plan. The discussion below is specific to 2015. Version control and revision control name the same mechanism: knowing which iteration is current. Change control approves a proposed change, while document control governs the wider lifecycle. An auditor asking for version control needs to see the effective revision and the decision that released it.
Clause 7.5 of ISO 9001:2015 does not ask for a documented procedure: the six mandatory procedures the 2008 edition required, including one titled “control of documents,” were dropped. What replaced them is a requirement to control “documented information”: identify and describe it (a title, a date, an author, a reference number, the version), review and approve it for suitability before it is issued, and control its distribution, access, retrieval, storage, protection from unintended change, and retention and disposition. Nothing in that list says the control has to be written down as a procedure. Everything in it says the control has to be demonstrable, which is what an auditor samples for: pull a document at the point of use, check its revision against the register, and ask what happened to the one it replaced.
QueryChart's free version history gives you the demonstrable half without extra setup: every save is a dated, attributed revision, the Change Log shows who changed which field and from what value, Compare Versions puts two revisions side by side, and restoring an old one is one click. See /features/version-control. What it will not do on its own is run the wider document control lifecycle (request, draft, review, approve, issue, withdraw, review again) which is the fuller process covered at /guides/how-to-create-a-document-control-process and built out below as the chart at /templates/document-control-process. This guide stays inside the version-control slice of that lifecycle: the identifier and revision, the approval before issue, and the withdrawal of what a new revision replaces.
Where clause 7.5's controls sit in one lifecycle
Twenty rows, five lanes, the same chain an auditor would sample: identify, approve, version, publish, withdraw, control access, then retain or dispose.
Identify, then approve before issue
Rows 1 to 8 are clause 7.5's “identify” and “approve before use”: “Raise a document change request” comes before anyone drafts, “Carry out technical review” and “Comments to resolve?” loop through “Update the draft against comments,” and “Approve for issue?” is the approval clause 7.5 requires before a document reaches anyone else.
The version number, the register, the withdrawal
Row 9, “Assign version and effective date,” is the identifier clause 7.5 names. Row 10 writes it to the master document register as a File row. Row 11 publishes to the controlled location. Row 12, “Withdraw superseded copies from use,” is the disposition control most document control processes leave out entirely.
Distribution and access, named as rows
Rows 13 to 16 are the distribution and access half of clause 7.5: “Training required for this change?” splits into “Complete training on the change” or “Read and acknowledge the new version,” and both converge on “Use the current controlled version,” the row that makes using anything else a nonconformity.
Retention and disposition close the loop
“Trigger the scheduled periodic review” and “Document still valid?” are the review interval clause 7.5 implies. “Valid” records the outcome and next date at row 19; “Revise” loops back to row 2 to open a new version; “Retire” reaches “Document withdrawn and retired”: disposition, the control most registers never actually exercise.
How it works
Give every document a unique identifier and a revision
Fix a numbering scheme (whole numbers for issued revisions, decimals for drafts) and print the identifier, revision, effective date and approver in the header of every page. This is the “identify” half of clause 7.5's documented-information requirement, and it's the first thing an auditor checks against the register.
Record approval before issue, not after
Route every new or revised document through a named reviewer and approver before it reaches its controlled location, and keep a record of who approved which revision and when. Clause 7.5 asks for approval for suitability and adequacy before use: a document already in circulation being approved retroactively is the finding, not the fix.
Publish to one authoritative location and register it
Every copy outside that one location is a control gap waiting to be found. Write the new revision to a master document register at the same step you publish it, so the register and the controlled copy can never drift apart.
Withdraw the superseded revision at the same step
Give withdrawal its own step immediately after publishing, and list every point of use the old revision reached: noticeboards, shared drives, supplier packs. A register that says revision 4 is current while revision 3 is still on the wall is the gap most audits actually find.
Set a review interval and record its outcome
Attach a review date to every controlled document and log the outcome (keep, revise or retire) rather than only refreshing the date. Clause 7.5's disposition requirement expects an ending, so “retire” has to be a reachable outcome on the chart, not an assumption off it.
Let QueryChart's version history stand as your evidence
Every edit to a chart or document built in QueryChart is a dated, attributed revision automatically. Open the Change Log to show a reviewer exactly what changed, use Compare Versions to put two revisions side by side for an auditor, and restore an earlier one if a revision needs reverting. See /features/version-control.
Mistakes to avoid
A procedure that describes a control nobody runs
Writing an elegant document control procedure satisfies nobody if the register disagrees with what's on the wall. Clause 7.5 does not require the procedure; it requires the evidence, so spend the effort on the register and the withdrawal list, not the prose.
Confusing version control with change control
Version control answers “which revision is current”; change control answers “was this change approved before it happened.” A chart can show both, but they are separate questions with separate rows: collapsing them into one approval step is what makes an auditor ask a follow-up you can't answer. See /guides/how-to-create-a-change-control-process for the change-control mechanics on their own.
No answer for the printed copy
A revision printed for a machine station or handed to a supplier is outside your controlled location, and it's the copy an auditor asks to see first. Either stamp and register permitted printouts or forbid them: “we don't have a policy on that” is not a version control system.
Treating restore as undo
Restoring an old chart revision in QueryChart creates a new current revision rather than deleting the ones in between, so the full history stays intact for the register and for an auditor's trail. Restoring is not the same operation as deleting a mistake.
Related QueryChart feature
Build your ISO 9001 document register
Take the document control chart as your starting register, assign your own numbering scheme, and let QueryChart's Change Log stand as the evidence an ISO 9001 audit samples for.
Related guides
Sources
Frequently asked questions
What did ISO 9001:2015 clause 7.5 require for document version control?
It requires documented information to be identified (a title, date, author and reference, the version), reviewed and approved for suitability before it is issued, and controlled for distribution, access, retrieval, storage, protection from unintended change, and retention and disposition. Version control is the identification, approval-before-issue and disposition parts of that list; distribution and access are a related but separate control clause 7.5 states next to it.
Is a written procedure still required for document control under ISO 9001:2015?
No. The 2015 revision dropped the six mandatory documented procedures the 2008 edition required, including the one titled “control of documents.” What clause 7.5 asks for now is the control itself, demonstrated through documented information (a register, a version scheme, an approval record) whether or not a procedure describes how you run it. See /guides/how-to-create-a-document-control-process for the fuller process a procedure would otherwise describe.
How is version control different from revision control, change control and document control?
Version control and revision control are the same idea under two names: knowing which iteration of a document is current. Change control is the decision that approves a change before it's made: the gate, not the record. Document control is the whole system clause 7.5 names, of which version control is one part; document management is the broader discipline of storing, finding and securing documents, version or no version. This page covers the version-control slice; /guides/how-to-create-a-change-control-process covers the change-control mechanics.
Is document version control for ISO 9001 the same as clause 4.4?
No. Clause 4.4 asks you to determine a process's inputs, outputs, sequence, interaction with other processes, criteria, resources, responsibilities and risks: process design, not documents. Clause 7.5 governs the documented information a process produces, including its version. A process map can satisfy part of 4.4 and still fail 7.5 if the map itself has no revision, no approval record and no register entry. See /guides/how-to-create-a-process-for-iso-9001 for the clause 4.4 side.
Does QueryChart's version history establish ISO 9001 conformity?
No. Version history can provide revision evidence, but your organization must verify all applicable documented-information controls, approvals and actual use under its applicable ISO 9001 edition. See /features/version-control for the product feature, and /guides/version-control-for-iso-9001 for the current-edition starting point.