Controlled documents and ISO 9001 documented information

A certification body, a donor or an auditor asks for the procedure on credit approval and which version is in force. The company holds three files with the same title in three folders. Each is plausible, none states an owner, and the question of which is current cannot be answered from the documents.

This note sets out what ISO 9001 asks of documented information, which edition now applies, what a controlled policy or procedure carries, how policy, procedure, work instruction and record fit together, and how a review calendar for a 40-document set is computed. Clause text is paraphrased only as far as ISO's own guidance states it.

What does ISO 9001 require of documented information?

ISO 9001 requires the quality management system to include the documented information the standard requires and the documented information the organisation decides is necessary for the system to be effective. The extent can differ between organisations, depending on size, process complexity and the competence of staff, and the information may be in any medium ⁵.

All of it is controlled under clause 7.5 ⁵. ISO's overview lists creating or updating documented information as a practical first step ⁶. The guidance also states that the 2015 edition does not specifically require a quality manual or procedures, and that process maps are not required ⁵. ISO's handbook for small enterprises adds that a system should not result in excessive bureaucracy or paperwork ⁷.

Which edition of ISO 9001 applies in October 2026?

ISO 9001:2026, the sixth edition, was published on 16 September 2026 and replaces ISO 9001:2015 and its Amendment 1:2024, both now withdrawn ²³. ISO's frequently asked questions give organisations certified to the 2015 edition three years to move ⁴. The standard's page ties the move to the timeframe of each certification cycle ². The certification body confirms the date.

ISO lists five main changes: leadership and quality culture, a quality policy linked to strategic direction, a clearer split between risks and opportunities, new awareness requirements for people and a new Annex A ⁴. Documented information is not among the five, and the page says only that documented information and governance may need updating during transition ⁴. The Client reads clause 7.5 in the edition named on the certificate sought.

What does a controlled policy or SOP carry?

A controlled document carries seven fields: title, reference, owner, version, approval, review date and distribution. The first six identify the document and show who answers for it. The seventh records who holds a copy. The list is a preparation standard for company documents, not a quotation of clause text.

• Title and reference: a unique code, so two files cannot share a name.
• Owner: a named post in the company, not a department.
• Version: a number and a date, with the previous version withdrawn.
• Approval: a named approver and the date of approval.
• Review date: the date by which the document is next read.
• Distribution: the posts or locations that hold a copy.

NEMBO's documents desk puts reference, version, owner, review date and approval block on every page of a controlled document ¹.

How do policy, procedure, work instruction and record fit together?

The hierarchy runs from intent to evidence. A policy states what the company commits to, a procedure states who does what and in what order, a work instruction states how one task is done, and a record shows that it was done. ISO's guidance names procedures and work instructions as examples that can add value, and states that where they exist they fall under clause 7.5 ⁵.

Who certifies a company in Tanzania?

ISO does not certify organisations. Certification is performed by independent certification bodies ⁶. The Tanzania Bureau of Standards states that it certifies management systems for public and private companies, manufacturers and service providers, and lists ISO 9001 among four standards ⁸. Documents completed by NEMBO support a Client's system. They do not certify it.

How is a review calendar computed for a 40-document set?

Each document has a last review date and an interval. The next review date is the last review date plus the interval, and a document is overdue when that date falls before the date of the check. The calendar below applies that rule at 17 October 2026.

What the NEMBO desk prepares

NEMBO's library holds 27 volumes and 1,033 controlled documents, completed on the Client's facts on a Tanzania Mainland basis, with 10 master registers ¹. A single policy, procedure or register is delivered in hours per document, a full operating set is scoped on the number of documents, and each order is quoted in writing with its date ¹.

• The document completed on the Client's facts, with fields left open only where a figure must come from the Client.
• Document control on every page: reference, version, owner, review date and approval block.
• A matched set, so a policy arrives with the procedure and register it needs.
• Editable and print files, with Acts cited by short title where the position is settled.

The documents are general operating documents and not legal, tax or financial advice. Zatra Consultants authors and checks the content, NEMBO designs and delivers, and no certification or audit outcome is promised.