In short: ISO 9001:2015 replaced "documents and records" with one concept, documented information. Clause 7.5 says how that information must be created, updated and controlled; clause 8.5.1 says which information must be available where production and service take place. For work instructions this means: the current version must be available at the workstation, old versions must be withdrawn, changes must be traceable, and the use of the instruction must be evidenced. Paper can meet this with discipline; digital SOPs build much of it into the system.
From "documents and records" to "documented information"
Earlier versions of ISO 9001 distinguished between documents (procedures, instructions, forms) and records (the filled-in forms). The 2015 revision merged both into documented information: information that the organisation must control and maintain, and the medium on which it is held. The standard deliberately stopped prescribing a quality manual and six mandatory procedures. Instead, the organisation decides which information it needs to run its processes, and the auditor checks whether that decision holds up in practice.
For work instructions this is good news and a responsibility at once. Good news, because a binder is no longer required and an app is explicitly acceptable. A responsibility, because "we did not think an instruction was necessary" has to be defensible when errors occur.
Clause 7.5: creating, updating and controlling documented information
Clause 7.5 has three parts. The table translates each requirement into what it means for work instructions and SOPs.
| Requirement (7.5) | What it means for work instructions | Typical audit finding |
|---|---|---|
| 7.5.1 The QMS includes the documented information required by the standard and determined by the organisation as necessary | You decide which tasks need an instruction, and you can explain why others do not | Critical task without any instruction; operators work from memory |
| 7.5.2 Creating and updating: identification, format, review and approval | Every instruction has a title, number or ID, version, owner and an approval before release | Instructions without version or approver; drafts in circulation |
| 7.5.3 Control: available and suitable where needed, protected, distributed, stored, changes controlled, retained, and information of external origin identified | The current version is available at the workstation, old versions are withdrawn, changes are traceable, records are retained | Outdated copy on the shop floor; two versions in use; no change history |
Most non-conformities against 7.5 are not about missing documents. They are about control: an obsolete copy in a drawer, a change made in one binder but not in the other, a procedure whose approval date lies two years before the machine it describes was installed.
Clause 8.5.1: control of production and service provision
Clause 8.5.1 lists the controlled conditions under which production must take place. The first item is the availability of documented information that defines the characteristics of the products to be produced, the activities to be performed and the results to be achieved. Other items include suitable monitoring and measuring resources, competent people, validation of processes whose output cannot be verified afterwards, and actions to prevent human error.
Read together, 8.5.1 says what an instruction must contain and where it must be: the operator must be able to see, at the workstation, what to make, how to do it and what a good result looks like. That is a definition of a work instruction with target values and checks, available at the point of work. It also explains why "actions to prevent human error" appears in the same clause: a mandatory confirmation before a critical step is such an action.
What auditors actually check
An auditor walking through production will typically pick one workstation and follow the chain:
- Which instruction applies here? Can the operator show it within a minute, and is it the current version?
- Who approved it, and when? Is the version on the floor the one that was approved?
- Is the operator competent? Is there evidence of training for this instruction, for example in a skills matrix?
- Was it followed? Are the required checks recorded, with values, by whom and when?
- What happened after the last change? Was the instruction updated, were operators informed, was the old version withdrawn?
Paper systems fail most often at steps 1, 4 and 5. Digital systems fail when nobody owns the content, which is a management problem rather than a system problem.
How digital SOPs cover the requirements
| Requirement | Paper practice | Digital SOP practice |
|---|---|---|
| Identification and version (7.5.2) | Header fields filled in by hand | Automatic ID, version and publish date per instruction |
| Review and approval (7.5.2) | Signature on the cover sheet | Changes stay a draft until a user with the Manage role publishes them as a new, numbered version |
| Availability where needed (7.5.3, 8.5.1) | Binder at the line; walk to the office | Opened at the machine via QR code or NFC tag |
| Withdrawal of obsolete versions (7.5.3) | Collect and destroy copies | The new version replaces the old one at the workstation on publish; a version that may no longer be used can be retracted (version control) |
| Change control (7.5.3) | Revision table maintained by hand | Every published version is kept with its number, so you can always show which version applied when |
| Evidence of use and results (8.5.1, 9.1) | Signed checklists, filed later | Every run records the user, start and end time, the version and every value, photo and signature (audit trail) |
| Prevention of human error (8.5.1) | Warning text in the instruction | Required confirmation, value or photo: the operator cannot go to the next page until it is filled in |
| Retention (7.5.3) | Archive boxes | Records stored centrally; completed runs can be filtered per work instruction, user and period |
Five steps to close the most common gaps
- List the tasks that need an instruction. Use the criteria of 8.5.1: where would the absence of an instruction lead to a wrong product or an unsafe situation?
- Give every instruction an owner and an approval step. Nothing reaches the shop floor without a named approver and a version number.
- Publish at the point of work and withdraw paper. If an operator can find an old copy, an auditor will too.
- Turn checks into records. Every acceptance criterion in the instruction becomes a value, confirmation or photo that the operator enters while working.
- Link competence to instructions. A skills matrix that shows who is trained for which instruction answers the competence question before it is asked.
In practice with digital work instructions
In the Work Instruction App you build a work instruction in the browser from steps with text, photos, video, checkboxes and measurement fields. Changes are saved automatically as a draft; only when you publish is a new version created (v1, v2, ...) and does the shop floor see it. Older versions stay traceable, and a version that may no longer be used can be retracted. Operators open the instruction by scanning a QR code or NFC tag at the machine, so they always have the current version in front of them. If the review and approval of a new version should happen in the system, turn on Review required: Publish then becomes Submit for review, and a Manage user who did not author the version checks the changed steps and approves it with their own password before it is published. The History tab shows who changed, submitted, approved and published each version.
Every run records the user, start and end time, the version used and every answer, photo and signature. Fields you mark as required must be filled in before the operator can continue. With courses and the skills matrix you link the training of employees to the work instructions. That puts the evidence for most of the audit questions above within easy reach.
Beyond ISO 9001
The same logic applies to GMP (where the requirements for approval, version control and records are stricter and explicit), ISO 13485 for medical devices, HACCP and food safety schemes, and IATF 16949 in automotive. The differences are in the details of approval and retention, not in the principle: the information must be current, available, controlled and evidenced. See the pages on ISO 9001 and GMP for how the Work Instruction App supports each, and the SOP template for the structure auditors expect to find.
This article summarises the requirements of ISO 9001:2015 as we apply them with customers; it is not a substitute for the standard itself or for advice from your certification body.
