The first ISO 9001 consultant I ever sat across from arrived with a binder of forty procedures and a quote for the time it would take to install them. We were a manufacturer with a real quality problem and about six documents that anyone used. The standard, it turned out, asked for far less than the binder did, and the difference between the two was where all the money went.
What does ISO 9001 actually require you to document?
ISO 9001:2015 (ISO 9001:2026 is on its way) names only a handful of documents you must create and keep current: the scope of your quality system, your quality policy, your quality objectives, and whatever documented information you decide is necessary for your processes to run. Everything else the standard asks for is a record, which is evidence that something happened, not a procedure telling people how to do it.
That distinction carries the whole subject. The 2015 edition dropped the mandatory quality manual and the six mandatory procedures that the 2008 edition required. In their place it uses one phrase, "documented information," and splits it two ways. Information you maintain is a living document, like a procedure or a policy. Information you retain is a record, like a calibration result or a signed management review.
The maintained list is short. Clause 4.3 wants the scope. Clause 5.2 wants the policy. Clause 6.2 wants the objectives. Clause 4.4 asks you to keep documented information "to the extent necessary" to support your processes, and that phrase is yours to interpret. A company with twelve people and one product line needs a different extent than a plant with three shifts and a customer who audits them twice a year.
If you've never read the standard itself, read it before you read anyone's summary of it, including mine. It's about thirty pages, and the parts that apply to documentation take an afternoon.
Which records does the standard make you keep?
The retained records are the longer list, roughly twenty of them, and most are things a working company already produces. Calibration results, training and competence evidence, contract reviews, supplier evaluations, product release approvals, nonconformance reports, internal audit results, management review minutes, and corrective actions all count. If your operation runs at all, you have most of these somewhere already.
When I was chief financial officer of a manufacturing company, the records question was the one that surprised me most. I'd assumed the registrar wanted new documents. What the auditor asked to see was the evidence we'd been generating for years and filing badly. Who approved this shipment, and when. What the calibration on that micrometer read last spring. Whether the person running the brake press had been trained on it, and who said so.
A few records catch people out. Clause 7.1.5 wants the basis for calibration when no standard exists, which matters for the odd instrument you built in-house. Clause 8.2.3 wants a record that you reviewed customer requirements before you committed to them, including the ones that arrived by phone. Clause 8.5.6 wants a record of production changes and who authorized them. Clause 9.3 wants management review outputs, meaning decisions and actions, not a note that a meeting occurred.
None of these need a form designed for the auditor. An email that shows the approval and the date is a record. A spreadsheet is a record. What the auditor wants is that the record exists, that you can find it, and that it says what you claim it says.
Why do most companies end up with far more than they need?
Companies over-document because the extra paper is sold to them, because it feels safer, and because nobody in the building is willing to say a procedure isn't needed. The standard has never required a procedure for every process. It requires that your processes produce consistent results, and documentation is one of several ways to get there.
The binder I mentioned earlier came from a genuine belief that more procedures meant more control. In practice it meant forty documents with owners who never read them, three of which contradicted each other on how a nonconforming part was to be tagged. The auditor found the contradiction in twenty minutes. A system with six honest procedures would have passed where the forty failed, because the forty described a company that didn't exist.
Now for the failure mode I watched most often: A company writes a procedure to satisfy an audit finding rather than to fix the work. The procedure says what the auditor wanted to hear. The floor keeps doing what it always did. At the next audit the gap between the document and the practice is now itself a nonconformance, and the fix is another document. The pile grows and the process never changes.
The honest objection at this point is that the auditor will expect procedures anyway, and it's cheaper to have them than to argue. There's something to that. A registrar's auditor is a person with a checklist and a flight to catch, and thin documentation makes their job harder. The answer isn't to write forty procedures. It's to write the few you need well enough that each one shows the auditor a process that's real, controlled, and producing records. Auditors relax around evidence. They tighten up around paper that nobody can explain.
What will your registrar actually ask to see?
Expect the auditor to ask for the scope, the policy, the objectives with evidence you're tracking them, and then to follow a product through your operation from order to shipment asking for records at each step. They'll want your internal audit results, your management review, and your corrective actions, and they'll read those closely because that's where a system shows whether it's alive.
The process-based audit is the one most first-time companies don't prepare for. The auditor doesn't work down the standard clause by clause. They pick a job and trace it. Order received, requirements reviewed, materials bought from an approved supplier, product made by a competent person on a calibrated machine, inspected, released, shipped, and if anything went wrong, recorded and corrected. At each step they ask what you did and what proves it.
That trace is where the "extent necessary" question gets answered for you. Wherever the auditor finds a step that only one person knows how to do, and that person can't point to anything written down, you'll hear a question about how the company would carry on if that person left. That's the moment a procedure earns its existence. Not before.
Management review is the other place they linger. A review that produces minutes reading "quality discussed, no issues" tells the auditor the system isn't being used to run the company. One that produces three decisions with owners and dates tells them the opposite, even if the decisions are modest.
How do you decide what's necessary for your own processes?
Write a procedure where the cost of doing the step wrong is high, where the step is done by more than one person or shift, where a new hire has to learn it, or where a customer or regulator expects to see it. Leave alone the steps that one experienced person does reliably and that the records already prove. That test fits on an index card and it's the one the standard is pointing at.
I used that test to take a manufacturing quality system from forty procedures to nineteen without losing a single audit point. The nineteen that survived each did a job. The twenty-one that went had been written for a reader who never existed. If you already have the binder and you're wondering where to start, the audit-readiness question is a good first sort, and documenting the process before you write it keeps the survivors honest.
For the people who've already got it wrong, the advice is simpler than it sounds. Don't start a rewrite project. Pull the procedures nobody has opened in a year and ask their owners whether the work would change if the document vanished. Where the answer is no, retire it and note why. Where the answer is yes, that's a document worth keeping and probably worth rewriting for the person who uses it.
When is it worth hiring a writer for ISO documentation?
A writer earns their fee when the people who know the process can't produce a clear document, when the quality manager is one person who also runs production, or when a certification deadline has arrived and the documents that exist describe the wrong company. What a writer cannot do is decide what your processes should be. That part stays with you.
The work I do on technical documentation starts with the extent question, not with writing. We find the handful of procedures that carry real risk, interview the people who do the work, and write those to the reading level of the person standing at the machine. The records that already exist get organized rather than replaced. Nothing gets written for the auditor alone.
Market rates for this kind of work vary widely, from a few thousand dollars for a small set of core procedures to considerably more for a full system, and any honest writer will quote after seeing what you have. The FAQ covers how I scope a documentation project, and if you'd like to talk through what your registrar is likely to ask for, book a discovery call. Bring the binder. We'll find the six that matter.
Frequently asked questions
What documents does ISO 9001:2015 require you to maintain?
The standard explicitly requires the scope of the quality management system, the quality policy, the quality objectives, and whatever documented information you determine is necessary to support your processes. The 2015 edition removed the mandatory quality manual and the six mandatory procedures of the 2008 edition.
How many records does ISO 9001 require?
Roughly twenty retained records, including calibration results, competence and training evidence, review of customer requirements, supplier evaluations, production changes, product release, nonconforming outputs, internal audit results, management review outputs, and corrective actions. Most working companies already generate these and mainly need to organize them.
Do you need a written procedure for every process under ISO 9001?
No. The standard requires that your processes produce consistent results and that you keep documented information to the extent necessary. A procedure is worth writing where the cost of error is high, more than one person does the step, a new hire has to learn it, or a customer or regulator expects to see it.
What will an ISO 9001 auditor ask to see?
The scope, policy, and objectives, then records traced through a real job from order to shipment: contract review, approved supplier, competent operator, calibrated equipment, inspection, release, and any nonconformance and corrective action. Internal audit results and management review outputs get particular attention.
