Key takeaways
- 1competence (7.2 d));
- 2fitness for purpose of monitoring and measuring resources (7.1.5.1);
- 3the release of products and services, with traceability to whoever authorized it (8.6);
- 4nonconforming outputs and the decisions taken on them (8.7.2);
ISO 9001:2015 uses two verbs for documented information, and they ask for different things. Maintained information describes the system, such as the scope, the quality policy and the quality objectives. Retained information is evidence, such as evidence of competence or the results of management reviews. The verb in a clause tells you which kind it asks for.
Where the two words come from
The informative Annex A explains them at A.6. "Maintain" took the place of the 2008 edition's documents, documented procedures, quality manual and quality plan. "Retain" took the place of its records, the documents that provide evidence of conformity. Clause 7.5 then sets the controls for both.
Maintained: it changes when the system changes
Few clauses ask for it: the scope (4.3), the quality policy (5.2.2 a)), the quality objectives (6.2.1) and, to the extent necessary, process information under 4.4.2 a) and 8.1 e).
Each describes the system as it stands. When the scope or an objective changes, the documented information is updated under 7.5.2, and the change is controlled under 7.5.3.2 c), which gives version control as an example.
The question to ask of a maintained document: is it the current version?
Retained: evidence of an event or a result
Many more clauses ask for it, and each names what the evidence is of. Examples from the list:
- competence (7.2 d));
- fitness for purpose of monitoring and measuring resources (7.1.5.1);
- the release of products and services, with traceability to whoever authorized it (8.6);
- nonconforming outputs and the decisions taken on them (8.7.2);
- the implementation of the audit programme and the audit results (9.2.2 f));
- the results of management reviews (9.3.3);
- nonconformities and the results of corrective action (10.2.2).
Clause 7.5.3.2 requires documented information retained as evidence of conformity to be protected from unintended alterations.
The questions to ask of a retained record: does it exist for the event the clause names, and is it intact?
When one document is both
A.6 says a requirement to maintain documented information does not rule out also retaining it, for example to keep previous versions. A superseded scope statement kept to show what applied on an earlier date is one example. Clause 8.1 e) uses both verbs in the same sentence.
How long to keep it
ISO 9001 does not set a period. A.6 makes it the organization's decision: what is retained, for how long and on what media. Clause 7.5.3.2 d) lists retention and disposition among the control activities to be addressed, as applicable.
The name on the folder
A.1 says the organization does not have to adopt the standard's terms. It can keep calling them "records", "documentation" or "protocols". What matters is the content, read against the clause.
This is generic information about the requirement, not advice on any particular management system.
CAS — An EGAC accredited MS certification body No. 012418. Accredited scope: ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 50001 and ISO 22301. Certificates accredited for ISO 9001, 14001, 45001, 22000 and 50001 fall within EGAC's IAF MLA scope; ISO 22301 is accredited by EGAC and sits outside that scope.
Verify any certificate: cas.com.eg/certsearch
Read next