Blog / Documents

ISO 9001 Mandatory Documents: The Complete List of 21 Records and Documents You Need

October 21, 2026 · 8 min read · By the Total ISO team

ISO 9001:2015 dropped the long list of required procedures, but it did not drop documentation. It asks for “documented information” in specific places. Some of it is a document you write and keep current (like a policy). Some of it is a record you keep as proof (like an audit report). Here is every item the standard requires, clause by clause, so you build what an auditor will ask for and nothing more.

1.Scope of the quality management system (clause 4.3)

A short statement of the products, services, sites and activities the system covers, including any requirement you decided does not apply and why. Auditors read this first because it sets the boundary for everything else.

Tip: Keep it to a page. A scope that lists every site and process by name is easier to defend than a vague paragraph.

2.Quality policy (5.2)

A policy that fits your organisation, gives a framework for objectives, commits to meeting requirements and to continual improvement, and is available to interested parties. It must be communicated and understood inside the company, so staff should be able to say roughly what it means.

3.Quality objectives (6.2)

Measurable objectives at the relevant functions and levels, consistent with the policy, with who is responsible, what will be done, what resources are needed, when it will be finished and how results are evaluated.

4.Documented information the organisation determines is necessary (7.1.1 and 7.5.1)

This is the catch-all. The standard lets you decide how much documentation your system needs, based on size, complexity and competence of your people. Procedures, work instructions, forms and process maps all fall here if you decide you need them.

Tip: Write a procedure only where a mistake would hurt or where people disagree about how the work is done.

5.Basis for calibration where no standard exists (7.1.5.1)

If measuring equipment must be traceable to a national or international standard and none exists, keep the basis you used to calibrate or verify it.

6.Evidence of fitness for purpose of monitoring and measuring resources (7.1.5.1)

Calibration and verification records for the equipment you rely on to show product conforms. This is the item small manufacturers most often fail: the calibration sticker is on the gauge but the record is missing.

7.Evidence of competence (7.2)

Records of education, training, skills and experience for people whose work affects quality. A training matrix with dates and sign-offs usually covers it.

8.Results of reviewing requirements for products and services (8.2.3.2)

Records of contract or order review, and of any new requirements that came out of it.

9.Design and development inputs, controls, outputs and changes (8.3.2 to 8.3.6)

Only applies if you design products or services. Keep the requirements you worked to, the reviews, verifications and validations you did, and any changes made along the way and who approved them.

10.Evaluation, selection and monitoring of external providers (8.4.1)

Records showing how you chose suppliers and how you check they stay good. An approved supplier list, a completed questionnaire and a review date satisfy most auditors.

11.Characteristics of production and service provision (8.5.1)

The definition of what you produce or deliver and the results to be achieved. For many firms this is a specification, drawing, service description or work order template.

12.Traceability records, where traceability is a requirement (8.5.2)

If you need to identify outputs uniquely, for example by lot or serial number, keep the records that let you trace them.

13.Customer or external provider property that is lost, damaged or unsuitable (8.5.3)

If something belonging to a customer or supplier goes wrong while in your care, keep a record of it and that you told them.

14.Results of the review of changes affecting production or service (8.5.6)

Who authorised a change, what the review found and any actions that arose from it.

15.Evidence of conformity with acceptance criteria and release authority (8.6)

Inspection and test records, with the name of the person who authorised release of the product or service.

16.Nonconforming outputs: what happened and what you did (8.7.2)

The description of the nonconformity, the action taken, any concession obtained and who decided. A quarantine log with dispositions and sign-off meets this.

17.Monitoring and measurement results (9.1.1)

The data behind your performance numbers: customer satisfaction, on-time delivery, defect rates, process results. Keep enough to show the trend.

18.Internal audit programme and results (9.2.2)

The schedule showing what you audit and how often, plus the report for each audit with findings and the person who carried it out.

19.Management review results (9.3.3)

Minutes or a report showing the inputs considered and the decisions and actions that came out of the meeting.

20.Nature of nonconformities and any action taken (10.2.2)

The nonconformity, the root-cause investigation, the corrective action and the review of how effective it was.

21.Results of corrective action (10.2.2)

Evidence that the action worked. Closing a corrective action without an effectiveness check is one of the most common audit findings.

Tip: Add a date to check back and sign it off when the check is done.

The short version

That is the whole list. Notice what is not on it: there is no required quality manual, no required procedure for document control or internal audit, and no required format for anything. If you can show each item above and your people can explain how they work, you have the documentation ISO 9001 asks for.

Frequently asked questions

Keep reading

This guide is general information based on ISO 9001:2015 and is not legal or certification advice. Check requirements against the official standard from ISO or your national standards body. ISO is a registered mark of the International Organization for Standardization; Total ISO is not affiliated with or endorsed by ISO.