Documented information is the term ISO management system standards use for anything you must maintain or retain in a recorded form. It replaced the older distinction between “documents” and “records”.
The two words in the standard still matter, though:
- Maintain documented information — keep it current. This is what used to be called a document: a procedure, a policy, a work instruction.
- Retain documented information — keep it as evidence of what happened. This is what used to be called a record: a completed inspection form, an audit report, a training log.
Format is deliberately open
Nothing requires paper, or a specific system, or a document control database. Documented information can live in your ERP, a shared drive, a quality management platform, or a well-organised folder structure. What matters is that it is available where it is needed, protected from loss and unauthorised change, and identifiable.
The most common mistake
Producing more than you need. The 2015 revision deliberately removed the mandatory six procedures and the requirement for a quality manual, precisely to stop organisations writing documents for the auditor rather than for the business.
A useful test: if a procedure exists only so that something can be shown during an audit, and nobody consults it during normal work, it is a liability rather than an asset. It still has to be followed, kept current and controlled — and if it is not, that is a nonconformity you created for yourself.