Which documents must I keep for ISO 9001?

In addition to the legislative requirement for your business to keep certain records ISO 9001 2000 requires your business to retain other records to demonstrate compliance with its various clauses.

From an ISO 9001 2000 viewpoint records are documents generated whilst operating your Quality Management System. Typical examples are records of management reviews, purchase orders, sales orders, test results and internal quality system audits.

An ISO 9001 2000 consultant can be very helpful to your business in deciding which records are required and those that are not.

The standard is not specific about how long your business must retain each record but in order not to fall foul of your own Quality Management System, or the law, you might like to consider the following.

If your business offers a period of (x) years guarantee with its product you must keep associated records for at least (x) years.

If your business sells products that have legislative requirements for product testing you must keep associated records for the life of the product and sometimes longer.

Any legislative requirement for you to keep records associated with your product or service.

Records can be in many formats including computer generated records such as those maintained by the Easy ISO 9001 2000 software package.

It would be wise to remember when keeping computer based records for long periods (say 10 - 30 years) the medium upon which the data is stored will deteriorate and therefore you must periodically validate its integrity. Another factor to consider with long term data storage is will a device still be available in 30 years time to read the media upon which the data is stored? I still have computer programs on punch tape but I no longer have a punch tape reader! If you do not know what I am talking about here take it as validation of this advice. (Punch tape was a medium for storing computer programs and data in the 1960's and 1970's)

The following table identifies the specific records required by ISO 9001 2000. The list does not include records that your business might choose to retain voluntarily or those required by legislative requirements for your product or service.

Clause Document to retain, (Record)

5.6.1 Minutes from your Quality Management Review meetings, including any actions raised.

6.2.2 Education, training, skills and experience.(Sub clause-e)

7.1 Evidence that the realization processes and resulting product fulfill requirements. (Sub clause-d)

7.2.2 Results of the review of the requirements relating to the product and actions arising from the review.

7.3.2 Design and development inputs.

7.3.4 Results of design and development reviews and any necessary action.

7.3.5 Results of design and development verification and any necessary action.

7.3.6 Results of design and development validation and any necessary action.

7.3.7 Results of the review of design and development changes and any necessary action.

7.4.1 Results of supplier evaluations and actions arising from evaluations.

7.5.2 As required by the organization to demonstrate the validation of processes where the resulting output cannot be verified by subsequent monitoring and measurement. (Sub clause-d)

7.5.3 The unique identification of the product, where traceability is a requirement.

7.5.4 Customer property that is lost, damaged or otherwise found to be unsuitable for use.

7.6 Standards used for calibration or verification of measuring equipment where no international or national measurement standards exist. (Sub clause-a)

7.6 Validity of previous results when measuring equipment is found not to conform with its requirements.

7.6 Results of calibration or verification of measuring equipment.

8.2.2 Internal audit results.

8.2.4 Evidence of product conformity with the acceptance criteria and indication of the authority responsible for the release of the product.

8.3 Nature of the product non-conformities and any subsequent actions taken, including concessions obtained.

8.5.2 Results of corrective actions.

8.5.3 Results of preventive actions.