Document and records control: the boring clause that fails audits

Documents say what you intend to do; records prove what you did. Documents are living and get revised. Records are historical and must not be altered. Management systems require both, control them differently, and a surprising proportion of routine findings come from treating them the same way.

The distinction in practice

ISO standards fold both into the single term documented information, with different requirements attached to each - which is why the clause reads as bureaucratic until you separate the two ideas.

Controlling documents

• A single authoritative location. The most common finding of all: three versions of the same policy in a wiki, a shared drive and someone's email. If people cannot tell which is current, the document is not controlled.
• Version number, approval date, approver and owner on the document itself - not only in the repository metadata, because documents get downloaded and circulated.
• A review cycle - annually is the norm, and the review must be evidenced even when nothing changes. "Reviewed, no changes required" with a date and a name is a valid record; silence is a finding.
• Change history showing what changed and why.
• Communication. An approved policy nobody was told about does not affect behaviour, and auditors test awareness, not publication.
• Withdrawal of superseded versions, or clear marking if they must be retained.

Controlling records

• Integrity. A record stored where its author can silently edit it is weak evidence. System-generated records in ticketing or identity platforms are stronger than files in a folder for exactly this reason.
• Retention periods, defined and applied. Long enough for audit cycles and legal obligations; short enough to satisfy data protection requirements. Both directions are failure modes - insufficient retention loses evidence, indefinite retention of personal data is its own violation.
• Retrievability. Evidence you cannot find within a reasonable time is functionally absent during fieldwork.
• Legibility and context. A spreadsheet named "review final v3" tells the auditor nothing about what was reviewed, by whom, or when.
• Protection from loss - backed up like any other asset.

Never correct a record. If it was wrong, add a dated correction that references the original. Editing history to look better converts a control exception into an integrity finding, which is a categorically worse conversation.

The failures auditors find most

1. Policies overdue for review - by far the most common, and the easiest to prevent with a calendar entry.
2. Multiple versions in circulation with no clear authority.
3. No approval evidence. The document says "approved by the board"; there are no minutes recording it.
4. Records that cannot be produced - the activity happened, the evidence was never kept.
5. Undated evidence. A screenshot with no timestamp cannot be tied to the audit period.
6. Retention undefined, so records are deleted or hoarded arbitrarily.

Keeping it proportionate

None of this requires a document management system. A repository with version history, a naming convention, an owner per document, and review dates in the compliance calendar covers the requirement for most organisations. What it does require is that one person is accountable for the set - otherwise documents drift out of date individually and nobody notices until fieldwork.

Key takeaways

• Documents are revised and need version control; records are fixed and need integrity and retention.
• One authoritative location, with version, owner, approver and date on the document itself.
• Evidence a review happened even when nothing changed.
• Correct records by appending, never by editing - the alternative is an integrity finding.