← Insights

Compliance

Document control that passes the audit

July 2026 · 6 min read

There is a question that opens a surprising number of audits, whatever the standard: "show me your document register." It is a deliberate opener. How an organisation controls its documents tells the auditor, in about ninety seconds, how disciplined the whole management system is likely to be. A confident answer sets the tone. A shared drive full of files called Quality-Manual-v7-final-FINAL-v2.docx sets a rather different one.

Document control is ISO clause 7.5 in the 9001 world, and it has close cousins in 27001 and every other management-system standard. Underneath the clause number it asks something simple: is the right version of every document in use, are the obsolete ones withdrawn, and is each document reviewed before it goes stale? A master register is how you answer yes to all three.

What "controlled" actually means

A controlled document is one whose lifecycle is managed on purpose rather than by accident. In practice that means a handful of attributes are tracked for every document that matters - manuals, policies, procedures, work instructions, forms, records, and the external documents you rely on.

• A unique document number so people can reference it without ambiguity.
• The current version and its issue date, so everyone knows which one is live.
• An owner - the person accountable for keeping it accurate.
• Approval - who signed it off, and when.
• The controlled-copy location - where the authoritative version lives, which is precisely what an auditor will ask to see.
• A review cycle - how often it must be revisited.

Track those and a document has a life story an auditor can follow. Skip them and you are trusting memory, which is the one control that never passes.

Two statuses, kept apart

A subtle mistake breaks a lot of home-made registers: collapsing two different ideas into one status column. A document has a control status - is it Controlled, Draft, Superseded or Obsolete? - and, separately, a review status - is its next review Current, Due soon or Overdue? These are different questions. A document can be perfectly Controlled and simultaneously Overdue for review. Holding both states in one field forces you to lose information. Holding them apart makes the state of every document unambiguous, which is exactly the clarity an assessor is testing for.

It also lets you do something useful automatically: obsolete and superseded documents should drop out of the review cycle, because reviewing a withdrawn document is meaningless. When the two statuses are separate, that exclusion is a simple rule rather than a manual clean-up.

Make the review dates compute themselves

The failure mode a register exists to prevent is the quiet one: a procedure that was last reviewed three years ago on a two-year cycle, discovered only when the auditor does the arithmetic you did not. The fix is to let the spreadsheet do the arithmetic continuously. Given an issue date and a review frequency, the next review date and the days remaining are pure calculation - and once they calculate, a traffic-light status can flag green Current, amber Due soon and red Overdue on its own, every time you open the file.

A register whose review dates compute never quietly goes out of date. That single property is the difference between a live control and a decorative one.

The payoff is that "are any documents overdue for review?" stops being a project and becomes a glance. You see the reds before the auditor does, which is the whole point.

The master list versus the shared drive

None of this requires a document management platform. It requires one authoritative list - the single place that says, for every controlled document, which version is live, who owns it, when it was approved and when it is next due. A shared drive holds the files; the register holds the truth about them. Pair the register with a revision-history log, so each document's change trail is one click away, and you have the two artefacts document control actually depends on.

Build it once, keep it current as documents change, and the opening question of your next audit becomes the easiest one of the day.