Updated October 9th 2026
Document control is the process of creating, reviewing, approving, publishing, revising and archiving documents in a controlled way. It ensures that everyone works from the latest approved version and that every change can be traced. The digital tool used for this is often called a document management system.
Here we explain what document control is, how it differs from simply storing documents, what a document's lifecycle looks like and what standards such as ISO 9001 actually require.
Document control vs. a document management system
A document management system is the tool. Document control is the discipline the tool supports. A shared folder or a cloud storage service solves the problem of keeping files in one place, but it does not necessarily answer the questions that matter in a regulated organization:
- Which version is the valid one?
- Who reviewed and approved it?
- When is it due for its next review?
- Who has read the new version?
- What changed compared to the previous version, and why?
A document management system built for controlled documents answers those questions automatically.
The lifecycle of a controlled document
Controlled documents, such as procedures, work instructions, policies and forms, go through the same phases:
- Draft. An author creates or updates the document. The draft is not visible as the valid version.
- Review. One or more reviewers check the content.
- Approval. An authorized person approves the document. The approval is logged with name and date.
- Publication. The document becomes valid and available to those who need it. The previous version is replaced.
- Acknowledgement. Affected employees may need to confirm that they have read the document.
- Revision. The document is reviewed on a planned date or when the organization changes.
- Archiving. Obsolete versions are withdrawn from use but kept for traceability.
When document control is handled manually, steps 5 and 6 are usually where things break down. Documents go without review, and no one knows who has actually seen the changes.
What does ISO 9001 require?
ISO 9001 uses the term documented information (clause 7.5). Among other things, the standard requires that documented information is:
- identified and described, for example with a title, date, author or reference number
- reviewed and approved for suitability and adequacy
- available where and when it is needed
- protected, for example from loss of confidentiality, improper use or loss of integrity
- subject to version control and stored in a controlled way
Similar document control requirements exist in ISO 14001 (environment), ISO 45001 (occupational health and safety), ISO 27001 (information security) and ISO 13485 (medical devices). The standards specify what must be achieved, not which tool to use. But the more documents and users there are, the harder it becomes to meet the requirements without a system.
Signs that your document control is not enough
- Several versions of the same procedure are in circulation, often as printouts or email attachments.
- It takes a long time to find the right document.
- Before an audit, you have to dig out who approved what.
- Documents have passed their review date without anyone noticing.
- You cannot show which employees have read an updated instruction.
What to look for in a document management system
|
Feature |
Why it matters |
|---|---|
|
Version control |
Only one valid version is visible, older ones are kept |
|
Approval workflows |
Review and approval happen in the right order and are logged |
|
Access control |
The right people can create, edit and read |
|
Review reminders |
Documents do not become outdated by mistake |
|
Read acknowledgement |
Shows who has seen a new version |
|
Search |
Employees find the right document quickly |
|
Audit trail |
All changes can be traced in an audit |
|
Links to other areas |
Documents can be connected to processes, risks and non-conformances |
Common mistakes
- Migrating everything. Start by cleaning up. Documents nobody uses do not need to be migrated.
- Too many approval steps. Every extra step causes delays. Adapt the workflow to the document's risk.
- No clear document structure. Decide on naming and categories before adding the documents.
- No owner per document. Every controlled document needs someone responsible for its review.
Summary
Document control gives you control over the entire document lifecycle, from draft to archive. It ensures that everyone works from the valid version and that you can show who approved what and when. For organizations working to ISO standards, it is the foundation for meeting the requirements on documented information, and a document management system is the tool that makes it manageable.
Next step: See how Centuri works as document control software →
