Documented information: creating and updating

What the requirement asks

When documented information is created or updated the organization makes sure it has suitable identification and description (such as title, date, author or reference number), a suitable format (such as language, software version or graphics) and medium (paper or electronic), and is reviewed and approved as suitable and adequate.

What the guidance adds

Creating and updating documented information is expected to follow a method: identification, format, review and approval for suitability. The guidance looks for the version, the author, the reviewer and the approval in the record. A file name with 'final' in it is not a control.

What good looks like

Keep document control conventions for titles, dates, authors, reference numbers and versions with the clause record, and give it an owner and a review date.

Evidence an assessor asks for

• Document identificationDocument control conventions for titles, dates, authors, reference numbers and versions
• Document identificationExamples of ISMS documents showing identification, format and approval
• Document identificationApproval records demonstrating review for suitability and adequacy
• Document identificationTemplates used for ISMS documents

The question an assessor will ask

An assessor will ask for document control conventions for titles, dates, authors, reference numbers and versions. The test for 7.5.2 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.

Common gaps

• Documents lack version, date or owner
• Approval before issue is not recorded
• Different versions of the same document circulate
• Formats cannot be read by the intended audience

Before the next audit

Before the next audit, test this against one live record: documents lack version, date or owner.