ISO 9001:2015 requires you to retain about 15 distinct sets of records. They run from calibration results under clause 7.1.5 to corrective action records under clause 10.2, and the full clause-by-clause table is below. If you can produce each row on demand, your record system meets the standard.
Records are the evidence half of a quality management system. Your procedures say what you will do. Your records prove you did it. In a certification audit, the auditor spends most of the time sampling records, and missing records — not badly written procedures — are the classic first-audit finding at small manufacturers.
This guide covers the full checklist with clause references, how long to keep each record, the difference between a document and a record, and the three records that can quietly wreck a Stage 1 audit because they need calendar time to exist.
Records vs. documents: two different things
ISO 9001 splits documented information in two. Documents tell people what to do: procedures, work instructions, the quality policy. The standard calls these "maintained documented information." You keep them current and revise them when a process changes.
Records prove what happened. An inspection result. A training sign-off. Management review minutes. The standard calls these "retained documented information." You never revise a record. Clause 7.5.3.2 requires you to protect records from unintended change. If a record is wrong, add a corrected entry and keep the original.
The difference matters under audit. A weak procedure can be rewritten in a day. A missing record cannot be recreated — not honestly. That is why record gaps sink more first-time audits than document gaps do.
The clause-by-clause checklist
The table below lists every place ISO 9001:2015 says "retain documented information." This is the record set a certification auditor will sample. Paper or electronic both work, as long as each record is identified, legible, and protected.
| Clause | Record you must retain | Typical evidence in a small shop |
|---|---|---|
| 7.1.5.1 / 7.1.5.2 | Proof that measuring equipment is fit for use; calibration or verification results traceable to a measurement standard | Calibration certificates, gauge log, calibration stickers |
| 7.2 | Evidence of competence for people whose work affects quality | Training records, skills matrix, certificates |
| 8.1 | Evidence that production ran as planned and output meets requirements | Job travelers, routers, in-process check sheets |
| 8.2.3.2 | Results of the review of order and contract requirements, including any new or changed requirements | Signed quotes, order review checklist, change notes |
| 8.3.2–8.3.6 | Design and development records: planning, inputs, reviews, verification, validation, outputs, and changes | A design file per project (only if you design product) |
| 8.4.1 | Evaluation, selection, performance monitoring, and re-evaluation of external providers | Approved supplier list, supplier scorecards |
| 8.5.2 | Traceability records, where traceability is a requirement | Lot numbers, heat numbers, serial logs |
| 8.5.3 | What happened when customer or supplier property was lost, damaged, or found unfit | Customer property incident report |
| 8.5.6 | Review of production changes: results, who authorized them, actions taken | Change log or engineering change records |
| 8.6 | Evidence the product met acceptance criteria, with traceability to who released it | Final inspection records, certificates of conformance |
| 8.7.2 | The nonconformity, actions taken, any concessions, and who decided | NCR log and NCR forms |
| 9.1.1 | Results of monitoring, measurement, analysis, and evaluation | KPI reports: on-time delivery, scrap, returns |
| 9.2.2 | Evidence the audit program was carried out, plus audit results | Audit schedule, audit reports, findings |
| 9.3.3 | Results of management reviews | Meeting minutes with decisions and actions |
| 10.2.2 | Nature of nonconformities, actions taken, and the results of corrective action | CAPA log and closed corrective actions |
One common adjustment: if you build only to customer prints and make no design decisions, clause 8.3 may not apply to you. State that in your QMS scope with a one-line justification. Every other row in the table applies to nearly every manufacturer.
How long to keep each record
ISO 9001 sets no retention times. None. Clause 7.5.3.2 says you must control "retention and disposition," which means you decide the durations and write them down — usually as a column in your record control list.
The real durations come from outside the standard:
- Customer contracts. Aerospace and automotive flow-downs often demand 7 to 10 years or more, sometimes "life of program." The contract wins over any internal default.
- Regulators. FDA, FAA, and similar agencies set fixed retention rules for regulated product records.
- Product liability. Your attorney may want production and inspection records kept for the useful life of the product.
- Your own operations. Keep calibration records at least one full calibration cycle back, so you can trace what a gauge read before its last adjustment.
With no flow-downs and no regulator, a three-year default is a common, defensible starting point for a small shop. Set it, write it down, and apply it. Auditors do not judge the number. They judge whether you follow your own rule.
The Stage 1 killers: records that need calendar time
Most mandatory records accrue on their own once your forms are in use. Three do not. Internal audit results (9.2.2), management review results (9.3.3), and corrective action records (10.2.2) exist only if you run those activities — and running them takes weeks on the calendar, not effort in a day.
At Stage 1, the auditor checks readiness for Stage 2. They expect at least one completed internal audit covering your QMS, one management review with the required inputs and recorded decisions, and corrective actions raised and worked to closure. Certification bodies also want roughly three months of operating records before Stage 2. These are the items that most often push a Stage 2 date back.
Closing the gaps
Work the list in two passes. First, the document layer: a form or log for every row in the table that you cannot already produce from your ERP or job files. Second, the record layer: put those forms into daily use and let time pass.
For the document layer, you have the usual three options: write it yourself from the standard, adapt purchased templates, or have it written for you. As one example of the third route, ISO Delivered sells a flat $8,000 documentation package — about 44 documents, including the 15 forms that generate this record set, delivered 2 to 4 weeks after you complete a questionnaire. No documentation provider is a certification body, and none can sell you the record layer: you still need about three months of your own operating records before Stage 2.
That is the order of operations to remember. Documents can be written in weeks. Records only accrue in real time. Build the forms early, use them every day, and the evidence the auditor needs will exist when the audit arrives.
Frequently asked questions
How many mandatory records does ISO 9001:2015 require?
About 15 sets, depending on how you count sub-clauses. The list runs from calibration records (7.1.5) to corrective action records (10.2.2). Companies that exclude design (clause 8.3) drop to about 14. Maintained documents like procedures are a separate category with their own requirements.
How long do I have to keep ISO 9001 records?
The standard sets no retention times. Clause 7.5.3.2 only says you must define retention and disposition. Durations come from customer contracts, regulators, and product-liability exposure. A common small-shop default is three years, with longer periods wherever a contract or regulation demands one.
What is the difference between a document and a record in ISO 9001?
Documents are "maintained documented information": procedures and instructions you keep current and revise as processes change. Records are "retained documented information": evidence of what happened, protected from alteration. You update a procedure when the process changes. You never rewrite a record.
Can ISO 9001 records be electronic?
Yes. Spreadsheets, ERP entries, scanned forms, and signed PDFs all count. The requirements are the same as for paper: records must be identified, legible, protected from unintended change, and retrievable when the auditor asks. Auditors care about content and control, not the medium.
Which records does a Stage 1 audit check?
Stage 1 is a readiness review. The auditor confirms your documentation exists and that three time-based record sets exist: at least one internal audit (clause 9.2), one management review (clause 9.3), and corrective actions raised and worked (clause 10.2). Missing any of these usually delays your Stage 2 date.
Do I need design records if I only build to customer prints?
Usually not. If customers supply the design and you make no design decisions, you can state clause 8.3 as not applicable in your QMS scope, with a short justification. The auditor will test that claim, so be sure you never modify designs or develop products yourself.