Clause 7.5, "Documented information". Is the single most-flagged finding in SMB ISO 9001 audits. Not because the requirement is unreasonable, but because it's usually translated by consultants into a binder system that starts drifting from reality the day it's installed. This guide explains what 7.5 actually asks for in normal English, the three findings every SMB manufacturer eventually gets, and what a digital-first answer looks like , without selling you a $250,000 MES.
Clause 7.5 breaks into three sub-clauses. 7.5.1 is a scope statement, you need documented information. 7.5.2 covers creating and updating (it has to be identifiable, in an appropriate format, and reviewed for suitability). 7.5.3 is the big one and breaks into two further parts: 7.5.3.1 says documented information has to be controlled, available where needed, and protected from loss / unauthorised change. 7.5.3.2 spells out the controls: distribution, access, retrieval, storage, preservation, change control, retention, and disposition. The core idea: you have to KNOW what version is authoritative, the people who need it have to be able to FIND it, and you have to be able to PROVE nothing was changed without a record.
Finding 1: obsolete revision in use. Engineering moves the master to rev F, the floor copy stays at rev D, the auditor walks the line and flips to the station copy. Five-minute finding. Finding 2: distribution gap. The official copy lives in the engineering server, the floor has a printed copy in a binder, and nobody can show how a change in the server makes it to the binder in less than a week. Finding 3: change history gaps. The master binder shows revs A through F, but the auditor asks "who approved rev D?" and the trail goes cold. All three are 7.5.3 findings, all three are caused by paper systems, and all three close on the same day you replace the binder with a database row.
Binder systems can theoretically pass 7.5.3. You just need a distribution log, a revision control sheet, and someone whose job is literally to walk every station after every revision and swap the binder. In a 50-person shop that person works full time on document control, which most SMBs cannot afford. So they skip it, and the gap opens. Tablet-based work instructions close the gap at the architecture level: there is no floor copy to drift because the floor reads the database row in real time. When engineering bumps to rev F, the next badge-in at the station renders rev F. Nobody walks the line, nobody swaps a binder, nobody has to.
A digital work-instruction system that passes 7.5 needs three properties. One: single source of truth. The authoritative version lives in one database row, and the floor reads that row, period. Two: version history. Every save bumps the version, stamps the editor, and stores a snapshot. So 7.5.2 (identification of changes) and 7.5.3.2 d) (change control) are both answered automatically. Three: append-only history. The version log cannot be edited after the fact, including by the admin. So 7.5.3.1 (protection from unauthorised change) is enforced at the database level, not in app code. Ignite Lean is one system that has all three; there are others. The point is the three properties, not the vendor.
Most SMBs hit the audit window in panic mode at week 12. Here's the inverse: weeks 1–2, inventory your current work instructions and pick the top 20 by usage. Weeks 3–6, convert them to the digital system, one a day. Weeks 7–8, pilot at two stations and capture the operator feedback. Weeks 9–10, roll out plant-wide and retire the binders. Weeks 11–12, dry-run the audit with the QMS manager: pick five units from build history, ask the same questions the auditor will ask, time the answer. If every answer comes in under two minutes, you're ready. If anything takes longer, that's the gap to close.
Clause 7.5 is the headline, but the same architecture that solves it also covers 8.5.1 (control of production. Build records), 8.7 (nonconforming output. Defect flag + supervisor disposition), 9.1 (monitoring & measurement. Cycle time, defect pareto), 9.2 (internal audit. Searchable build history), and 10.2 (corrective action, attributed approvals with reason text). Most SMBs implement 7.5 as a one-off project; they end up de-risking five other clauses as a side-effect. That's the ROI conversation worth having with your QMS manager before you scope the budget.
Free during early access — 1 manager seat included, unlimited operators.
Get early access