The standard is clear. The interpretation varies wildly. After sitting through a BSI audit, here's what they actually look for — and what gets you a major finding.
If you review the distribution of IATF 16949 audit findings across automotive suppliers, Clause 7.5 (Documented Information) consistently appears in the top five most-cited clauses, often in the top three. It generates more corrective actions than requirements about product realization, monitoring and measurement, and in many auditor surveys, more than nonconformance control.
This happens for a straightforward reason: most manufacturing organizations have documentation. What they lack is documented information that is properly created, controlled, and maintained in the way the standard requires. The distinction matters enormously during an audit.
The clause has three sub-clauses addressing different aspects of the requirement.
The QMS must include documented information required by the standard and documented information determined by the organization to be necessary for QMS effectiveness.
This establishes a dual requirement. Some documented information is explicitly mandated by the standard. Beyond that, your organization is responsible for determining what additional documented information is necessary — and then maintaining it.
The common misreading is that only the standard-required documents matter. Auditors look for evidence that your processes are actually controlled. If a critical manufacturing process lacks documented information, an auditor can cite 7.5.1 regardless of whether that specific type of documentation is explicitly named in the standard.
When creating and updating documented information, the organization must ensure appropriate identification and description, format and media, and review and approval for suitability and adequacy.
"Appropriate identification" means version control. Each document needs a unique identifier and a current revision level. "Format and media" addresses whether the document is fit for its use — a procedure that cannot be read under normal working conditions fails this requirement regardless of content quality.
"Review and approval" means someone with appropriate authority reviewed the document before release and approved it as suitable for use. This approval must be documented.
Documented information must be available where and when needed, in a format and on media suitable for its purpose. It must be protected from loss of confidentiality, improper use, and loss of integrity.
The control requirements address creation, distribution, access, retrieval and use, storage and preservation, change control, retention, and disposition.
This is where most organizations have gaps.
IATF 16949:2016 collapsed "documents" and "records" into a single term, but the operational distinction remains important.
A work instruction is documented information that tells operators how to perform a process. It requires version control, review, approval, and controlled distribution.
A calibration record is documented information providing evidence that equipment was calibrated on a specific date. It requires retention, protection from alteration, and defined disposal procedures.
The control requirements are different for each type. Treating them identically creates gaps.
After reviewing hundreds of IATF 16949 audit reports, these findings appear most frequently.
Work instructions at the workstation but not at current revision. The most common finding. Operators work from old procedure versions. The document control system does not ensure current versions reach active workstations before old ones are removed.
No evidence of review and approval. Procedures are in use but there is no signature block, approval date, or evidence that someone with appropriate authority reviewed the current revision before deployment.
Retention requirements undefined or inconsistently applied. The standard requires defined retention periods. Many organizations have this defined for some record types but not others.
Electronic documents accessible but not protected from modification. A shared drive is not document control. If operators can modify procedure files directly, the integrity of documented information is not maintained.
Foreign language procedures not addressed for multilingual workforces. IATF 16949 and many customer-specific requirements include expectations about procedure accessibility. Operators who cannot read the language of a procedure are not operating from documented information in a meaningful sense.
Obsolete documents not identified or segregated. When a new revision is released, the old revision must be identified as obsolete and either removed from use or clearly marked. Finding operators with access to obsolete procedures is a consistent finding.
Training records not linked to specific procedure revisions. Demonstrating competence requires evidence not just that someone was trained, but that they were trained on the current version of the procedure they are expected to follow.
Customer-specific documented information requirements not met. Most OEMs have customer-specific requirements that augment IATF 16949. Auditors check whether these are incorporated into your QMS documentation.
A practical framework that satisfies Clause 7.5 while remaining manageable:
Tier 1 — QMS Overview: High-level description of scope, policy, and structure. Reviewed annually. Infrequently changed.
Tier 2 — Process Procedures: How each major business process works, who is responsible, and how it interfaces with other processes. Reviewed on a defined cycle.
Tier 3 — Work Instructions: Step-by-step instructions for specific process steps. Maintained at current revision. Controlled distribution to workstations.
Tier 4 — Records: Evidence of process execution. Retained according to defined schedule. Protected from alteration.
The key discipline: every document must have a clear owner, a defined review cycle, and a controlled release process. Anything less creates the conditions for a Clause 7.5 finding.
Coplain helps you create controlled, audit-ready work instructions from existing procedures in minutes. Built for IATF 16949, AS9100, and FDA Part 820 environments. Free trial at coplain.com.
Coplain turns any work instruction into a print-ready, audit-proof job aid in minutes.
Try Coplain free →