Whether your organisation runs a formal ISO-style quality management system or simply wants fewer surprises at audit time, document control is where good quality management starts. In simple terms, document control is the system you use to make sure people are working from the current, approved version of every document, and that completed records are stored, protected and kept for the right length of time.
This guide covers three practical basics: version control, records retention and audit-ready filing. It is general guidance only, not certification advice, so always check the requirements of your chosen standard, your auditor and the regulators that apply to your organisation.
What is document control in a quality management system?
Most quality systems separate information into two types. Documents tell people how to do something, such as policies, procedures, work instructions and blank forms. They change over time, so they need to be controlled. Records show what was done, such as completed checklists, inspection results, training sign offs and supplier invoices. Records should not change once they are complete. They need to be kept, protected and easy to retrieve.
Getting this distinction right pays off. The Australian National Audit Office notes that effective records management improves decision making, reduces the risk of corporate knowledge loss and strengthens business continuity.
Version control: make the current version obvious
Version control prevents one of the most common audit findings: staff working from an outdated form or procedure. A simple, consistent approach works for most organisations:
- Identify every document. Give each controlled document a unique ID, title, version number, approval date and owner.
- Keep a master register. List every document, its current version and where it is stored.
- Approve before release. Nominate who reviews and authorises changes and record that approval.
- Withdraw superseded copies. Remove old versions from work areas promptly. If you need to keep them, mark them “Superseded” and file them separately.
- Set review dates. Schedule regular reviews, commonly every one to two years, so documents do not quietly go out of date.
For hard copy procedures kept in work areas, a binder per process makes it easy to swap pages when a new version is issued. Binder dividers numbered to match your document register help staff find the right section quickly and make missing or outdated pages easy to spot during an internal check.
Records retention: know how long to keep what
Retention periods are often set by law, not just by your quality system. For Australian businesses, these common benchmarks are a good starting point:
- Tax records (income, expenses, GST): generally, 5 years (business.gov.au and the ATO).
- Employee time and wages records: 7 years (Fair Work Ombudsman).
- Company financial records: 7 years after the transactions are completed (Corporations Act 2001, section 286).
Your quality system or customer contracts may require longer retention for some records, such as calibration certificates, product traceability or nonconformance reports. Capture every record type in a single retention schedule, including the retention period, who owns the record and how it will be disposed of at the end of that period.
How you store records matters as much as how long you keep them. Business.gov.au advises that paper and digital records must be stored in a way that prevents any change or damage, and notes that the ATO accepts digital images of paper records if they are true and clear reproductions of the originals.
Audit-ready filing: set up a system anyone can follow
Auditors typically select a sample of records and trace them back to a procedure. If retrieval takes 20 minutes, it signals a weak system. Poor handling also creates privacy risk. The Office of the Australian Information Commissioner (OAIC) received 532 data breach notifications between January and June 2025, and human error accounted for 37% of them.
A practical three-tier physical filing setup keeps records secure and easy to find:
- Active files. Use A4 suspension files in filing cabinets for current records accessed daily or weekly. Colour code by department or process and match indicator tabs to your document register.
- Working and transport files. A document wallet with a secure closure suits job files, audit packs and records that move between sites or teams, keeping loose pages together and protected.
- Archive. Once records are no longer active, move them into archive boxes or document boxes. Mark each box with its contents, date range, owner and destruction date, then store boxes off the floor in a dry, secure area.
Consistent labels pull the whole system together. Printed labels using one naming convention across suspension files, wallets and boxes make records faster to retrieve and destruction dates impossible to miss.
Document control checklist
- The master document register is current and accessible to staff.
- Every controlled document shows its ID, version, approval date and owner.
- Superseded documents are withdrawn or clearly marked.
- A retention schedule covers every record type, including legal minimums.
- Active, working and archive files follow one naming and labelling convention.
- Archive boxes list their contents and destruction dates.
- A secure disposal process is in place for records past their retention period.
- A regular internal spot check confirms records can be retrieved quickly.
Document Control: Frequently Asked Questions
What are the basics of document control?
The basics are unique identification, review and approval before release, version control, controlled distribution, withdrawal of obsolete versions, and defined retention and disposal periods for records.
What is the difference between a document and a record?
A document describes how work should be done and can be revised. A record is evidence of what was done and should not be altered once complete.
How long should Australian businesses keep records?
It depends on the record. Tax records are generally kept for five years, while employee time and wages records and company financial records must be kept for seven years. Always confirm the requirements that apply to your organisation with the relevant regulator or adviser.
What supplies do I need for audit-ready filing?
Most workplaces need A4 or foolscap suspension files for active records, document wallets for working files, binder dividers for controlled procedures, archive boxes for long-term storage, and labels to tie the system together.
Build a system that stands up to scrutiny
Good document control is not about paperwork for its own sake. It gives you confidence that teams are using the right version, that records will be there when an auditor, customer or regulator asks for them, and that nothing is kept longer than it should be.
