Chapter 14: Document Control as a Living System: Preventing Document Decay

Every manufacturing auditor in Canada can tell you the same story: a client passes the certification audit, things are great for six months, then someone changes a process and forgets to update the procedure, an employee retires and nobody knows who owns document maintenance, a critical work instruction gets lost in a folder reorganization, and suddenly you're nonconforming.

Document decay is the slow death of your QMS. Here's how to prevent it.

Tie Document Reviews to Process Changes, Not the Calendar

Most plants set arbitrary annual review dates. "Every procedure gets reviewed on January 15." Terrible. You'll reapprove a document that hasn't changed, and you'll miss one that should have been updated six months ago.

Instead, review a document *when the process changes*. You upgraded your CNC software? Review the programming work instruction within two weeks. You hired a new quality engineer? Review the nonconformance procedure with them in their first month. You changed suppliers? Update the incoming inspection criteria immediately.

Use a simple trigger list:

• Process change → review within 2 weeks
• Nonconformance found → review within 1 week
• New equipment installed → review within 2 weeks
• Audit finding → review immediately
• Scheduled review date → annual, optional

Create a Document Register and Actually Use It

A document register is simply a one-page spreadsheet listing every documented information item, its issue date, next review date, and owner. It lives in your quality manager's shared folder and gets printed monthly. Here's what it looks like:

That last row should trigger a conversation: "Operations, your procedure is due for review. Anything changed since August?" Either it gets updated or you document that no changes were needed.

The Obsolete Document Trap (Most Common First-Certification Failure)

The audit finds three procedures that describe processes you haven't done in two years. Classic scenario: you retired a batch inspection process, installed an SPC system instead, and filed the old procedure but never formally withdrew it. An auditor will cite this as evidence that your document control system is not effective—not just the procedure, but the system itself.

Prevention is simple: every procedure and work instruction must have a status field that says either "Current" or "Superseded by [new doc ID]" with a retire date. Nothing just disappears. When you change to SPC, you update P-INS-001 to say "Superseded by P-INS-002, effective [date]" and archive the old version.

In a SharePoint system, create a folder called "_Superseded Documents" and move old versions there when they're replaced. In a QMS software system, use the "archive" function. In a paper binder, use a red label that says "SUPERSEDED [DATE]" and keep it in the back of the binder for one year, then destroy it.

By the time you finish this chapter, you should have a clear picture of what you actually need to document, how to organize it so it stays current, and how to prevent the document decay that kills most certification projects. In the next chapter, we'll move from documentation infrastructure to people—specifically, how to structure your quality management team, assign accountability without creating silos, and avoid the consultant trap where you're paying for expertise you should be building internally.

Embedding Risk-Based Thinking Into Daily Manufacturing Operations (Not Just Your Risk Register)

If you've spent the last three years building a risk register that sits in a folder somewhere, getting dusted off once a year for your management review, you're not alone—and you're missing the entire point of ISO 9001 Clause 6.1. Risk-based thinking isn't a document. It's a way of running your plant that stops problems before they reach your customer's door. In 2026, auditors are less interested in whether you have a 47-row spreadsheet of threats and less interested in whether risk identification has become woven into how your team actually thinks about their work.

This chapter walks you through embedding risk-based thinking into the real operations of a Southern Ontario parts supplier—a shop floor where receiving inspections, setup procedures, and material traceability matter enough to keep you awake at night. We'll show you how to identify risks that matter, connect them to controls that work, and use the same process to spot opportunities your competitors are missing.