IA202609 — Document Control¶
Audit Record
| Field | Value |
|---|---|
| Audit reference | IA202609 |
| Area audited | Documented information |
| Audit criteria | ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018 clause 7.5 · SOP 4.6 · SOP 4.7 |
| Audit date | 14/05/2026 |
| Auditor | Sean Ashton, HSQE Consultant, Onyx Operations Ltd |
| Auditees | Aaron Mason (Director), Leanne Mason (Director) |
| Result | Conforms. 0 non-conformities, 0 observations |
| Previous audit of this area | IA202509, 2025 cycle |
| Form | FORM_INTAR001 Rev 1 ID 01/09/2025 |
1. Scope, criteria and independence¶
1.1 Scope¶
How controlled documents are created, identified, approved, issued, revised and withdrawn, and how records are retained, protected and disposed of.
Clauses examined: 7.5.1 general, 7.5.2 creating and updating, and 7.5.3 control of documented information, in all three standards.
1.2 Independence¶
The auditor is an external HSQE consultant engaged through Onyx Operations Ltd. He is not an employee of AMWS and holds no line responsibility for the work audited. SOP 6.2 requires that an auditor does not audit work for which they are also responsible; AMWS has no second competent auditor, and the consultant drafted much of the documented system. The mitigation applied is that no document is tested against its own wording. Each clause is tested against records, against what the people responsible describe doing, and against what can be produced on request. Findings are reviewed and countersigned by a Director, who holds the authority to accept or reject them.
This audit examines document control, which is the area the auditor operates most directly. It is therefore tested by sampling documents at random and checking whether the control band is complete and whether the stated issue matches the index — a test that does not depend on the auditor's own account of the system.
2. Method and sample¶
| Method | What was covered |
|---|---|
| Document review | SOP 4.6 Document Control Issue 3 (01/05/2026) · SOP 4.7 Control of Records Issue 3 · MAN_01 IMS Manual Revision 3 (30/04/2026) |
| Sampling | Control bands checked on a sample drawn across every document class — procedures, policies, registers, risk assessments, forms and manuals — testing for document reference, issue number, issue date, next review, approver and controller |
| Change records examined | The reissue of the full procedure set at Issue 3 on 01/05/2026 · MAN_01 Revision 3 of 30/04/2026 · the two policies issued 04/05/2026 · the register reissues of 13/05/2026 |
| Interview | Both Directors, on where they go for the current version of a document and what they would do with a printed copy |
3. Result against each clause¶
| Clause | What the standard requires | Objective evidence examined | Result |
|---|---|---|---|
| 7.5.1 General — the system includes the documented information the standards require and that the organisation determines is necessary | MAN_01 Revision 3 states the arrangement and assigns it: "Master document control is coordinated by the Supervisor with administrative support. Sean Ashton (HSQE Consultant) maintains master documentation structure. Document control processes are detailed in SOP_4.6 and SOP_4.7." The documented set spans the manual, policies, procedures, registers, risk assessments and forms, each in a defined class with its own control band | Conforms | |
| 7.5.2 a) Identification and description | SOP 4.6 Issue 3 fixes the format and the route: "Internal documents are produced by the HSQE Consultant in the AMWS format (document reference, issue number, issue date), reviewed and approved by the Directors, uploaded to the controlled IMS portal, and recorded in the Master Document & Record Index." Tested by sampling: every document sampled carried a reference, an issue number and an issue date | Conforms | |
| 7.5.2 b) Format and media | A single document class carries a single format. Procedures are held as controlled pages with an identical control band; registers carry a control band and a revision history; policies carry a footer stating reference, revision, date and next review. Tested across classes | Conforms | |
| 7.5.2 c) Review and approval for suitability and adequacy | SOP 4.6 Issue 3 sets a periodic requirement with a floor: "Periodic review — check issue status of all internal controlled documents at least annually." Every document sampled carried a next review date. Approval is by a Director and is named on the control band. The reissue of the entire procedure set at Issue 3 on 01/05/2026, each carrying a next review of 01/05/2027, is the exercised evidence of the review cycle operating rather than being stated | Conforms | |
| 7.5.3 a) Available and suitable for use where and when needed | SOP 4.6 Issue 3 names one master source: "The IMS portal at amwaterservices.onyxoperations.co.uk is the master source for every controlled internal document." Tested at interview: both Directors named the portal without prompting when asked where they would go for a current version | Conforms | |
| 7.5.3 b) Adequately protected — from loss of confidentiality, improper use, or loss of integrity | SOP 4.7 Issue 3 states the standard for records: "A M Water Services keeps every record legible, indexed, protected against loss or unauthorised access, and retained for at least its minimum statutory or contractual retention period." Access control is specific where the material is sensitive: "Customer information held in secure location, accessed only by the Managing Director or by named delegate." | Conforms | |
| 7.5.3 c) Distribution, access, retrieval and use | The portal is the distribution mechanism and SOP 4.6 Issue 3 addresses the risk it creates directly: "Printed or downloaded copies are uncontrolled — they may be out of date the moment they leave the portal... the version reference shown on the document must be checked against the portal before use." Tested at interview: both Directors gave the same answer about a printed copy | Conforms | |
| 7.5.3 d) Control of changes — version control | Every register carries a revision history table recording issue, date, approver and what changed, so the change history travels with the document rather than sitting in a separate log. SOP 4.6 Issue 3 sets the tie-breaker where two sources disagree: "The Master Document & Record Index is the single canonical list of all current controlled documents and their current issue numbers; if it disagrees with what's on the portal, the index wins and the portal is corrected." Tested on the reissues of 13/05/2026, each of which carries a revision row stating what changed and why | Conforms | |
| 7.5.3 e) Retention and disposition | SOP 4.7 Issue 3 sets the retention rule and the conflict rule together: "Records are retained for at least the longest applicable period from the table below. Where a record falls under multiple categories, the longest period applies." Disposal is a controlled act rather than an omission: "Sanction disposal of records that have exceeded the retention period; choose method (shred / secure deletion / specialist disposal)." Retention periods are carried into the operating procedures where the record arises — waste transfer notes for two years under SOP 9.4, hazardous waste consignment notes for three years under SOP 9.5, vibration exposure records for forty years under SOP 8.10 | Conforms | |
| 7.5.3 Prevention of the unintended use of obsolete documents | SOP 4.6 Issue 3 sets the handling: "Obsolete versions retained for archive purposes are clearly marked \"OBSOLETE — FOR REFERENCE ONLY\" and segregated from current documents on the portal under the relevant document's change-log table." The mechanism keeps superseded content attached to its successor rather than free-standing, so an obsolete version cannot be reached without passing the current one | Conforms | |
| 7.5.3 Documented information of external origin | SOP 4.6 Issue 3: "External documents are tracked for currency through subscription services or periodic checks; superseded versions are removed from circulation and the index is updated." Tested against the standards, the safety data sheets and the client framework documents held | Conforms |
4. Findings¶
4.1 Non-conformities¶
None.
4.2 Observations¶
None.
4.3 Status of the previous audit of this area¶
IA202509 closed with no findings. The migration of the procedure set onto the portal since that audit was examined and has not disturbed the control arrangements; the control band travelled with each document.
5. Conclusion¶
Documented information conforms to clause 7.5 of all three standards. There is one master source, one format per document class, an issue number and a date on every document, a named approver, and a next review date. Records carry defined retention periods drawn from the statutory duty that creates them rather than from a general rule.
Two provisions are worth recording as strengths because they close the failures this clause usually reveals. The first is the explicit statement that printed copies are uncontrolled and must be checked against the portal, which is the control most often missing in a system that has moved online. The second is the rule that where the index and the portal disagree, the index wins and the portal is corrected — a system with two sources of truth and no tie-breaker will drift, and this one has a tie-breaker.
No findings were raised.
6. Recommendations¶
- Keep the revision history attached to each register rather than in a separate log. It is what allows any statement about a document's past state to be tested.
- Where a document is withdrawn rather than superseded, record the withdrawal in the same change log so the absence is explained.
- Continue recording what changed and why in each revision row. A row that records only a date and an issue number cannot support a question about why a control changed.
7. Sign-off¶
| Role | Name | Position | Signature | Date |
|---|---|---|---|---|
| Auditor | Sean Ashton | HSQE Consultant, Onyx Operations Ltd | S. Ashton | 14/05/2026 |
| Reviewed and accepted | Aaron Mason | Director | A. Mason | 14/05/2026 |