Since the move to the common "high-level structure" (now called the harmonized structure), ISO management system standards use the term documented information instead of documents and records. The good news: the mandatory list is shorter than most people expect.
Required across ISO 9001, 14001, 45001 and 27001
Each of these standards requires documented information for:
- The scope of the management system
- The policy (quality, environmental, OH&S or information security)
- Objectives and plans to achieve them
- Evidence of competence
- Results of monitoring and measurement
- The internal audit programme and audit results
- Results of management review
- Nonconformities and corrective actions
Additional items by standard
ISO 9001 adds records such as calibration of measuring equipment, design and development records (if applicable), evaluation of external providers, release of products and services, and control of nonconforming outputs.
ISO 14001 adds environmental aspects and their significance criteria, compliance obligations, evaluation of compliance, and emergency preparedness where needed.
ISO 45001 adds hazard identification and risk assessment processes, legal requirements and their evaluation, and incident investigation records.
ISO 27001 adds the information security risk assessment and treatment process and results, and the Statement of Applicability.
What is optional
A quality manual, procedures for every process, organization charts and process maps are all optional. Create them when they help people work consistently, not because an auditor might ask.
A practical rule
For any document, ask: "Would work go wrong without this?" If yes, document it simply. If no, skip it. A lean set of documents that people actually use will always beat a thick manual that nobody reads.