How to Prepare PDFs for ISO Audit Documentation
ISO certification audits require organizations to demonstrate that their quality management system, environmental management system, information security controls, or other management systems are implemented, effective, and maintained. The evidence for this demonstration comes in the form of documented information — procedures, records, forms, logs, and objective evidence of compliance. Preparing for an ISO audit is fundamentally a documentation management task. Auditors will ask to see specific types of documented information prescribed by the standard (ISO 9001, ISO 14001, ISO 27001, ISO 45001, etc.), and they will examine whether your documentation control practices themselves comply with clause 7.5 requirements for documented information. A disorganized or inconsistently controlled document set signals poor overall management system implementation, regardless of what the underlying processes look like. PDF documents are the practical standard for ISO audit documentation — they can be controlled (versioned, approved, distributed), protected from unauthorized modification, organized into evidence packages, and presented consistently across physical and digital audit formats. This guide covers how to prepare and organize PDF documentation for ISO audits, using LazyPDF's merge, page-numbers, and protect tools to efficiently handle the assembly and control steps.
Understanding ISO Document Control Requirements
ISO standards under the High Level Structure (HLS) — which applies to ISO 9001:2015, ISO 14001:2015, ISO 45001:2018, ISO 27001:2022, and others — share a common clause 7.5 on documented information. Understanding these requirements determines how your PDF documents should be prepared and controlled. Clause 7.5.2 requires documented information to be identified and described (title, date, author, reference number), in a format and on media that is appropriate, and reviewed and approved for suitability and adequacy. Clause 7.5.3 requires controlled documented information to be available and suitable for use where and when needed, adequately protected, and controlled for distribution, access, retrieval, and use. Retention requirements must be established, and obsolete information must be prevented from unintended use. For PDF documents, these requirements translate to: every document must have a unique identifier (document number), a version/revision indicator, an effective date, approver identification, and appropriate access controls. Outdated versions must be withdrawn from circulation. A document numbering scheme should be established before audit preparation begins: a prefix for the management system or process area, followed by a sequential number. Example: QMS-PRO-0042 for Quality Management System, Procedure, number 42. This numbering should appear in the header or footer of every page of the document.
Preparing Document Control Headers and Footers
Proper header and footer information makes ISO documents instantly identifiable and verifiable — the auditor can confirm at a glance that they are viewing a controlled document. ISO document header should include: Organization name and/or logo, Document title, Document number (unique identifier), Revision level or version number. ISO document footer should include: Effective date, Page number and total pages ('Page X of Y'), Review date or next review cycle, Name or role of approver, A confidentiality classification if appropriate. Creating a consistent header/footer template in Word or another word processor and applying it to all quality documents before converting to PDF ensures uniformity across the entire document set. The template should be a locked section in Word — editable only by document controllers — to prevent accidental modification of the header/footer format. After converting from Word to PDF using LazyPDF's word-to-pdf tool or native Word export, verify that the header/footer information appears correctly on every page of the PDF, including any pages with landscape orientation or different section formatting. For existing PDFs that were created without proper headers/footers, Adobe Acrobat Pro's Header & Footer feature (Tools > Edit PDF > Header & Footer > Add) allows adding formatted text to all pages. LazyPDF's page-numbers tool adds sequential page numbers — use it after merging if the source documents did not include page numbering.
- 1Create a standard document template with approved header/footer layout for your management system type
- 2Convert all documented procedures, work instructions, and forms to PDF using the template
- 3Verify header/footer is correct on every page of each PDF: document number, revision level, effective date, page numbers
- 4Organize documents into the evidence package structure that mirrors the ISO standard's clause structure
- 5Use LazyPDF's merge tool to create clause-specific evidence packages, then add page numbers to the combined package
- 6Apply password protection using LazyPDF's protect tool to prevent unauthorized modification of controlled documents
Organizing Audit Evidence Packages by ISO Clause
During an ISO audit, auditors sample evidence against each clause of the standard. Pre-organizing your documentation into clause-structured evidence packages streamlines the audit process and demonstrates systematic document management. For ISO 9001:2015, a typical evidence package structure might mirror the standard's clause structure: Clause 4 (Context): Interested party register, scope document, quality manual if maintained; Clause 5 (Leadership): Quality policy, management review records, objectives records; Clause 6 (Planning): Risk and opportunity register, objectives and planning records; Clause 7 (Support): Training records, calibration records, communication records, documented information list; Clause 8 (Operation): Process procedures, work instructions, quality plans, supplier evaluation records, nonconformance reports; Clause 9 (Performance Evaluation): Audit schedules, internal audit reports, customer satisfaction data, KPI tracking; Clause 10 (Improvement): Corrective action records, continual improvement initiatives. Create a PDF evidence package for each clause by merging the relevant documents using LazyPDF's merge tool. Add page numbers to each package. Maintain an index page at the front of each package listing every document included with its document number and revision level. The value of pre-organizing this way: when an auditor asks 'Show me your internal audit records for the past 12 months,' you can immediately produce the Clause 9 evidence package with all audit reports compiled and indexed, rather than searching through a disorganized folder.
Version Control and Obsolescence Management
Version control is one of the most commonly cited findings in ISO certification audits. Auditors specifically look for evidence that obsolete documents have been prevented from unintended use, and that the current revision of each document is clearly identifiable. Version control for PDF documents requires: a master document register that lists every controlled document with its current revision level and effective date, a formal approval process documented for each revision, physical or digital withdrawal of previous versions when a new revision is issued, and a secure archive of obsolete versions for reference (clearly marked as obsolete and inaccessible to regular users). For PDF document sets, version control is most reliably managed through a document management system (DMS) rather than manual filing. SharePoint, Confluence, Laserfiche, or a dedicated quality management system provides version tracking, approval routing, and access control that manual PDF management cannot match. For organizations managing PDFs without a DMS: establish strict naming conventions that include revision level (QMS-PRO-0042_Rev03.pdf), maintain a master register in Excel or SharePoint List, and implement a review/approval process where the quality manager signs off before any document is released. Protect approved PDFs using LazyPDF's protect tool to prevent editing, making it immediately apparent if someone attempts to modify a controlled document. Document retention: Different document types have different retention requirements. ISO standards require organizations to determine appropriate retention periods for all documented information. Record this in your document register and apply it consistently.
Preparing for a Surveillance or Re-Certification Audit
The difference between a smooth audit and a stressful one often comes down to preparation. Systematic PDF preparation in advance of a scheduled audit allows you to identify gaps before the auditor does. Pre-audit document review: Three to four weeks before the audit, review every document in your quality management system. Are all documents at their current revision? Are revision dates recent enough to show periodic review? Are there any procedures that describe current practice and have been reviewed within the last two years? Internal audit completeness: The audit schedule for the past period should show that all processes were audited. Internal audit reports should be compiled into a single PDF evidence package showing complete coverage. Any nonconformances from prior audits should have documented corrective actions with objective evidence of effectiveness. Management review records: ISO standards require management review at planned intervals. The management review minutes or report should show that all required inputs were reviewed (results of internal audits, customer feedback, process performance, changes in external/internal issues, etc.) and that outputs (decisions and actions) were documented and followed through. Corrective action tracking: Compile all open and closed corrective actions into a summary PDF. Open corrective actions should be within their target dates or have documented rationale for extensions. Closed corrective actions should have objective evidence of effectiveness. For each evidence package you assemble, use LazyPDF's merge tool to combine related records, add consistent page numbers, and protect the package with a password to prevent modification before presenting to the auditor.
Frequently Asked Questions
What documents must a company maintain for ISO 9001:2015 certification?
ISO 9001:2015 requires specific documented information: quality policy, quality objectives, the scope of the QMS, and evidence of conformity with requirements (records). Beyond these, organizations must maintain documented information as necessary to support operation of processes and to have confidence that processes are being carried out as planned. Common maintained documents include procedures for key processes, work instructions, forms, and records such as customer orders, inspection results, and calibration certificates. The specific document list varies by organization size and process complexity.
How should I store ISO audit evidence in PDF format?
Organize audit evidence in a folder structure that mirrors the ISO standard's clause structure. Each major clause should have its own folder containing the relevant documented information. Within each folder, maintain current versions of procedures and representative samples of records (audit reports, training records, calibration certificates). Use consistent naming with document numbers and revision levels. Protect controlled documents from modification using PDF password protection, and maintain a master document register as the authoritative source of what is current.
How do I prevent someone from modifying a controlled ISO document PDF?
Use LazyPDF's protect tool to add an owner (permissions) password to the PDF that restricts editing, copying, and printing while allowing viewing. This prevents casual modification of controlled documents. For stronger control, a document management system with role-based access controls is more reliable — users can only view, not edit, documents they are not authorized to modify. For the most critical documents, consider adding a digital signature that invalidates if the document is modified.
What is the difference between a procedure and a work instruction in ISO terms?
A procedure describes what is done, who does it, when, and the high-level how — the process flow and responsibilities. A work instruction provides step-by-step detailed instructions for a specific task, typically at the operator level. For example, a procedure might describe the calibration management process (who is responsible, when calibration is due, how nonconforming equipment is handled), while a work instruction describes exactly how to calibrate a specific measurement instrument. Both require document control, but work instructions tend to be more detailed and more frequently updated.
How often should ISO documentation be reviewed?
ISO standards do not specify a fixed review frequency — organizations must determine appropriate review periods based on their circumstances. Annual review is common for most documented procedures. More frequently for documents in rapidly changing areas (processes under development, areas with recent nonconformances), less frequently for stable, well-established processes. The review date should appear on each document, and the master document register should flag upcoming reviews. Auditors will check whether documents have been reviewed within the defined review cycle.