Document control in 2026: do you still need a 'controlled copy' stamp?
Wet-ink stamps, revision tables, and master lists made sense when documents lived on paper. Here is what document control actually looks like in a cloud-native QMS — and what auditors expect to see.
Walk into a factory built before 2005 and you will still find them: red 'CONTROLLED COPY' stamps, signature blocks on the cover page, a master document list maintained by one person who has been there forever. These artifacts were a sensible response to a real problem — paper copies drift, and people work from whatever happens to be in the drawer.
In 2026, the problem has changed. Documents live in SharePoint, Google Drive, Notion, Confluence, a QMS platform, or some combination of all four. The question is no longer 'is this the controlled copy?' but 'is the system itself trustworthy?'
What ISO 9001 actually requires
Clause 7.5 talks about 'documented information' — deliberately format-neutral language introduced in 2015 to retire the old document/record distinction. The standard requires that documented information be available where needed, suitably protected, and controlled for changes, distribution, retention, and disposition.
Nowhere does it say 'stamp it red.' Nowhere does it require a paper master list. Auditors care about the controls, not the rituals.
What modern document control looks like
- Single source of truth — one URL per document, no email attachments in circulation
- Version history is automatic and permanent, not a manually-maintained table on page 2
- Permissions enforce who can edit vs. read, replacing the signature block
- Approval workflows are timestamped and tied to identity, not a scribble
- Obsolete documents are archived, not deleted, with a clear status flag
- Search works — if people cannot find a procedure in 10 seconds, they will not use it
What still matters from the old world
The controlled copy stamp solved one real problem the cloud has not eliminated: external distribution. The moment a procedure leaves your system as a PDF — to a customer, regulator, or supplier — you lose version control. For those cases, an explicit watermark, expiry date, or 'uncontrolled when printed' footer is still the right answer.
A practical rule of thumb
If a document lives only inside your governed system, the system is the control. If it can leave the system, mark it accordingly. Stop spending audit prep time chasing red stamps on internal copies.
“Auditors stopped being impressed by stamps a decade ago. They want to see your access logs.”