The controlled document: from draft to active
The commonest mistake new tenants make is uploading a file and assuming 7.5 (control of documented information) is satisfied. The clause does not ask whether you have a file — it asks: which version is in force, who approved it, when, and was the old one withdrawn from use?
The document is a container; the revision is the record
In goiso the document is separated from its content:
- The document is an identity: a unique code (
POL-001), a type, an owner, and a next review date. No file lives on it. - The revision is the content: a file, a change summary saying why it was issued, and an effective date.
That is why you will find no upload button on the document screen itself: the file is a property of a revision, not of a document.
The lifecycle — five states
| State | What it means |
|---|---|
| Draft | Freely edited: file, change summary, effective date |
| In review | Submitted for approval — and it cannot be submitted without a file and a change summary |
| Active | In force now; this is what the document points to |
| Superseded | It was active, then a later revision was approved |
| Withdrawn | Deliberately pulled, so the document has no active revision |
Approval supersedes the previous one — in the same instant
When the second revision is approved, the first becomes superseded and the document pointer moves, inside the same transition, not as a second step. Two active revisions of one document cannot exist — which prevents the most common auditor finding of all: two copies in circulation and nobody sure which is approved.
The superseded copy stays, and is not hidden
A superseded revision is never deleted: it is displayed with an explicit tag, "Superseded revision — the active one is no. N". The purpose is not tidy archiving but preventing unintended use, which is what §7.5.3 literally requires. And whoever needs to prove what was in force during an incident a year ago will find it.
An approved revision is not edited
Once approved, a revision is closed for good: no edits, no deletion. A correction is issued as the next revision, never as an in-place edit. If approved text could be rewritten, the answer to "what did the document say on the day of the incident?" would be gone.
The fingerprint
When the file is uploaded, a SHA-256 fingerprint is computed and stamped onto the revision row — it is not recomputed later at display time. So the approver's signature is bound to that exact file, and it appears in the history tab.
The periodic review date
Every type carries a default review interval (policy: one year; procedure: two...). The document inherits it at creation, you may override it at any time, and it rolls forward automatically on each approval. The nightly sweep warns before the due date and turns it red after.
One open draft per document. Two parallel drafts mean two editors and one text, and nobody knows which will become active.
Where to find it: sidebar → Governance → Controlled documents. The "without an active revision" filter at the top of the index is the first thing an auditor asks about.