(00)Guide
Controlled documents: how to manage versions, distribution and withdrawal of old copies
In many companies a single procedure or policy lives in five places at once: the shared folder, an email attachment, someone's laptop, a printout on the wall and a chat message. When someone asks which one applies, the answer is usually a guess based on file dates. Document control is the way to stop guessing, and this guide shows how to set it up without a heavy system.
What a controlled document is
A controlled document is an official document whose creation, approval, changes and distribution follow clear rules. Each one has an owner, a number, a version number, an effective date and a record of who approved it. Anyone holding the document can confirm that it is still the version in force.
An uncontrolled copy is one that nobody tracks after it is made. Examples are a printout kept in a drawer, a file downloaded to a laptop, or an email attachment forwarded to a third party. Such a copy is accurate on day one, yet it does not change when the original is revised, so people gradually work from rules that no longer apply.
The term "documented information" comes from ISO 9001:2015, clause 7.5, and many companies use it as a common reference when they write their document control rules. This guide mentions it only as a reference point. Following it does not make your company comply with any standard, and Obscura does not promise that either.
Which documents to control
Not every file needs the same treatment. Documents that guide work or support decisions are usually worth controlling, such as procedures, policies, work instructions, standard forms, contract templates and organisation charts. Meeting minutes, correspondence and temporary working files can normally be managed as ordinary records. Write the choice down in a master list so the scope is visible to all staff.
Example of a master list
A master list is one table that holds every controlled document, so anyone can check the version in force without asking around. For example:
| Number | Title | Owner | Current version | Effective since |
|---|---|---|---|---|
| SOP-HR-004 | Recruitment procedure | [owner position] | 2.1 | 1 Sep 2026 |
| POL-FIN-001 | Expense policy | [owner position] | 3.0 | 15 Jun 2026 |
The current-version column is the first thing to check when someone doubts the copy they hold.
The controlled and uncontrolled stamp
Many companies mark printed copies with a "CONTROLLED COPY" or "UNCONTROLLED COPY" stamp. This is an internal convention and not a legal requirement, so you are free to decide its form and rules. These rules are common.
- A printed copy handed out according to the distribution list gets the controlled stamp and a copy number, and the recipient signs a receipt.
- Any other printout made for a one-off purpose gets the uncontrolled stamp, together with a line saying it is valid only on the print date.
- A file in the official storage system counts as controlled while it carries the current-version status, and anything downloaded or printed from it counts as uncontrolled.
A stamp is only useful when people follow the rules behind it. Ink on paper does not prove the content is up to date, so also print the date and say where the latest version can be checked.
Version numbers and revision history
Each controlled document needs a fixed document number and a version number that changes. The document number can follow your company letter numbering format, for example SOP-HR-004. For versions, a simple rule is enough.
- Minor changes such as a typo or a broken link raise the last digit, for example from 2.0 to 2.1.
- Changes to the content that affect how work is done raise the first digit, for example from 2.1 to 3.0.
- A draft that is not yet approved carries its own marker, such as "draft 3.0-a", and is never distributed as the version in force.
Keep a revision history table on the first page or at the end of the document. For example:
| Version | Effective date | Change | Prepared by | Approved by |
|---|---|---|---|---|
| 1.0 | 2 Jan 2026 | First issue | [name/position] | [name/position] |
| 2.0 | 15 Jun 2026 | Vendor verification step added | [name/position] | [name/position] |
| 2.1 | 1 Sep 2026 | Form name corrected | [name/position] | [name/position] |
The diagram below follows one document from draft to the withdrawal of the old version.
Distribution lists
A distribution list records who is entitled to receive a document, in what form and since when. For each document, note the recipient's position (not only the name, because people change roles), the number of copies, the form of the copy (paper or digital) and the date received. When a new version is issued, this list tells you who must be informed and who must return the old copy.
Highly confidential documents need extra care. If a copy reaches someone who should not have it, you need to be able to trace who it was issued to. The guide on watermarking confidential documents covers this.
Withdrawing obsolete copies
Withdrawal is often forgotten because all the attention goes to issuing the new version. A practical sequence is this.
- Set the effective date of the new version, and declare the old version void from the same date.
- The document owner checks the distribution list and informs every recipient.
- Recipients return or destroy the old printed copies and sign a confirmation on the distribution list.
- The old file in working folders is moved or marked as obsolete.
- One copy of the old version stays in the document history, marked "obsolete" with the date of withdrawal.
The last step matters because you will still need the old version to answer questions such as which rule applied when an incident happened. How long it is kept follows your records policy, and the guide on how long to keep company documents covers the basis.
Who approves a revision
The author, the reviewer and the approver should be different people. The document owner proposes the revision, a reviewer who understands the content checks that it is correct, and the person with authority over the process approves it. The level of approval can match the impact of the document: a form change may only need the head of department, while a company-wide policy change should go up to the directors. How to design these levels is covered in the guide on document approval workflows.
Before approving, the approver needs to see what changed. Comparing two versions side by side is far more reliable than relying on the proposer's summary.
The audit trail
An audit trail is a chronological record of what happened to a document: who changed it, who approved it, when a version was issued and when the old one was withdrawn. It matters when an internal auditor, a manager or an outside party asks why a rule changed and who decided it. If the record is scattered across email and memory, answering takes days. If you manage it in a spreadsheet, assign one person to update it with every revision.
How Obscura helps
In Obscura every upload becomes a new version, and earlier versions stay available to view. You can designate one PDF as the official copy, compare two versions with their metadata before a revision is approved, and set who may view and change each document. The audit log records changes, decisions and activity on each document, so nobody has to collect evidence from several applications. For the approval route of a revision, see approvals and e-signatures. The full description is on the document control page, and the security side is on the security page.