ISO 9001 does not hand you a maintenance procedure template, and it does not say “you must run a preventive maintenance program.” It requires you to keep the infrastructure and environment your processes depend on in working condition, and to keep enough documented information to show that this happens as planned. How you get there, and how much you write down, is your decision.

That flexibility is where most teams get stuck. Too little documentation leaves an auditor with nothing to verify. Too much creates paperwork nobody follows. This guide explains what the standard asks for, what a workable maintenance procedure contains, which records prove conformity, and how to decide retention periods.

TL;DR

• ISO 9001:2015 does not specifically require procedures. It requires documented information to the extent needed to support processes and give confidence they run as planned.
• Clause 7.1.3 covers buildings, utilities, equipment (hardware and software), transportation and information and communication technology that your processes need.
• A practical procedure identifies what gets maintained, sets intervals and activities, and produces records of what was actually done.
• There is no fixed ISO retention period for maintenance records. Set one based on legal, customer, contractual and internal needs, and write it down.
• A CMMS keeps schedules, work orders and history in one controlled place, which makes audit evidence easy to retrieve.

Table of Contents

• What ISO 9001 actually requires for maintenance
• Which assets and conditions fall under ISO 9001 maintenance
• What a maintenance procedure should include
• Maintenance records that demonstrate conformity
• How long to keep maintenance records
• Controlling maintenance records under clause 7.5
• Our perspective: procedures should come from the work order, not the other way around
• How a CMMS supports ISO 9001 maintenance
• Common audit findings, and how to avoid them
• FAQ
• Sources

What ISO 9001 actually requires for maintenance

The first thing to settle is whether you need a written procedure at all. ISO’s own guidance on documented information states that ISO 9001:2015 does not specifically require procedures. Clause 4.4 asks organizations to maintain documented information to support the operation of processes and to retain documented information that gives confidence the processes are carried out as planned.

In the United States, the standard is adopted as ASQ/ANSI/ISO 9001:2015, which ASQ identifies as identical to ISO 9001:2015. The same requirements apply whether you are audited in Ohio or Osaka.

Certification body guidance points the same direction. TÜV SÜD notes that the standard requires neither a quality manual nor documented procedures generally, and that the right amount of documentation depends on organization size and process complexity.

In practice, this gives you three questions to answer:

1. Does maintenance affect whether your product or service meets requirements? For almost every manufacturer and for many service operations, yes.
2. Would people perform maintenance inconsistently without written instructions? If so, a procedure is worth having, even though no clause forces it.
3. Can you show an auditor that maintenance happened as planned? That is the evidence requirement, and it is the one that matters most.

A small shop with two machines and one maintenance lead may satisfy auditors with a short schedule and a log. A multi-site plant with regulated products will need something more structured. Both can conform.

Which assets and conditions fall under ISO 9001 maintenance

Maintenance requirements come mostly from clause 7.1 on resources. Clause 7.1.3 asks you to determine, provide and maintain the infrastructure needed for process operation and for conformity of products and services. The Management Systems Professionals Association lists the categories as:

• Buildings and associated utilities
• Equipment, including hardware and software
• Transportation resources
• Information and communication technology

The published text of the standard also asks you to maintain the environment for the operation of processes, including physical conditions such as temperature, humidity, lighting, airflow, hygiene and noise. For a food packager, a cleanroom operator or a lab, work-environment maintenance can matter as much as machine maintenance. Think HVAC filters, humidity control and lighting in inspection areas.

Monitoring and measuring equipment is a related but separate case. The same text says these resources must be maintained so they stay fit for their purpose, and that documented information must be retained as evidence of that fitness. Gauges, scales, torque tools and test instruments belong in your maintenance scope, even if the calibration program is run by a different team.

Scope by criticality, not by habit

You do not need to treat every asset the same. A sample procedure from 9001Simplified recommends selecting equipment critical to production or service and the work-environment characteristics that need periodic maintenance. Ask which assets, if they failed, would cause nonconforming product, missed delivery or a safety event. Those get planned maintenance and full records. Low-impact assets can run on a lighter regime, such as inspect-and-replace or run-to-failure with a documented rationale.

What a maintenance procedure should include

If you decide a written procedure helps, keep it short and operational. Based on the sample procedure above and on the way larger manufacturers structure their quality systems, a workable document covers these elements.

1. Purpose and scope. State which sites, asset classes and environmental conditions are covered, and which are excluded and why.
2. Equipment and condition identification. Maintain a master asset list. One published quality manual from a large manufacturer describes a preventive maintenance system spanning production equipment, support equipment, facilities equipment and related tooling, built on a master equipment list.
3. Intervals and activities. For each critical asset, define what is done and how often. The 9001Simplified sample suggests that equipment intervals generally follow manufacturer recommendations, adjusted for nonstandard use, while work-environment intervals draw on management experience.
4. Adjusting frequencies. The manufacturer manual mentioned above says its preventive maintenance frequencies are typically based on OEM recommendations and adjusted using supporting risk data. It also controls changes to schedules, qualified spare parts, tools and maintenance procedures through change control. Your version can be lighter, but the principle holds: any change to the plan should be deliberate and recorded.
5. Spare parts and consumables. Name the parts that must be on hand to keep critical equipment running. Our article on expected value critical spares planning shows one way to decide what to stock.
6. Responsibilities. Say who schedules, who performs, who verifies and who approves return to service.
7. Records. List what gets recorded, where, and for how long (covered below).

Keep the procedure honest

Write what your team actually does. An auditor will compare the document against the shop floor, and a procedure that describes an idealized process creates findings. If your technicians already work from OEM manuals and a calendar, say so and reference them rather than rewriting them.

Maintenance records that demonstrate conformity

The procedure is the plan. The records are the proof. The 9001Simplified sample lists the following as useful content for a maintenance record: asset or condition description, planned and actual intervals, activities performed, unusual observations or problems, the responsible person, and the date or time.

Here is how that translates into a record design:

Pay attention to the gap between planned and actual. Auditors rarely penalize a missed PM that was noticed, explained and rescheduled. They do penalize a schedule with no evidence of follow-through, or records that look filled in after the fact.

For measuring equipment, add calibration status and the result of any check, since the standard asks for evidence that these resources are fit for purpose.

How long to keep maintenance records

People searching for a retention period usually want a number. ISO 9001 does not provide one. ISO’s guidance says to retain documented information to the extent necessary to have confidence that processes are carried out as planned.

So the period is yours to set, and it should reflect real drivers. Sprinto’s guidance on document controls says retention is based on legal, customer, contractual and internal requirements. Examples of what that can mean:

• Legal. Safety, environmental or industry regulations may require specific retention for certain equipment, such as pressure vessels, lifts or fire systems. Check the rule that applies to your sector and jurisdiction.
• Customer. Automotive, aerospace, medical device and similar customers often set retention terms in supplier agreements.
• Contractual. Warranties and service contracts may require proof of maintenance for the life of the warranty.
• Internal. Failure analysis and reliability work benefit from long histories.

For a sense of what an internal policy can look like, one manufacturer’s quality manual states that equipment maintenance information and data are kept for the lifetime of the equipment. That is that company’s policy, not an ISO rule, but it is a sensible default for critical assets because the history stays useful until the machine leaves service.

Whatever you choose, define it in your documented-information controls and dispose of records in a controlled way once the period ends, as Sprinto recommends. A written retention schedule that you actually follow beats a generous one that nobody enforces.

Controlling maintenance records under clause 7.5

Records count as documented information, so clause 7.5.3 controls apply. A sample control procedure maps these to distribution, access, retrieval, storage and preservation, change control, retention and disposition. For maintenance, that raises practical questions:

• Can the person who needs a record find it quickly, including during an audit?
• Can someone alter a closed work order without a trace?
• Are records backed up, and are paper logs stored where they will not be damaged?
• Who can see or change them?

The same sample recommends protecting records against unauthorized modification, deletion, loss or disclosure through measures such as access controls, version locking, backups and encryption where applicable. Spreadsheets on a shared drive and binders in a supervisor’s office struggle on most of these points. That is a main reason teams move maintenance records into a system built for them.

ASQ’s QMS guidance adds a useful frame: implementation moves through design, build, deploy, control, measure, review and improve, and the specifics vary with organization size, risk and environmental impact. Routine, systematic audits support control and measurement. Internal audits of maintenance records are therefore a good habit before the external auditor arrives.

Our perspective: procedures should come from the work order, not the other way around

We talk with maintenance teams every week who are preparing for ISO 9001 audits, and the pattern is consistent. The teams that struggle wrote a beautiful procedure first and then tried to make the shop floor match it. The teams that pass without drama let the maintenance system produce the evidence as a byproduct of normal work.

Our view is simple. Put every asset in a register. Attach a preventive maintenance schedule to each critical one. Generate work orders automatically, close them with the tasks done and the findings noted, and let the history accumulate. Then write a one- or two-page procedure that describes what the system already does. The audit conversation becomes a walkthrough, not a document hunt.

We also think ISO 9001 maintenance is rarely a stand-alone effort. The same records support asset management programs, regulated environments and internal reliability work. If you want to see how the same data serves related frameworks, read our pieces on audit-ready CMMS records for ISO 55001 and on building a GMP maintenance program.

— Mark

How a CMMS supports ISO 9001 maintenance

A computerized maintenance management system does not make you compliant on its own. It makes the evidence easier to produce and harder to lose. The features that matter for an audit are:

• Preventive maintenance automation. Schedules generate work orders on time, which shows maintenance was planned.
• Work order history by asset. Every task, finding, part and technician is attached to the equipment record.
• Calendar scheduling. Supervisors can see what is due and what is overdue at a glance.
• Inventory for parts and supplies. Spares are tied to the assets that need them.
• Reporting. Completion rates and overdue work can be shown to auditors and management reviews.
• Compliance and regulatory recordkeeping. Records stay consistent and retrievable for the retention period you set.
• Condition-based triggers. Where sensors or readings justify it, maintenance can be triggered by condition rather than a fixed interval. See how condition-based maintenance works in MPulse.

For a deeper look at mapping software features to the standard, see our guide on CMMS features that manage ISO 9001 maintenance requirements.

Getting started with MPulse

MPulse CMMS gives facility, manufacturing and maintenance teams one controlled place for schedules, work orders, assets, inventory and reports. Plans are published on our pricing page: Professional is $29 per month per user and Advanced is $79 per month per user. Requesters, the people who submit maintenance requests, are unlimited and free. If you want help setting up asset records and PM schedules, our implementation and training services cover that work.

Common audit findings, and how to avoid them

Auditors tend to return to the same weak points. Check these before your next audit.

• A schedule exists but records do not match it. Reconcile planned and actual dates, and document why tasks slipped.
• Measuring equipment is missing from the maintenance scope. Include gauges and test instruments, and keep evidence they are fit for purpose.
• Work environment is ignored. If temperature, humidity or cleanliness affects conformity, show how those conditions are maintained.
• Intervals have no rationale. Note whether they come from the manufacturer, from history or from risk, and record why they changed.
• Retention is undefined. Put the period and the reason in your documented-information controls.
• Records can be edited without a trace. Lock closed work orders and limit who can change history.

Fixing these rarely needs new documents. It usually needs consistent habits and a system that captures them.

FAQ

Does ISO 9001 require a preventive maintenance program?

No. ISO 9001:2015 does not specifically require procedures, and it does not prescribe a preventive maintenance program. It does require you to maintain the infrastructure and environment your processes need, and to retain evidence that processes run as planned. For most organizations, planned maintenance is the simplest way to meet that.

What maintenance records will an auditor ask to see?

Expect requests for the asset list, the maintenance schedule, completed work orders for critical equipment, and evidence for measuring equipment. Records should show the asset, planned and actual dates, tasks performed, findings and who did the work. Auditors often sample a few assets and trace the history from plan to completion.

How long should we keep maintenance records?

ISO 9001 sets no fixed period. Retain records as long as needed to show that processes were carried out as planned, and consider legal, customer, contractual and internal requirements. Define the period in your documented-information controls. Many organizations keep records for critical equipment for the life of the asset.

Can we keep ISO 9001 maintenance records in a spreadsheet?

The standard does not forbid it. The difficulty is control: spreadsheets make it hard to prevent unauthorized edits, track versions, and retrieve history quickly. A maintenance system with access controls, locked closed records and backups handles those clause 7.5.3 concerns more reliably.

Does the same standard apply in the United States?

Yes. ASQ/ANSI/ISO 9001:2015 is identical to ISO 9001:2015, so the requirements are the same. Separate US regulations for your sector, such as safety or environmental rules, may add their own recordkeeping duties.

Sources

• ISO Guidance on the requirements for Documented Information
• ASQ/ANSI/ISO 9001:2015: Quality management systems
• TÜV SÜD, Quality at a glance
• ISO 9001 Clause 7.1.3 Infrastructure, Management Systems Professionals Association
• ISO 9001:2015 standard text (NBR ISO 9001 reproduction)
• 5.4 Maintenance sample procedure, 9001Simplified
• Entegris quality operating system manual
• ISO 9001 Document Controls: Clauses & Requirements, Sprinto
• ISO 9001 Control of Documented Information Procedure sample
• What is a Quality Management System (QMS)? ASQ

Recommended

• Pharma Teams: Field-Level GMP Maintenance Records and CMMS Steps
• Building a GMP Maintenance Program That Passes Inspection
• CMMS Features Manage ISO 9001 Maintenance Requirements
• Simple Preventive Maintenance Can Boost PM Effectiveness