October 2026. Auditors often start with the simplest question: is this the current version, and who approved it? Clause 7.5 of ISO 27001 requires documented information to be controlled. That does not have to be bureaucracy, but it does have to be accurate.
What clause 7.5 actually requires
The standard expects documents to be identifiable (title, date, author or reference), approved before use, available where needed in the right version, and protected and retained. It covers policies, procedures and evidence. See also document control.
One owner per document
Give every document one owner, by name or role. The owner reviews it at least annually and reports changes. Without an owner a document silently ages, and auditors see that as a policy that still names a colleague who left. Put the owner and the next review date in the document header.
Versions: choose one place
Keep policies and procedures in one place that tracks version history automatically, such as SharePoint or a wiki with history. Email copies are the main cause of two current versions. Agree that only the central location counts and that PDF exports carry a date.
Making approval demonstrable
Approval can be a status change in the system, an agreement in the minutes or a signature. Pick one method and apply it consistently. For high-level policy such as the information security policy, approval belongs with top management; see the management review. For work instructions the process owner is enough.
Evidence is documented information too
Logs, minutes, audit reports and training records fall under the same rules, each with its own retention period. Record those periods in one overview. Automated evidence collection helps but does not replace the agreements. Shortly before the audit, spot-check that the links in your evidence folder still work.