What is document control?
It is the set of criteria that allows for the consistent creation, use, and maintenance of occupational health and safety (OSH) information. Its purpose is to ensure that current instructions reach the workplace, that modifications are identified, and that records can be retrieved and interpreted when needed. The system can be digital, paper-based, or a combination of both.
Mandatory preventive documentation establishes some of the required content, but document control is responsible for its functionality. A folder with many files can become unmanageable if versions are not differentiated or if access is restricted. Conversely, a simple structure can be effective if it is tailored to the activity and has clear responsibilities.
Documents and records
A document describes information that can be updated: a procedure, an assessment, a plan, or an instruction. A record documents an activity or outcome: a check, attendance, a measurement, or a decision. This distinction helps determine what to review, what to replace, and what to preserve as historical evidence.
Correcting a record should not opaquely erase what happened. Traceability of relevant corrections must be maintained, identifying who makes them and why. Nor is it enough to simply keep a file if it cannot later be linked to the equipment, site, person, or period to which it corresponds. The meaning of the data is part of its usefulness.
Identification, review and approval
Each document type requires a sufficiently clear identification, a responsible person, and approval criteria commensurate with its impact. Title, code, version, effective date, and scope can be used. Not all documents require the same process: a critical operating instruction requires a different review than an informational notice.
The review should verify both the technical content and its practical application. Instructions that are understandable in the office may be of little use when working with a machine or in the field. It is advisable to discuss them with those performing the task and ensure that they describe the expected conditions, the necessary checks, and the procedures to follow in case of changes or incidents.
Distribution and access at the workstation
The organization must define where the current version can be accessed and how previous versions are removed or identified. Access should take into account shifts, remote locations, partner companies, and offline situations. Certain tasks may require accessing information outside the standard system, while maintaining a mechanism for updating it.
Permissions are assigned based on job functions and the sensitivity of the information. Providing access to an operational instruction does not imply opening health records for the entire organization. Traceability in occupational health and safety must be compatible with confidentiality and the ability to consult the information necessary to work safely.
Changes, conservation and recovery
A process modification may require updating several related documents. It’s important to identify dependencies between assessments, instructions, training, permissions, and controls. Changing a file without reviewing these relationships creates inconsistencies: a new instruction might coexist with a checklist that still reflects the previous procedure.
Retention periods should be established based on document type, legal requirements, and evidence needs. There is no single retention period that applies to all occupational safety and health (OSH) documentation. In addition to preservation, retrieval is essential: planned searches, backups, and restorations must be verifiable. A document that is inaccessible when needed offers little preventive benefit.
Practical example
A company modifies the maintenance sequence for a piece of equipment. It updates the digital procedure but keeps an old printed copy in the tool cabinet. Upon discovering the discrepancy, it verifies the affected tasks and removes the outdated version. The investigation reveals that the distribution system did not include copies at that point of use.
A list of locations is created, an update manager is assigned, and the change is linked to the training matrix. The people involved receive the necessary information, and it is verified that they know how to locate the current instruction. In the next change, the locations and communication logs are reviewed, allowing for an assessment of whether the system is working.
Common mistakes and digitization
Common errors include duplicating files indiscriminately, using names like “new final,” accepting informal approvals that are difficult to reconstruct, or mistaking a signature for a technical review. Access can also fail: a perfectly approved document is useless if only one person knows where it’s stored.
Software can facilitate versioning, permissions, notifications, and relationships between evidence, but it needs usage rules and accurate data. Importing disorganized documents into a platform doesn’t automatically solve the problem. If a nonconformity is detected, the response must analyze the document process and its relationship to the work, in addition to the specific file.
Framework and checks
In Spain, Article 23 of the Occupational Risk Prevention Law regulates the preventive documentation that must be prepared and kept available for the labor authority. The Regulation of Prevention Services details the content of the plan, the assessment, and the planning. Specific requirements also depend on the risks, equipment, and activities.
A useful review verifies whether information is current, understandable, accessible to those who need it, and can be linked to evidence of its application. The quantity of documents is not a measure of effectiveness. Document control should support decisions and tasks, preventing administrative effort from replacing intervention in working conditions.
