Records must be identified, stored, protected, retrievable and kept for the contractual and legal period, with access limited by confidentiality.
What applies today
The body must have procedures that define the controls for identifying, storing, protecting, retrieving, retaining and disposing of records related to fulfilling the standard. It must also have procedures for keeping records for as long as its contracts and the law require. Who may read them follows the confidentiality arrangements.
Why it matters
The clause completes the records rules in 7.12 by adding the management controls. The six verbs are a practical checklist: can you find it, is it safe, can you get it back, how long do you keep it and how do you destroy it? Access is part of the control, because a record that everyone can read is not protected even if it is stored in a locked system.
The public FDIS contents lists clause 8.4 as Control of records (Option A). This site uses the shorter label Control of records for the page. The FDIS requirement wording is not held, so the requirement above is the 2012 text that applies until publication.
Where this clause lands in the revision
Clause 8 is where the 8.8 replacement meets management review, internal audit and corrective action. The public record confirms the titles; the requirement wording is not held. A first artefact an assessor commonly asks for here is records procedure covering identification, storage, protection, retrieval, retention and disposal. The party this touches first is The records owner and every team that creates or stores certification records.
What the assessor asks for
| Category | Artefact to have ready |
|---|---|
| Procedure | Records procedure covering identification, storage, protection, retrieval, retention and disposal |
| Schedule | Record types with owner, location and retention period |
| Access | Role-based access list consistent with confidentiality |
| Retrieval | Test retrieval of a selected record within the stated time |
| Disposal | Disposal record with approval and method |
One common question. ask for a record from a closed certificate and for the rule that says how long it is kept. A retention period with no contractual or legal basis is a weak answer.
Common failures
- Records are kept forever because no one has decided
- Access is granted to the whole company
- Disposal happens without a record
Prepare before publication
Build the records schedule from the scheme, the contracts and the law. Give each record type one owner.
Dates that matter
The public record gives stage 50.20 on 4 August 2026 and voting to 27 October 2026. The planning date, 15 February 2027, is an estimate from that stage and not an ISO date, and clause 8.4 has no separate date.
Cross-references
4.5 Confidentiality · 7.12 Records · 8.3 Control of documents
Source
Source for 8.4: ISO/IEC 17065:2012, Clause 8.4, with the ISO/IEC FDIS 17065 public record. Our statement, not the instrument verbatim; the FDIS wording is not held.
Not legal advice; does not certify. A reading of the requirement and the evidence an assessor commonly samples, not a substitute for the standard or your accreditation body's rules.