How long should manufacturers keep quality records?

Is there one retention period for all quality records?#

There is no single retention period for manufacturing quality records; each record type gets its own period, set by the strictest requirement that applies to it. ISO 9001 requires an organization to control the retention and disposition of the documented information it keeps, but it leaves the number of years to the organization.

In practice the strictest requirement often sits outside the quality manual. An aerospace purchase order clause, an automotive customer-specific requirement or a supply agreement for a medical device component can each demand longer retention than your own procedure. Product liability exposure may justify keeping some records longer for parts that stay in service for many years, and counsel should set those periods.

The COO's job is to turn those scattered requirements into one schedule that quality, IT and the shop floor can all follow. A usable schedule names the record, the system that holds it, the period, the event that starts the clock and the person who approves disposal.

Retention approach by quality record type#

Retention for each quality record type follows its strongest driver, which is usually a customer requirement, a certification standard or the need to trace shipped product. The table shows the usual drivers and a sensible way to set retention for each; the actual periods come from your customer contracts, your certification body's expectations and advice from counsel.

Where does the retention clock start?#

The retention clock should start at a trigger event tied to the product, not at the date the record was created. A first article report for a part you still ship every month is current evidence however old it is, and destroying it under a creation-date rule leaves you unable to answer a customer audit.

Pick one trigger per record family and write it into the schedule. These are the common ones.

• 1Last shipment of the part number or revision, for inspection and traceability records.
• 2End of the customer program or contract, where the customer agreement counts from program end.
• 3Closure of the NCR, CAPA or complaint, for investigation records that stand on their own.
• 4Retirement of the gauge or machine, for calibration and maintenance history.
• 5Separation of the employee, for training and qualification records, subject to employment law advice.
• 6Release of a legal hold, which suspends disposal for every record it covers.

Which customer clauses override your own schedule?#

Customer requirements override your internal schedule whenever they are longer, and they are often buried in documents the quality team does not read every day. Purchase order quality clauses, supplier quality manuals, quality agreements and the terms printed on the back of a PO can all set retention, access and destruction rules.

Aerospace and defense customers commonly flow down record requirements through numbered quality clauses on each PO, and automotive customers publish customer-specific requirements that sit on top of IATF 16949. Read the clauses for each active customer, record the longest period per record type, and note any duty to notify the customer or offer records back before destruction.

Customer agreements can also shorten what you may keep. Many NDAs and supply agreements require you to return or destroy drawings, specifications and other confidential information when the relationship ends. Give customer-owned design material its own line in the schedule so it follows the contract rather than the quality procedure.

How do you keep retained records readable after a system change?#

Retained quality records stay useful only if someone can still find, open and connect them after the system that created them is gone. The most common failure is a QMS or ERP migration that moves open records and leaves closed NCRs, CAPAs and inspection history in a database nobody can query.

Before retiring a system, export closed records with their identifiers intact: NCR number, part number and revision, lot or heat, work order, and customer and supplier codes. Keep attachments such as inspection photos and CMM reports with a key back to the record. Store a read-only copy in a format the company controls, document the fields and name an owner for the archive.

Paper travelers and binders deserve the same discipline. Scanning them helps only if each scan is indexed by part, lot and date; an unindexed folder of PDFs meets the letter of retention and fails every practical test.

One schedule, two questions: keep it, and can it be reused?#

A retention schedule answers how long you must keep a record; a reuse review asks whether a record you already keep has value beyond compliance. Inspection results, MRB dispositions and CAPA investigations capture real engineering judgment, the kind of operational history AI developers license to train and evaluate models.

The two questions have different owners. Retention belongs to quality and legal, while reuse depends on who controls the content. Your own process decisions are usually yours to consider; customer drawings, customer specifications and anything from export-controlled work generally are not.

Illustrative: a valve components machine shop rebuilds its schedule#

Illustrative: a fictional valve components manufacturer machines bodies and stems for industrial customers and runs aerospace work for one customer. Its quality records are split across an ERP with lot traceability, a spreadsheet NCR log, CAPAs written as Word documents on a shared drive, and calibration history in a paper binder.

The COO asks quality to list every record type and its drivers. The review finds that the aerospace customer's PO clauses require far longer retention than the company procedure, and that the NCR spreadsheet has no lot field, so NCRs cannot be tied to shipped product. The company moves NCRs and CAPAs into one QMS, back-fills lot numbers for active part numbers, indexes the calibration binder by gauge ID and starts every inspection clock at last shipment.

The outcome is a schedule auditors can follow and an archive that can be searched. Leadership also notes that its NCR and inspection history, kept for compliance anyway, is a candidate for a metadata-only fit check, with aerospace job records and customer drawings excluded from the start.

How SourceX looks at retained quality records#

SourceX treats a retention schedule as a map of what history exists and what must stay out. In the Supply step of the SourceX five-step transaction, a manufacturer describes record families, systems and years of accessible history as metadata only; no files move during the initial assessment.

Under the SourceX Enterprise Data Value Framework, retained quality records are rated on drivers such as domain expertise, human-generated signal, recency, data cleanliness and rights. Customer-owned designs and export-controlled work are removed during the Rights step, and anything that proceeds is documented in a SourceX Evidence Packet covering provenance, licensing rights, permitted use, the privacy record and release authorization.