Do emails count as records for the management system?

Yes, and ignoring that fact has burned more companies in audits than I can count.

ISO 9001:2015 clause 7.5 covers documented information, and it does not care what format your records are in. If an email contains evidence that something happened, a decision was made, approval was given, or a requirement was communicated, it is documented information. Full stop.

The thing I see constantly is businesses with beautifully formatted procedures and register templates, and then all the actual decisions happening in someone's inbox that nobody can find. Your auditor is not going to be impressed by your forms if the real story is buried in Outlook.

Emails that typically become records include:

• Customer approvals or changes to scope or specs
• Supplier confirmations of requirements
• Internal sign-offs on nonconformances or corrective actions
• Management decisions about risks or objectives
• Complaints received and responses sent

The tricky part is that most businesses have no policy around this. So when you need to demonstrate you followed up on a corrective action or got sign-off on a design change, someone is frantically searching their deleted items at 11pm before the audit.

What ISO 9001:2015 clause 7.5.2 actually requires is that you can identify, store, protect, retrieve, and retain documented information. An email sitting in one person's personal inbox fails almost every one of those criteria.

Practical move right now: have a conversation in your next management review about where your real evidence actually lives. Not where your procedure says it should live. Where it actually lives. Then decide if you need a shared folder, a naming convention, or just a habit of copying a central inbox.

The system should reflect how you actually work, not how you wish you worked. Get those emails treated as the records they genuinely are and you will sleep a lot better the night before your surveillance audit.