Guide · Confluence
ISO 9001 documented information: showing a review in Confluence
Attestation Flow for Confluence 3.1.0 is the production version (30 October 2026). Last updated 1 November 2026. On the Atlassian Marketplace.
By Bartosz Stankiewicz, founder, Stanki Guild.
If your quality system keeps its procedures in Confluence, an audit will ask how you know each one is still current and who said so. This page is about the records, not about the standard's wording.
Which edition
#The ISO catalogue page for ISO 9001:2015, read on 30 October 2026, states: "This current edition has now been withdrawn and replaced by ISO 9001:2026". Check with your certification body which edition your audit uses.
What we do not do here
#The text of ISO 9001 is sold by ISO, so we do not quote clauses and we do not tell you which clause a record satisfies. The standard's text for your edition is the reference, and your auditor decides what counts as evidence. What follows are the records a document review usually leaves, and how to produce them.
Records a document review leaves
#| Record | Native Confluence | With Attestation Flow (paid) |
|---|---|---|
| Who owns the document | A field you maintain yourself, for example in Page Properties | Review owners, up to 10 people; by default the requirement owner and the page owner |
| When it must be reviewed next | A date you type | A review cycle of 30 to 1095 days; the next date is computed and shown in the page box |
| That the owner reviewed it | Nothing is recorded; a new page version proves an edit, not a review | Reviewed, no changes with a note, signed into a tamper-evident log with the page version and a content checksum |
| That people read it | Not tracked | Receipts per reader and page version |
| Overdue documents | You build a report | A Next review column and a filter for overdue pages in the compliance dashboard |
| Something to hand to an auditor | Page history | An audit evidence pack PDF with the policy, receipts and review history |
Native Confluence has had open requests for a review mechanism since 2004 (CONFCLOUD-1675, 52 votes) and for page expiry since 2007 (CONFCLOUD-9699, 68 votes). More on the Confluence side in Confluence page review date, owner and next review.
Limits to keep in mind
#- A recorded review shows that a named person confirmed a version on a date. It does not show that the review was thorough.
- The app records and reminds; it does not decide whether your document control meets the standard.
- Records imported from other tools stay labelled as imported and do not count as acknowledgements.
For information security policies, see ISO 27001 policy acknowledgement evidence.
What we have not shown live yet
#Periodic review, the review log entry and the evidence pack's review history are described in the documentation and covered by tests. We have not run them on a live site for this page.
Common questions
#Is Attestation Flow ISO 9001 certified or compliant?
No. We hold no ISO certification and make no compliance claim. The app produces records you can show; whether they meet your standard is for you and your auditor to decide.
Related
#- Attestation Flow for Confluence documentation
- Confluence policy templates
- Attestation Flow compared with other Confluence apps
- Read and understood in Confluence: how to get proof, not just page views
- Confluence policy: owner, review date and next review
- Policy acknowledgement evidence for ISO 27001 and SOC 2 audits: what to keep, and how to produce it from Confluence
- ISO 27001 awareness for staff: how to run a quiz, and keep the evidence
- Policy acknowledgement nudges in Slack and Microsoft Teams with Confluence Automation
- Comala Document Management alternative for Confluence: when Attestation Flow fits and when it does not
- When is "everyone has read it" actually true? Testing read and understood in Confluence