I am asking myself this exact question so I resurrected this thread.
After going through many threads regarding this problem I got that basicly there are two kinds of external documents that require control:
1. Standards, regulations and manuals followed by company
2. Documents that specify customer requirements
(please correct if I am wrong)
My puzzle regards the second kind. Our company do not receive any specs or blueprints to follow. Customers indicate their requirements during sales process in a phone conversation and e-mail. Most of the requirements are voiced over the phone and maybe some issues are agreed via e-mail. Our reference for fulfilling customer requirements is an order (where seller collects all the info) that is confirmed by customer.
Should I explicitly mention this fact in our doc control procedure? So that it is justified and will not create NC?
Here is how the procedure looks at the moment
"XYZ recognises external documents that are relevant for the control procedure as those that are affecting the final product delivered to XYZ customers but are not originating in XYZ. Specifically those documents are:
Governmental regulations pertaining to XYZ
Standards and operating manuals followed by XYZ
External documents are controlled by Master list maintained by MR"
Is such delimitation correct? I want to avoid unnecessary work when the system is running and include things like eg. business correspondance we receive.
I read the 9001 norm, use my common sense and I really do not see any other external documents that we must have a control of.
Please help

and thank you so much for all advice.
--
Maja