Quality Documentation Manager

ISO 13485:2016 §4.2 Document Control Requirements

Section 4.2.3 defines what a controlled document system must do. The standard is explicit — these are auditable requirements, not guidelines:

• Documents must be reviewed and approved for adequacy before issue
• Changes and current revision status must be identifiable (typically via a revision history table on the document itself)
• Relevant versions of applicable documents must be available at points of use — not just filed in a central location
• Obsolete documents must be prevented from unintended use, with retained obsolete documents clearly identified
• Documents of external origin (ISO standards, regulatory text, customer specifications) must be identified and distribution controlled

"Controlled copy" definition: A controlled copy is a document instance that is covered by the document control system — meaning it receives updates when the master is revised and is retrievable when the document is obsoleted. Printed controlled copies require a mechanism to prevent ongoing use of outdated prints; most auditors expect either a "uncontrolled if printed" watermark on electronic documents or a controlled print register for paper-distributed copies.

Review frequency: ISO 13485 does not specify a review interval. Most QMS procedures define annual review as standard, with additional triggered review after nonconformances, regulatory changes, or process modifications. The review must be documented — a calendar reminder is not evidence.

Document Hierarchy

The four-tier quality document model separates intent from execution:

Why conflating tiers causes audit findings: A procedure that contains step-by-step operator instructions will require re-approval every time an operator's technique changes — elevating a routine operational update into a formal document change event. Conversely, a work instruction that contains scope and policy language creates ambiguity about which document governs in case of conflict. Keep tiers distinct: procedures reference work instructions; work instructions reference forms; none of them replicate content from the tier above.

Effective Date Synchronization

When a procedure is revised, every work instruction and form it references must be reviewed and either confirmed as still current or revised concurrently. All affected documents in a change set should carry the same effective date.

How misalignment creates a nonconformance: If Complaint Handling SOP v3.0 (effective 1 March) references Complaint Intake Form FRM-QA-015 v2.0, but the current approved form is v2.1 (effective 15 February), the SOP is referencing an obsolete document from the moment it is issued. An auditor will cite this as a failure of document control under §4.2.3.

Practical mitigation: Use a Document Change Request (DCR) that requires the initiator to list all documents that cross-reference the changed document. The document controller reviews the list before approving release. This creates a traceability chain from the DCR through all affected documents.

Common Audit Findings in Document Control

1. Obsolete documents accessible to users. The most cited finding globally. Obsolete revisions left in shared drives, email attachments, or local desktop folders. Mitigation: enforce a single source of truth; archive immediately on release of new version; audit shared drives quarterly.

2. No evidence of periodic review. Document headers show "Review date: annually" but no review records exist. A reviewed-and-unchanged document must still produce a record showing who reviewed it, when, and what conclusion was reached.

3. Approved-by signatures undated. An approval signature without a date cannot demonstrate that the document was approved before it was issued or used. Electronic QMS systems that timestamp approvals automatically eliminate this finding.

4. Revision history missing rationale. "Updated section 4.3" is not sufficient. Auditors expect a brief description of what changed and why — especially when the change is CAPA-driven. The rationale links the document system to the corrective action system.

5. Training records not linked to document changes. Releasing a new document version without evidence that affected personnel were trained on the changes is a §6.2 finding (competence), often raised in conjunction with the document control finding.

Electronic QMS Considerations

21 CFR Part 11 applicability: If your device is subject to FDA oversight and you use electronic records and electronic signatures to satisfy FDA record-keeping requirements, Part 11 applies. Key requirements: audit trail that records who made each entry and change, with date and time; the ability to reconstruct prior record states; electronic signatures that are attributable to an individual and cannot be repudiated.

What Part 11 does not require: A validated QMS software product is not mandatory. A configured SharePoint instance with documented validation testing, access controls, audit logging, and a system administrator procedure can satisfy Part 11. The burden is on the organization to document the validation.

Audit trail minimum requirements: Every controlled document must have a record of: who created it, who approved it, when each action occurred, and what changed in each revision. Systems that allow post-hoc editing of records without leaving a trace are non-compliant.

Electronic signature validity: Under Part 11, an electronic signature must be linked to the record it signs, executed only by the signature's owner, and accompanied by the meaning of the signature (e.g., "Approved," "Reviewed"). A checkbox or free-text name field does not constitute an electronic signature.