The ISO 13485 standard for Medical Devices – Quality Management Systems – Requirements for Regulatory Purposes establishes that the documentation required by the Quality Management System (QMS) must be kept under control. But what does document control entail?
Document control includes a series of activities—usually mostly handled by the Quality Office—such as:
- Reviewing and approving documents to ensure their adequacy before issuance
- Revising, updating (when necessary), and re-approving documents
- Ensuring that the revision status and changes of each document are easily identifiable
- Ensuring that the updated version of all documents is always available at points of use
- Ensuring that documents are always legible and easily identifiable
- Ensuring that documents are adequately protected and kept confidential, if necessary
- Ensuring that external documents are identified and that their distribution is controlled
- Preventing deterioration and loss of documents
- Preventing unintentional use of obsolete documents by uniquely identifying them
To keep track of all the documents that make up the organization’s Quality Management System and their current status, it would be advisable to list all documents—including external ones—within a form that allows for proper identification of all documents, including any internal coding, their index, last revision date, and, if applicable, issuance date.
Drafting, Review, and Approval of Documents
The organization should identify the functions responsible for drafting, reviewing, and approving QMS documents.
It would be appropriate to assign the drafting phase to the person responsible for the process addressed by the document (possibly supported by the Quality Office), as they are the one who knows the process best and can provide a very precise and detailed description of all the activities performed. The Quality Office should then verify the document’s contents to ensure compliance with the requirements of ISO 13485. Document approval can be entrusted to a managerial or executive function, or to management itself, as evidence of their commitment to the Quality Management System.
Documents should be understandable, simple yet complete, correctly identified, and consistent with other QMS documents and relevant standards.
Management of Changes
Documents should be periodically reviewed (usually in conjunction with Management Review), updated—if necessary—and re-approved whenever the need arises (for example, following changes to an operational process or as a result of a corrective action, etc.).
Modified documents should be reviewed and approved by the original functions.
Additionally, changes should be appropriately identified (for example, by using a different color, highlighting or underlining new or modified text, and striking out text intended for deletion).
Distribution
The function responsible for controlling QMS documentation should make updated documents available to all personnel in the organization, eliminate obsolete versions, and notify via written communication (e.g., email) in the event of the issuance of new documents and/or changes to existing documents. This communication should contain a brief description of the new document or a summary of the changes made.
Finally, the organization should provide specific information/training activities in the case of issuing new documents or in the case of significant changes, directed at the business functions most involved.
External Documents
External documents should also be adequately controlled: identified, distributed within the organization, and kept updated.
External documents may include:
- Management system standards (e.g., ISO 13485)
- Technical product standards
- Official guidelines
- National and international legislative acts and regulations
- Documents issued by customers, suppliers, and external stakeholders
- Contractual documents issued by the notified body and/or the relevant certification body
Periodically, the organization should verify the update status of external documents and, in the case of new editions being issued, evaluate the impact of the changes on products, processes, and the organization’s QMS.
Retention of Documents
The organization should establish the period during which at least one copy of obsolete QMS documentation must be retained, taking into consideration any applicable regulatory requirements.
It must also ensure that, throughout the indicated period, the documents remain legible and do not deteriorate.
For this reason, it is good practice to prefer electronic storage over paper storage: by electronically archiving all QMS documents, it is then possible to subject them to periodic backups, thereby reducing the risk of deterioration or loss.
