ISO 13485 Document Control

Organizations implementing ISO 13485 or 21 CFR 820 must maintain a large number of critical documents. ISO 13485 Document control must be established over all internal documents and those of external origin, covering their preparation, issuance, adequacy, approval, re-approval, revision, retrieval, availability, legibility, archival, storage, and destruction. The specific documents that require control can differ based on the risk class of the medical device produced. Common documents subject to ISO 13485 document control include:

• Quality Policy, Manual, and Objectives
• Quality Procedures, including validation procedures
• Medical Device Files
• Work Instructions / SOP
• Forms and templates
• Specifications, Quality Plans/Control plans
• Drawings etc.

Documents require review and approval from different individuals prior to their release into the Quality Management System. The process of reviewing and approving new documents is important for maintaining control over documentation.

Once incorporated into the QMS, any modifications to a released document require a review and approval process. Companies must follow change control procedures for the review and approval of documents as mentioned earlier. As per ISO 13485 (4.2.4), changes to documents must be reviewed and approved by the initial approving authority or another authorized person in consultation with a management representative.

Documents should indicate their revision, which can be a letter, number, or a combination thereof, to easily identify the version in use. A revision history, typically found at the document’s end, summarizes the changes made in each new version.

The documents must be legible and identifiable, requiring clear formatting for readability with a title and identification number. Although not explicitly mandated by ISO 13485, assigning document numbers is a widely adopted practice to aid in document identification.

Organizations must establish a system to protect documents against loss or damage. Electronic systems require backup procedures, and paper-based systems need safeguards such as fireproof storage to prevent loss or damage.

Documents that are no longer in use should be marked as obsolete and removed from active use. For reference purposes, at least one copy of these obsolete documents should be preserved, with retention periods determined by the medical device’s lifespan and regulatory obligations.

The duration for retaining documents should be established according to the document control procedure and the applicable regulatory requirements. Electronic systems may preserve documents for an indefinite period, whereas paper-based systems must comply with regulatory standards and incorporate a safety margin in their retention timeline.