23.

H Document and record control

Up11 Katherine M. Wortley, Ph. D., Sherry Leichtweis, Dr. jur. Volker Lücker

Here you will find answers to the following questions:

● What is expected for document control?

● What is expected for record control?
● What is the difference between a Device Master Record (DMR) and Device History Record (DHR)?

The organization must establish documentation to define, control and support the QMS. The documentation should be
consistent with the quality policy and translate the organization’s quality objectives and plans into actions.

The format and level of detail may vary between organizations and even within an organization depending on the skills
and qualifications of the personnel and the type of products or services produced (ISO 14969:2004, section 4.2.1.1).

Documentation may be paper based or electronic. Quality management system documents should be clear,
unambiguous and understandable to the users. Procedures can be communicated with written text, flow charts,
diagrams, pictures or even videos depending on the needs of the organization.

Additional suggestions related to documents and records can be found in the following chapters: Chapter 1.C.2.3
Control of documents, Chapter 1.C.2.4 Control of records and Chapter 15 Documentation.

The following publication can serve as a useful reference for interested readers.

● ISO/TR 10013:2001 Guidelines for quality management system documentation, International Organization for
Standardization ISO, 2001.
23.H.1 Control of documents
Organizations must establish and maintain procedures for the control of documents related to the QMS. Many
organizations maintain a single system, centrally located and managed by a single functional area such as quality or
engineering, for managing documents and changes related to the QMS. This is often the easiest to maintain.

With a single system, the organization will tailor change requirements to the document type; for example, changes to a
management review procedure may not require validation while a change to a manufacturing procedure will need to
take into consideration validation and regulatory registration requirements. Documents must be accessible to all areas
of the organization as necessary.

In addition to controlling internally generated documents, regulators expect that external documents, such as standards
and guidelines, that are used for quality related activities be identified and controlled.

23.H.1.1 Approval

Controlled documents must be reviewed and approved by designated individuals or functions prior to issuance.
Regulators require that the same individuals or functions review and approve changes to previously approved QMS
documents. This provides continuity as the original approvers will know the document history and understand the impact
of the proposed changes. If another designated function approves they must have access to key background
information for decision-making purposes.

Approval must be documented with the approver’s name and date of approval. Many organizations find an approval
matrix is useful for defining the approval requirements (see example shown in Figure 23.H-1). There are a number of
things to take into consideration when defining the functions necessary for approving each type of document. Consider
what functional areas are most relevant for approving each document type and do not include an excessive number of
approvers as this will not provide for efficient document approval. For documents related to the QMS, quality should
always be an approver.

Other key approver roles include

● regulatory: for review of labeling and any documents that may have impact on registrations,
submissions or certifications
● medical/clinical: for review for impact to patients and
● legal: for review labeling along with advertizing and promotional materials

Figure 23.H-1 Approval matrix example

  Quality R&D/ Technical Medical/ Clinical Purchasing Regulatory Legal

Quality System Policies X       X  

Manufacturing Procedures X X        

Test Methods & X X        

Specifications

Purchasing Specifications X X   X    

Labeling Content X   X   X X

Raw Materials X X   X    

Advertizing/Promotional     X   X X
Items

23.H.1.2 Distribution and implementation

Documents must be made available at all sites where necessary. New or revised documents must be communicated to
personnel in a timely manner. Implementation timing (effectivity date) may be defined based on date or may link to
specific product lots or serial numbers or some other method such as depletion of current stock. Effectivity date needs
to take into consideration the time necessary for training personnel.

23.H.1.3 Obsolete documents and preservation

Obsolete documents must be removed from all points of use. It is important that only the most current version be
available and accessible to avoid mix-ups. The person responsible for ensuring that only the most current version of a
document is available and accessible must decide on effective action. On the European level there are no legal
provisions for the physical destruction of obsolete documents. The U.S. FDA has stated in the preamble to 21 CFR 820
that “obsolete documents, in lieu of being promptly removed from points of use, may be otherwise prevented from
unintended use.” It is also important to maintain at least one copy of obsolete documents for historical and reference
purposes. Some organizations choose to retain a single master copy of obsolete documents and destroy all other
copies.

23.H.1.4 Control of change

All changes to controlled documents need to go through formal change control. Hand written changes to controlled
documents should not be allowed.

Change documentation/records should include:

● description of change
● reasons for change
● justification for change
● implementation/effectivity timing
● revision identification
● approving individual(s) and
● approval date

Document revision should also take into consideration (and document where appropriate)

● impact to other affected product(s) or system(s)

● verification and/or validation requirements
● link to design control process (reference as necessary)
● regulatory considerations such as need for resubmission or re-registration
● training
● distribution and/or
● disposition of affected records
23.H.1.5 Signatures and data entries

Signatures may be accomplished by a variety of means. Handwritten signatures are not the only means to document
actions taken or approval. Electronic signatures are now widely used by industry and accepted by regulators. Systems
must be in place to control and secure the use of electronic signatures. In some areas stamps may be used. The
organization must have formal procedures in place to control use and ensure that the stamp is that of the user.

Hand-written data entries must be clear, legible and made with indelible media (pencil or erasable ink is not acceptable).
Good data entry practices include:

● entering data at the time it is generated

● no pre- or post dating entries
● have a second person verify data entries for accuracy
● do not obscure existing data or text
23.H.2 Control of records
Records related to the QMS must be retained. They must be stored safely to protect them from loss, destruction,
damage, unauthorized access and alteration. According to ISO 13485:2003, section 4.2.4, records must remain “legible,
readily identifiable and retrievable” for the duration of their retention time. Records must be readily available for review
such as during inspections and audits. Confidential records need to be designated as such.

Storage may be in paper form, electronic, or a combination depending on the records and the needs of the organization.
Electronic records must be backed-up and prevented from degradation. Additionally, as technology changes, records
stored electronically may need to be transferred to new media types to ensure continued accessibility.

Some organizations contract with outside vendors to store records which is possible in principle.

23.H.2.1 Record retention time

The organization needs to define record retention times based on regulatory requirements for the applicable markets.
Legal (liability) aspects may also be considered. The organization then needs to establish a process for destroying
records when appropriate.

The relevant EN ISO 13485 requires records to be retained for the expected lifetime of the medical device but not less
than 2 years from the date of product release.

On the European level according to the modules of the conformity assessment procedure of the annexes to Directives
90/385/EEC, 93/42/EEC and 89/79/EC the manufacturer must, for a period ending at least five years, and in the case of
implantable devices at least 15 years, after the last product has been manufactured, keep relevant documentation at the
disposal of the national authorities. Depending on the lifetime of the device this period may considerably exceed the
retention period stated in EN ISO 13485.

The retention of documents has to be considered not only under regulatory viewpoints. In case of liability claims against
an organization it is essential to provide a carefully kept documentation to oppose such claims. Here, retention times are
above all determined by limitation periods for claims and the absolute limits of liability claims, which for example in
Europe do not expire until ten years after the respective device was marketed (Article 10, paragraph 2 of Directive
85/374/EEC on product liability).

23.H.2.2 Medical device lifetime

Device lifetime or expected device life needs to be defined especially for record keeping purposes. There is a wide
range of lifetimes for medical devices. An in vitro diagnostic analyzer or x-ray machine may be functional for decades
while cardiac catheter is used once and destroyed. Implantable devices such as cardiac pacemakers or spinal implants
are intended to be functional for the lifetime of the patient (ISO 14969:2004, section 7.1.3).

The basis for the determination needs to be documented. The following may be considered when defining product
lifetime (ISO 14969:2004, section 7.1.3):

● shelf-life, stability, or expiry date of the device

● ability to maintain packaging integrity especially for sterile devices or
● number of times a device can be used or cycled such as surgical instruments
23.H.2.3 Specific records

Medical device records generally fall into one of four categories. The table shown in Figure 23.H-2 describes the
four categories with examples of the records that may be located in the files.

Records related to the four categories may be stored or referenced in multiple files. It should be noted that each
organization should store and maintain records in a workable manner as opposed to in specific file types or locations.

Figure 23.H-2 Specific records

Record type Description

QMS Documentation ● Compilation of documents that define and control the QMS. Not
specific to any particular product.
● ISO 13485:2003 4.2.1
● Document types may include policy, process, procedure,
● U.S.: Quality System Record (QSR) [21 CFR templates, forms, guidance.
Part 820.186]
● Documents may include:

Design File
● EU: Part of the Technical Documentation and
Design Dossier
● U.S.: Design History File (DHF) [21 CFR Part
820.30 (j)]
Production Documentation (similar to master
production instructions or master control records
for pharmaceuticals)
● EU: Part of the Technical Documentation and
Design Dossier
● U.S.: Device Master Record (DMR) [21 CFR
Part 820.181]
● ISO 13485:2003 4.2.1
Batch Record, Lot Record, Lot History Record,
Batch Manufacturing Record
● EU: Manufacturing Records
● U.S.: Device History Record (DHR) [21 CFR
Part 820.184]
23.H Summary:
Documents and records related to the QMS must be controlled and retained. Documents and changes must be
approved and made available. Retention periods for documentation depend on legal provisions for documentation as
well as on the need to furnish documentation as proof in case of liability claims.
● corrective action and preventive action (CAPA) system,
● complaint system,
● internal and external audit procedures,
● supplier control procedures,
● calibration program and records,
● preventive maintenance procedures.
● Compilation of documents and records that define and record the
history of the medical device (or device family) design and
development (see also Chapter 23.D.10)
● Documents may include:
● design control procedures
● laboratory notebooks
● design review meeting minutes
● validation study records
● design and development plans
● human factors analysis
● risk management assessments
● clinical study records, design inputs and outputs, etc.
● Compilation of records pertaining to the procedures and
specifications of the device. May also contain or reference QMS
documents.
● It is a good practice to have an index of all documents contained
or referenced in the file.
● Documents may include:
● device specifications (including drawings),
● production processes and specifications,
● work instructions, parts lists, raw material specifications,
● sterilization process details,
● quality assurance procedures,
● test methods and specifications,
● packaging, labeling (including drawings), distribution
procedures and specifications,
● installation, maintenance and servicing procedures and
methods.
● Compilation of the documents and records associated with the
production and distribution history pertaining to one lot of a
finished device.
● Documents may include:
● date(s) of manufacture,
● quantity manufactured,
● quantity released for distribution,
● acceptance records,
● actual labels used,
● identification(s) and/or control number(s),
● test results,
● manufacturing records.