TL;DR
- ISO 13485:2016 Clause 4.2.4 covers document control, including review, approval, revision status, access, and obsolete documents.
- Clause 4.2.5 covers records, including identification, storage, protection, retrieval, retention, and disposition.
- A reliable process defines who can create, review, approve, revise, distribute, and retire controlled documents.
- Digital tools can support version control and traceability, but organizations remain responsible for implementing and maintaining their quality management system (QMS).
Need better visibility into controlled laboratory documents and quality workflows?
Explore Compliance ResourcesDocument control is a core part of an ISO 13485 quality management system. Medical-device organizations rely on procedures, work instructions, specifications, forms, and other controlled documents to ensure that personnel follow approved processes.
The challenge is not simply storing files in one place. Teams need to know which version is approved, who authorized a change, where the document must be available, and how outdated versions are prevented from being used unintentionally.
ISO 13485:2016 addresses these controls in Clause 4.2.4. Clause 4.2.5 separately addresses records that provide evidence of conformity and effective QMS operation. Understanding the difference helps organizations design a document-control process that is both practical and audit-ready.
What Is ISO 13485 Document Control?
ISO 13485 document control is the process an organization uses to create, review, approve, update, distribute, and retire documents required by its QMS.
Under Clause 4.2.4, organizations must establish a documented procedure defining the controls needed for applicable QMS documents. These controls should reflect the organization's processes, products, and regulatory obligations.
Which documents need to be controlled?
Depending on the organization's scope, controlled documentation may include:
- Quality policies, manuals, and procedures
- Standard operating procedures (SOPs) and work instructions
- Product specifications, drawings, and manufacturing instructions
- Inspection, testing, and process-validation procedures
- Risk-management documents and change-control documentation
- Supplier specifications and relevant external standards
- Forms and templates used to create required quality records
The applicable document set depends on the organization's activities and regulatory requirements. Not every file needs the same level of control, but documents necessary for planning, operating, and controlling the QMS must be managed appropriately.
Document control vs. record control
These activities are related but not identical.
Document control - Clause 4.2.4: Focuses on ensuring that documents are reviewed, approved, current, identifiable, available where needed, and protected against unintended use of obsolete versions.
Record control - Clause 4.2.5: Focuses on maintaining evidence of what happened, including how records are identified, stored, protected, retrieved, retained, and disposed of. Changes to records must remain identifiable.
For example, an approved inspection procedure is a controlled document. The completed inspection report generated using that procedure is a record.
ISO 13485 Document Control Requirements
A practical document-control process should address the following areas.
1. Document review and approval
Documents should be reviewed for adequacy and approved before issue. The organization should define the functions or roles responsible for reviewing and approving each document type.
A useful procedure specifies:
- Who prepares, reviews, and approves documents
- How approval is recorded
- How personnel know a document is approved and effective
- How documents are updated and re-approved when necessary
Evidence to prepare: Approved SOPs, approval records, document histories, and the documented procedure defining approval responsibilities.
2. Revision and change control
The organization must identify current revision status and document changes. Changes should be reviewed and approved by the original approving function or another designated function with access to relevant background information.
A controlled change process should identify the document affected, explain the change, record the required approvals, and make the effective version clear.
Where a change affects related procedures, training, equipment, or operational processes, evaluate those impacts through the applicable change-control process.
Evidence to prepare: Revision histories, change requests, approval records, effective dates, and evidence that affected personnel were informed when necessary.
3. Availability at points of use
Personnel need access to relevant versions of applicable documents where they perform the work.
This requires more than uploading the latest file to a shared folder. Organizations should establish how approved documents are distributed, how access is maintained, and how superseded versions are removed from routine use.
Evidence to prepare: Document access permissions, distribution records where applicable, point-of-use checks, and examples showing that staff can retrieve the current approved procedure.
4. External documents and obsolete versions
External documents necessary for QMS planning and operation must be identified, and their distribution controlled. These may include applicable standards, regulatory documents, supplier specifications, or customer requirements.
The organization must also prevent unintended use of obsolete documents and apply suitable identification to obsolete versions that are retained.
Clause 4.2.4 additionally requires the organization to define how long at least one copy of an obsolete controlled document is retained. The period must meet the standard's applicable device-lifetime and record-retention conditions or longer periods specified by applicable regulatory requirements.
Evidence to prepare: External-document registers, review or update records, obsolete-document archives, and the documented retention rationale.
ISO 13485 Document Control Checklist
Use this checklist as a starting point for a gap assessment or internal audit. Adapt it to your organization's document-control procedure and applicable requirements.
| Check | Question |
|---|---|
| [ ] | Is there a documented procedure defining document-control responsibilities and activities? |
| [ ] | Are relevant documents reviewed and approved before issue? |
| [ ] | Is the current revision status clearly identifiable? |
| [ ] | Are changes reviewed and approved by designated functions? |
| [ ] | Can personnel access applicable approved versions at points of use? |
| [ ] | Are documents legible, identifiable, and protected against loss or deterioration? |
| [ ] | Are relevant external documents identified and their distribution controlled? |
| [ ] | Are obsolete documents prevented from unintended use and suitably identified if retained? |
| [ ] | Is the retention period for obsolete documents defined and appropriate? |
| [ ] | Are associated records controlled separately in accordance with Clause 4.2.5? |
| [ ] | Are document-control failures investigated and addressed through the relevant QMS process? |
A checked box is not, by itself, evidence of conformity. Verify the process using sampled documents, approval histories, interviews, and actual practices.
For a broader view of audit preparation, see Scispot's ISO 13485 certification guide.
Common ISO 13485 Document Control Mistakes
Using shared folders without a defined approval process
A shared drive may make documents accessible, but it does not automatically establish which version is approved or who authorized changes. Define approval status, access permissions, and revision controls.
Leaving obsolete versions available at workstations
Old work instructions or downloaded copies can remain in circulation after a revision. Define how superseded versions are withdrawn from points of use and how retained copies are identified.
Treating records like editable procedures
A procedure may be revised as the process changes. A completed record provides evidence of an activity that took place. Changes to records need appropriate controls and must remain identifiable.
Forgetting external documents
Organizations may control internal SOPs carefully while overlooking standards, supplier specifications, or regulatory documents used in their processes. Maintain an appropriate inventory and define how relevant updates are reviewed.
Relying on software without defining the process
A document-management platform cannot compensate for unclear responsibilities, inadequate review, or missing approval rules. Define the process first, then assess which software capabilities can support it.
How Digital Systems Can Support ISO 13485 Document Control
Digital systems can make controlled documents and supporting evidence easier to organize and retrieve. Depending on the platform and configuration, useful capabilities may include:
- Controlled access to approved procedures and work instructions
- Revision history and approval workflows
- Identification and retrieval of relevant records
- Traceability between documents and associated laboratory activities
- Audit trails that help reviewers understand recorded changes
Before implementing software, assess its intended use, access controls, change history, data protection, validation needs, and fit with your QMS. Confirm that the system's actual functionality meets the organization's requirements rather than assuming that a product label guarantees compliance.
Scispot provides resources for evaluating digital systems in regulated laboratory environments. Visit the Scispot compliance hub to explore document-control, audit-readiness, and related compliance topics.
Bring more structure to your laboratory data and quality workflows.
Book a Demo
