Document control sounds boring until an auditor picks up an SOP from your shop floor and asks: "Is this the current version? Who approved it? Where is the previous revision?"
If your team hesitates, the audit just got harder.
ISO 13485 clause 4.2.4 requires documented procedures for document control. In practice, that means every document that affects product quality must be identified, reviewed, approved, distributed, and obsolete versions removed from use.
What counts as a "controlled document"
Not every file in your company needs formal control. But anything that defines or records quality-related activities does:
- Quality manual and quality policy
- Standard operating procedures (SOPs)
- Work instructions and batch records templates
- Specifications — raw material, in-process, finished product
- Forms and templates used in production and QC
- External documents — standards, regulations, customer specs
- Quality records generated from the above
That Excel sheet taped to the mixing machine with updated mixing times? If operators follow it, it is a controlled document — whether QA acknowledges it or not.
The document lifecycle auditors expect
Creation and identification
Each controlled document needs a unique identifier (SOP-QA-012, not "Final_v3_revised"). The master list of controlled documents must match what actually exists on the floor.
Review and approval
Approval must be by authorized personnel — usually defined in your document control SOP. Signatures (physical or electronic) with dates. Review before issue, not after.
Distribution and access
Approved versions must reach the people who use them. Obsolete versions must be removed. This is where shared drives fail: someone prints SOP-005 Rev 3, Rev 4 gets approved, and Rev 3 stays in the production office for six months.
Changes and revision history
Every revision needs a reason. A revision log showing version number, date, description of change, and approver. Major changes may trigger change control or retraining.
Obsolete document retention
You cannot use obsolete documents operationally, but you must retain them for reference — especially for batches manufactured under old versions. Auditors will trace a batch from two years ago back to the SOP version that was effective at the time of manufacture.
How long to retain quality records
ISO 13485 clause 4.2.5 sets minimum retention at the lifetime of the medical device, as defined by the organization, but not less than two years from product release.
In practice, for most manufacturers:
| Record type | Typical retention |
|---|---|
| Batch manufacturing records | Lifetime of device + 2 years minimum; many keep 5–15 years |
| Incoming inspection / COA | Linked to batch retention |
| Calibration certificates | Duration of equipment use + audit trail |
| Training records | Employment + 2 years |
| CAPA records | Closure + minimum 2 years; often permanent |
| Internal audit reports | 3–5 years |
| Management review minutes | 3–5 years |
| Complaint and vigilance records | Per CDSCO / regulatory requirements — often permanent |
Your quality manual should define retention explicitly. "We keep records as required by law" is not sufficient — auditors want specific periods.
Common document control audit findings
Uncontrolled copies in production. Photocopied work instructions without version stamps or control marks.
Missing approval signatures. Documents in use with blank approval blocks.
Master list out of date. SOP exists on the floor but is not on the controlled document register.
No link between document changes and training. SOP revised but operators not retrained on the change.
Electronic documents without access control. Shared folder where anyone can edit SOPs without audit trail.
Building a document control system that works
Paper-based document control can work for small operations. The breaking point is usually 15–30 controlled documents with multiple revisions per year across several departments.
Digital document control solves the distribution and obsolescence problem automatically:
- Only current approved versions are accessible to production
- Revision history is automatic
- Approval workflows route documents to the right signatories
- Obsolete versions are archived, not deleted
- Search retrieves any version by date — critical for batch traceability
The goal is not software for its own sake. It is ensuring that the document an operator follows at 2 AM on a Saturday shift is the same document QA approved — and that you can prove it.
Struggling with document control? RapidFacto includes version-controlled document management with approval workflows and full audit trails. Book a free demo to see it in action.