Document control in your medical device Quality Management System

Document controls are a fundamental requirement of every medical device regulatory regime. They are the ‘building blocks’ of an effective Quality Management System.

What is document control in medical device development?

‘Document controls’ are the policies and procedures you have in place to manage the way documents are created, approved, issued, shared, updated, and archived throughout your medical device product lifecycle. They stop documents being added or changed in a development process without authorisation. They make the history of your development process trackable through effective version control. They ensure the right version of quality documents can be accessed by the right people whenever and wherever required, to aid auditing, decision making and investigation.

How to build your med dev eQMS: Download our free eBook

What does med dev regulation say about document control?

Document control is a major feature of medical device standards and regulation including the ISO 13485 standard and FDA 21 CFR PART 820 and  FDA 21 CFR part 11:

What are the document control requirements specified in ISO 13485?

ISO 13485 says you should develop document control process and procedures to:

• Review and approve documents for adequacy prior to issue;
• Review, update as necessary and re-approve documents;
• Ensure that the current revision status of and changes to documents are identified;
• Ensure that relevant versions of applicable documents are available at points of use;
• Ensure that documents remain legible and readily identifiable;
• Ensure that documents of external origin, determined by the organization to be necessary for the planning and operation of the quality management system, are identified and their distribution controlled;
• Prevent deterioration or loss of documents;
• Prevent the unintended use of obsolete documents and apply suitable identification to them.

What are the document control requirements specified in FDA 21 CFR PART 820

The FDA specify document control in their regulation as well. 820.40a outlines QMS requirements for:

• Document approval and distribution.
• Each manufacturer shall designate an individual(s) to review for adequacy and approve prior to issuance all documents established to meet the requirements of this part.
• The approval, including the date and signature of the individual(s) are approving the document, shall be documented.
• Documents established to meet the requirements of this part shall be available at all locations for which they are designated, used, or otherwise necessary, and all obsolete documents shall be promptly removed from all points of use or otherwise prevented from unintended use.

While 820b concentrates on requirements for document change control

• Changes to documents shall be reviewed and approved by an individual(s) in the same function or organization that performed the original review and approval, unless specifically designated otherwise.
• Approved changes shall be communicated to the appropriate personnel in a timely manner.
• Each manufacturer shall maintain records of changes to documents.
• Change records shall include a description of the change, identification of the affected documents, the signature of the approving individual(s), the approval date, and when the change becomes effective.

Requirements for document control in 21 CFR Part 11

21 CFR Part 11 outlines requirements for document control within a electronic Quality management system, The regulation states ‘companies using electronic records shall “secure, computer-generated, time-stamped audit trails to independently record the data and time of operator entries, and actions that create, modify, or delete electronic records.”

It also, famously, specifies the need for controlling the approval process of documents using electronic signatures.

What is 21 CFR Part 11? FDA requirements explained

What documents need to be ‘controlled’ in the med dev process

Some of the required documents and processes that need to be ‘controlled’ in the med dev process include:

• Quality manuals
• Standard operating procedures (SOPs)
• Design input and output documents
• Test plans
• Validation checklists
• CAPA reports

How do document controls support quality outcomes

Controls assign ownership of key documents to named individuals in your organisation so they cannot be lost or orphaned. They ensure processes are properly defined and communicated to your workers, that critical events are documented properly and that records about them can be easily accessed for reference, investigation or future audit.

How document controls help you deliver on key quality requirements

SOPs

These are the documents that show your team ‘how you do things’ and are critical to the replication of good practice and consistent quality in your end products. Good documentation controls ensure;

• They’re always accessible and visible to the teams who need to use them
• The most uptodate, approved version of the SOPs are always visible
• They are properly indexed for ease of search and retrieval
• They cannot be changed without authority
• Records of changes are kept with a full version history available for auditors

Change control

When requests are made to change the way you work, to meet new business or regulatory objectives, document controls need to kick in to ensure they are managed effectively. The document controls you have in place should ensure that proposed changes are seen by the right people, accepted, documented and results reviewed once they have been implemented. This will ensure that changes to processes and procedures have not led to any errors or nonconformities.

Across your change control process the mandated use of electronic signatures intended to provide incontrovertible proof of

• the identity of the person approving it
• the date and time a measure was approved
• the ‘intention’ or meaning of their approval

Design controls

Your ability to control documentation in the way defined by the regulation will help you meet the design control requirements of the medical device development process.

Both ISO and FDA require you to develop a structured phase gated design process that makes your process trackable and your people accountable for the decisions that are made along the way.

Why design control matters in medical device development

The regulation requires you to document user requirements and design specifications. It requires you verify these designs against specifications, and validate end products against user requirements. These tasks should be carried out in a series of iterative, project stages.

Proper document controls help you demonstrate that:

• You planned your process prior to commencing the build
• You have gathered and documented user requirements in line with the plans
• You have documented your proposed designs
• Documents have been reviewed and approved by the right people at every stage
• Changes to requirements and designs have been approved and documented
• The right people have validated the product according to your designs

Document controls ensure that all relevant stakeholders have seen and ‘signed off’ on key documents before each new stage of design and development took place. And that you can prove when and how this happened.

Phase gating tools in an eQMS can deliver the ultimate control over documentation, ensuring that ‘input’ and ‘output’ documents are grouped together and shared with specific stakeholders in automated sequences of review and publication.

Proper document controls help you meet design requirements, mitigating the risk of deviating from your plans, not meeting requirements and consequent harm to end users. They will ensure you have a full and detailed record of the process you have undertaken.

Technical files: DHF, DMR and DHR

Your ability to control documentation can also impact the way you can gather and share the required technical information with auditors.

The FDA specifies that you should make your ‘Design History Files’, ‘Design Master Record’ and ‘Device History Record’ available to auditors. ISO 13485 has similar technical file requirements. These requirements are there so regulators can verify you have developed your device in line with the standard.

DHF, DMR and DHR: Demystifying FDA medical device development requirements

If you have been controlling your documentation in line with the regulation and have the right digital tools available to you for search and retrieval - then the documents which tell the story of the evolution of your design and build process will be easier to isolate and publish in a structured way.

CAPAs

Document control procedures are vital for effective Corrective and Preventive Action processes, too. Having the right document control procedures in place will ensure that complaints are captured and recorded in your QMS, shared with and investigated by the right people.

Using digital signatures will allow you to prove who has investigated, signed off and approved corrective and preventive actions to thee regulator. The right process will also ensure that these documents are reviewed in the future to check the success of the CAPAs that have been implemented.

In medical device development everything rests on your ability to control your documentation effectively. Controls are central to delivering the quality outcomes that the regulation requires. They ensure your process is;

• Consistent
• Reliable
• Repeatable
• Trackable

And by extension, that you are managing:

• Accountability of your people throughout the process
• Traceability of the root causes of nonconformities in end products
• The efficacy and safety of your product
• The risk of harm to the people who will use them

The challenge for medical device developers is finding the digital tools that can give you this level of control, without taking years to implement or slowing up the speed of your development