What is a document control system and why is it important?

Having a document control system in place is a requirement of quality standards and regulations around the world. But for high tech and medical device developers, it’s more than a requirement. It’s an absolute necessity.

What is a document control system?

A document control system is a formal set of tools and processes that ensure vital documents in a company are created, approved, distributed, and archived systematically throughout their lifecycle.  Document control systems bring order to complex operations.  They can be paper-based and manual, or electronic and automated.  They are intended to make companies more capable of organising their business to deliver quality products and services.

Who needs a document control system and why?

For companies in some sectors, like life science or high tech product development, having a document control system is essential.  

Document control is a requirement of the quality standard ISO 9001:2015, which you may need to sell products to certain companies and markets. A document control system is also a requirement of ISO 13485:2016, as well as the medical device regulations FDA CFR 21 Part 11 and 820. Without meeting these standards, you may not be able to legally sell your products at all.

What’s the point of a document control system?

Building a system to control your documentation is more than completing a box-ticking dance for regulatory acceptance. These controls are the safeguards you need to ensure (and prove) products are designed and manufactured consistently to the levels of quality your customers will expect.  

Why a document control system is central to ISO 9001 

In high tech manufacturing scenarios (like fabless semiconductor design), the document control requirements of ISO 9001 help businesses refine their efficiency and effectiveness to continually improve the quality and value of their end products.

What are the document control requirements in ISO 9001?

The ISO 9001 standard requires you to formally control the way key quality documents are:

• Stored
• Protected
• Retrieved
• Retained
• Reviewed
• Approved
• Deleted
• Kept legible
• Subject to change control

With these systems in place to control your documentation, you can create all the secure workflows, processes and procedures you need to develop and manufacture your products consistently and to the right quality. They give you the tools to continually review and improve the way you work to serve your customers better and ultimately increase your profitability.

How do ISO 9001 document control systems drive quality outcomes?

Document control systems developed for ISO 9001 :

• Protect access to sensitive design, data and other IP - so information is never lost or misused
• Organise data and information logically - so that they can be retrieved when needed
• Ensure your workers are always using the latest and most up-to-date version of documentation - so time is not wasted and mistakes aren’t made
• Securely share data and information at the right moment - so the right people can keep projects moving
• Create review cycles for requirements, plans and specifications  - so that approval, verification and validation of designs/products can take place and be documented
• Ensure documents cannot be changed without authorisation - so mistakes and scope creep can be prevented
• Create audit trails for documentation - so you can demonstrate how decisions have been taken throughout the product lifecycle 

Document control systems create cycles of PDCA required by ISO 9001

Key to the control systems in IOS 9001:2106 is the ability to create cycles of PCDA, (Plan, Do, Check, Act) for all your quality, design and development documentation. 

They govern the way documents are treated in your system and the way processes are planned, executed and then assessed against original requirements to check and optimise for quality.  

PDCA create cycles of continuous improvement

These cycles ensure everything your company does is subject to a documented process of continuous improvement.  From creating and managing SOPs (standard operating procedures), to building the phase gated development processes that continually check deliverables against requirements.  This approach increases the accuracy, efficiency and velocity of your process.

ISO 9001 document control for semiconductor companies

In fabless semiconductor production, in common with many high tech industries, the huge volume of documentation generated and the demands of validation can easily begin to seed mistakes and slow companies down.

But applying the formal document controls required by ISO 9001 is the way to achieve faster, more effective and profitable product development

Ready to take control? Download our free guide to document control and

ISO 9001 for fabless semiconductor companies

Why a document control system is central to ISO 13485

Compared to document control requirements in ISO 9001, those in the medical device standard ISO 13485 are much more prescriptive. And they have to be, as lives can be at stake if mistakes are made.

In the life science sector document control systems are focused on minimising the risk of product failure and resulting harm to patients  They require the continual verification and validation of designs against requirements, to ensure mistakes, omissions, or non-conformities in end product can be avoided.  They are intended to ensure full traceability and accountability around all your decision making.  

What’s the difference between document control requirements in ISO 13485 and ISO 9001?

On the face of it, the ISO 13485 standard requires all documents are subject to the same controls as ISO 9001.  You need the same tools to store, protect, retrieve, share, and archive the documents that define the way you work.  But ISO 13485, GxP and the FDA regulations also add requirements for document control by electronic signature so that documents and decisions are authenticated and approved in very specific ways.  

Are your e-signatures FDA compliant? Download our checklist to find out

In medical device development, your document control systems need to provide absolute proof who approved what documentation, why and when.  Full accountability and traceability means the history of your process  and the root cause of failures can always be audited, traced and corrected as effectively as possible.

ISO 13485 demands you control both documents and records

ISO 13485 draws a distinction between documents and records (here’s a blog post that explains just that). Your document control system should naturally be driving the production of both to control your process and prove you have done so.

• Documents include: SOPS, designs, drawings, requirements, specifications etc
• Records include: clinical testing records, Device Master Records, CAPA reports etc

Documents change and evolve, but records remain the same.  Records are evidence that you have correctly followed the required processes and procedures to build your product in the way intended.

The standard specifically requires your medical device document control system to generate and control both kinds of documentation as part of your product development process.

The ISO 13485 standard requires you to impose design controls

ISO 9001 doesn’t specify how you must control the design of your products, but ISO 13485 and the FDA do.

Both ISO 13485 and FDA 21 CFR 820 specify that you must phase gate your documentation to regularly check deliverables against requirements at critical stages of development.  

As ISO 13485 put it:

​​’At suitable stages, systematic reviews of design and development shall be performed in accordance with planned and documented arrangements”

Your document control system needs to generate and collate all the required information for defined stages of a development project and share it with the right stakeholders to validate deliverables.  

These are the critical STOP/GO moments in a medical device project, the commercial and quality circuit breakers that ensure you are delivering products that exactly match specifications.  

And meeting these demands is all contingent on your document control capabilities.

What document control system do you need?

To create the kind of document control systems required by ISO 9001 and 13485, you need a  sophisticated digital tool kit that can flex with the demands of your commercial growth. 

But paper-based systems won’t help you effectively organise and automate a document control. system. You’ll quickly be overwhelmed by the volume and complexity of the files you need to manage.  

On the other hand, using a patchwork of off-the-shelf software to create and automate a document control system is likely to collapse into chaos quickly.

The alternative can be a ‘heavy duty eQMS’ used by the aeronautical industry, big pharma or med-tech corporations.  But these are hugely expensive and often come with templates for quality procedures that smaller businesses will find burdensome and restrictive.  They could make you change the entire way you work just to satisfy your software provider rather than actually meet the regulation.

Choose a Lean approach and avoid overprocessing

Whether you are a medical device or a semiconductor developer, document control processes and documentation that are over-specified and overly prescriptive can be actively damaging to the search for quality.  Systems that impose procedures beyond what you need to manage the risk of product or process failure, and demonstrate compliance, can and should be avoided.  

‘Overprocessing’ can slow down operations, introduce inefficiencies and make workers actively avoid using the document control systems you create for them.  As the medical device quality manager Shuan Knights points out in this blog:

“Having procedures which require well beyond the given regulation, you are not only ‘over-processing’ and doing more work than is necessary, but you have given yourself a higher risk of non-compliance due to the size of your documented process.”

Instead, look for electronic document management systems that can deliver just the right level of control for your purposes. Ensure you have the tools to impose required document controls, through automated workflows, digital audit trails, compliant e-signature integrations and the like, but can be built to support the way you work.

Choose the systems that can help you cut out the wasted time of a manual review and approval process, stripping out unnecessary bureaucracy from the way you work.  Make sure they will keep you laser-focused on generating the documentation you need to build the products your customers want to the quality required.