What is a document control system and why is it important?

What does it mean to 'control documents'? And who needs a formal document control system to manage and optimise their business processes?

1. What is document control?

Document control refers to the processes a business puts in place to oversee the creation, review, modification, issuance, distribution and accessibility of their business-critical documentation.

These controls are the formal circuit breakers that mean changes to plans, procedures, and products are properly reviewed and approved before they are actioned.

2. What is a document control system?

A document control system is the formal set of tools and rules that ensure vital documents in a company are created, approved, distributed, and archived systematically throughout their lifecycle.

Document control systems bring order to complex operations. They can be paper-based and manual, or electronic and automated. But they exist to define and animate the way you control information and data within your business to ensure products always meet the required quality standards.

3. Why is document control important?

Document controls prevent mistakes, confusion and unauthorised change happening within quality management systems. They ensure your decision-making is always trackable and your people accountable in line with commercial needs and regulatory requirements.

4. Who needs a document control system?

Any business which produces complex documentation and has a need for clarity, accountability and traceability in their business processes will benefit from a document control system. Electronic Document Management Systems (eDMS) with robust document control tools are used by law firms, high tech product developers and those in the life science sector to manage their complex processes in the most transparent and auditable way possible.  

But having formal document control procedures in place is an absolute requirement for those who wish to gain the quality management standard ISO 9001:2015 and medical device developers who need ISO 13485: 2015 to legally trade their products.

Ready to take control? Download our guide to digital document control for medical device developers.

5. Why a document control system is central to ISO 9001?

In high tech manufacturing scenarios (like fabless semiconductor design), the document control requirements of ISO 9001 help businesses refine their efficiency and effectiveness to continually improve the quality and value of their end products.

What are the document control requirements in ISO 9001?

The ISO 9001 standard requires you to formally control the way key quality documents are:

• Stored
• Protected
• Retrieved
• Retained
• Reviewed
• Approved
• Deleted
• Kept legible
• Subject to change control

With these systems in place to control your documentation, you can create all the secure workflows, processes and procedures you need to develop and manufacture your products consistently and to the right quality.

They give you the tools to continually review and improve the way you work to serve your customers better.

How do ISO 9001 document control systems drive quality outcomes?

Document control systems developed for ISO 9001 :

• Ensure proper access control to ensure sensitive design, data and other IP is never lost or misused.
• Organise data and information logically - so that they can be retrieved when needed.
• Ensure your workers are always using the latest and most up-to-date version of documentation - so time is not wasted and mistakes aren’t made.
• Securely share data and information at the right moment - so the right people can keep projects moving.
• Create review cycles for requirements, plans and specifications - so that approval, verification and validation of designs/products can take place and be documented.
• Ensure documents cannot be changed without authorisation - so mistakes and scope creep can be prevented.
• Create audit trails for documentation - so you can demonstrate how decisions have been taken throughout the product lifecycle.

Document control systems create cycles of PDCA required by ISO 9001

Key to the control systems in IOS 9001:2106 is the ability to create cycles of PCDA, (Plan, Do, Check, Act) for all your quality, design and development documentation.

They govern the way documents are treated in your system and the way processes are planned, executed and then assessed against original requirements to check and optimise for quality.

PDCA create cycles of continuous improvement

These cycles ensure everything your company does is subject to a documented process of continuous improvement. From creating and managing SOPs (standard operating procedures), to building the phase gated development processes that continually check deliverables against requirements. This approach increases the accuracy, efficiency and velocity of your process.

ISO 9001 document control for semiconductor companies

In fabless semiconductor production, in common with many high tech industries, the huge volume of documentation generated and the demands of validation can easily begin to seed mistakes and slow companies down.

But applying the formal document controls required by ISO 9001 is the way to achieve faster, more effective and profitable product development.

6. Why a document control system is required by ISO 13485:2016?

Compared to document control requirements in ISO 9001, those in the medical device standard ISO 13485 are much more prescriptive. And they have to be, as lives can be at stake if mistakes are made.

In the life science sector document control systems are focused on minimising the risk of product failure and resulting harm to patients  They require the continual verification and validation of designs against requirements, to ensure mistakes, omissions, or non-conformities in end product can be avoided. They are intended to ensure full traceability and accountability around all your decision making.

Document control requirements in ISO 13485 and ISO 9001?

On the face of it, the ISO 13485 standard requires all documents are subject to the same controls as ISO 9001.  You need the same tools to store, protect, retrieve, share, and archive the documents that define the way you work.

But ISO 13485, GxP and the FDA regulations also add requirements for document control by electronic signature so that documents and decisions are authenticated and approved in very specific ways.

Are your e-signatures FDA compliant? Download our checklist to find out

In medical device development, your document control systems need to provide absolute proof of who approved what documentation, why and when. Full accountability and traceability means the history of your process  and the root cause of failures can always be audited, traced and corrected as effectively as possible.

ISO 13485 demands you control both documents and records

ISO 13485 draws a distinction between documents and records (here’s a blog post that explains just that). Your document control system should naturally be driving the production of both to control your process and prove you have done so.

• Documents include: SOPS, designs, drawings, requirements, specifications etc
• Records include: clinical testing records, Device Master Records, CAPA reports etc

Documents change and evolve, but records remain the same.  Records are evidence that you have correctly followed the required processes and procedures to build your product in the way intended.

The standard specifically requires your medical device document control system to generate and control both kinds of documentation as part of your product development process.

The ISO 13485 standard requires you to impose design controls

ISO 9001 doesn’t specify how you must control the design of your products, but ISO 13485 and the FDA do.

Both ISO 13485 and FDA 21 CFR 820 specify that you must phase gate your documentation to regularly check deliverables against requirements at critical stages of development.

As ISO 13485 put it:

​​"At suitable stages, systematic reviews of design and development shall be performed in accordance with planned and documented arrangements”.

Your document control system needs to generate and collate all the required information for defined stages of a development project and share it with the right stakeholders to validate deliverables.

These are the critical STOP/GO moments in a medical device project, the commercial and quality circuit breakers that ensure you are delivering products that exactly match specifications.

And meeting these demands is all contingent on your document control capabilities.

ISO 13485 requires Supplier Management capabilities 

Sharing accurate and up-to-date specifications with key suppliers is central to maintaining the quality of your end product.  And the standard requires you to operate a supplier quality management system that can demonstrate this kind of control: 

“Each manufacturer shall establish and maintain the requirements, including quality requirements, that must be met by suppliers, contractors, and consultants.” 

Read our blog about maintaining supplier quality through advanced document control. 

7. What kind of document control system do you need?

To create the kind of document control systems required by ISO 9001 and 13485, you need a sophisticated digital tool kit that can flex with the demands of commercial growth.  

But paper-based systems won’t help you effectively organise and automate you document control process. Infact, if you rely on paper you’ll quickly be overwhelmed by the volume and complexity of the files you need to manage.   

On the other hand, using a patchwork of off-the-shelf software to create and automate a document control system is likely to quickly collapse into chaos. 

The alternative can be a ‘heavy duty eQMS’ used by  big pharma or med-tech corporations.  But these are hugely expensive and often come with templates for SOPs (standard operating procedures) that smaller businesses will find burdensome and restrictive. They could make you change the entire way you work just to satisfy your software provider rather than helping you achieve your quality goals! 

Take a LEAN approach and avoid over processing 

Whether you are a medical device or a semiconductor developer, a document control process that is over-specified and prescriptive can be actively damaging to the search for quality.

Systems that impose procedures beyond what’s necessary to manage the risk of product failure and demonstrate regulatory compliance should be avoided.

‘Overprocessing’ can slow down operations, introduce inefficiencies and make workers actively avoid using the document control systems you create for them.

As the medical device quality manager Shuan Knights points out in this blog on regulatory compliance:

“Having procedures which require well beyond the given regulation, you are not only ‘over-processing’ and doing more work than is necessary, but you have given yourself a higher risk of non-compliance due to the size of your documented process.”

Look for LEAN Quality Management Software 

Instead, look for electronic document management systems that can deliver just the right level of control for your purposes. Ensure you have the tools to handle required levels of change management, through automated workflows, digital audit trail and compliant e-signature integrations.

But above all, make sure you can use those tools to build a quality management system that works for you.

Choose a solution that can help you cut the wasted time of manual review and approval. Choose the solution that can help you strip out all the unnecessary bureaucracy from the way you work.

Whatever document control system you adopt, it should keep you laser-focused on generating the documentation you need to build the products your customers want to the quality standards required. Nothing more and nothing less.

Blog post updated on 19/04/2024