‘Document controls’ are the policies and procedures you have in place to manage the way documents are created, approved, issued, shared, updated, and archived throughout your medical device product lifecycle. They stop documents being added or changed in a development process without authorisation. They make the history of your development process trackable through effective version control. They ensure the right version of quality documents can be accessed by the right people whenever and wherever required, to aid auditing, decision making and investigation.
Document control is a major feature of medical device standards and regulation including the ISO 13485 standard and FDA 21 CFR PART 820 and FDA 21 CFR part 11:
ISO 13485 says you should develop document control process and procedures to:
The FDA specify document control in their regulation as well. 820.40a outlines QMS requirements for:
While 820b concentrates on requirements for document change control
21 CFR Part 11 outlines requirements for document control within a electronic Quality management system, The regulation states ‘companies using electronic records shall “secure, computer-generated, time-stamped audit trails to independently record the data and time of operator entries, and actions that create, modify, or delete electronic records.”
It also, famously, specifies the need for controlling the approval process of documents using electronic signatures.
Some of the required documents and processes that need to be ‘controlled’ in the med dev process include:
Controls assign ownership of key documents to named individuals in your organisation so they cannot be lost or orphaned. They ensure processes are properly defined and communicated to your workers, that critical events are documented properly and that records about them can be easily accessed for reference, investigation or future audit.
These are the documents that show your team ‘how you do things’ and are critical to the replication of good practice and consistent quality in your end products. Good documentation controls ensure;
When requests are made to change the way you work, to meet new business or regulatory objectives, document controls need to kick in to ensure they are managed effectively. The document controls you have in place should ensure that proposed changes are seen by the right people, accepted, documented and results reviewed once they have been implemented. This will ensure that changes to processes and procedures have not led to any errors or non-conformities.
Across your change control process the mandated use of electronic signatures intended to provide incontrovertible proof of
Your ability to control documentation in the way defined by the regulation will help you meet the design control requirements of the medical device development process.
Both ISO and FDA require you to develop a structured phase gated design process that makes your process trackable and your people accountable for the decisions that are made along the way.
The regulation requires you to document user requirements and design specifications. It requires you verify these designs against specifications, and validate end products against user requirements. These tasks should be carried out in a series of iterative, project stages.
Proper document controls help you demonstrate that:
Document controls ensure that all relevant stakeholders have seen and ‘signed off’ on key documents before each new stage of design and development took place. And that you can prove when and how this happened.
Phase gating tools in an eQMS can deliver the ultimate control over documentation, ensuring that ‘input’ and ‘output’ documents are grouped together and shared with specific stakeholders in automated sequences of review and publication.
Proper document controls help you meet design requirements, mitigating the risk of deviating from your plans, not meeting requirements and consequent harm to end users. They will ensure you have a full and detailed record of the process you have undertaken.
Your ability to control documentation can also impact the way you can gather and share the required technical information with auditors.
The FDA specifies that you should make your ‘Design History Files’, ‘Design Master Record’ and ‘Device History Record’ available to auditors. ISO 13485 has similar technical file requirements. These requirements are there so regulators can verify you have developed your device in line with the standard.
If you have been controlling your documentation in line with the regulation and have the right digital tools available to you for search and retrieval - then the documents which tell the story of the evolution of your design and build process will be easier to isolate and publish in a structured way.
Document control procedures are vital for effective Corrective and Preventive Action processes, too. Having the right document control procedures in place will ensure that complaints are captured and recorded in your QMS, shared with and investigated by the right people.
Using digital signatures will allow you to prove who has investigated, signed off and approved corrective and preventive actions to thee regulator. The right process will also ensure that these documents are reviewed in the future to check the success of the CAPAs that have been implemented.
In medical device development everything rests on your ability to control your documentation effectively. Controls are central to delivering the quality outcomes that the regulation requires. They ensure your process is;
And by extension, that you are managing:
The challenge for medical device developers is finding the digital tools that can give you this level of control, without taking years to implement or slowing up the speed of your development