What does it mean to 'control documents'? And who needs a formal document control system to manage and optimise their business processes?
|
Jump to |
Document control refers to the processes a business puts in place to oversee the creation, review, modification, issuance, distribution and accessibility of their business-critical documentation.
These controls are the formal circuit breakers that mean changes to plans, procedures, and products are properly reviewed and approved before they are actioned.
A document control system is the formal set of tools and rules that ensure vital documents in a company are created, approved, distributed, and archived systematically throughout their lifecycle.
Document control systems bring order to complex operations. They can be paper-based and manual, or electronic and automated. But they exist to define and animate the way you control information and data within your business to ensure products always meet the required quality standards.
Document controls prevent mistakes, confusion and unauthorised change happening within quality management systems. They ensure your decision-making is always trackable and your people accountable in line with commercial needs and regulatory requirements.
Any business which produces complex documentation and has a need for clarity, accountability and traceability in their business processes will benefit from a document control system. Electronic Document Management Systems (eDMS) with robust document control tools are used by law firms, high tech product developers and those in the life science sector to manage their complex processes in the most transparent and auditable way possible.
But having formal document control procedures in place is an absolute requirement for those who wish to gain the quality management standard ISO 9001:2015 and medical device developers who need ISO 13485: 2015 to legally trade their products.
Ready to take control? Download our guide to digital document control for medical device developers.
In high tech manufacturing scenarios (like fabless semiconductor design), the document control requirements of ISO 9001 help businesses refine their efficiency and effectiveness to continually improve the quality and value of their end products.
The ISO 9001 standard requires you to formally control the way key quality documents are:
With these systems in place to control your documentation, you can create all the secure workflows, processes and procedures you need to develop and manufacture your products consistently and to the right quality.
They give you the tools to continually review and improve the way you work to serve your customers better.
Document control systems developed for ISO 9001 :
Key to the control systems in IOS 9001:2106 is the ability to create cycles of PCDA, (Plan, Do, Check, Act) for all your quality, design and development documentation.
They govern the way documents are treated in your system and the way processes are planned, executed and then assessed against original requirements to check and optimise for quality.
These cycles ensure everything your company does is subject to a documented process of continuous improvement. From creating and managing SOPs (standard operating procedures), to building the phase gated development processes that continually check deliverables against requirements. This approach increases the accuracy, efficiency and velocity of your process.
In fabless semiconductor production, in common with many high tech industries, the huge volume of documentation generated and the demands of validation can easily begin to seed mistakes and slow companies down.
But applying the formal document controls required by ISO 9001 is the way to achieve faster, more effective and profitable product development.
Compared to document control requirements in ISO 9001, those in the medical device standard ISO 13485 are much more prescriptive. And they have to be, as lives can be at stake if mistakes are made.
In the life science sector document control systems are focused on minimising the risk of product failure and resulting harm to patients They require the continual verification and validation of designs against requirements, to ensure mistakes, omissions, or non-conformities in end product can be avoided. They are intended to ensure full traceability and accountability around all your decision making.
On the face of it, the ISO 13485 standard requires all documents are subject to the same controls as ISO 9001. You need the same tools to store, protect, retrieve, share, and archive the documents that define the way you work.
But ISO 13485, GxP and the FDA regulations also add requirements for document control by electronic signature so that documents and decisions are authenticated and approved in very specific ways.
Are your e-signatures FDA compliant? Download our checklist to find out
In medical device development, your document control systems need to provide absolute proof of who approved what documentation, why and when. Full accountability and traceability means the history of your process and the root cause of failures can always be audited, traced and corrected as effectively as possible.
ISO 13485 draws a distinction between documents and records (here’s a blog post that explains just that). Your document control system should naturally be driving the production of both to control your process and prove you have done so.
Documents change and evolve, but records remain the same. Records are evidence that you have correctly followed the required processes and procedures to build your product in the way intended.
The standard specifically requires your medical device document control system to generate and control both kinds of documentation as part of your product development process.
ISO 9001 doesn’t specify how you must control the design of your products, but ISO 13485 and the FDA do.
Both ISO 13485 and FDA 21 CFR 820 specify that you must phase gate your documentation to regularly check deliverables against requirements at critical stages of development.
As ISO 13485 put it:
"At suitable stages, systematic reviews of design and development shall be performed in accordance with planned and documented arrangements”.
Your document control system needs to generate and collate all the required information for defined stages of a development project and share it with the right stakeholders to validate deliverables.
These are the critical STOP/GO moments in a medical device project, the commercial and quality circuit breakers that ensure you are delivering products that exactly match specifications.
And meeting these demands is all contingent on your document control capabilities.
Sharing accurate and up-to-date specifications with key suppliers is central to maintaining the quality of your end product. And the standard requires you to operate a supplier quality management system that can demonstrate this kind of control:
“Each manufacturer shall establish and maintain the requirements, including quality requirements, that must be met by suppliers, contractors, and consultants.”
Read our blog about maintaining supplier quality through advanced document control.
To create the kind of document control systems required by ISO 9001 and 13485, you need a sophisticated digital tool kit that can flex with the demands of commercial growth.
But paper-based systems won’t help you effectively organise and automate you document control process. Infact, if you rely on paper you’ll quickly be overwhelmed by the volume and complexity of the files you need to manage.
On the other hand, using a patchwork of off-the-shelf software to create and automate a document control system is likely to quickly collapse into chaos.
The alternative can be a ‘heavy duty eQMS’ used by big pharma or med-tech corporations. But these are hugely expensive and often come with templates for SOPs (standard operating procedures) that smaller businesses will find burdensome and restrictive. They could make you change the entire way you work just to satisfy your software provider rather than helping you achieve your quality goals!
Whether you are a medical device or a semiconductor developer, a document control process that is over-specified and prescriptive can be actively damaging to the search for quality.
Systems that impose procedures beyond what’s necessary to manage the risk of product failure and demonstrate regulatory compliance should be avoided.
‘Overprocessing’ can slow down operations, introduce inefficiencies and make workers actively avoid using the document control systems you create for them.
As the medical device quality manager Shuan Knights points out in this blog on regulatory compliance:
“Having procedures which require well beyond the given regulation, you are not only ‘over-processing’ and doing more work than is necessary, but you have given yourself a higher risk of non-compliance due to the size of your documented process.”
Instead, look for electronic document management systems that can deliver just the right level of control for your purposes. Ensure you have the tools to handle required levels of change management, through automated workflows, digital audit trail and compliant e-signature integrations.
But above all, make sure you can use those tools to build a quality management system that works for you.
Choose a solution that can help you cut the wasted time of manual review and approval. Choose the solution that can help you strip out all the unnecessary bureaucracy from the way you work.
Whatever document control system you adopt, it should keep you laser-focused on generating the documentation you need to build the products your customers want to the quality standards required. Nothing more and nothing less.