Document Control Software for ISO 9001 & ISO 13485: A Guide

There’s plenty of document management and file-sharing software available on the market, but not all of it is able to control documents in a way required by quality standards like ISO 9001 and ISO 13485. What does the best document control software look like? How can it help your business fulfill its regulatory obligations while meeting your commercial needs?

What is a document control software?

This software is often used by businesses who need to meet the ISO 9001 and ISO 13485 quality standards. They are typically SaaS platforms that give clients the ability to:

• Approve, review, update and re-approve documents when required,
• Identify changes made and current document revision status,
• Make documents available at points of use,
• Ensure documents remain legible and readily identifiable,
• Identify external documents and control their distribution,
• Prevent obsolete documents from being used accidentally, 
• Apply suitable identification if obsolete documents are retained,

Document control ensures the quality of end products

But document control is not control for its own sake.

Control over documentation is, ultimately, the way the quality of end products is maintained and tracked by your organisation. It ensures:

• Consistency in process and procedures that result in products of uniform and required quality
• Certainty around the latest approved version of requirements, specifications and designs that the business is working from
• Accountability and traceability around all your decision-making processes in product design and development
• Complete, transparent access for auditors to ensure quality processes have been adhered to

But, of course, not every business requires this level of document control to operate successfully. And for some, managing this granular level of secure access, tracking, indexing and archiving would be a sledgehammer to crack a nut.

Where does your software sit within the document control pyramid?

It’s true that when it comes to document control - not every file storage solution is created equal.

Think of it like a pyramid - a hierarchy of information management:

Simple file sharing

At the bottom of the hierarchy of solutions are the low-cost or no-cost, frictionless file-sharing tools like the basic versions of Google Docs, Box or Dropbox. They are designed specifically to make life easier for teams who need to collaborate rapidly across platforms without a strict and enduring record of what has gone before. 

Document management

Enterprise document management solutions (like Dropbox Business or a self build Microsoft Sharepoint option) can offer more sophisticated opportunities for version control, managed collaboration and better archiving opportunities.  You might have more power to allow or deny access to documents by named individuals with more granularity around editing permissions. There may be better indexing and larger storage potential. Simple document workflow control can be achieved to automate some processes, though frequently with limitations.  

Users can manage documentation more effectively, but they ultimately don’t have the extended functionality required to satisfy regulators that they can manage the 5 stages of document control: creation, publication, change control, retrieval and obsolescence.

Document Control

At the summit of the triangle are the ‘heavy duty’ document control solutions - software that is designed to answer the demands for authentication, scrutiny and traceability required by ISO standards or regulators like the FDA. The workflows available at this level ensure the most robust approval processes can be built out to support, for example, multiple sign-off and phase gating processes to impose design controls.

In these systems, there is one master version of each document. There is an audit trail and a full activity history. This goes beyond mere event logs; it will be possible to easily view the activity history around a document when it was in a previous version. These versions will be retained for as long as the law requires.

Electronic signatures are also built into the system itself, ensuring the highest level of authentication, and an indelible record of the ‘meaning’ of each signature applied to each document.

Only with this kind of functionality can you meet the kind of change control requirements demanded by the FDA in QSR 820 and elsewhere:

“Each manufacturer shall maintain records of changes to documents. Change records shall include a description of the change, identification of the affected documents, the signature of the approving individual(s), the approval date, and when the change becomes effective.”

FDA, QSR 820

Is all Document Control Software created equal?

No. 

Document control software built to meet the requirements of the most demanding regulation (like ISO 13485 for medical device developers) can often be rigid and unbending in the way it functions. And in many ways that’s the point, to ensure documents are treated consistently and that quality processes cannot be circumvented or activity falsified.

But the document control software we encounter often asks you to manage the flow of documentation in ways the supplier demands rather than what the regulation actually requires.  

When you pick document control software you need to be sure that it’s not going to condemn you to needlessly rework your existing processes and procedures to fit in with their templates. Instead, you should be able to use the robust document control tools they offer to meet the regulation and your business needs.

Too little or too much? 

When start up and SMEs trying to break into regulated industries are faced with options for formalising their document and quality management to meet complex standards, they can end up doing too little or too much.  

Some opt to use file-sharing platforms stitched together with email and PM tools to automate their workflows and control their documentation in the most cost-effective way they can.  As discussed above this kind of solution can be complex to administer and unequal to the task. 

Others choose the expensive, ‘best in breed’ options used by large pharma and med tech giants to ensure they can take the most robust approach to their regulatory challenges. These businesses can end up getting bogged down by complexity, imprisoned by overly rigid systems and burdened with a costly interface that no one likes and no one can use.  

Everyone’s needs are different, of course, but the best document control software is the application that gives you the level of control you need to meet regulatory obligations while running your business in the most logical and cost-effective way.

Blog post updated on 31/07/2023