Free ISO 13485 Control of Documents Template

4.2.4 Control of documents

A documented procedure shall define the controls needed to: Write a SOP for this process and make sure it cover all points below.

a) review and approve documents for adequacy prior to issue; Have process owner draft or change the document/ form and get the supervisor and Management rep to review and approve and sign the SOP

b) review, update as necessary and re-approve documents; Same as above

c) ensure that the current revision status of and changes to documents are identified; have revision number in your SOP. Changes can be captured in Change Request Form/ Document Change Request and in the history of your SOP.

d) ensure that relevant versions of applicable documents are available at points of use; Have a Master List/ Quality System Record that captured the latest applicable SOP and form. Put them in the accessible part of your QMS server for the rest of the team to use.
e) ensure that documents remain legible and readily identifiable; Softcopy are always legible and cannot be damaged by environment. Identity can be addressed by the SOP reference and version number. 

f) ensure that documents of external origin, determined by the organization to be necessary for the planning and operation of the quality management system, are identified and their distribution controlled; This means external document (like ISO standards or supplier specification) should be captured in your master list as well. And be approved by a responsible and qualified person. Distribution can be done via server as well. 

g) prevent deterioration or loss of documents; Softcopy cannot deteriorate but you must ensure you back up your server at stated frequency. Hardcopy can act as a back up too. 

h) prevent the unintended use of obsolete documents and apply suitable identification to them. Quality department has to ensure obsolete documents are  identified by stamping obsolete on it. 

The organization shall define the period for which at least one copy of obsolete documents shall be retained. This period shall ensure that documents to which medical devices have been manufactured and tested are available for at least the lifetime of the medical device as defined by the organization, but not less than the retention period of any resulting record (see 4.2.5), or as specified by applicable regulatory requirements. Softcopies can remain indefinitely. 

4.2.5 Control of records

The organization shall document procedures Write a SOP, usually it is written together with the control of document SOP to define the controls needed for the identification linked to the SOP, storage put in server, security put in server and integrity put in server, retrieval put in server, retention time put in server indefinitely and disposition of records put in server.

The organization shall define and implement methods for protecting confidential health information contained in records in accordance with the applicable regulatory requirements. Limited access needed if there is confidential information in the records example patient identity (refer to the confidential acts applicable in your jurisdictions)

Records shall remain legible, readily identifiable and retrievable. Use the server Changes to a record shall remain identifiable. If you make changes to a record, make sure you do not delete the old data but you sign and date over the changes you made. 

The organization shall retain the records for at least the lifetime of the medical device as defined by the organization, or as specified by applicable regulatory requirements, but not less than two years from the medical device release by the organization. Just retain all softcopies indefinitely so you do not need to rack your brain what information to keep for how long!