ISO 13485 from zero, episode two: the quality manual and document control.

What does this episode cover?

This is episode two of ISO 13485 from zero. Last time we set the role, scope and regulatory requirements in episode one. This episode covers the documents that hold the system together: the quality manual, the medical device file, and the controls over documents and records.

What must the quality manual contain?

Unlike ISO 9001, ISO 13485 requires one. It must include the scope and the justification for any exclusions, the documented procedures or references to them, and a description of how the processes interact. Keep it practical. A manual of twenty to thirty pages that describes how your company actually works is far better than a long one that repeats the standard.

What is the medical device file?

For each device type or family, ISO 13485 expects a file that holds or references the documents that show conformity with requirements: the general description and intended use, labelling and instructions for use, product specifications, manufacturing and servicing specifications, and the procedures for measuring and monitoring. This file is often what a regulator or auditor looks at first for a given device. Start an index for each device family now, even if many entries are still empty.

How should document control work?

ISO 13485 requires a documented procedure, and auditors test it on the first day. Every controlled document needs a unique identifier, a revision status, review and approval before issue, and a record of what changed and why. Current versions must be available where they are used, and obsolete versions must be prevented from unintended use. Compared with ISO 9001, changes must be reviewed and approved either by the same function that approved the original, or by another designated function with access to the background information. Set up a master document list as the first thing you build.

Template for this step: the Document Control SOP and master document list are in the ISO 13485 Document Control & Records Kit ($79).

How do you control records?

Records prove that requirements were met. They must be legible, readily identifiable and retrievable, and protected from loss, damage and unauthorised change. If records are electronic, think about backups, access rights and audit trails. Changes to records must remain identifiable, so the original entry can still be seen.

How long must records be kept?

At least the lifetime of the device as defined by your organisation, and never less than two years from release, or longer where regulations require. Write the retention period down for each type of record, and check it against your regulatory register. An auditor will ask how long you keep device history records, and why.

The ISO 13485 Quality Manual and Management System Kit and the ISO 13485 Document Control and Records Kit cover all of this, and both are in the ISO 13485 Starter Kit. Next episode: risk management.