ISO 13485 from zero, episode two: the quality manual and document control.
ISO Cloud Consulting editorial teamISO 13485 requires a quality manual, a medical device file for each device family, a documented document control procedure and a records procedure with retention periods. Build a practical manual of twenty to thirty pages, start a device file index now, and set up a master document list first.
What does episode two cover?
Last time we set the role, scope and regulatory requirements. This episode covers the documents that hold the system together: the quality manual, the medical device file, and the controls over documents and records.
What must the quality manual contain?
Unlike ISO 9001, ISO 13485 requires one. It must include the scope and the justification for any exclusions, the documented procedures or references to them, and a description of how the processes interact.
Keep it practical. A manual of twenty to thirty pages that describes how your company actually works is far better than a long one that repeats the standard.
What is the medical device file?
For each device type or family, ISO 13485 expects a file that holds or references the documents that show conformity with requirements: the general description and intended use, labeling and instructions for use, product specifications, manufacturing and servicing specifications, and the procedures for measuring and monitoring.
This file is often what a regulator or auditor looks at first for a given device. Start an index for each device family now, even if many entries are still empty.
How should document control work?
ISO 13485 requires a documented procedure, and auditors test it on the first day. Every controlled document needs a unique identifier, a revision status, review and approval before issue, and a record of what changed and why. Current versions must be available where they are used, and obsolete versions must be prevented from unintended use.
Template for this step: the Document Control SOP and master document list are in the ISO 13485 Document Control & Records Kit ($79).
One addition compared with ISO 9001: changes to documents must be reviewed and approved either by the same function that approved the original, or by another designated function with access to the background information. Set up a master document list as the first thing you build.
What does records control require?
Records prove that requirements were met. They must be legible, readily identifiable and retrievable, and protected from loss, damage and unauthorized change. If records are electronic, think about backups, access rights and audit trails. Changes to records must remain identifiable, so the original entry can still be seen.
How long must records be kept?
ISO 13485 requires records to be kept for at least the lifetime of the device as defined by your organization, and never less than two years from release, or longer where regulations require. Write the retention period down for each type of record, and check it against your regulatory register from episode one. An auditor will ask how long you keep device history records, and why.
By the end of this episode's work you should have a draft quality manual, an index for each medical device file, a document control procedure with a working master list, and a records procedure with retention periods. Next episode: risk management.
Where can you find templates for these documents?
The ISO 13485 Quality Manual and Management System Kit and the Document Control and Records Kit cover all of this. Both are in the ISO 13485 Starter Kit too. You can also browse the document control collection.
