Evidence-first control map for Clauses 4.1 to 4.2.5: QMS architecture, quality manual, medical device file, document control, and record control.
What this guide covers
This guide translates ISO 13485 Clause 4 into an evidence-first control map. It focuses on what auditors actually test: executed records, controlled document states, retrievable device files, and traceable change history. Use it for certification audits, surveillance audits, supplier or customer audits, and internal audits.
What Clause 4 covers
Clause 4 is the QMS foundation: how you define and control the system (Clause 4.1) and how you control the information the system runs on (Clause 4.2). That requires a defined process architecture, controlled documentation, a maintained medical device file, and reliable document control and record control that prevent outdated instructions, missing evidence, and untraceable decisions.
How auditors evaluate Clause 4
Auditors rarely read SOPs end to end. They follow evidence chains. A change request must show impact review, approvals, training, and effectiveness. A device file must be complete and navigable. Records must be retrievable quickly with defined retention and access control. Weak Clause 4 controls make every other clause fragile.
Use this guide to
- Identify the minimum Clause 4 controls and records needed to pass an audit.
- Run a fast evidence check: what exists, what is missing, what is unlinked.
- Find templates that implement Clause 4 controls with audit-ready outputs.
ISO 13485 Clause 4 Evidence Table (4.1 to 4.2.5)
| Clause | Clause Title | Operational Intent | Typical Audit Evidence (Records) | Jump |
|---|---|---|---|---|
| 4.1 | General requirements | Define, control, and maintain the QMS processes so execution is stable, changes are controlled, and evidence is retrievable. | Process map; process interaction diagram; QMS scope statement; outsourced-process controls; change impact assessments; QMS software validation evidence (if used). | Open |
| 4.2 | Documentation requirements | Maintain a controlled documentation set that is sufficient to operate the QMS and prove conformity. | Quality manual; master document list; procedure/register indexes; controlled template library; documented information gap assessment. | Open |
| 4.2.1 | General | Demonstrate the required documented information exists and is aligned to actual operations. | Policy acknowledgement; quality objectives register; procedure matrix; records index; rationale for documents needed for planning and operation. | Open |
| 4.2.2 | Quality manual | Keep a controlled manual that defines scope/exclusions and describes process interactions. | Quality manual revision history; approval record; scope/exclusion justification; process interaction diagram control. | Open |
| 4.2.3 | Medical device file | Maintain a navigable device-family file that references the controlled documents proving product conformity and regulatory readiness. | Device file index; labeling/IFU approval trail; key specifications; manufacturing/servicing references; acceptance criteria references. | Open |
| 4.2.4 | Control of documents | Prevent uncontrolled or obsolete documents through review/approval, revision control, distribution control, and controlled external documents. | Document change requests; approval logs; revision history; controlled distribution; obsolete archive; external document register. | Open |
| 4.2.5 | Control of records | Ensure records remain identifiable, secure, retrievable, and retained so audit sampling succeeds without reconstruction. | Record retention schedule; record index; access control logs; backup/restore test record; record integrity/audit trail evidence. | Open |
ISO 13485 Clause 4.1: General Requirements
Operational intent
Prove the QMS is a controlled system: defined processes, defined owners, controlled interfaces, and controlled changes. The test is whether the organization can demonstrate stability over time using records.
Minimum controls that must exist
- Process architecture: list of QMS processes and interactions (an owned system, not a poster)
- Process ownership: accountable roles for each process, including outsourced processes
- Change impact discipline: documented assessment of impact to documents, training, validation, and records
- QMS tool control: if software manages records, approvals or workflows, keep validation evidence aligned to intended use
Audit tests (evidence challenges)
- Show the current process interaction map and evidence it is reviewed under change control.
- Show the last 3 QMS changes and the impact assessment, approvals, and resulting updates.
- Show how outsourced processes are controlled (supplier controls, acceptance evidence, escalation triggers).
- Show that your QMS software tool's intended use is defined and the tool is controlled under change.
Major nonconformity indicators
- Critical processes exist in reality but are absent from the defined QMS process set.
- Changes occurred with no impact assessment and no retraining or effectiveness evidence.
- QMS software drives approvals or records, but there is no validation or change control evidence.
ISO 13485 Clause 4.2: Documentation Requirements
4.2.1 General
Intent: Maintain a minimum documented information set that matches operational reality and produces records that prove execution.
Evidence (records):
- Master Document List (MDL) / document register
- Procedure matrix (process to SOP to forms/records)
- Controlled template library index
- Records index (what records exist, where stored, retention owner)
Failure patterns:
- Documents exist but the MDL is incomplete or stale.
- Forms exist without controlled IDs and revision control.
- Procedures describe records that are not actually generated.
4.2.2 Quality Manual
Intent: Provide controlled scope and QMS interaction visibility. The manual must be current and consistent with the real process architecture.
Evidence (records):
- Quality manual approval and revision history
- Scope statement and exclusion/justification record (where used)
- Process interaction diagram under change control
Failure patterns:
- Manual exists but scope/exclusions are inconsistent with actual operations.
- Process interaction diagram is generic and not maintained under change control.
4.2.3 Medical Device File
Intent: Maintain a device-family file that is navigable and references the controlled documents that define the device and how it is realized.
Evidence (records):
- Device file index (table of contents with controlled references)
- Labeling/IFU approval trail and revision history
- Key specifications and acceptance criteria references
- Manufacturing/servicing references (controlled, current)
Audit tests:
- Open the device file and retrieve specific referenced documents within 60 seconds.
- Show how a labeling change flowed through approvals, training, and release documentation.
Failure patterns:
- Device file is just a folder of PDFs with no index and no controlled references.
- Labeling exists without traceable approval and effective date control.
4.2.4 Control of Documents
Intent: Ensure only approved, current documents are used. Control changes, distribution, and external documents that affect product or QMS.
Minimum control mechanics:
- Document lifecycle states: draft, review, approved, effective, obsolete
- Role-based approvals (owner plus quality approval where appropriate)
- Controlled distribution and point-of-use rules
- External document register (standards, regulations, supplier specs) with review triggers
Evidence (records):
- Document change requests with impact statements
- Approval logs (who, when, what changed)
- Revision history and effective date control
- Obsolete archive control evidence
Major NC indicators:
- Obsolete instructions found at point of use.
- Changes made without formal approval trail.
- External standards used operationally but not controlled.
4.2.5 Control of Records
Intent: Records must be identifiable, secure, retrievable, and retained. The audit test is speed and integrity: retrieve samples quickly with intact history.
Minimum control mechanics:
- Record taxonomy and indexing (record type, ID rules, storage path)
- Retention schedule aligned to device lifetime and regulatory requirements (at least device lifetime, not less than two years from release)
- Access control and confidentiality rules, including confidential health information
- Backup/restore test evidence for electronic records
Evidence (records):
- Record retention schedule and approvals
- Record index / evidence index
- Access control logs and permission reviews
- Backup/restore test records
Major NC indicators:
- Records cannot be retrieved promptly or are missing.
- No defined retention rules or uncontrolled deletions/overwrites.
- Electronic records with no integrity controls or audit trail evidence.
Clause 4 Templates (Direct Implementation)
These kits map directly to Clause 4 audit exposure: document control, medical device file structure, record control, and QMS architecture.
ISO 13485 Starter Kit
Quality manual, document control, CAPA, internal audit and management review templates that form the core QMS architecture.
View KitCompare kitsDocument Control and Records Kit
Implements Clauses 4.2.4 and 4.2.5: controlled lifecycle, approvals, change control, distribution, external documents, retention and retrieval.
View KitGo to 4.2.4Medical Device File and Labelling Kit
Implements Clause 4.2.3: device file indexing and labeling control with audit-ready evidence trails.
View KitGo to 4.2.3Quick answers
What is the fastest way to pass Clause 4 sampling?
Make evidence retrieval predictable: a master document list that matches reality, a record index that maps record type to storage path and retention, and a device file index that points to controlled document IDs, not folders of PDFs.
What do auditors target first in document control?
Obsolete documents at point of use, missing approvals or effective dates, uncontrolled external documents (standards, regulatory guidance), and changes implemented without impact assessment and training evidence.
What makes record control fail under audit?
Slow retrieval, missing records, unclear retention rules, uncontrolled edits or overwrites, weak access control, and electronic record systems with no integrity or audit trail evidence.
How should the medical device file be structured?
Use a controlled index that references controlled document IDs for labeling/IFU, specifications, acceptance criteria, production and service references, and applicable procedures. Auditors expect navigation and traceability, not bulk storage.
Clause 4 Audit Reality: Auditors Sample Records, Not Narratives
Clause 4 failure is usually not “missing documentation.” It is uncontrolled state:
- Outdated work instructions at point of use
- Device file exists but is not navigable (no index, no controlled references)
- Records exist but cannot be retrieved quickly
- Changes happened without impact assessment, training, or effectiveness evidence
Clause 4 fixes are mechanical: define the system, control documents, control records, enforce storage paths, and prove execution through an evidence index.
Clause 4 Self-Audit Checklist
Clause 4.1: QMS Process Architecture (Evidence Challenges)
- Show the controlled list of QMS processes and the owner role for each.
- Show the interaction map and evidence it is controlled under change.
- Show the last 3 QMS changes with impact assessment and approvals.
- Show how outsourced processes are controlled (requirements, verification, escalation triggers).
Clause 4.2.1: Minimum Documented Information
- Show the Master Document List (MDL) with status and revision control.
- Show the procedure matrix that maps processes to SOPs and records.
- Show controlled templates/forms with IDs and revision history.
Clause 4.2.2: Quality Manual Integrity
- Show the scope statement and any exclusion justification record.
- Show evidence the manual reflects the actual process architecture.
- Show the manual's approval and revision trail.
Clause 4.2.3: Medical Device File Retrieval Test
- Open the device file index and retrieve referenced documents quickly.
- Demonstrate labeling/IFU approval history and effective date control.
- Demonstrate linkage between device file references and controlled documents.
Clause 4.2.4: Document Control at Point of Use
- Show current work instructions in use and prove they match approved revisions.
- Show the change request, review, approval, effective date and training trail.
- Show obsolete documents are prevented from unintended use.
- Show an external document register for standards and regulatory documents used operationally.
Clause 4.2.5: Record Control (Integrity and Retrieval)
- Show record retention schedule approvals and controlled access.
- Show record indexing rules and retrieval performance (sample 10 records).
- Show backup/restore test evidence for electronic record systems.
Clause 4: Top Failure Patterns (Major NC Signals)
- Obsolete documents found in production or service contexts.
- Device file exists but is not indexed, not controlled, or not retrievable.
- Records reconstructed during audit instead of retrieved from controlled storage.
- Uncontrolled external standards or specs used operationally.
Clause 4: Rapid Fix Sequence (Execution Order)
- Define process architecture and owners.
- Implement MDL and procedure/record matrix.
- Build medical device file index with controlled references.
- Implement document lifecycle, approvals and distribution control.
- Implement record taxonomy, retention, access and retrieval discipline.
- Validate QMS software tools where used for approvals, records or workflows.
- Run an internal audit retrieval test and close gaps via CAPA or change control.
Clause 4 FAQ
What is ISO 13485 Clause 4?
Clause 4 defines the QMS foundation: how the system is structured (4.1) and how QMS documented information is controlled (4.2), including the medical device file, document control, and record control.
What evidence do auditors sample for ISO 13485 Clause 4?
Auditors sample document approvals and revision history, controlled distribution at point of use, obsolete document controls, device file indexes, and record retrieval/retention/integrity evidence.
What is ISO 13485 document control (Clause 4.2.4)?
Document control is the lifecycle that ensures only approved, current documents are used, changes are reviewed and approved, distribution is controlled, and obsolete documents are prevented from unintended use.
What is ISO 13485 record control (Clause 4.2.5)?
Record control ensures records are identifiable, secure, retrievable, and retained for defined periods, with integrity controls for electronic records and evidence of backup/restore discipline.
What is a medical device file in ISO 13485 (Clause 4.2.3)?
A medical device file is a controlled, device-family file that references the documents and records that define the device, its specifications, labeling, and the processes that produce and verify it.
What is a Master Document List (MDL) and why do auditors ask for it?
An MDL is the index of controlled documents with identifiers, revision status, owners, and effective dates. Auditors use it to test whether control is real and complete.
What is the most common Clause 4 audit failure?
Uncontrolled document state: obsolete instructions at point of use, weak approval trails, and missing distribution or withdrawal controls. The second most common is record retrieval failure.
How does Clause 4 affect ISO 13485 Clauses 7 and 8?
Clause 4 is the control layer for the documents and records that Clause 7 (product realization) and Clause 8 (measurement and CAPA) depend on. Weak Clause 4 breaks traceability, CAPA credibility, and audit closure.
Do digital QMS tools require validation for Clause 4.1?
Yes, where software is used in the QMS. Clause 4.1.6 requires documented procedures for validating QMS software before first use and after changes, proportionate to the risk of using it.
Where do I go next after Clause 4?
Use the ISO 13485 Clause Hub to navigate Clauses 5 to 8 and follow evidence chains across management review, internal audit, complaints, supplier control, and CAPA.