Keep Your Document Control System in Control

Document control is always an interesting topic for discussion.  It seems like a simple topic and area for compliance, but I often run into companies with document control systems that are overly complicated and difficult to manage.  Many companies separate document control for quality system procedures/processes from other types of change control.  In reality, document control is one element of the overall change control and records management requirements.  There are many procedures, formats, tools, and/or styles for managing quality documents and records.   Let’s take a look at how these key activities are related and why we should focus on implementation of strong change control processes within the quality systems — rather than just a document control process.

As you look at the various regulations and/or standards like 21 cfr (210, 211, 820, 600, etc.), ISO (9001, 13485, etc.), EU, JPAL, etc., they all require document and change control/management.  Additionally, 21 cfr 11 describes the FDA requirements for the use and management of electronic records.

We are all familiar with the standard document control pyramid. The diagram below reminds us of the relationship between documents and records within the Quality Management System.

You can see from this diagram that there are many types of Quality System documents you could generate.  I strongly recommend that you “right size” your procedures and records to assure compliance and simplicity for the organization. 

• Determine the relationship between the various documents and which ones meet the needs of your specific business. 
• The regulations/standards identify the minimal procedures that are actually required to meet the defined requirements. 

The following list was extracted from the ISO 13485 standard

• 4.2.3 Control of documents
• 4.2.4 Control of records
• 6.4 Work environment
• 7.3.1 Design and development planning
• 7.4.1 Purchasing process
• 7.5.1.2.3 Servicing activities
• 7.5.2.1 Validation of processes for production and service provision —
• General requirements
• 7.5.2.2 Particular requirements for sterile medical devices
• 7.5.3.1 Identification and traceability — Identification
• 7.5.3.2.1 Identification and traceability — Traceability
• 7.5.5 Preservation of product
• 7.6 Control of monitoring and measuring devices
• 8.2.1 Monitoring and measurement — Feedback
• 8.2.2 Internal audit
• 8.3 Control of nonconforming product
• 8.4 Analysis of data
• 8.5.1 Improvement — General
• 8.5.2 Corrective action
• 8.5.3 Preventive action

• You do not need a work instruction/procedure for every activity in your operation.  Create these additional documents if they help the employees perform the operations/tasks or assure higher level of quality.   
• Keep it simple.

There is specific information that should be addressed as you implement the document/record/change control system:

1. Document identification/number system – develop a simple but intelligent number system.  I have seen everything from basic sequential numbering (1, 2,3,etc.) to extremely long alpha/digit numbers with built in intelligence.  I recommend something that is meaningful and simple for the employees to understand and find documents.

• Revision control – identify how the employee knows they are using the correct version of the SOP.  There are many approaches including, but not limited to, alpha characters, numbers, and date codes, to name a few.
• Purpose – why are you generating the procedure? If you can’t explain why you are writing the document in a couple of sentences, maybe you should think about whether or not it is really needed. 
• Scope – what/who is impacted by this procedure.  There are times a procedure is not applicable to all functions/sites.  This is a great time to identify what is or isn’t included in the scope of the process.
• Definitions – this is really a tricky area.  I prefer a stand-alone glossary of terms, rather than building them into the procedure.  Putting all definitions/terms into a glossary document assures consistency in how terms are used.
• Roles and responsibilities – You may choose to use the RACI (Responsible, Accountable, Consult, Inform) model to identify what roles different functions have in the process. Another option is to call out cross functional  and or interrelationship responsibilities.
• Records – it is always good practice to identify the records generated as a result of the procedure. 
• Procedure – this is the actual process being documented.  There are many forms/formats for writing the procedures.  A process flow diagram may work and be more effective than a 14-page document.  Select the format that best meets the process and is easy to demonstrate compliance.

Procedures and records can usually be distributed into three major buckets:

• Product – those documents that support the design and development of products.  These records make up the Design History File (DHF) and serve as the master record for how the product was designed.
• Process – those documents that support the manufacturing, procurement, and/or operations of the organization.  These records make up the Device Master Record (DMR) and serve as the master record/recipe for how a particular product is manufactured.
• Quality System – these documents define the activities and processes necessary to support the quality system requirements. These procedures do not normally impact product design or manufacturing operations.

Implementing an effective document/record control system requires a simple change control process. The FDA is taking a much closer look at planned changes in relation to product and process design.  Unplanned changes are normally documented as deviations and should be included in the evaluation of nonconformances, as a feeder to the CAPA systems.    

There is no requirement to have a separate change control system for each type of document.  One simple process can be established to support all types of changes.  Evaluation of changes should use a risk approach based on major/minor types of change.  The risk based definitions must be included in your procedures and should be determined on specific business needs.  Administrative changes (typo, wording clarification, page numbers etc.) must be addressed but do not require the same level of scrutiny or evaluation.  A good rule of thumb to use when evaluating change is the impact of the change on the form, fit, or function of the product/activity. 

I have seen change processes implemented in many different ways.  I recommend one basic process to address all types of change, rather than individual change processes.  You can develop one process flow and form to support all areas of the quality system.  The following table gives you an example of how you might establish a risk based approach to change control with one process:

Change Control
	Product	Process	Quality System	Administrative
Requirements	X	X	NA	NA
Risk Assessment	X	X	NA	NA
Product Verification	X	X	NA	NA
Product Validation	X	X	NA	NA
Training	X	X	X	NA
Process validation	X	X	X	NA
Process Risk Assessment	X	X	X	NA

There are several very effective automated tools on the market that could be considered to support the document/record/change control processes.  The key is to have thought through how you want the processes to work, map out a plan for implementation, validate that the tool meets your business needs and requirements, educate the organization on how the system works and why key decisions were made.

I strongly recommend defining user needs and requirements for the document/record/change control electronic tool prior to purchasing.  Having a defined procedure and process will facilitate the selection activity.  Identify those functions/features the system MUST have versus those that would be NICE to have.  Build a table of these requirements and ask the various suppliers to address your needs.  Each system/tool will have key features and benefits  Knowing what your business needs and wants before making the selection will make the implementation much more effective.

In summary,

• Document/record control is one of the main cornerstones for a successful quality management system.
• It is critical that you establish the document/record/change process and controls as simply and clearly as possible.  Make it easy for the employees to understand and use.
• Change control should be simple and risk based.
• Automation is great – as long as you are clear about what you are automating and how it needs to work for your business.