A Guide to Document Control
01. What is Document Control?
Document control is an organization's formal and organized process of managing a document throughout its entire lifecycle - from creation to obsolescence. It is a fundamental practice for ensuring that all critical documents within an organization are accurate, correct, and readily available to the right people.
The main purpose of document control is to create a reliable, organized, and auditable system for handling important information. It is one of the most crucial aspects of any QMS, and a strong Document Control system is critical for industries with strict regulatory requirements such as manufacturing, medical device, pharmaceuticals, and engineering.
It would not be an exaggeration to say that Document Control is the most important process in any QMS. As anyone who has worked in Quality will tell you, "if it's not written down, it didn't happen". Therefore, a strong Document Control system is imperative to ensuring all your "written down" information - procedures, work instructions, forms, records, training materials, and other crucial documents - are being appropriately reviewed, stored, accessed and managed.
02. The Critical Role of Document Control
There are several advantages to maintaining a strong and organized Document Control system:
Single Source of Truth: It provides a single source of information (also known as "source of truth") for all procedures, processes, and other documents within an organization.
Current Information Only: It ensures that employees work and train to current procedures only, minimizing the risk of an employee using outdated or obsolete procedures which can lead to non-conformances, rework, and product defects.
Efficiency: It reduces the time it takes to search for information by making current documents readily accessible and easily retrievable for review and training.
Regulatory Compliance: It can help achieve regulatory compliance. Most quality standards (e.g., ISO 9001, ISO 13485, FDA) require an organization to have a robust document management system in place.
Remember, without proper document controls, organizations face serious risks including quality failures from employees following outdated procedures, audit findings due to improper document management, compliance violations when regulatory requirements are not properly documented and followed, training gaps when employees are not working to current procedures, and inefficiencies from duplicated or conflicting documentation.
03. Document Categorization and Hierarchy
A well-designed document control system organizes documents into clear categories that reflect your QMS structure. Below is an example of how documents within your QMS may be organized. While this is an example of typical document "hierarchy" (how your documents are arranged and ranked), your organization may have more, or even less, document categories depending on the needs of your QMS.
Standards: Often managed as part of a company's document control system and can include external requirements like ISO 9001:2015, AS 9100:2016, and ISO 13485:2016. Standards may also include customer-specific documented requirements. As a general rule, standards are documents of an external origin (originating outside your company).
Quality Policy: The highest level internal document within a QMS is often the Quality Policy - the formal document that essentially states an organization's commitment to quality and how its quality goals will be achieved.
Quality Manual: The highest level procedure is often the Quality Manual, which describes and breaks down an organization's Quality Management System and serves as the primary reference document for how the QMS is organized.
Procedures (SOPs): High-level instructions that outline a process, often to show compliance with certain requirements of a standard.
Work Instructions: Provide detailed step-by-step guidance for specific tasks within a process. They explain "how" something is done.
Forms: Serve as templates for capturing required information. They are often the precursors to records as the data, information, and supporting documentation captured in forms serves as evidence of how a process was completed.
Records: The completed forms, templates, or supporting documents that provide evidence of compliance. These are the documents that show what was done, how it was done, and the results. In audits, records are the primary method by which an organization proves they are meeting requirements.
04. The Document Control Process
There are several aspects of a robust Document Management system that should be included as part of your document control process. These include:
A centralized system with an intuitive search capability: Ensures your controlled documents and records are stored and accessed in one system, and that those documents are easy to find using searchable terms like keywords, authors, effectivity dates, etc.
Version control: Every controlled document within a QMS, whether automated or on paper, must have a clear revision history. This revision history must show:
- When released/updated
- What changed
- Who made changes
- Why changes were necessary
- Who approved
A clear revision history helps you easily track and trace all changes made to documents throughout your organization, including documents that have been inactivated or obsolesced.
Access Controls/Permissions: Ensures that only the right employees are able to access, view, update (redline), review, and approve the documentation in your system.
Approval workflow: Ensures that your newly released or redlined documents are routed to the appropriate employees for review and approval prior to effectivity and use within the organization.
Record Management: Ensures that evidence of activities and tasks are retained and remain identifiable, accessible, and protected from alteration.
Training: While not necessarily a part of your formal document management system, training is inextricably tied to Document Control. A robust training system assigns documents that require training to defined roles within your organization once the document has been approved. This allows documents to be trained to prior to the effectivity date (the date in which the document becomes "live" for use in your organization).
05. Document and Record Workflows
Document Workflow: A typical Document workflow will start with the creation of a document (such as a procedure or work instruction) that will be assigned a name, document number (such as PRO-001) and revision (1.0 or A). The document number is unique and must not change throughout the lifetime of the document as it is used for traceability and tracking the document history.
Once the document has been drafted, it will be sent for review and approval by applicable people in the organization. These are often process managers, quality and regulatory representatives, and subject matter experts who review the content of the document for accuracy and thoroughness. They may reject a document if they feel more changes are needed, or approve it if they are satisfied with the content.
Once the document is fully approved, it can move either to a training phase where employees have a set amount of time to complete training, or to release, at which time the document becomes effective for use (also known as the effectivity date). Depending on the type of document, records may be created from these documents.
Often, a document will need to be revised due to a change in the process or requirements. This will require someone to "redline" the currently released version of the document (meaning, make edits that are viewable to reviewers). The document number will not change, however, the revision will roll to the next level (for example, 2.0 or B). Once the document is released, only the updated revision of the document will be available for use, and the old revision will be made inactive.
Note: Inactive documents should always be retained in the document history for traceability and reference purposes, however, they should only be available to certain individuals in your organization who have responsibility over document management such as Document Control administrators.
06. Record Workflow
Record Workflow: Records are a special type of document and require some unique controls to ensure they are protected from alteration and loss as required by most regulatory agencies and Quality Management System standards. Records are created from a source document that is released following the document control workflow above.
A record can be created from any type of document, but are most typically created from forms (like an order form), a template (such as a design review template) or a supporting document (such as a data verification plan). Like documents, records must have a unique name and number assigned to them, and some indicator of what order the record was created in (such as V1). This is especially important for record "packets" that will have supplemental information added at a later date (such as design testing that occurs over many months and has many data sets). At minimum, a record should include the date the record was created or approved.
Once a record is ready for retention, you may choose to have it reviewed by another individual in your company, or simply "release" it in your electronic system for storage. When updates to the record are needed (such as adding supplemental information), the previous version of the record must be retained. The original record should not be replaced, but either added to by attaching additional documentation, or by creating a new record number and creating a relationship to the previously released record.
Because records serve as the evidence of what happened during a process, it is important to protect all records associated with that process or product's history to be retained. This is especially important in industries such as medical device or aerospace where a product design may go through extensive testing and iterations before release.
07. Industry-Specific Requirements
Depending on the industry your organization belongs to, your Document Control system may have certain requirements that must be complied with in order for your products and services to be made available to customers.
ISO 9001:2015: Quality Management Systems - Requirements is the foundation standard upon which most other Quality Management Systems (QMS) standards are based. Document Management in ISO 9001 is covered under its requirements for "documented information," which essentially requires documentation related to, or resulting from processes to be controlled and retained. While ISO 9001 allows organizations flexibility regarding which documented information is controlled and how best to manage that information, some documents and records are mandatory including documenting the scope of the quality management system, the quality policy and quality objectives, and retaining evidence of competencies, internal audit results, and management reviews.
AS9100:2016: Quality Management Systems - Requirements for Aviation, Space and Defense Organizations is used by organizations in the aerospace and defense industry. It is based on ISO 9001, but has additional requirements specific to the unique needs of these types of organizations. AS9100's document control requirements are also based on ISO9001, but have some specific and mandatory documentation type requirements. For example, AS 9100 requires "configurational management" documents which ensure tight controls of design and development documentation, supplier documentation for controlling parts or services acquired from outside vendors, and records of conformity to prove that products and services meet all specifications.
08. Additional Industry Standards
ISO 13485:2016: Medical Devices - Quality Management Systems - Requirements for regulatory purposes is specific to organizations whose QMS must comply with the requirements for medical devices. ISO 13485 has some key differences from ISO 9001. It is more tightly regulatory focused and requires a robust risk-based process approach to the entire product lifecycle. In the area of Document Control, it has much more extensive and detailed requirements than either ISO 9001 or AS9100 including the requirement for an organization to have a formal Quality Manual, Design History Files, a Medical Device File, extensive supplier documentation including records of audits and supplier performance, a record retention system that ensures specific records are kept for prescribed periods of time, and risk-based device verification and validation records.
FDA 21 CFR part 820: The U.S. Food and Drug Administration has similarly strict requirements for document controls in medical devices, and companies that want to market and sell medical devices in the U.S. must meet these requirements. This includes maintaining a Document Control system where documents are reviewed, approved, retained and available to all applicable employees when and where they need them, as well as ensuring obsolete documents are removed to prevent unintended use. The FDA additionally has strict requirements for electronic signatures and records to ensure the integrity, authenticity, and confidentiality of electronic data (FDA 21 CFR part 11).
IATF 16949:2016: Automotive Quality Management System Standards is specific to the automotive industry. While aligned with ISO 9001, IATF 16949 also has additional stringent requirements to address the specific needs of the automotive industry. The requirements for documentation in IATF 16949 are also more rigid and there are some mandatory documentation requirements including a documented Quality Manual and specific documented procedures covering such subjects as product safety, engineering specifications, and total productive maintenance.
ISO 22000: Food Safety Management Systems is applicable to organizations that work anywhere within a "food chain" (from farm to fork). This standard is unique in that it not only builds upon the ISO 9001 structure, but also Hazard Analysis and Critical Control Points (HACCP) principles and Prerequisite programs (PRPs) specific to hygiene and sanitation practices in a food production environment.
No matter what standards and regulations your organization's QMS is based on, your document control system should have tight version controls, a strong approval process, access controls, robust audit trails, and must protect documents and records from loss and unintended or unauthorized changes.
09. Advanced Document Control Features
Automating your Document Control system with the right features can make your processes more efficient and effective. This will lead to higher employee adoption and better compliance during audits. Some of these features include:
Document Change traceability: A strong automated redlining feature which clearly highlights all additions, deletions, and modifications to a document, making it easy for reviewers to see exactly what has changed between document versions.
Standards Compliance dashboard: Provides a one-click view of your organization's adherence to the standards on which your QMS is based. It offers direct links to procedures that demonstrate compliance, as well as the status of document reviews and employee training.
Automated Document Relationships: Automatic links to related documents create an organized network of connections, helping users to navigate complex quality systems. For example, a procedure might link to multiple work instructions, a work instruction might link to specific forms needing completion, and standards requirements can be directly linked to the high level procedures that address them.
Multi-Site Management: Organizations with multiple locations need to manage both corporate-wide and site-specific documentation. Advanced document control systems allow corporate procedures that apply to all sites, site-specific procedures that override or supplement corporate requirements, automatic distribution of updates to appropriate locations, and centralized oversight with local flexibility.
Document Migration and Import: When transitioning from legacy systems, organizations need tools to import existing documents efficiently while preserving revision history, convert various file formats into standardized templates, maintain traceability from old document numbering systems, and minimize disruption during the transition period.
1factory's Quality Management System provides comprehensive document control capabilities that streamline your entire document lifecycle, automatically calculates compliance metrics, and saves hours of manual work. Learn More