This guide covers how to build a document control system that satisfies ISO 13485, FDA QMSR, and 21 CFR Part 11 requirements, from the foundational structure to the workflows that keep it running.

What document control means in a regulated environment

Document control is the set of policies, procedures, and systems a company uses to create, review, approve, distribute, revise, and retire documents that affect product quality and regulatory compliance. In regulated industries, pharma, medical devices, biotech, food safety, document control carries legal weight. A document that existed but was not controlled, or was controlled but not followed, can result in an FDA Form 483 observation or a warning letter.

ISO 13485:2016 Section 4.2.4 specifies that documents required by the quality management system must be controlled. FDA QMSR (21 CFR Part 820) aligns with that standard and adds specific expectations around electronic records. 21 CFR Part 11 applies if you manage any of those documents in electronic form, which most companies do today.

The scope of document control is wider than most teams expect when they first set it up. It covers:

• Standard operating procedures (SOPs)
• Work instructions and job aids
• Specifications: product, material, packaging, labeling
• Forms and templates used to generate quality records
• Validation protocols and reports
• Policies and quality manual content
• External documents incorporated by reference (regulatory guidance, standards)

The difference between documents and records

Before building your system, get this distinction clear: documents are instructions and specifications. Records are the evidence that those instructions were followed. A batch record form is a document. A completed batch record is a record. Both require control, but the specific requirements differ.

Records must be retained for defined periods (often the life of the device plus two years under 21 CFR Part 820, or longer under some state regulations). Documents must be kept current, with obsolete versions removed from use. Confusing the two is one of the more common audit findings.

Step 1: Write your document control procedure first

The document control SOP is the foundational document in your quality system. It governs itself and every other controlled document. Write it before you create anything else.

At minimum, your document control SOP should cover:

• Document numbering and naming conventions
• Revision levels and how they are tracked
• Who can initiate a new document or change request
• Review and approval authority by document type
• Distribution controls: who gets access, how
• Training requirements triggered by document approval
• Obsolete document retirement and archiving
• How external documents are incorporated and reviewed
• Electronic signature requirements under 21 CFR Part 11

Get this SOP approved through your existing QMS before using it to control anything else. If you are building your QMS from scratch, have senior leadership sign off on the procedure as part of the initial quality system establishment.

Step 2: Define your document hierarchy

Most regulated companies use a three-level or four-level document hierarchy. It keeps the structure logical and makes it easier to manage revisions without triggering rewrites across the entire system.

A common structure looks like this:

• Level 1: Quality Manual. Describes the overall quality management system and its scope. References the standards and regulations the company complies with.
• Level 2: Policies and SOPs. Describe what the company does to meet quality requirements. Each SOP covers a specific process area.
• Level 3: Work instructions and job aids. Provide step-by-step instructions for specific tasks. More granular than SOPs.
• Level 4: Forms and templates. The blank documents used to capture records during activities.

Some companies add a fifth level for external documents. Others combine levels two and three. The specific levels matter less than consistency. Pick a structure and document it in your document control SOP.

Step 3: Set up your numbering system

Every controlled document needs a unique identifier. A typical numbering convention includes a document type prefix, a sequential number, and a revision level indicator.

For example: SOP-QM-001-Rev-B identifies a Quality Management SOP, document number 001, at revision level B. Forms might use FORM-QM-001-Rev-A, linking back to the SOP they support.

Whatever convention you choose, apply it from day one. Renumbering documents later is time-consuming and creates confusion during audits because the historical record will show different identifiers for what is logically the same document.

Step 4: Establish approval workflows

Every controlled document must go through a defined review and approval process before it becomes effective. Who needs to approve a document depends on its type and impact. A product specification typically requires sign-off from engineering, quality, and regulatory affairs. An internal SOP for office procedures might only need the department manager and the quality function.

Define your approval matrix in the document control SOP or in a separate approval authority matrix document. Be specific. Vague language like “appropriate management” is an invitation for an audit observation. Name the roles, not the individuals. That way, personnel changes do not require a document revision every time someone leaves.

Set a review cycle. ISO 13485 does not specify a frequency, but most companies review controlled documents every one to three years, or upon any change to the process, regulation, or equipment the document governs. Log the review date and outcome, even if no changes are made.

Step 5: Control distribution and access

The goal of distribution control is to make sure people work from the current, approved version of every document, and that obsolete versions cannot be mistakenly used.

In paper-based systems, this typically means stamping printed copies as “Controlled” and maintaining a distribution log. The document control team issues copies and collects and destroys obsolete ones when a revision is approved.

In electronic systems, access control takes the place of physical distribution. Users can only access the current approved version. Older versions move to a restricted archive accessible only to document control administrators. The audit trail records who accessed which document version and when.

Electronic systems are far easier to manage at scale. Once a company reaches 50 or more SOPs across multiple departments, paper-based distribution control becomes a full-time job with significant error risk.

Step 6: Link document approval to training

A controlled document approved and distributed to people who have not been trained on it is a compliance gap. The link between document control and training management is one of the most commonly cited weaknesses during FDA inspections.

Your document control system should automatically trigger training assignments when a new document is approved or an existing one is revised. Training completion should be captured as a record, with the specific document version that was trained documented. If a new revision supersedes the training record, a new training record should be created.

This connection matters most for SOPs and work instructions that directly affect product quality. If an operator was trained on Revision A and Revision B changes a critical step, the training gap is a real compliance risk, not a paperwork issue.

Step 7: Manage change requests systematically

Documents change because processes change, regulations change, or audit findings require correction. Every change needs to go through a defined change request process, not be made informally and submitted for approval after the fact.

A document change request should capture:

• The document being changed
• The reason for the change
• The proposed change content
• Impact assessment: does this change affect other documents, validated systems, or customer specifications?
• Approval signatures before the revision is effective

Changes that affect validated processes or equipment require a separate change control review before the document revision is finalized. Your Process Change Notification process and your document control process need to be connected.

Step 8: Handle obsolete documents correctly

When a document is superseded or retired, the previous version must be removed from active use. In electronic systems, this happens automatically when a new revision is approved. In paper systems, it requires active retrieval and destruction or clear marking of all controlled copies.

Retain obsolete documents in an archive, with access restricted to document control personnel. FDA requires that records of obsolete documents be maintained for specified retention periods. The content of the document is less important than the metadata: what version it was, when it was effective, when it was superseded, and who approved the change.

Common audit findings in document control

FDA warning letters and 483 observations cite document control problems regularly. The most frequent issues:

• Using forms or SOPs that were not the current approved version at the time of use
• No evidence that obsolete documents were retrieved or destroyed
• Signatures missing from approval sections
• Training records that reference a different document revision than the one currently approved
• No periodic review of documents, or reviews performed but not documented
• Informal revisions made in the field without going through the change request process

These are procedural failures, not technical ones. They happen when the document control system is either too cumbersome to follow consistently or too loosely defined to enforce.

Paper vs. electronic document control

The FDA’s guidance on Computer Software Assurance (CSA) makes clear that it expects most regulated companies to move toward electronic quality records. The agency reduced the validation documentation burden specifically to lower the barrier to electronic adoption.

Electronic document control systems built for regulated industries handle version control, approval workflows, electronic signatures, distribution, training triggers, and archiving in a single platform. They also generate the audit trail that regulators expect to see when they review your electronic records under 21 CFR Part 11.

What to look for in document control software

If you are evaluating an eQMS platform with document control capabilities, these are the features that matter most in a regulated environment:

• Configurable approval workflows by document type and department
• Electronic signatures compliant with 21 CFR Part 11
• Automatic version control with full revision history
• Integrated training management linked to document approval events
• Controlled access with role-based permissions
• Automatic archiving of obsolete versions with restricted retrieval
• Audit trail on every document action: created, viewed, approved, revised, retired
• Support for external document management
• Pre-validated system with a supplier-provided validation package

Cloudtheapp includes a complete document control application as part of its 60+ app eQMS platform, built specifically for regulated industries including medical devices, pharmaceuticals, biotech, and food safety. The platform is pre-validated to FDA guidelines and supports 21 CFR Part 11-compliant electronic signatures, configurable approval workflows, and automatic training assignment on document approval. Request a walkthrough here.

Getting started: a practical first week

If you are setting up document control for the first time, a practical first-week sequence looks like this:

Day 1: Draft your document control SOP. Define scope, document types, numbering convention, and approval matrix.

Day 2: Get the SOP reviewed and approved by quality management and at least one senior operations leader.

Day 3: Create your master document list. Inventory every document that should be controlled and assign document numbers.

Day 4: Evaluate your system for managing documents. If you are using shared drives or email, map out where the gaps are against the requirements you documented in your SOP.

Day 5: Train everyone who creates, reviews, approves, or uses controlled documents on the new procedure.

From there, document control is an ongoing process. Assign ownership. Build review cycles into your quality calendar. Run periodic audits against your own procedure to catch gaps before a regulator does.

Conclusion

Document control is the backbone of a compliant quality system. Without it, every other quality process, your CAPAs, your audits, your training records, operates on an unstable foundation. Getting it right from the start saves years of remediation work and protects you during inspections.

The setup effort is front-loaded. Once your system is running, maintenance is manageable. The companies that struggle with document control are usually the ones that skipped the foundational structure work and tried to retrofit controls later. Start with the SOP, define your hierarchy, build your workflows, and connect document approval to training. That sequence works for a five-person quality team and a five-hundred-person one.

This post created by and appeared first on Cloudtheapp