This guide explains what ISO 13485 and FDA QMSR actually require from a quality manual, what auditors expect to find, and how to write one that holds up under inspection without becoming a document that no one inside the organization actually uses.

What is a quality manual?

A quality manual is the top-level document that defines the scope of an organization's quality management system, describes how the QMS elements relate to each other, and references the procedures, work instructions, and records that form the system's operational backbone.

It sits at the top of the document hierarchy. Below the quality manual come standard operating procedures, then work instructions, then forms and records. The manual does not describe how to perform work in detail. That is the role of procedures. The manual describes what the QMS includes, why it is structured the way it is, and where to find the documents that govern specific processes.

Is a quality manual required under ISO 13485?

Yes. ISO 13485:2016 Section 4.2.2 explicitly requires a quality manual. The section specifies minimum content:

• The scope of the QMS, including details of and justification for any exclusions
• The documented procedures established for the QMS, or reference to them
• A description of the interaction between the processes of the QMS

Unlike ISO 9001:2015, which removed the quality manual requirement in its 2015 revision, ISO 13485 retained it because the medical device sector operates under regulatory requirements that benefit from a defined top-level QMS document. Certification bodies audit against the manual during initial certification and surveillance audits.

Is a quality manual required under FDA QMSR?

FDA's Quality Management System Regulation (21 CFR Part 820, commonly called QMSR) does not use the term "quality manual" specifically, but it requires organizations to establish and maintain a quality system. In practice, FDA investigators expect to find a document or set of documents that describe the QMS scope and structure. During inspections, investigators frequently request the quality manual as a starting point.

Organizations operating under both ISO 13485 and FDA QMSR typically maintain a single quality manual that satisfies both requirements. This is practical because the two frameworks are broadly aligned, and managing separate top-level documents for each creates version control complexity without adding regulatory value.

What must a quality manual include?

The minimum content required by ISO 13485 Section 4.2.2 is the starting point, but a manual that contains only the minimum is usually too sparse to be useful either to auditors or to employees. The sections below cover the elements that consistently appear in quality manuals that pass third-party audits and FDA inspections without findings related to the manual itself.

Organization profile and scope

The opening section describes the organization: legal name, address, what it makes or does, and which regulatory frameworks apply. The scope statement specifies what the QMS covers. If the organization has excluded any clause of ISO 13485 because that activity does not apply, the exclusion is stated here with its justification.

Scope exclusions are common for smaller companies. A contract manufacturer that does not design products may exclude Section 7.3 (Design and Development). A distributor that does not manufacture may exclude several production-related clauses. Each exclusion requires a brief explanation of why the clause does not apply to the organization's activities.

QMS overview and document hierarchy

This section explains how the quality management system is organized and how the documents within it relate to each other. A simple diagram showing the four tiers of documentation, quality manual at the top, followed by SOPs, work instructions, and forms or records, is standard here and gives auditors an immediate visual map of the system.

This section also lists or references the documented procedures that form the operational core of the QMS. Under ISO 13485, several procedures are explicitly required to be documented. These include audits, corrective and preventive action, control of nonconforming product, control of documents, and control of records, among others. The quality manual should either list these procedures by name or reference the section of the QMS where they are located.

Management responsibility

This section covers the commitments and authorities that senior leadership has defined for the QMS. It describes how quality objectives are set, how they are communicated, and how they are reviewed. It identifies the management representative, the person responsible for ensuring QMS processes are maintained and for reporting QMS performance to top management.

The section also describes the planning process for the QMS, including how the organization manages changes that affect the QMS without losing continuity.

Resource management

This section describes how the organization ensures it has the people, infrastructure, and work environment needed to meet product and regulatory requirements. For regulated companies in life sciences, this typically includes references to personnel qualification, training requirements, equipment qualification, and facility controls.

The manual does not describe how training is conducted. That is the role of the training SOP. The manual states that a training process exists, what it covers at a high level, and where to find the governing procedure.

Product realization

This section maps the major product realization processes: from customer requirements and design through purchasing, production, and delivery. For a medical device manufacturer, this section typically includes references to design controls, purchasing controls, production and process controls, and monitoring and measurement of products.

Again, the manual does not describe how to perform these activities in detail. It describes the processes that exist and references the procedures that govern them. Auditors use this section to verify that the organization has acknowledged and documented all required processes.

Measurement, analysis, and improvement

This section describes how the organization monitors QMS performance and drives improvement. It typically references the processes for internal auditing, management review, control of nonconforming product, corrective and preventive action, and statistical techniques where applicable.

For ISO 13485 auditors, this section is scrutinized because it connects the quality manual to the improvement cycle. An organization whose quality manual describes robust monitoring and analysis processes but whose actual records show little data collection or follow-through is a common audit scenario. Auditors check whether the manual's description of the improvement system matches what they find in the records.

Common quality manual writing mistakes

Copying regulatory language verbatim. A quality manual that reproduces the text of ISO 13485 section by section, with the organization's name substituted for "the organization," tells an auditor almost nothing about how the company actually operates. It is also frequently out of date the moment a procedure changes. The manual should describe what the organization does, not restate what the standard requires.

Describing activities at procedure level. The quality manual is not a procedure. It should not explain step by step how to conduct an internal audit or process a CAPA. Those details belong in the corresponding SOPs. A manual that contains step-by-step instructions becomes unmanageably long and requires revision every time an operational process changes.

Making commitments the procedures do not keep. A quality manual that states "all corrective actions are verified for effectiveness within 30 days" creates an audit obligation. If the CAPA procedure does not specify 30 days, or if records show effectiveness checks being completed at 60 or 90 days, the manual creates a finding rather than preventing one. The manual must align with what the procedures actually say and what the records actually show.

Not updating the manual after QMS changes. The quality manual is a controlled document subject to the same document control requirements as every other QMS document. Organizations that update procedures and work instructions but fail to update the manual over time end up with a top-level document that describes a QMS that no longer exists. This is a common finding in surveillance audits.

Treating the manual as internal-only. Quality manuals are frequently shared with customers, regulatory bodies, and certification bodies. Some organizations maintain two versions: a detailed internal version and a shorter external version. If only one version exists, it should be written with the understanding that it may be reviewed by any of these audiences.

How to structure a quality manual that survives audits

The structure below works for most regulated companies operating under ISO 13485 and FDA QMSR. It maps directly to the clause structure of ISO 13485, which makes cross-referencing straightforward during audits.

Section 1: Introduction and scope. Organization overview, applicable regulatory frameworks, QMS scope, scope exclusions with justification.

Section 2: Normative references. List of standards and regulations the QMS is designed to satisfy (ISO 13485:2016, 21 CFR Part 820, any other applicable standards).

Section 3: Terms and definitions. Key terms used in the manual, with definitions. For organizations with a glossary document or procedure, this section can reference that document rather than duplicating definitions.

Section 4: Quality management system. Document hierarchy, list of required documented procedures and their locations, record retention requirements at a summary level.

Section 5: Management responsibility. Quality policy, quality objectives process, management commitment, management representative, management review overview.

Section 6: Resource management. Human resources and competency, infrastructure, work environment.

Section 7: Product realization. Planning, customer requirements, design and development (or exclusion with justification), purchasing, production and service provision, control of monitoring and measuring equipment.

Section 8: Measurement, analysis, and improvement. Feedback processes, internal audits, monitoring and measurement of processes and products, control of nonconforming product, data analysis, improvement processes including corrective and preventive action.

How long should a quality manual be?

There is no required length. Quality manuals range from 10 pages to more than 100 pages. The right length depends on the complexity of the organization and the QMS.

For a small company with a focused product line and a relatively simple QMS, 15 to 25 pages is typically sufficient. For a large, multi-site organization with complex product realization processes and multiple regulatory frameworks, 40 to 60 pages may be necessary to adequately describe the system without duplicating procedure content.

The test is whether the manual, read on its own, gives an auditor or new employee a clear understanding of what the QMS includes and where to find the documents that govern specific processes. If it does that in 15 pages, 15 pages is the right length. If additional context is needed for the system to be comprehensible, that context belongs in the manual.

How Cloudtheapp supports quality manual management

A quality manual is only as useful as the document control system that governs it. A manual sitting in a shared drive without version control, approval workflow, or revision history is not compliant with ISO 13485 Section 4.2.4 (control of documents) regardless of how well it is written.

Cloudtheapp's document control module manages quality manuals and all other QMS documents in a single controlled environment. Version history, approval workflows, review reminders, and electronic signatures are built into the document lifecycle. When a procedure changes and the quality manual needs updating, the system routes the revision through the same controlled approval process as the original document, with a full audit trail.

With 60+ applications across quality, safety, and compliance, Cloudtheapp gives regulated organizations the infrastructure to maintain a living quality management system where the manual and the procedures stay aligned over time, not just at initial certification.

Request a demo to see how Cloudtheapp manages document control for quality manuals in regulated industries.

Summary

A quality manual written to satisfy auditors without being useful to the people who work inside the QMS is a compliance liability. The most effective quality manuals are precise about scope, honest about what the organization does, and structured so that anyone reading them can quickly understand the QMS and navigate to the governing procedures for any process area.

ISO 13485 Section 4.2.2 sets the minimum content requirements. FDA QMSR expects a document that describes the QMS structure. What turns a compliant quality manual into a useful one is alignment with the actual procedures, specificity about organizational commitments, and a document control process that keeps it current as the QMS evolves.

This post created by and appeared first on Cloudtheapp

Most migrations fall somewhere on a spectrum between complete structure preservation and complete loss of historical data. Where a migration lands on that spectrum depends almost entirely on the QMS vendor's migration methodology.

<h2>What actually happens during most document migrations</h2>

The most common migration approach is bulk upload. The incoming QMS vendor provides an import tool. The customer packages their documents and uploads them. Document content is preserved, but metadata, classification, revision history, and numbering conventions are handled inconsistently. What the quality team receives on the other end is a document library with the right files and the wrong structure.

Fixing this manually, after the fact, is the project most quality teams do not budget for. Someone has to open each document record in the new system, verify the classification, confirm the number, add the revision history, and link associated records. For a library of 100 documents, this is a multi-day project. For a library of 1,000, it is measured in months.

This is why companies with large controlled document libraries stay on systems they have outgrown. The pain of staying is known and manageable. The pain of migrating appears, at first glance, to be enormous.

<h2>What a metadata-driven migration changes</h2>

The alternative to manual post-migration cleanup is a migration approach that begins with data preparation rather than document upload.

In a metadata-driven migration, the quality team prepares a structured workbook, typically an Excel file, that captures every document's metadata: document number, title, classification, revision level, status, associated approval records, and any linked records such as training requirements or change controls. This workbook becomes the migration specification.

The implementation team uses this specification to build an automated injection process. Every document is inserted into the new QMS with its full metadata intact, in the correct classification, with the correct number, and linked to its associated records. The injection is validated against the source workbook before go-live. Discrepancies are caught in the validation phase, not discovered weeks into production use.

For a library of 1,000 documents, the manual work for the quality team is the preparation of the workbook, not the execution of the migration. The workbook preparation requires one member of the quality team who knows the classification system and has access to the existing records. The actual migration runs automatically.

<h2>What this looked like for a semiconductor company</h2>

A Silicon Valley materials science company with over 35 years in the semiconductor industry had built a document control system that was the backbone of its quality operation. The documents were classified, numbered, and structured in an electronic folder system. The content was good. The approval process, <a href="https://www.cloudtheapp.com/glossary-deviation-report/">deviation</a> management, and change control that ran through those documents were entirely manual: paper-based signature routing, manual classification assignments, and manual numbering for every revision.

When the company decided to move to a digital QMS, they had three requirements that ruled out most platforms: preserve the existing document classification structure exactly, migrate approximately 1,000 controlled documents without manual re-entry, and allow the quality team to configure and maintain the system without IT involvement.

After evaluating available options, they selected Cloudtheapp. Before implementation began, both teams agreed on the migration structure. The company's administrative team prepared an Excel workbook capturing the metadata for every document in the library, one row per document, with columns for number, classification, revision history, and document type. Multiple review sessions confirmed that the prepared data would inject correctly into the Cloudtheapp structure.

The migration ran automatically. All documents entered the system in their correct classification, with their correct numbering, and with their historical revision data intact. The quality team's first day in the new system was spent doing quality work, not correcting migration errors.

The observation from the team: configuration discussions happened in real time during working sessions. Workflow steps were built on the spot. Page design requirements were addressed while they were being described. The responsiveness of the implementation process and the quality of the migration made the transition significantly less disruptive than expected.

<h2>What to ask your QMS vendor about migration</h2>

If your quality operation has a large controlled document library, these questions belong in your first vendor conversation:

Does the vendor have a structured migration methodology, or does the customer own the migration process? Can the vendor demonstrate migration from a comparable document library with structure preserved? How are document numbers and classifications handled during migration? What is the validation deliverable for the migration itself, and who produces it?

The answers reveal whether migration is a solved problem for the vendor or an assumption they have not thought through.

A QMS vendor with a migration methodology treats the document library as an asset to be preserved and transferred. A vendor without one treats it as a data problem the customer will manage. For a quality team in a regulated environment, the difference between those two approaches is months of post-migration cleanup on one side or a validated go-live on the other. <a href="https://www.cloudtheapp.com/demo/">See how Cloudtheapp handles document migration in a 45-minute demo.</a>

This post created by and appeared first on Cloudtheapp

Document control software is the regulated industry's answer to a persistent compliance problem: managing the creation, approval, distribution, and revision of quality documents in a way that satisfies FDA inspectors and ISO auditors while keeping operations functional. This buyer's guide covers what document control software must do in a regulated environment, the specific regulatory requirements that drive those capabilities, the features that separate purpose-built platforms from generic tools, how to structure a vendor evaluation, and what a well-implemented document control system looks like inside a pharmaceutical, medical device, or food manufacturing organization.

What Document Control Software Actually Does in a Regulated Environment

Document control software in a generic business context manages files. In a regulated industry, it does something more specific: it enforces the process by which a document becomes controlled, governs who can access which version, captures an unbroken record of every change, and ensures that obsolete documents cannot reach the production floor.

Those distinctions matter because regulators do not simply want documents to exist. They want evidence that documents are:

• Reviewed and approved by authorized individuals before use
• Current and reflective of actual practice
• Protected from unauthorized changes
• Retrievable on demand with a complete change history
• Controlled such that only the current approved version is in use

A spreadsheet, a shared drive, and a general-purpose DMS can store documents. They cannot enforce these requirements systematically or produce the audit-ready evidence that 21 CFR Part 11 requires for electronic records. Document control software purpose-built for regulated industries does both.

The Regulatory Requirements Driving Document Control

Three primary regulatory frameworks define what document control software must deliver for most regulated manufacturers.

FDA 21 CFR Part 820 and QMSR

FDA's Quality Management System Regulation, now aligned with ISO 13485, requires that medical device manufacturers establish and maintain procedures for document control. Key requirements include:

• Designated authority for document approval prior to issuance
• Document change review, approval, and notification procedures
• Removal of obsolete documents from points of use
• Retention of master documents with change history

FDA 21 CFR Part 11

21 CFR Part 11 applies to all electronic records and electronic signatures used in FDA-regulated contexts. For document control software, this means:

• Audit trails that record who created, changed, or approved a document and when
• Electronic signatures that are legally equivalent to handwritten signatures
• System access controls that prevent unauthorized use
• System validation demonstrating that the software does what it is intended to do

ISO 13485 and ISO 9001

Both standards require formal document control procedures. ISO 13485 clause 4.2.4 specifies that documents required by the quality management system must be controlled, including approval before issue, identification of current revision, distribution controls, and prevention of unintended use of obsolete documents.

For food manufacturers under ISO 22001 and HACCP requirements, document control extends to HACCP plans, prerequisite programs, and monitoring records.

The Hidden Cost of Using the Wrong System

Many regulated manufacturers underestimate the cost of inadequate document control until an inspection reveals the gaps. FDA Form 483 observations for document control failures are consistently among the most frequently cited across medical device and pharmaceutical inspections.

The specific failure patterns fall into predictable categories:

Obsolete documents in active use. When a procedure is updated but the previous version remains physically accessible on the production floor or electronically on a shared drive, the company cannot demonstrate that operators followed the current, approved procedure. Inspectors cite this under the requirement to prevent unintended use of obsolete documents.

Incomplete or missing audit trails. Regulators expect every change to a controlled document to carry a complete audit trail: who made the change, what was changed, why the change was made, and who approved it. Systems that do not automatically capture this trail require manual reconstruction, which fails validation requirements and signals data integrity risk.

Gap between document approval and training. A document can be approved and distributed before the people who need to use it are trained on its content. Without a system that links document approval to training assignment, this gap is impossible to manage consistently.

Informal change processes. When changes to procedures happen through informal channels such as email approval or verbal authorization rather than through the controlled change process, the audit trail does not reflect actual organizational decisions. Inspectors consistently probe this gap.

Core Features of Purpose-Built Document Control Software

Not all document control platforms deliver the same regulated-industry capabilities. These are the features that distinguish purpose-built regulated-industry solutions from generic document management tools.

Version Control With Automated Workflow

Every document revision should follow a defined workflow: draft, review, approval, release. The system should enforce this sequence, prevent users from bypassing steps, and automatically archive superseded versions as obsolete. Reviewers and approvers should receive automated notifications, and overdue approvals should escalate without manual intervention.

Electronic Signatures Under 21 CFR Part 11

Approvals and sign-offs must be captured as compliant electronic signatures: linked to the specific document version, attributed to an identified individual with role confirmation, timestamped, and non-repudiable. Systems that capture approvals only through login authentication without a distinct signature act do not meet Part 11 requirements.

Complete and Tamper-Evident Audit Trail

The audit trail must capture every interaction with every document: creation, edits, version changes, review actions, approvals, distribution, and archival. It must be system-generated, not editable by users, and must meet the data integrity requirements that FDA and ISO auditors evaluate.

Document Distribution and Receipt Control

When a new document version is released, the system should automatically distribute it to the relevant roles and locations, withdraw the prior version from active use, and require acknowledgment of receipt where required. Distribution without confirmation creates the obsolete-document-in-use risk.

Controlled Access by Role

Access control must be role-based, defining who can create, who can edit, who can review, who can approve, and who has read-only access. This control must be enforced by the system, not by convention, and must be configurable as roles evolve.

Document Linking and Cross-References

SOPs reference work instructions. CAPAs reference deviation reports. Validation protocols reference design specifications. Purpose-built document control software maintains these relationships, so that when a primary document changes, linked documents are automatically flagged for review.

Training Integration

Document approval should trigger training assignment for the roles that must be trained on the new version. Training completion records should link back to the specific document version and revision, so an auditor can see in a single view which employees were trained on which version and when.

Process Change Notification and Change Control

Document changes that affect validated processes, GMP operations, or product specifications should route through a formal change control workflow, not just the standard document review cycle. The system should support configurable change classification, so that minor editorial changes follow a lighter workflow while significant process changes trigger the full Process Change Notification and change control sequence.

How to Evaluate Document Control Vendors: A Buyer's Framework

Step 1: Define Your Regulatory Scope

Before comparing platforms, document the regulatory frameworks that apply to your organization. An FDA-regulated medical device manufacturer has different requirements than a food company under FSMA. Identify every regulatory framework, standard, and customer requirement that your document control system must satisfy. This list becomes the baseline for vendor qualification.

Step 2: Assess Your Current System's Gaps

Conduct an honest gap analysis of your current document control process. Common gaps in organizations migrating from manual or generic systems include: missing audit trail entries, informal approval records, no link between document release and training, and lack of controlled obsolescence. Map these gaps to requirements in your shortlisted platforms.

Step 3: Evaluate the Validation Package

Any document control software used in a regulated environment must be validated. The critical question is: what does the vendor provide? A vendor that supplies a complete Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ) package significantly reduces the customer's validation burden. Platforms that require the customer to validate the full system from scratch impose a significant time and resource cost that many quality teams underestimate.

Step 4: Test the Configuration Capabilities

Regulated organizations have document types that generic systems do not anticipate: master batch records, validation protocols, HACCP plans, design history files. Evaluate whether the platform can be configured to support your specific document taxonomy without custom development.

Step 5: Assess Integration With Your QMS

Document control does not operate in isolation. Documents link to CAPAs, audits, change control, training, and supplier qualification. A document control module built into a full eQMS platform, rather than a standalone tool, delivers these integrations without custom API development.

The Case for Integrated Document Control Within a Full eQMS

Standalone document control software solves the document management problem but creates a data integration problem. When a CAPA references a document that needs updating, the connection between the CAPA record and the document control workflow exists only in email threads or manual cross-referencing.

An integrated eQMS connects document control to every quality process that depends on it. When a deviation triggers a CAPA, the CAPA workflow can automatically identify and queue affected documents for review. When a document is updated, the training module automatically generates assignments. When an auditor requests evidence of a process change, the audit trail spans the entire lifecycle from the originating deviation through the CAPA through the document revision through the training record.

Cloudtheapp's document control module operates within this integrated model. Built as part of its AI-powered eQMS, it delivers version control, electronic signatures, automated workflow, and controlled distribution alongside CAPA management, change control, training, supplier qualification, and 40+ additional quality applications. Quality teams configure document types, approval workflows, and distribution rules directly, without writing code or filing IT requests.

The result is document control that stays aligned with the actual quality processes it supports, rather than a system that manages documents in isolation from the rest of the quality operation.

Book a free demo to see how Cloudtheapp's integrated document control delivers Part 11 compliance, automated workflows, and complete audit trail visibility for regulated manufacturers.

Common Buyer Mistakes to Avoid

Underestimating the validation effort for standalone tools. A platform without a vendor-supplied validation package can consume 200 to 400 hours of quality engineer time just for initial system validation, not counting re-validation for every update.

Selecting for ease of use over regulatory capability. Consumer-grade or generic document management platforms often score high on user experience. Their compliance infrastructure is shallow. An easy-to-use system that fails your next inspection costs far more than a well-configured system that requires a training period.

Not accounting for obsolescence management. Retrieval of current documents is straightforward. Systematic removal of obsolete documents from all points of use is where most non-purpose-built systems fail. This is a specific regulatory requirement with inspection consequences.

Choosing a standalone tool over an integrated platform. The integration cost of connecting a standalone document control system to your CAPA, training, and change control systems typically exceeds the cost differential between a standalone tool and an integrated eQMS.

Conclusion

Document control software for regulated industries carries a different weight than document management in general business contexts. The regulatory requirements, the inspection consequences, and the operational complexity of managing quality documents across multiple product lines, facilities, and regulatory frameworks demand a purpose-built solution with validated architecture, compliant electronic signatures, tamper-evident audit trails, and deep integration with the quality processes that depend on document accuracy.

The buyer's decision ultimately comes down to whether to purchase a standalone document control tool and build integrations manually, or to deploy document control as part of a complete eQMS platform. For regulated manufacturers where quality data must flow seamlessly across CAPAs, change control, training, and supplier qualification, the integrated approach consistently delivers lower total cost, stronger compliance posture, and better inspection outcomes.

This post created by and appeared first on Cloudtheapp