Document and Record Control Procedure Working Template

STATUS: DRAFT EXAMPLE — NOT APPROVED — NO COMPLIANCE CLAIM

This structure is not a released procedure. It does not determine retention, regulatory applicability, conformity, or certification. Authorized management, RA/QA, legal/regulatory, process owners, and document control must approve the organization-specific controls. ISO publications are copyrighted; use an authorized copy and do not paste their text here.

Controlled-document metadata

Field	Entry
Document ID/revision	`<ID>` / `<revision>`
Owner	`<accountable role>`
Status	`draft` / `in-review` / `approved`
Effective date	`<YYYY-MM-DD after approval>`
Evidence repository	`<controlled location>`
Change/superseded record	`<IDs>`

Approval role	Named approver	Status	Date	Approval evidence
Process owner	`<name/role>`	`pending`	`<date>`	`<ID>`
RA/QA	`<name/role>`	`pending`	`<date>`	`<ID>`
System owner	`<name/role>`	`pending`	`<date>`	`<ID>`

1. Purpose, scope, and interfaces

Controlled documents covered: <types, systems, sites, products>
Records covered: <types, systems, sites, products>
External sources covered: standards, regulations, guidance, customer and supplier specifications, and product-specific sources.
Interfaces: change control, training, validation, data integrity, cybersecurity, supplier controls, product files, complaints/CAPA, audit, and management review.

2. Roles and segregation of duties

Role	Authority/responsibility	Independence or access restriction	Delegate	Evidence	Approval
Document owner	`<entry>`	`<entry>`	`<role>`	`<ID>`	`<ID>`
Record owner	`<entry>`	`<entry>`	`<role>`	`<ID>`	`<ID>`
Reviewer	`<entry>`	`<entry>`	`<role>`	`<ID>`	`<ID>`
Approver	`<entry>`	`<entry>`	`<role>`	`<ID>`	`<ID>`
System administrator	`<entry>`	`<entry>`	`<role>`	`<ID>`	`<ID>`

3. Document lifecycle

Stage	Required controls	Owner	Status	Evidence	Approval
Request/authoring	need, scope, source/version, author	`<role>`	`draft`	`<ID>`	`<ID>`
Review	technical, process, RA/QA, linked-document impact	`<role>`	`draft`	`<ID>`	`<ID>`
Approval/release	named authority, date, revision, effective date	`<role>`	`draft`	`<ID>`	`<ID>`
Distribution/use	access, point-of-use revision, copy status	`<role>`	`draft`	`<ID>`	`<ID>`
Change	rationale, impact, validation/training, linked updates	`<role>`	`draft`	`<ID>`	`<ID>`
Obsolescence	withdrawal, archive, retained-copy identification	`<role>`	`draft`	`<ID>`	`<ID>`

Define approved rules for identifiers, revision schemes, emergency changes, printed copies, translations, electronic signatures, and controlled exports. Do not assume that a downloaded or printed file remains controlled.

4. Record lifecycle and data integrity

Control	Organization-specific method	Owner	Status	Evidence	Approval
Creation/attribution	`<entry>`	`<role>`	`draft`	`<ID>`	`<ID>`
Legibility/completeness	`<entry>`	`<role>`	`draft`	`<ID>`	`<ID>`
Contemporaneous entry	`<entry>`	`<role>`	`draft`	`<ID>`	`<ID>`
Corrections/audit trail	`<entry>`	`<role>`	`draft`	`<ID>`	`<ID>`
Access/security	`<entry>`	`<role>`	`draft`	`<ID>`	`<ID>`
Backup/recovery	`<entry>`	`<role>`	`draft`	`<ID>`	`<ID>`
Retrieval	`<entry>`	`<role>`	`draft`	`<ID>`	`<ID>`
Retention/disposition	`<entry>`	`<role>`	`draft`	`<ID>`	`<ID>`

Retention periods must cite an approved basis for each record type. This template does not supply a universal period.

5. External source and version control

Source ID	Publisher/title	Version/date	Authorized location	Applicability owner	Last currency review	Impact record	Status	Approval
`<ID>`	`<entry>`	`<entry>`	`<entry>`	`<role>`	`<date>`	`<ID>`	`review-due`	`<ID>`

Required controls:

Obtain standards from an authorized source and preserve license restrictions.
Record the exact edition/version incorporated into each jurisdictional basis.
Monitor official publishers; do not rely on search snippets as controlled text.
Perform and approve impact assessment before changing QMS documents.
Distinguish ISO, FDA QMSR/eCFR, MDSAP, EU MDR/IVDR/MDCG, and product-specific sources rather than treating them as interchangeable.

6. Electronic systems and software validation

System/use	Intended use	Risk basis	Access/audit-trail controls	Validation evidence	Change/revalidation trigger	Owner	Approval
`<system>`	`<entry>`	`<entry>`	`<entry>`	`<ID>`	`<entry>`	`<role>`	`<ID>`

Do not release an electronic workflow until authorized owners approve intended use, validation evidence, access roles, data migration, backup/recovery, and change controls.

7. Change and training impact

Every change record should include:

reason, affected products/sites/processes/documents/records;
source/version and regulatory-impact review;
risk, validation, software, supplier, and postmarket impacts;
training population and completion evidence before effective use;
implementation verification, owner, status, evidence, and approval.

8. Registers and audit evidence

Register	Owner	Status	Location	Review frequency/basis	Evidence	Approval
Master document list	`<role>`	`draft`	`<location>`	`<basis>`	`<ID>`	`<ID>`
Record retention schedule	`<role>`	`draft`	`<location>`	`<basis>`	`<ID>`	`<ID>`
External source ledger	`<role>`	`draft`	`<location>`	`<basis>`	`<ID>`	`<ID>`
Access/role register	`<role>`	`draft`	`<location>`	`<basis>`	`<ID>`	`<ID>`
Training/change register	`<role>`	`draft`	`<location>`	`<basis>`	`<ID>`	`<ID>`
Obsolete/disposition log	`<role>`	`draft`	`<location>`	`<basis>`	`<ID>`	`<ID>`

Release checklist

[ ] Scope includes documents, records, external sources, and electronic systems.
[ ] Owners, statuses, evidence, source versions, and approvals are explicit.
[ ] Access, integrity, retrieval, retention, disposition, and audit trails are defined.
[ ] Change, validation, software, supplier, and training impacts are linked.
[ ] No universal retention period or automatic applicability conclusion is asserted.
[ ] No template or script result is described as compliance or certification.
[ ] Required human approvals are complete before the effective date.