quality-documentation-manager

---
name: quality-documentation-manager
description: Use when working on document control procedures, change control workflows, document numbering, version management, electronic signature compliance, or 21 CFR Part 11 review.
category: Regulatory & Quality
version: 1.0.0
tools: []
---

# Quality Documentation Manager

Document control system design and management for ISO 13485-compliant quality management systems: numbering conventions, approval workflows, change control, and electronic record compliance.

## Document Control Workflow

Implement document control from creation through obsolescence:

1. Assign a document number per the numbering procedure
2. Create the document using a controlled template
3. Route for review to required reviewers
4. Address review comments and document responses
5. Obtain required approval signatures
6. Assign effective date and distribute
7. Update the Document Master List
8. Validate: document accessible at point of use; obsolete versions removed

### Document Lifecycle Stages

| Stage | Definition | Actions Required |
|-------|------------|------------------|
| Draft | Under creation or revision | Author editing, not for use |
| Review | Circulated for review | Reviewers provide feedback |
| Approved | All signatures obtained | Ready for training/distribution |
| Effective | Training complete, released | Available for use |
| Superseded | Replaced by newer revision | Remove from active use |
| Obsolete | No longer applicable | Archive per retention schedule |

### Document Types and Prefixes

| Prefix | Document Type | Typical Content |
|--------|---------------|-----------------|
| QM | Quality Manual | QMS overview, scope, policy |
| SOP | Standard Operating Procedure | Process-level procedures |
| WI | Work Instruction | Task-level step-by-step |
| TF | Template/Form | Controlled forms |
| SPEC | Specification | Product/process specs |
| PLN | Plan | Quality/project plans |

### Required Reviewers by Document Type

| Document Type | Required Reviewers | Required Approvers |
|---------------|-------------------|-------------------|
| SOP | Process Owner, QA | QA Manager, Process Owner |
| WI | Area Supervisor, QA | Area Manager |
| SPEC | Engineering, QA | Engineering Manager, QA |
| TF | Process Owner | QA |
| Design Documents | Design Team, QA | Design Control Authority |

## Document Numbering System

Standard format: `PREFIX-CATEGORY-SEQUENCE[-REVISION]`, e.g. `SOP-02-001-A` = SOP (document type) + 02 (category code, Document Control) + 001 (sequence) + A (revision indicator).

### Category Codes

| Code | Functional Area |
|------|-----------------|
| 01 | Quality Management |
| 02 | Document Control |
| 03 | Human Resources |
| 04 | Design & Development |
| 05 | Purchasing |
| 06 | Production |
| 07 | Quality Control |
| 08 | CAPA |
| 09 | Risk Management |
| 10 | Regulatory Affairs |

Numbering workflow: author requests a number from Document Control, Document Control verifies category and assigns the next sequence number, the number is recorded in the Master List, and the author creates the document with the assigned number. Validate: number format matches standard; no duplicates in the Master List.

Revision designation: major revision increments the number (Rev 01 → Rev 02); minor revision increments the sub-revision (Rev 01 → Rev 01.1); administrative changes get no change or a letter suffix (Rev 01 → Rev 01a).

## Approval and Review Process

Review workflow: author completes the draft and submits for review, reviewers are assigned by document type, reviewers comment within 5-10 business days, the author addresses comments and resubmits, and approvers sign and date. Validate: all required reviewers completed; all comments addressed with documented disposition.

Comment disposition options: **Accept** (incorporate as written), **Accept with modification** (incorporate with changes, document rationale), **Reject** (do not incorporate, document justification), **Defer** (address in a future revision, document reason).

Approval matrix: Document Level 1 (Policy/QM) needs CEO or delegate + QA Manager; Level 2 (SOP) needs Department Manager + QA Manager; Level 3 (WI/TF) needs Area Supervisor + QA Representative. Every signature requires printed name, signature (handwritten or electronic), date, and role.

## Change Control Process

Change control workflow: identify the need for change, complete a Change Request Form with justification, Document Control assigns a change number and logs the request, route to reviewers for impact assessment, obtain approvals based on classification, implement approved changes, and update the revision number and change history. Validate: changes match approved scope; change history complete.

### Change Classification

| Class | Definition | Approval Level | Examples |
|-------|------------|----------------|----------|
| Administrative | No content impact | Document Control | Typos, formatting |
| Minor | Limited content change | Process Owner + QA | Clarifications |
| Major | Significant content change | Full review cycle | New requirements |
| Emergency | Urgent safety/compliance | Expedited + retrospective | Safety issues |

Impact assessment checks: does the change require retraining, affect equipment/systems, require revalidation, affect regulatory filings, require updates to other documents, or affect existing records? Every document keeps a change history table (revision, date, description, author, approver).

## 21 CFR Part 11 Compliance

Applies to records required by or submitted to FDA regulations and electronic signatures on those records; does not apply to paper records or general internal communication.

Electronic record controls: validate the system for accuracy and reliability, implement a secure audit trail for all changes, restrict access to authorized individuals, generate accurate human-readable copies, and protect records through the retention period. Validate: audit trail captures who, what, when for all changes.

### Audit Trail and Signature Requirements

| Requirement | Implementation |
|-------------|----------------|
| Secure | Cannot be modified by users |
| Computer-generated | System creates automatically |
| Time-stamped | Date and time of each action |
| Original values | Previous values retained |
| User identity | Who made each change |

Electronic signatures must be unique to the individual (not shared), use at least 2 components (e.g. user ID + password), display a manifestation (printed name, date/time, meaning — e.g. "John Smith, 2024-03-15 14:32:05 EST, Approved for Release"), and be linked to the record so it cannot be excised or copied.

System controls checklist — access: unique user ID per person, password complexity, account lockout after failed attempts, session timeout. Audit trail: all creation/modification logged with old/new values, user identity, date/time. Security: role-based access control, encryption at rest and in transit, tested backup/recovery.

## Document Control Metrics

| Metric | Target | Calculation |
|--------|--------|-------------|
| Document cycle time | <30 days | Average days from draft to effective |
| Review completion rate | >95% | Reviews completed on time / Total reviews |
| Change request backlog | <10 | Open change requests at month end |
| Overdue review rate | <5% | Documents past review date / Total effective |
| Audit finding rate | <2 per audit | Document control findings per internal audit |

Periodic review frequency: Policy every 3 years, SOP every 2 years, WI every 2 years, Specifications as needed or with product changes, Forms/Templates every 3 years.

## Regulatory Requirements

### ISO 13485:2016 Clause 4.2

| Sub-clause | Requirement |
|------------|-------------|
| 4.2.1 | Quality management system documentation |
| 4.2.2 | Quality manual |
| 4.2.3 | Medical device file (technical documentation) |
| 4.2.4 | Control of documents |
| 4.2.5 | Control of records |

**QMSR transition (effective 2026-02-02):** FDA's Quality Management System Regulation (QMSR) final rule (89 FR 7496) amended 21 CFR Part 820 to incorporate ISO 13485:2016 by reference and removed the legacy QSR subsection structure. Legacy section numbers (e.g. 820.40, 820.180, 820.181, 820.184) no longer exist in the CFR and are retained only as a familiar index. Current document/record control authority is ISO 13485:2016 §4.2 — especially §4.2.4 (control of documents) and §4.2.5 (control of records) — with the medical device file in §4.2.3 and records additions in retained 21 CFR 820.35. Cite the ISO 13485 clauses, not the legacy 820.x numbers, in current compliance documentation. Legacy mapping for reference: 820.40 (document controls) → ISO 13485 §4.2.4; 820.180 (general record requirements) → ISO 13485 §4.2.5 + retained 21 CFR 820.35; 820.181 (device master record) → ISO 13485 §4.2.3.