1

Documents, Change Control and Records

Slide 1

Hello, my name is Joseph Tartal and I'm the Deputy Director in the Division of Industry and Consumer 

Education. Today I'll talk to you about Documents, Change Control and Records. I have written 

documents and developed document systems while in industry and I currently work with a team to 

write and develop them for our division today. I understand the importance of this work.

Slide 2

We have all heard the joke. SOP stands for "stacks of paper" and not standard operating procedures. 

But documentation is not a stack of papers and like any requirement is only as useful and efficient as the 

input provided by the user and author. Most importantly when the question is asked: "Did it happen?" I 

can respond "yes" - it was documented and here is the evidence. Both my colleagues here at FDA and 

our contemporaries in the medical device industry would agree if it wasn't documented, there is no 

objective evidence of it happening and this highlights the importance of documents, changes to those 

documents and records produced from those documents.

Slide 3

Here are the learning objectives for this module. By the time we are finished I will identify key 

definitions related to documents and records. I'll describe key categories and how they inter-relate with 

one another. And finally, I'll describe the requirements and intent for Document Controls, General 

Records, Device Master Records, Device History Records, and Quality System Records.

Slide 4 

Let's start with some definitions. All definitions are taken from Part 21 the Code of Federal Regulations, 

CFR, 820.3 in the quality system regulation.

Slide 5

Establish. Establish means to define, document either in writing or electronically and implement. Do it. 

Design history file or DHF. The design history file is a collection of all the documents and records which 

describes the design history of a finished device.

Slide 6 

Device master record or DMR. The DMR is the set of records that contain the procedures and 

specifications for manufacturing a finished device. Device history record or DHR. The device history 

records are all the records for the production history of a finished device. 

Slide 7 

Now that we have defined each of these records, let us look at where they fit and how they interact 

with one another. 

Slide 8

Starting with the top left, the design of the device is captured in the design history file. One of the 

design outputs from the DHF is the device master record on the top right. The DMR is the recipe for 

how to make that device and the device history records just below it are produced from the documents 

found in the device master record. The quality system records are all other documents that are not 

device specific and not covered by the other categories. Additionally, all documents are approved 
2

according to document controls, 21 CFR 820.40. The box at the bottom left and all records, highlighted 

in the green box, are subject to the general record requirements in 21 CFR 820.180. 

Slide 9 

First, I'll discuss the requirements for document controls.

Slide 10 

Document controls and its requirement are important. You are required to establish and maintain 

procedures to control all documents as required by the quality system regulation. The procedures have 

to provide for approval, distribution and changes to those documents. 

Slide 11

First you must designate the individuals who will review documents for adequacy and approve them 

prior to their issuance. The document approval must include the date and signature of those approving 

the document. 

Slide 12

The next document control requirement is document distribution. Required documents must be 

available at all locations for which they are designated, used, or otherwise necessary. Documents are 

only useful if you have them, so they must be present where you need them. All obsolete documents 

need to be immediately removed, so they are not used by mistake.

Slide 13

Changes to documents require review and approval by individuals from the same function or 

organization that performed the original approval unless specifically noted otherwise. Changes must be 

communicated to appropriate personnel in a timely manner. It is important that the right people 

approve changes, and everyone affected knows about them. 

Slide 14

Before going forward, I'll provide a short background on the preamble to the quality system regulation. 

When proposed regulations are published, the public has an opportunity to comment and ask questions. 

FDA responds to all comments and questions in the preamble to the final regulation. The preamble is 

very important as it explains the intent of FDA at the time the regulation was published. 

For more information about the preamble to the quality system regulation, please watch the CDRH 

Learn quality system overview. FDA's intent regarding the review of changes is stated in Preamble 

Comment #96. The intent is to ensure that those who originally approved the document have an 

opportunity to review any changes, since they typically have the best insight on the impact of the 

changes.

Slide 15

However, if those individuals are no longer available or the appropriate personnel have changed, the 

manufacturer may specifically designate new individuals to review and approve the changes.

Slide 16

Comment #96 further states why communicating changes is important, as FDA has had many 

experiences where manufacturers made corrections to documents, but the changes were not 

communicated in a timely manner to the personnel using the documents. The result of these untimely 

communications was the production of defective devices.
3

Slide 17

Document changes must describe the change, identify the affected documents, have signatures of the 

approving individuals, the approval date, and date on which the change becomes effective. This 

concludes the requirements for document controls.

Slide 18 

Next, I'll explain the general requirements for records, as depicted in the green box on this slide. 

Slide 19

First, all records required by the quality system regulation must be located at the manufacturing site or a 

location reasonably accessible to the manufacturer and FDA. Also, those records must be readily 

available for review and copy by FDA.

Slide 20

What do we mean by "readily available"? Preamble Comment #180 states that FDA expects that such 

records will be made available during the course of an inspection. 

If the foreign manufacturer maintains records at remote locations, such records are expected to be 

produced by the next working day or two, at the latest. The comment further clarifies that records can 

be kept at other locations, provided that they are made "readily available" for review and copying.

Slide 21 

All records must be legible and stored to minimize deterioration and prevent loss. For example, use a 

single line, date and initials for crossing out mistakes, as even mistakes can be considered a part of the 

document's history and must be legible. This practice is also discussed as part of Good Laboratory 

Practices, GLP. Last, any records stored in an automated data processing system, electronically, must be 

backed up. Please review 21 CFR 820.70(i) on validating automated processes.

Slide 22

As FDA employees, we are bound to the confidentiality rules in the Food, Drug and Cosmetic Act and the 

Freedom of Information Act, and thereby, cannot just disclose information to the public. During an 

inspection, manufacturers may mark records as confidential to assist FDA in determining whether 

information may be disclosed under the Freedom of Information Act. However, please note that not all 

records are confidential.

Slide 23

Next, I'll discuss records exceptions as they relate to making specific records available to FDA. 

Manufacturers are not required to make the reports and results of management reviews, quality audits 

and supplier evaluations available for review and copy by FDA. You do not need to provide them to us. 

Slide 24

However, we are allowed to see the procedures that govern these activities, just not the results 

themselves. Also, I want to point out that any items relating to corrective and preventive actions do not 

fall into these categories. Furthermore, investigators can ask that a responsible management official 

certify in writing that such procedures were followed and that management reviews, internal audits and 

supplier evaluations occurred.
4

Slide 25

The last general requirement I will note is record retention. All records required by the Quality System 

Regulation must be retained for the expected life of the device or at least 2 years from the date of 

commercial distribution. 

Slide 26 

Now I'll talk about the Device Master Record, or DMR, in greater detail.

Slide 27

You're required to maintain a device master record for each device type or family of devices, and 

prepare and approve the DMR in accordance with document controls. The DMR is a design output from 

design controls.

Slide 28

As I noted earlier, the DMR is a recipe book for how to manufacturer the device. I should be able to take 

the DMR, go to any facility with the same materials, equipment and qualified personnel, and 

manufacturer that device. It includes device specifications, production and process specifications, 

quality assurance procedures and specifications, packaging and labeling specifications and installation, 

maintenance and servicing procedures. 

Slide 29

Device specifications include the bill of materials, drawings and schematics, ingredients list, component 

specifications, material composition, formulations, assemblies and sub-assemblies and software 

specifications. This list and those in the following slides are only limited examples and are not 

comprehensive. You need to determine your full set of specifications for your specific device.

Slide 30

Examples of production and process specifications include: the production environment, cleaning 

procedures, equipment, calibration procedures and process flow charts, set-up and production 

procedures, and production methods.

Slide 31

As you are now noticing, the DMR is very comprehensive. Besides device and production specifications, 

it also includes how you perform quality assurance and quality control activities on the device. Items 

here may include testing and acceptance criteria, testing and measuring equipment, procedures for 

doing inspection and testing, and the forms and charts that accompany those activities. 

Slide 32

Next are examples of packaging and labeling in the DMR. These include labeling and packaging 

specifications, drawings for the labeling, instructions for use, manuals and their relevant procedures and 

controls. These also include packaging and shipping procedures and customer feedback forms. 

Slide 33

Finally, the device master record will also include any information on device installation, maintenance 

and servicing such as procedures, equipment and forms used. How you put your DMR together is up to 

you. It could be as a single binder, or set of binders, or an electronic index that references all the 

required documentation. The regulation is not prescriptive. Make sure that you meet the requirements 

in the Quality System Regulation. Do what you say you are going to do and it works for you. 
5

Slide 34 

Next, I'll review the device history record. As mentioned earlier, the device history record or DHR comes 

after and from the device master record.

Slide 35

The device history record demonstrates that a device was manufactured according to the device master 

record and the requirements of the Quality System Regulation. You must establish and maintain 

procedures for the DHR. These are the records for a specific manufactured device, device lot or batch. 

These are extremely important for performing investigations and evaluating trends. 

Slide 36

The device history records must include the dates the devices were manufactured, the quantity made, 

the quantity released and all the acceptance records showing that they were made and released

according to the DMR. This is evidence that a specific device, lot or batch, met your quality system 

requirements.

Slide 37

Regarding labels and the device history record, the DHR must include the labels release and the date 

and signature of the person examining the labels. This must be done for each labeling unit, lot or batch. 

Slide 38

You might ask: what if I use an automated reader to perform my label inspections? Do I still need to do 

this? You can use an automated reader, but you must still have some level of human oversight as 

explained in Preamble Comment #169. Several recalls on labeling have been attributed to automated 

readers not catching errors. It does not preclude you from using automated readers where the process 

is followed by human oversight. 

A "designated individual" must examine, at a minimum, a representative sampling of all labels that have 

been checked by the automated readers. The preamble comment goes on to note that many automated 

readers are often programmed with only the base label information and do not check for specifics, such 

as lot or control numbers and expiration dates that are distinct for each label batch. This is why even 

with the use of an automated reader, human oversight is still needed. 

Slide 39 

The last record I'll review is the Quality System Record or QSR. Note QSR stands for "quality system 

record" and not the Quality System Regulation, a misconception that I still see today. 

Slide 40

You are required to maintain quality system records and prepare and approve them per document 

controls. Quality system records are all other records required that are not part of the DHF, DMR or 

DHR, and therefore, they are not specific to a particular device type or family. These include the record 

requirements for 21 CFR 820 Subpart B, such as management responsibilities, quality audits and 

personnel.

Slide 41 

Examples of quality system records include training procedures and qualification records, internal audit 

procedures and records, and management review procedures and their records.
6

Slide 42

In concluding this presentation, I now ask you to take the following Call to Action: Meet your document 

and record requirements. Documents and records are important and impact everything in your Quality 

System. Take time to learn about documents, document controls and how to write good documents. 

And finally, write useful and effective documents that provide direction and evidence of compliance and 

quality. These are your procedures and documents. Take ownership.

Slide 43

Additional information on the Quality System, its Preamble, and the FDA Inspection Guide may be found 

at the links on this slide.

Slide 44

We encourage you to use other industry education resources we've developed especially for you, as 

shown on this slide. Of note, for comprehensive regulatory questions, please contact CDRH's Division of 

Industry and Consumer Education. We look forward to helping you. Thanks for watching this program.

 END