Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    Document Control

    Also known as: Control of documents, Controlled documents, Document management

    Definition

    The rules for writing, approving, issuing, changing and withdrawing documents so that people work from the current version, and for keeping the records that show what was done.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/document-control

    Scope: Document control covers instructions such as procedures and specifications, while records have their own rules. Wording and retention periods differ by regulator and sector, and the text of ISO 9001 and ISO 13485 is not reproduced.

    Example for your evaluation: Follow one procedure revision from approval and effective date to the withdrawal of every printed copy of the superseded revision.

    Sources checked: . Examples are editorial illustrations.

    What FDA, WHO, the EU, EPA and ISO committee papers say about controlling documents

    On this page document control means the rules that decide who may write, approve, issue, change and withdraw a document, so that people use the current version, and the separate rules for the records that show what was done. The sources word it differently. A paper by ISO/TC 176/SC 2 for ISO 9001:2015 uses the term documented information for both documents and records, says the standard asks for a documented quality management system and not a system of documents, and leaves the amount to the organisation. It says documented information can be in any medium and that all of it forming part of the system is controlled under clause 7.5. It lists procedures, specifications, approved supplier lists, quality plans and forms as documents, and audit evidence and nonconformity records as records. The paper covers the 2015 edition, so check clause numbers against the edition you work to, and note that the committee site is managed by a third party. This is general information, not legal or certification advice.

    For medical devices, 21 CFR part 820 requires a manufacturer to document a quality management system that complies with the applicable requirements of ISO 13485, which the part incorporates by reference. The part's own text has no stand-alone document control section, and section 820.40 is shown as reserved. Section 820.35 adds to ISO 13485's clause on control of records, for example what a complaint record must hold. ISO 13485 is a paid standard and was not read for this page. For drugs, 21 CFR 211.22 gives the quality control unit authority to approve or reject all procedures and specifications affecting identity, strength, quality and purity,. Section 211.100 requires production procedures, including changes, to be reviewed and approved by the organisational units and by the quality control unit. Section 211.180 sets a minimum of one year after expiry for batch records and requires records to be readily available for inspection.

    EU GMP Chapter 4, in its January 2011 version, divides GMP documents into instructions and records or reports. It asks that instruction documents be approved, signed and dated by authorised persons, be uniquely identifiable and have a defined effective date, and that documents be reviewed regularly. Alterations are signed and dated with the original readable. Batch documentation is kept for one year after expiry or at least five years after Qualified Person certification, whichever is longer. It asks for an inventory of documents within the quality management system. WHO's main principles say no document should change without authorisation and approval, that a system should prevent inadvertent use of a superseded version, and that superseded documents should be retained for a specific period.

    EPA's Quality Assurance Project Plan Standard shows the same ideas outside medicines. Every page of a plan must carry its title, version number, version date and page number out of the total. The plan lists everyone who receives it and its revisions, and the organisation keeps the original and all revisions. A revised plan goes back to the approving authority with a revision history page, and no work under the changed condition proceeds until it is approved.

    Sources opened :

    What a document control record holds in software

    • The document's title, unique identifier, type, owner and the process it supports.
    • Each revision, with the author, the reviewers, the approver, the approval date and the effective date.
    • The reason for each change and a summary of what changed.
    • Distribution: who received the revision, where controlled copies are held, and when each superseded copy was withdrawn.
    • Superseded and obsolete revisions, kept readable with their retention period and disposal date.
    • Records that depend on the document, such as completed forms, linked to the revision in force.
    • A history of changes, including who altered an entry and when.

    Document control, records control, a quality manual and change control

    On this page's own summary, a document tells people what to do and a record shows what was done. EU GMP Chapter 4 draws that line, and the ISO paper treats records as documented information kept as evidence of results. A quality manual and a quality plan are each one controlled document among many. Change control is wider, because it governs changes to processes, materials and equipment, and a document revision can be one result. A document management system is a tool that may hold the files, while control is the set of rules about approval, issue, revision, withdrawal and retention that the tool must follow.

    A hypothetical example: a superseded procedure still at two work stations

    Everything in this case is invented and describes no real company. A firm with 25 staff revises its weld inspection procedure from revision B to revision C, tightening the acceptance limit from 0.8 mm to 0.5 mm. Revision C is approved on 3 March and takes effect on 10 March. Printed copies sit at six work stations. At an internal audit on 24 March the auditor checks all six and finds revision B at two of them, so 2 of 6, or 33%, are superseded and 4 are current. Since 10 March those two stations inspected 96 parts, and 7 measured between 0.5 mm and 0.8 mm, which is 7 of 96, or 7.3%, and would fail under revision C.

    The auditor raises a nonconformance and the 7 parts are held and re-inspected. The cause is that nobody recorded where printed copies were kept, so nobody knew which to withdraw. The corrective action is a register of every controlled copy by station and revision, and a rule that each holder signs for the withdrawal of the old copy when the new one is issued. Two stations are added in April and the register then lists 8. At the follow-up check all 8 stations show revision C, or 8 of 8.

    Common misunderstandings about document control

    • It is not only for paper, and it is not only software. EU GMP Chapter 4 says the requirements apply equally to all media, including hybrid ones.
    • Documents and records are not handled alike. The EU text separates instructions from records, and an altered entry must keep the original readable.
    • ISO 9001 does not ask for a system of documents. The ISO paper says it asks for a documented quality management system and leaves the extent to the organisation.
    • Controlled does not mean frozen. EU GMP and WHO say documents are reviewed and kept up to date.
    • A superseded revision is not deleted at once. WHO asks for superseded documents to be retained for a specific period, and EPA's plan standard keeps the original and every revision.
    • Part 820 has no stand-alone document section today. Section 820.40 is reserved, and the requirement sits in the incorporated ISO 13485, which this page did not read.

    How document control relates to other glossary terms

    Controlled documents link the system to daily work. These terms sit around them.

    • SOP: the most common controlled document, giving the steps for a task.
    • QMS: the system whose procedures, policy and records are controlled.
    • Quality policy: a controlled statement that is communicated and reviewed.
    • Non-conformance: the record raised when a superseded or missing document is found in use.
    • CAPA: the cycle that deals with the cause of a document control failure.

    Records and evidence that usually exist for document control

    • A document register or inventory, with identifier, title, revision and effective date.
    • Approval records and revision histories, with the reason for each change.
    • Distribution lists and a register of controlled copies and their withdrawal.
    • Audit findings on documents found in use, with the corrective action and its check.

    What a software tool needs to capture for document control

    • A unique identifier and revision for every document, with the effective date and approver.
    • Approval by a named person other than the author, with the revision approved.
    • Superseded revisions that stay readable but are marked as not for use.
    • Distribution records showing who received each revision and when it was withdrawn from each location.
    • Retention periods held by document type, with a record of any disposal.
    • Records linked to the revision in force when they were made.
    • A history of changes and access that cannot be silently edited, exportable for an inspector.

    Catalog profiles documenting document-control records

    Listed profiles meet the document-control rule used by the QMS document control software guide. That rule does not show that a product withdraws printed copies, holds retention periods or links records to the revision in force, which should be tested with your own documents.

    Same rule for every product: tagged “Document Management”, with a sourced document control capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 18 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    What is the difference between a document and a record?

    EU GMP Chapter 4 separates instructions, such as specifications and procedures, from records and reports that show an action was taken. ISO's paper on ISO 9001:2015 uses documented information for both and treats records as information kept as evidence of results.

    How long must controlled documents and records be kept?

    No single period applies. EU GMP Chapter 4 sets batch documentation at one year after expiry or at least five years after Qualified Person certification, whichever is longer. 21 CFR 211.180 and WHO set at least one year after expiry for batch records. The ISO paper read gives none, and an EPA plan must state its own.

    Do electronic documents need different controls?

    EU GMP Chapter 4 says the same requirements apply to every medium, and asks for controls on electronic templates, forms and master documents and for integrity through retention. WHO adds that only authorised persons should enter or change data, with a record of changes and deletions.

    More quality terms

    Related guides