Skills › Scientific Agent Skills › iso-standards-readiness › document-control-procedure-template.md
document-control-procedure-template.md
132 lines · skills/iso-standards-readiness/assets/templates/procedures/document-control-procedure-template.md at 5f2bc03
1# Document and Record Control Procedure Working Template
3> **STATUS: DRAFT EXAMPLE — NOT APPROVED — NO COMPLIANCE CLAIM**
4>
5> This structure is not a released procedure. It does not determine retention,
6> regulatory applicability, conformity, or certification. Authorized management,
7> RA/QA, legal/regulatory, process owners, and document control must approve the
8> organization-specific controls. ISO publications are copyrighted; use an
9> authorized copy and do not paste their text here.
Document and Record Control Procedure Working Template
STATUS: DRAFT EXAMPLE — NOT APPROVED — NO COMPLIANCE CLAIM This structure is not a released procedure. It does not determine retention, regulatory applicability, conformity, or certification. Authorized management, RA/QA, legal/regulatory, process owners, and document control must approve the organization-specific controls. ISO publications are copyrighted; use an authorized copy and do not paste their text here.Raw lines 1 to 10
11## Controlled-document metadata
13| Field | Entry |
14|---|---|
15| Document ID/revision | `<ID>` / `<revision>` |
16| Owner | `<accountable role>` |
17| Status | `draft` / `in-review` / `approved` |
18| Effective date | `<YYYY-MM-DD after approval>` |
19| Evidence repository | `<controlled location>` |
20| Change/superseded record | `<IDs>` |
22| Approval role | Named approver | Status | Date | Approval evidence |
23|---|---|---|---|---|
24| Process owner | `<name/role>` | `pending` | `<date>` | `<ID>` |
25| RA/QA | `<name/role>` | `pending` | `<date>` | `<ID>` |
26| System owner | `<name/role>` | `pending` | `<date>` | `<ID>` |
Controlled-document metadata
| Field | Entry |
|---|---|
| Document ID/revision | <ID> / <revision> |
| Owner | <accountable role> |
| Status | draft / in-review / approved |
| Effective date | <YYYY-MM-DD after approval> |
| Evidence repository | <controlled location> |
| Change/superseded record | <IDs> |
| Approval role | Named approver | Status | Date | Approval evidence |
|---|---|---|---|---|
| Process owner | <name/role> | pending | <date> | <ID> |
| RA/QA | <name/role> | pending | <date> | <ID> |
| System owner | <name/role> | pending | <date> | <ID> |
28## 1. Purpose, scope, and interfaces
30- Controlled documents covered: `<types, systems, sites, products>`
31- Records covered: `<types, systems, sites, products>`
32- External sources covered: standards, regulations, guidance, customer and supplier
33 specifications, and product-specific sources.
34- Interfaces: change control, training, validation, data integrity, cybersecurity,
35 supplier controls, product files, complaints/CAPA, audit, and management review.
1. Purpose, scope, and interfaces
- Controlled documents covered:
<types, systems, sites, products> - Records covered:
<types, systems, sites, products> - External sources covered: standards, regulations, guidance, customer and supplier specifications, and product-specific sources.
- Interfaces: change control, training, validation, data integrity, cybersecurity, supplier controls, product files, complaints/CAPA, audit, and management review.
37## 2. Roles and segregation of duties
39| Role | Authority/responsibility | Independence or access restriction | Delegate | Evidence | Approval |
40|---|---|---|---|---|---|
41| Document owner | `<entry>` | `<entry>` | `<role>` | `<ID>` | `<ID>` |
42| Record owner | `<entry>` | `<entry>` | `<role>` | `<ID>` | `<ID>` |
43| Reviewer | `<entry>` | `<entry>` | `<role>` | `<ID>` | `<ID>` |
44| Approver | `<entry>` | `<entry>` | `<role>` | `<ID>` | `<ID>` |
45| System administrator | `<entry>` | `<entry>` | `<role>` | `<ID>` | `<ID>` |
2. Roles and segregation of duties
| Role | Authority/responsibility | Independence or access restriction | Delegate | Evidence | Approval |
|---|---|---|---|---|---|
| Document owner | <entry> | <entry> | <role> | <ID> | <ID> |
| Record owner | <entry> | <entry> | <role> | <ID> | <ID> |
| Reviewer | <entry> | <entry> | <role> | <ID> | <ID> |
| Approver | <entry> | <entry> | <role> | <ID> | <ID> |
| System administrator | <entry> | <entry> | <role> | <ID> | <ID> |
47## 3. Document lifecycle
49| Stage | Required controls | Owner | Status | Evidence | Approval |
50|---|---|---|---|---|---|
51| Request/authoring | need, scope, source/version, author | `<role>` | `draft` | `<ID>` | `<ID>` |
52| Review | technical, process, RA/QA, linked-document impact | `<role>` | `draft` | `<ID>` | `<ID>` |
53| Approval/release | named authority, date, revision, effective date | `<role>` | `draft` | `<ID>` | `<ID>` |
54| Distribution/use | access, point-of-use revision, copy status | `<role>` | `draft` | `<ID>` | `<ID>` |
55| Change | rationale, impact, validation/training, linked updates | `<role>` | `draft` | `<ID>` | `<ID>` |
56| Obsolescence | withdrawal, archive, retained-copy identification | `<role>` | `draft` | `<ID>` | `<ID>` |
58Define approved rules for identifiers, revision schemes, emergency changes, printed
59copies, translations, electronic signatures, and controlled exports. Do not assume
60that a downloaded or printed file remains controlled.
3. Document lifecycle
| Stage | Required controls | Owner | Status | Evidence | Approval |
|---|---|---|---|---|---|
| Request/authoring | need, scope, source/version, author | <role> | draft | <ID> | <ID> |
| Review | technical, process, RA/QA, linked-document impact | <role> | draft | <ID> | <ID> |
| Approval/release | named authority, date, revision, effective date | <role> | draft | <ID> | <ID> |
| Distribution/use | access, point-of-use revision, copy status | <role> | draft | <ID> | <ID> |
| Change | rationale, impact, validation/training, linked updates | <role> | draft | <ID> | <ID> |
| Obsolescence | withdrawal, archive, retained-copy identification | <role> | draft | <ID> | <ID> |
Define approved rules for identifiers, revision schemes, emergency changes, printed copies, translations, electronic signatures, and controlled exports. Do not assume that a downloaded or printed file remains controlled.
Raw lines 47 to 6162## 4. Record lifecycle and data integrity
64| Control | Organization-specific method | Owner | Status | Evidence | Approval |
65|---|---|---|---|---|---|
66| Creation/attribution | `<entry>` | `<role>` | `draft` | `<ID>` | `<ID>` |
67| Legibility/completeness | `<entry>` | `<role>` | `draft` | `<ID>` | `<ID>` |
68| Contemporaneous entry | `<entry>` | `<role>` | `draft` | `<ID>` | `<ID>` |
69| Corrections/audit trail | `<entry>` | `<role>` | `draft` | `<ID>` | `<ID>` |
70| Access/security | `<entry>` | `<role>` | `draft` | `<ID>` | `<ID>` |
71| Backup/recovery | `<entry>` | `<role>` | `draft` | `<ID>` | `<ID>` |
72| Retrieval | `<entry>` | `<role>` | `draft` | `<ID>` | `<ID>` |
73| Retention/disposition | `<entry>` | `<role>` | `draft` | `<ID>` | `<ID>` |
75Retention periods must cite an approved basis for each record type. This template
76does not supply a universal period.
4. Record lifecycle and data integrity
| Control | Organization-specific method | Owner | Status | Evidence | Approval |
|---|---|---|---|---|---|
| Creation/attribution | <entry> | <role> | draft | <ID> | <ID> |
| Legibility/completeness | <entry> | <role> | draft | <ID> | <ID> |
| Contemporaneous entry | <entry> | <role> | draft | <ID> | <ID> |
| Corrections/audit trail | <entry> | <role> | draft | <ID> | <ID> |
| Access/security | <entry> | <role> | draft | <ID> | <ID> |
| Backup/recovery | <entry> | <role> | draft | <ID> | <ID> |
| Retrieval | <entry> | <role> | draft | <ID> | <ID> |
| Retention/disposition | <entry> | <role> | draft | <ID> | <ID> |
Retention periods must cite an approved basis for each record type. This template does not supply a universal period.
Raw lines 62 to 7778## 5. External source and version control
80| Source ID | Publisher/title | Version/date | Authorized location | Applicability owner | Last currency review | Impact record | Status | Approval |
81|---|---|---|---|---|---|---|---|---|
82| `<ID>` | `<entry>` | `<entry>` | `<entry>` | `<role>` | `<date>` | `<ID>` | `review-due` | `<ID>` |
84Required controls:
861. Obtain standards from an authorized source and preserve license restrictions.
872. Record the exact edition/version incorporated into each jurisdictional basis.
883. Monitor official publishers; do not rely on search snippets as controlled text.
894. Perform and approve impact assessment before changing QMS documents.
905. Distinguish ISO, FDA QMSR/eCFR, MDSAP, EU MDR/IVDR/MDCG, and product-specific
91 sources rather than treating them as interchangeable.
5. External source and version control
| Source ID | Publisher/title | Version/date | Authorized location | Applicability owner | Last currency review | Impact record | Status | Approval |
|---|---|---|---|---|---|---|---|---|
<ID> | <entry> | <entry> | <entry> | <role> | <date> | <ID> | review-due | <ID> |
Required controls:
- Obtain standards from an authorized source and preserve license restrictions.
- Record the exact edition/version incorporated into each jurisdictional basis.
- Monitor official publishers; do not rely on search snippets as controlled text.
- Perform and approve impact assessment before changing QMS documents.
- Distinguish ISO, FDA QMSR/eCFR, MDSAP, EU MDR/IVDR/MDCG, and product-specific sources rather than treating them as interchangeable.
93## 6. Electronic systems and software validation
95| System/use | Intended use | Risk basis | Access/audit-trail controls | Validation evidence | Change/revalidation trigger | Owner | Approval |
96|---|---|---|---|---|---|---|---|
97| `<system>` | `<entry>` | `<entry>` | `<entry>` | `<ID>` | `<entry>` | `<role>` | `<ID>` |
99Do not release an electronic workflow until authorized owners approve intended use,
100validation evidence, access roles, data migration, backup/recovery, and change
101controls.
6. Electronic systems and software validation
| System/use | Intended use | Risk basis | Access/audit-trail controls | Validation evidence | Change/revalidation trigger | Owner | Approval |
|---|---|---|---|---|---|---|---|
<system> | <entry> | <entry> | <entry> | <ID> | <entry> | <role> | <ID> |
Do not release an electronic workflow until authorized owners approve intended use, validation evidence, access roles, data migration, backup/recovery, and change controls.
Raw lines 93 to 102103## 7. Change and training impact
105Every change record should include:
107- reason, affected products/sites/processes/documents/records;
108- source/version and regulatory-impact review;
109- risk, validation, software, supplier, and postmarket impacts;
110- training population and completion evidence before effective use;
111- implementation verification, owner, status, evidence, and approval.
7. Change and training impact
Every change record should include:
- reason, affected products/sites/processes/documents/records;
- source/version and regulatory-impact review;
- risk, validation, software, supplier, and postmarket impacts;
- training population and completion evidence before effective use;
- implementation verification, owner, status, evidence, and approval.
113## 8. Registers and audit evidence
115| Register | Owner | Status | Location | Review frequency/basis | Evidence | Approval |
116|---|---|---|---|---|---|---|
117| Master document list | `<role>` | `draft` | `<location>` | `<basis>` | `<ID>` | `<ID>` |
118| Record retention schedule | `<role>` | `draft` | `<location>` | `<basis>` | `<ID>` | `<ID>` |
119| External source ledger | `<role>` | `draft` | `<location>` | `<basis>` | `<ID>` | `<ID>` |
120| Access/role register | `<role>` | `draft` | `<location>` | `<basis>` | `<ID>` | `<ID>` |
121| Training/change register | `<role>` | `draft` | `<location>` | `<basis>` | `<ID>` | `<ID>` |
122| Obsolete/disposition log | `<role>` | `draft` | `<location>` | `<basis>` | `<ID>` | `<ID>` |
8. Registers and audit evidence
| Register | Owner | Status | Location | Review frequency/basis | Evidence | Approval |
|---|---|---|---|---|---|---|
| Master document list | <role> | draft | <location> | <basis> | <ID> | <ID> |
| Record retention schedule | <role> | draft | <location> | <basis> | <ID> | <ID> |
| External source ledger | <role> | draft | <location> | <basis> | <ID> | <ID> |
| Access/role register | <role> | draft | <location> | <basis> | <ID> | <ID> |
| Training/change register | <role> | draft | <location> | <basis> | <ID> | <ID> |
| Obsolete/disposition log | <role> | draft | <location> | <basis> | <ID> | <ID> |
124## Release checklist
126- [ ] Scope includes documents, records, external sources, and electronic systems.
127- [ ] Owners, statuses, evidence, source versions, and approvals are explicit.
128- [ ] Access, integrity, retrieval, retention, disposition, and audit trails are defined.
129- [ ] Change, validation, software, supplier, and training impacts are linked.
130- [ ] No universal retention period or automatic applicability conclusion is asserted.
131- [ ] No template or script result is described as compliance or certification.
132- [ ] Required human approvals are complete before the effective date.
Release checklist
- [ ] Scope includes documents, records, external sources, and electronic systems.
- [ ] Owners, statuses, evidence, source versions, and approvals are explicit.
- [ ] Access, integrity, retrieval, retention, disposition, and audit trails are defined.
- [ ] Change, validation, software, supplier, and training impacts are linked.
- [ ] No universal retention period or automatic applicability conclusion is asserted.
- [ ] No template or script result is described as compliance or certification.
- [ ] Required human approvals are complete before the effective date.