Control of Records

Control of Records

[ISO 13485 Cl 4.2.5] 

Control of Records

Records are an essential element of a QMS and are required for verification, validation, monitoring, inspection and testing of activities to facilitate continual improvement of the QMS. They serve as evidence for audits and management reviews.


The ISO 13485 control of record process is mandatory for identifying, collecting, indexing, accessing, filing, storing, maintaining, protecting, backing up, and disposing of quality and technical records. It also outlines procedures for the protection and backup of data/records stored on computers.



ISO 13485:2016 standard Clause 4.2.5 insists on maintaining a procedure for document control to maintain the control of records and data within your quality management system, ensuring they are legible, easily identifiable, and retrievable for the duration mandated by regulatory requirements and your business needs. The version of the record control procedure shown in the video has been updated. It now features colour-coded cross-references to specific clauses in the ISO 13485:2016 standard and Regulation (EU) 2017/745, aiding auditors in quickly locating the relevant requirements within the procedure.

Record Retention and Maintenance

The “retention” period of a record denotes the duration it is preserved before being discarded, destroyed, or relocated off-site for extended storage. Records must be kept on-site for a minimum of 10 years by state and local laws. However, a laboratory may choose to retain records beyond this minimum period for its convenience. The retention periods for records specific to a work area are established by the laboratory and are documented in QMS


Records are filed and stored in an office or laboratory setting unless particular media and special environmental controls are specified to prevent damage, deterioration, or loss.

Record Generation

All process owners are responsible for generating records while performing their duties as per the corresponding procedure. Once a form, whether in hard copy or electronic format, is completed, it is considered a quality record. These records must be identified as per the relevant QMS procedure. Blank forms should be accessible in both electronic and printed formats for staff use. Quality records shall contain the following, as a minimum:

  • When the record was created (date and, if necessary, time of day);
  • Information on the situation or event,and
  • A unique record identifier


Hardcopy quality records must be filled out in ink to guarantee readability and prevent unauthorized alterations. Electronic quality records ought to be write-protected and have limited access to ensure proper change management.

Frequently Asked Questions

What is a Record?

A record is a document that details the results achieved and provides evidence of activities conducted to demonstrate compliance with standard requirements for the effective operation of the Quality Management System (QMS).

What are the most important records?

The following critical records are frequently inspected by Certification Bodies, Notified Bodies and FDA inspectors and should be carefully stored, organized, and monitored:

  • CAPAs
  • Complaints
  • Adverse Event Reports / Vigilance
  • Medical Device Reporting
  • Recalls
  • Nonconforming Material Records
  • Design History Files
  • Training Records
  • Device History Records
  • Purchase Records
  • Sterilization, Cleanroom, shelf-life, lifetime, records
  • Validation Records

What are the common forms used for creating records as per Control of Records

  • Master List of Records
  • Document Issue Register
  • Obsolete Document List
  • Master List of Records

Reports received from external sources to be controlled?

Yes, records (of test reports etc.) received from suppliers/outside laboratories/others and correspondence to and from customers and others concerned also constitute records. The respective process owner maintains these as records in their respective project files.


Step 1 of 3