Documentation Under the QMSR: A New Framework
The Quality Management System Regulation (QMSR) has fundamentally changed how medical device manufacturers must think about quality system documentation. By incorporating ISO 13485:2016 by reference, the QMSR aligns U.S. documentation requirements with international expectations while retaining certain FDA-specific provisions that reflect the unique demands of the American regulatory environment.
Documentation is the backbone of any quality management system. It provides evidence that processes are defined, implemented, and maintained. It enables traceability, supports decision-making, and serves as the foundation for both internal and external audits. Under the QMSR, the documentation framework is more structured and more comprehensive than what many manufacturers maintained under the legacy QSR.
The Documentation Hierarchy Under ISO 13485
ISO 13485:2016 establishes a clear documentation hierarchy that the QMSR now requires. At the top sits the quality manual, which defines the scope of the quality management system, references documented procedures, and describes the interaction between quality system processes. Below the quality manual are documented procedures — the required procedures that define how specific quality system activities are performed. Supporting these are work instructions, forms, templates, and other documents that provide detailed guidance for specific tasks.
The quality manual under the QMSR must include the scope of the quality management system, including details of and justification for any exclusions. It must reference the documented procedures established for the quality management system or include them directly. It must also describe the interaction between quality management system processes. For manufacturers who previously operated without a formal quality manual under the legacy QSR, this is a new requirement that demands attention.
Documented procedures are required for several specific quality system activities under ISO 13485, including document control, record control, internal audit, control of nonconforming product, corrective action, and preventive action. Additional documented procedures may be needed for other activities depending on the organization’s size, complexity, and the nature of its devices.
Record Requirements Under the QMSR
Records provide evidence that activities have been performed and that results have been achieved. Under the QMSR, records must be legible, readily identifiable, and retrievable. They must be stored and maintained in a manner that protects them from damage, deterioration, or loss. The organization must define the retention period for records, taking into account regulatory requirements, customer requirements, and the expected lifetime of the device.
Specific records required under the QMSR include management review records, education training skill and experience records, records needed to demonstrate that realization processes and resulting product meet requirements, design and development records, supplier evaluation records, production and service provision records including validation records, monitoring and measurement records, internal audit records, product traceability records, complaint handling records, and CAPA records.
One significant change under the QMSR is that the FDA can now inspect management review records and internal audit records. Under the legacy QSR, these records were generally exempt from FDA inspection. This change means manufacturers must ensure these records are complete, accurate, and demonstrate effective quality system management.
Document Control Requirements
Document control under the QMSR follows ISO 13485 Clause 4.2.4. Organizations must establish a documented procedure that defines the controls needed to approve documents for adequacy prior to issue, review and update as necessary and re-approve documents, ensure that changes and current revision status of documents are identified, ensure that relevant versions of applicable documents are available at points of use, ensure that documents remain legible and readily identifiable, ensure that documents of external origin are identified and their distribution controlled, and prevent the unintended use of obsolete documents.
Document control is an area where many organizations struggle, particularly as they transition to electronic document management systems. The QMSR does not prescribe the use of paper or electronic systems but requires that whatever system is used meets the control requirements. Electronic systems must include appropriate access controls, audit trails, backup procedures, and validation.
FDA-Specific Documentation Additions
The QMSR includes FDA-specific additions to the documentation requirements that go beyond what ISO 13485 requires. These additions address areas such as the Device Master Record (DMR), the Device History Record (DHR), and the Quality System Record (QSR — not to be confused with the legacy regulation). Manufacturers must maintain these records in addition to the documentation required by ISO 13485.
The Device Master Record includes or references all documentation needed to produce a finished device, including device specifications, production process specifications, quality assurance procedures and specifications, packaging and labeling specifications, and installation and servicing procedures. The DHR documents the production history of each production unit, providing traceability from raw materials through finished device. The Quality System Record contains or references all procedures and documentation relating to the quality management system.
Practical Steps for Documentation Compliance
To bring your documentation system into compliance with the QMSR, start by mapping your existing documentation against both ISO 13485 and QMSR-specific requirements. Identify gaps where new documents or records are needed, and prioritize their development based on risk and regulatory impact. Review your document control procedures to ensure they meet ISO 13485 Clause 4.2.4 requirements. Assess your record management practices for completeness, accessibility, and protection. Train personnel on new documentation requirements and ensure they understand both the what and the why of documentation practices.
An independent audit of your documentation system can reveal gaps that internal reviews may miss and provide a roadmap for achieving and maintaining compliance. Documentation is often the first area auditors examine, and weaknesses here can set a negative tone for the entire audit.
Implementation Considerations and Best Practices
Successful implementation requires careful planning, adequate resources, and sustained management commitment. Organizations should begin by conducting a thorough assessment of their current practices against the requirements discussed in this article. This baseline assessment identifies specific gaps that need to be addressed and provides a foundation for prioritizing improvement activities based on risk and regulatory impact.
Resource allocation is a critical success factor. Organizations must ensure that sufficient personnel, training, equipment, and time are dedicated to implementation efforts. Under-resourced implementation attempts often result in superficial changes that do not achieve genuine compliance or process improvement. Management must recognize that quality system investments produce returns in the form of reduced regulatory risk, improved product quality, greater customer satisfaction, and enhanced operational efficiency.
Training is another essential element. Personnel at all levels must understand the requirements applicable to their roles and must be competent to perform their quality-related responsibilities. Training should cover both the regulatory basis for requirements and the practical procedures the organization has established to meet them. Effectiveness of training should be evaluated through testing, observation, or other appropriate methods to ensure that competence has been achieved.
Documentation must be complete, current, and accessible. Quality system documentation provides the framework within which personnel operate, and records provide evidence that activities have been performed as planned. Organizations should invest in documentation management systems that support version control, accessibility, and retention while preventing the use of obsolete documents.
Partner with Qualyx Group
At Qualyx Group, we specialize in independent, audit-only services for regulated industries. Our experienced auditors bring deep domain expertise, bilingual capabilities, and an unwavering commitment to objectivity. Whether you need a gap analysis, a supplier audit, or preparation for an upcoming regulatory inspection, we are here to help.
Contact Qualyx Group today to discuss how our independent audit services can strengthen your quality system and support your compliance goals.