For medical device and pharmaceutical companies, the cornerstone of any successful document control program is having a baseline knowledge of their audience. Understanding who a particular doc is written for is just as important as the words typed on the page and how it’s organized.
“It’s all about having the right document for the right people,” QualityHub Principal Consultant Elisabeth George said. “You don’t want to have a PhD-level document written for children and you don’t want to have a thousand-page document that the company CEO must review and be trained on. And beyond that, for whichever document they’re developing, manufacturers must take into consideration all the stakeholders that need to be involved in its writing, reviewing, approval, and use.”
George, a MedTech industry veteran who held key positions at Philips Healthcare for nearly 25 years, is aware that such advice might be considered “basic” by many regulatory and quality professionals working in the device and drug arenas, “but in all my experience – and in my QualityHub experience as well – I’ve found that a lot of times it’s the basics that fall apart and land a company in compliance jeopardy with regulators.” (Related Story: “Could Adding Emojis to Documents Mean Hot Water For Manufacturers?” – QualityHub, July 15, 2025.)
In a recent interview, George offered manufacturers tips and advice on an array of document control topics, including document ownership, how to handle old documents, and making sure current versions of documents are being used. The Q&A below was lightly edited for clarity and brevity.
QualityHub: Let’s talk about another aspect of document control that might be, as you say, basic for many in QA and RA positions, and that’s the ownership of docs. Who should be developing documents at MedTech and pharma companies?
Elisabeth George: It could literally be anybody within an organization – it’s not always QA and RA. But QA and RA are key stakeholders because of the regulations and the requirements and ensuring alignment and consistency. QA and RA probably own the document management system and program, so they’re the ones that say we must have version control. We must have an appropriate tool. We must have the appropriate stakeholders involved. But it could literally be anybody.
A company might want to have one of its production operators help develop the document or have the R&D [research and development] people help develop it. A company also might want to have a customer involved in supplying information – not necessarily developing the document because usually the people who should write documents should employees of the company, and that’s because they understand the culture and they understand the idiosyncrasies of the organization. Because when they’re developing that document, they understand the skillsets that have been put in place for various functions.
QH: Would it be wise for a company to put together a team to review documents periodically to make sure they’re up to date and remain relevant?
George: There is a regulatory expectation that you have reviewed all your documents in an appropriate frequency to ensure they still meet expectations. I’ll call them state-of-the-art expectations because regulatory authorities talk about how things must be state of the art. It could be tools expectations. It could be organizational structure expectations. For many companies, it seems like every 18 months there’s a new organizational structure in place and if your process says the patient-monitoring division is responsible for something but two years from now there is no group called patient monitoring because now it’s called continuous care monitoring, that’s an issue. It’s the little things that can cause the biggest problems. It could be some of those simple basics – there could be a new standard that has come out that that you must ensure alignment with.
A worst-case scenario would be a company requirement that every document must be touched at least once during, say, a three-year time frame. I believe it should be fewer than three years, but I also understand the challenge that organizations face to do that given their resources. In a situation like that, using a risk-based strategy would be a good approach. If it’s a basic process that historically has never changed, then perhaps that could be put on a three-year review cycle. But if it’s something of higher risk, like artificial intelligence, then a shorter review cycle would be appropriate.
QH: How should a company handle old documents?
George: There are standard archival processes regarding every time a company updates a document. An update could be a simple update where words are rearranged or an extra sentence is added, but an update also could be starting from scratch and rewriting the document. Hopefully your company has defined a strategy for version control and how to manage that.
I’ll give examples. Some companies just keep adding to the revision. They keep the document number the same and then they add a revision. Another company, if they’re doing a full-blown quality system enhancement or develop a brand-new model of a device that’s going to be significantly different, might decide to have brand-new nomenclature defined to it. But there’s no one way to do that. So, a company must have those things well defined in its processes so it’s clear and consistent, that way two businesses within the same company don’t handle the same type of change very differently.
Manufacturers must also have a records or document management retention program, and this is where it sometimes can get confusing. As a company, with your legal department, HR [human resources] department, and quality and regulatory department, a records retention policy should be developed. That policy should identify to the organization the length of time to retain old documents. There are some regulatory reasons that things should be kept. It could be for five years; it could be seven years. It could be five years or seven years after the last sale of the last device. It could be that there is a specific country requirement – maybe China has a special regulation requirement that a company must keep all its documents for 22.7 years or some other crazy number. That’s why these policies must be put together.
QH: Let’s talk about version control – version management. What are some tips you have for manufacturers?
George: There are various ways that can be managed. Most companies have an electronic system and use standard lettering for each revision. There is a change order process that identifies what the changes are. So, if a company is using Version C of a document, you’ll know if they used Version B to do the update or if they inadvertently used Version A. So, you want to make sure there’s that type of consistency.
A lot of people nowadays, because of the wonderful tools that are out there, they’ll do red line processes so in the change order you can see the red lines and then you can see the completed version of the document. That’s because sometimes the red lines can be hard to read if there’s a significant number of changes or if you’re rearranging a lot of things.
And what constitutes a version change must be defined. Some organizations say minor typographical errors and things like that don’t justify having a version change. But I don’t like that. I would rather have you make the version change and justify why you didn’t have to train people to that newer version when it was just a typo. That’s because minor typos could potentially result in in something that’s more critical.
[Editor’s Note: If your MedTech or pharma company needs support with document control activities, QualityHub is here to help. Contact us today and let our pool of seasoned consultants, project managers, and regulatory experts assist in making sure you stay in compliance.]
