ISO 13485 records explained for small device makers

The standard separates two kinds of document: a procedure describes the method, while a record shows that someone followed it on a given day. Auditors spend most of their time on the second kind, and they will usually ask to see a few sample records chosen without warning.

A record needs a date, a name, the version of the instruction used and the result, and a signed paper without those four things proves little. Auditors reject it.

Your regulator or notified body may add rules for your market, so ask your quality consultant which apply before you write a single procedure.

The device file, often called the device master record, holds the design drawings, specifications, bill of materials, inspection plan, labelling and packaging instructions. It says how to build the device.

The device history record is the evidence for one lot or serial number, showing the components used, the process steps done, the test results and the release decision. The first is the recipe. The second is the receipt.

Small makers often keep both in folders on a shared drive, which works until a drawing changes and an old PDF stays open on a shop floor PC. Nobody notices.

Every complaint needs a file that records who complained, which lot, what happened, whether it is reportable to a regulator and what you decided. If the cause needs fixing, link the file to a corrective and preventive action, called CAPA, and give that action one owner and one due date.

Closing a CAPA is the weak point. Owners write the fix, mark the action closed and forget to test whether the failure came back, so the record should carry a date for verifying the fix.

Software helps by tying the complaint to the lot, and the lot to its history record, so staff find the evidence by lot number and not by memory.

Approved supplier lists, incoming inspection results and supplier audits form the purchasing record, and each approval needs a reason, an expiry date and a reviewer’s name.

Training records show who was trained on which procedure revision, and after a revision the old training no longer counts until the operator signs for the new one. Calibration records for gauges, torque drivers and balances belong here too, each carrying a due date that someone owns and checks every month.

Dull records trigger many audit findings. A tool that emails the calibration owner thirty days before a torque driver or balance falls due solves most of the problem before the auditor arrives.

Do not buy software to be certified. Buy it to stop losing evidence. That is the whole point. Look for document control with revision history, lot linking from receipt to shipment, a complaint file and due date reminders, then test each on your own records.

Before you choose anything, list the twenty records an auditor asked for in your last audit or mock audit and check how long each took to find. Fix the slowest three first, then add the remaining record types one at a time as the team gets used to the system.