Documents versus records: two different controls
Documents say how things are done and are revised over time: quality manual, procedures, work instructions, forms, test methods, policies. Records show that something was done and are never changed afterwards: calibration certificates, raw data, test reports, audit reports, training records. Mixing the two is the origin of many findings, because they need opposite handling: documents must be updated, records must be preserved unaltered.
| Aspect | Documents (8.3) vs. records (8.4) |
|---|---|
| Examples | Documents (8.3): Procedures, work instructions, forms, method descriptions, external standards — Records (8.4): Test reports, raw data, calibration certificates, audit and training records |
| Changes | Documents (8.3): Revised and re-approved, old versions withdrawn — Records (8.4): Never overwritten; corrections traceable with date and person |
| Key question | Documents (8.3): Is this the current valid version? — Records (8.4): Can we find it, and has it remained unaltered? |
| Time dimension | Documents (8.3): Valid from … until superseded — Records (8.4): Retained for a defined period |
What clause 8.3 requires for documents
- Approval: every document is approved for adequacy by authorised personnel before issue.
- Periodic review: documents are reviewed regularly and updated where necessary.
- Identification: changes and the current revision status are identifiable.
- Availability: the relevant versions are available at the points of use, and their distribution is controlled.
- Unique identification: every document has a unique ID, a title and a revision status.
- Obsolete documents: they are prevented from unintended use and, if retained, suitably marked.
External documents count too. Test standards, manufacturer manuals and customer specifications that your methods depend on belong in the same list, with a note on which edition applies and when it was last checked.
What clause 8.4 requires for records
- Records that result from laboratory activities are created and kept: technical records (7.5) as well as management system records.
- Controls cover identification, storage, protection, back-up, archive, retrieval, retention time and disposal.
- Retention periods are defined — by the lab, by contract or by regulation, whichever is longest.
- Records are kept confidential and secure; access is limited to authorised persons.
- Technical records allow the activity to be repeated under conditions as close as possible to the original.
Electronic records add one more point: the lab must be able to show that data is protected from unauthorised access and unauthorised amendment, and that backups can actually be restored.
Setting up document control in six steps
- 1
Build the document register
One list of all controlled documents with ID, title, owner, revision, approval date and location. Everything not on the list is not controlled.
- 2
Define roles
Who writes, who reviews, who approves, who may publish. Keep it to a few clear roles; the quality manager owns the system, not every document.
- 3
Fix the numbering and revision scheme
A simple ID system and revision letters or numbers, with a short change note on each revision.
- 4
Publish in one place
Employees must use one source for current versions. Printed copies are marked as uncontrolled or controlled with a distribution list.
- 5
Withdraw cleanly
When a new revision is approved, the old one leaves the working area on the same day and is archived with a clear "superseded" mark.
- 6
Review on schedule
Set a review interval per document type and track it in the register, so reviews do not depend on someone remembering.
Typical findings in assessments
- A work instruction at the test station is an older revision than the one in the register.
- Documents carry no revision status or approval, or the approver is not authorised.
- External standards are cited without the edition, or a withdrawn edition is still in use.
- Retention periods are not defined or differ between the procedure and practice.
- Records were corrected without a traceable note of who changed what and when.
- Electronic data is stored on a local drive without backup or access control.
Tools: from folders to a document management system
A shared drive with strict naming conventions is enough for a small lab, as long as the register is maintained and access rights are right. The effort grows with the number of documents and people. Dedicated quality management or document management systems add approval workflows, automatic revision history and reminders for reviews.
- Decide first which process you need (approval, distribution, review), then choose the tool.
- Keep technical records — measurement data, test cases, reports — close to the test itself, so the raw data and the report stay linked.
- Make sure changes to records leave an audit trail with user and timestamp.
- Check how each tool handles versions: some store files without any revision control at all.
TestLabIQ keeps technical records — test cases, measurement data, approvals and reports — together with an audit log. Its general document store is a simple folder structure without versioning or approval workflow, so for controlled procedures with revision status you would pair it with a document management or QM tool.