One document and records control procedure for an integrated ISO 9001:2015 and ISO 13485:2016 device quality system. Fifty-five pages. This is not two procedures merged, and it is not the ISO 9001 procedure with device notes bolted on. Where the two standards agree, one control serves both. Where they differ — and they differ most on the records a device regulator can inspect — the procedure takes the stricter requirement as its house standard and records the decision.
ISO 13485 places document and records control at Clauses 4.2.4 and 4.2.5, not at ISO 9001’s 7.5, and it adds requirements ISO 9001 has no equivalent for: two distinct retention clocks, record content set by regulation rather than by the standard, and the medical device file. Since 2 February 2026, ISO 13485:2016 is incorporated into 21 CFR Part 820, so these records are regulatory instruments, not paperwork.
55 pages, editable Word | 43 clauses cross-referenced | 28 MSI notes in the margin | 5 appendices, every one usable |
The integration is the product. Appendix D is an integration decision record — every place ISO 9001 and ISO 13485 diverge, what this procedure does about it, which standard is the house rule, and the alternative that was rejected. Assembling that table is the work a buyer cannot easily do alone, and running two separate procedures avoids it only by leaving the divergences unresolved.
01
ISO 13485 requires records to be retained for at least the lifetime of the device, and at least as long as any regulatory requirement specifies — two separate clocks that rarely match. Most device procedures state neither clearly. This one makes the device-lifetime determination explicit and holds the regulatory clock apart, so a record is never disposed of one clock too early.
02
ISO 13485 and 21 CFR Part 820 specify content that particular records must carry — content no clause checklist points at, and that device systems routinely leave to memory. The forms in this procedure carry that content by construction, so the record is complete when it is made rather than reconstructed under inspection.
03
The device file is a documented-information requirement that most document control procedures never mention, because it is defined elsewhere in the standard. This procedure names it, places it under control, and connects it to the records that populate it.
Every appendix, form and worked example is part of the document. Nothing is sold separately.
Quality and regulatory managers at medical device organizations running an integrated ISO 9001 and ISO 13485 system — certified to both, pursuing either, or operating the combined system to the standards without a certificate. Particularly useful where an ISO 9001 procedure has been stretched to cover device records it was never written for.
Not sure where your process stands? The free Document and Records Control Maturity Check scores it across eight elements in about six minutes, and your score appears without entering anything.
Preparing for a device quality audit?
MSI’s QMS Interviews course prepares your team for the conversations an auditor will actually have with them — and in a device quality system, one question about a record’s content can touch both ISO 13485 and the Quality Management System Regulation at once.
Both, deliberately. It is written as a filled-in worked example so you can see what each element looks like when done properly, with bracketed placeholders wherever a value is genuinely yours to set. You are editing a working document rather than filling in a hollow outline.
Because an ISO 9001 procedure stretched to cover device records, and a device procedure that ignores the general quality system, both leave gaps that surface under inspection. The integrated document handles both scopes and records every point where they differ in Appendix D.
Separately, and explicitly. The device-lifetime clock is calculated from a lifetime you define in the procedure; the regulatory clock is sourced and stated on its own. A record subject to both is retained on the longer, and the procedure says so rather than leaving it to be worked out later.
It is written to it. Since 2 February 2026 the FDA’s Quality Management System Regulation incorporates ISO 13485:2016, so device records are inspectable regulatory instruments. The record content this procedure builds into its forms is set with that in mind.
Editable Microsoft Word (.docx). Adapt it, rebrand it, and adopt it into your own document control system. The license permits the buying organization to use it across its own sites and issue it to employees, contractors and auditors, and permits consultants to adapt it for engagements they deliver.
A procedure does not pass an audit; an organization does. What this gives you is a procedure that addresses every requirement of every standard it covers with a named owner and a named record, every divergence between the standards resolved and recorded, and a records inventory with no blanks. Conformity is demonstrated by implementation and evidence. Unfilled placeholders are unmet requirements, so fill them.
Need more than one procedure?
This is one procedure from a larger library. If you are building or maintaining a full documentation system, view the complete ISO 9001 & ISO 13485 (Device) package — the procedures, guides and tools assembled together.
Prefer to purchase by invoice? Contact us and we will send an invoice you can pay by your organization’s normal process.
The procedure is written throughout for a fictional organization called Perennia Corp, used for illustration and not connected with any real organization of the same or a similar name. Replace it with your own name and work through the bracketed placeholders. This is a professional work product provided for adaptation and use within your organization. It is not a certification requirement, an audit checklist, or a substitute for the applicable standards, the applicable regulations, or the judgment of a competent professional. © Management Systems International, LLC. All rights reserved.
