Document Control Requirements within Oracle System



My company recently implement Oracle to integrate multiple business processes into one computer system Phase I of integration included document control workflows. We are struggling with many system inconsistencies after Go Live because the company did not opt to customize workflows due to cost involved. We have force fit our document creation, revision, obsolescence, and periodic review into the out of the box workflow options.
My questions center around actual CFR references for document control. I have looked through part 210/211 and 820 subpart D, but there aren't any references specific to the various requirements that we just know as industry professionals exist (my company produces cosmetics and OTC personal care items). In order to push for some improvement to the current workflows, we feel we need to point to specific requirements saying that these things need to be in place.
Two issues for example that are violations in our minds:
1. If a change to a document is created in the system, the document number automatically gets revved up. However, if for some reason that change is cancelled, the next time a change is created, the system moves on to the next revision (i.e. SOP XYZ rev 2 is put in for a change, and the draft becomes SOP XYZ rev 3. then that change is cancelled. The next time a change is placed to that document it will now be SOP XYZ rev 4). The actual revision table of the document would only have notes for rev 2 and rev 4, rev 3 basically gets skipped--there were not changes to the document, but the system itself doesn't account for that in any way. I feel this could get very messy trying to explain to FDA why we have missing revisions on our documents going forward.
2. When changing a document in the system, there is nothing that prevents a document from having multiple open changes on it at one time. All other systems I have used in my career will error if a document is already checked out for revision, but this system does not do that.

Overall just wondering how major these types of issues would be during FDA audit if discovered, if there is any specific CFR reference to point to when we are requesting the fixes (i.e. our word is not enough, we need backup). My experience thus far in my career with document control is on the periphery so I know that there are requirements for documents generally speaking, but I don't necessarily know the "why" or the specific federal regulation requiring it. I am not in a position that I have to take more ownership of document control, so just struggling with how to justify my requests for fixing this new system.

Jen Kirley

Quality and Auditing Expert
Welcome to The Cove, jm315999! I am sorry for the delay in this response.

The MDSAP Audit Model Document P0002.007 includes (on page 33)
Implementation of document and record control procedures

Confirm that the medical device organization has defined, documented, and implemented procedures for control of quality management system documents and records. Evidence that these controls are effective can be ascertained through the audit of the other quality management system processes. For example, evidence that the document controls process is ineffective might be the observation of obsolete procedures being used or required records being unavailable.

Ensure at least one copy of obsolete controlled documents is maintained
Both ISO 9001:2015 and ISO 13485:2016[E] require change to be controlled, and of course 13485 lists more specifics though none quite like you have mentioned.

From what I can see, the ability to have multiple changes floating around at one time poses a risk of failure to approve and re-approve documents for adequacy, and in identifying changes.
Top Bottom