ISO 13485 · Basic · 12 min lesson
Clause 4.2.5 - control of records and good documentation practice
ISO 13485:2016 clause 4.2.5, ALCOA+ data integrity principles, EU MDR Article 10(8) and 21 CFR part 820 section 820.35
What you will learn
- Explain the controls clause 4.2.5 requires for identification, storage, security, integrity, retrieval, retention and disposition of records.
- Apply good documentation practice and the ALCOA+ principles to paper and electronic records, including how to correct an entry.
- Set a retention period for a device record and tell a weak record from a compliant one.
Key takeaways
- Records are evidence of conformity and effective operation, controlled by a documented procedure (clause 4.2.5).
- Records stay legible, identifiable and retrievable, and any change to a record remains identifiable.
- ALCOA+ habits: attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring and available.
- Correct with one line, initials, date and reason; never white out, overwrite or backdate.
- Retention is at least the device lifetime and not less than two years from release; a longer legal period wins.
Free practice question
A Brindle operator realizes at the end of the shift that she did not record the mixing temperature during the 10:00 step. She remembers it was 22 C and wants to enter it now.
What is the right way to handle this entry?
Write a late entry marked as late, with the actual date and time, her signature and the reason it was missed.
Correct. Clause 4.2.5 requires records to remain identifiable, so a marked late entry keeps the truth visible.
Write 22 C in the 10:00 slot as if recorded then.
Not quite. Entering it as if contemporaneous misrepresents the record and breaks clause 4.2.5 integrity.
Leave the field empty so that no one can question it.
Not quite. An empty field leaves the record incomplete, which clause 4.2.5 evidence of conformity cannot accept.
Ask a colleague to sign that the temperature was 22 C.
Not quite. A colleague did not observe it, so the entry is not attributable under clause 4.2.5 principles.
Key terms
- record: Evidence of what was done or achieved; maintained and controlled, not revised (ISO 13485:2016 clause 4.2.5).
- ALCOA+: Data integrity framework: attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring and available (FDA guidance 2018).
- audit trail: Secure, time-stamped log of who changed an electronic record, what changed and why.
- late entry: An entry made after the activity, marked as late with the real date, time and reason.
- retention period: Time a record is kept: at least device lifetime and not less than two years from release, or longer by regulation (clause 4.2.5).
- disposition: Controlled action at the end of retention, such as secure destruction, approved and noted (clause 4.2.5).
Official sources
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
- FDA - Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018)
- Regulation (EU) 2017/745 on medical devices (EUR-Lex), Article 10(8)
- FDA - Quality Management System Regulation (QMSR), 21 CFR part 820
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.